diff --git a/.github/workflows/api-acceptance.yml b/.github/workflows/api-acceptance.yml
index ee010ed18..1db726e16 100644
--- a/.github/workflows/api-acceptance.yml
+++ b/.github/workflows/api-acceptance.yml
@@ -23,12 +23,12 @@ jobs:
         image: postgres:16-alpine
         env:
           POSTGRES_DB: oac_ci_tests
-          POSTGRES_USER: agents_api
-          POSTGRES_PASSWORD: agents_api_test_only
+          POSTGRES_USER: oac
+          POSTGRES_PASSWORD: oac_test_only
         ports:
           - 5432/tcp
         options: >-
-          --health-cmd "pg_isready -U agents_api -d oac_ci_tests"
+          --health-cmd "pg_isready -U oac -d oac_ci_tests"
           --health-interval 5s
           --health-timeout 5s
           --health-retries 10
@@ -58,7 +58,7 @@ jobs:
           PY
       - name: Verify official-client HTTP compatibility
         env:
-          OAC_TEST_DATABASE_URL: postgres://agents_api:agents_api_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_ci_tests?sslmode=disable
+          OAC_TEST_DATABASE_URL: postgres://oac:oac_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_ci_tests?sslmode=disable
           OAC_TEST_SERVER_BIN: ${{ runner.temp }}/oac-core-build/oac-core
           OAC_TEST_OFFICIAL_SDK_PYTHON: python
         run: |
@@ -70,7 +70,7 @@ jobs:
       - name: Verify the distribution's Core image
         if: inputs.container
         env:
-          OAC_TEST_DATABASE_URL: postgres://agents_api:agents_api_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_ci_tests?sslmode=disable
+          OAC_TEST_DATABASE_URL: postgres://oac:oac_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_ci_tests?sslmode=disable
           OAC_DEV_CORE_IMAGE: oac-core:ci
           OAC_TEST_OFFICIAL_SDK_PYTHON: python
         run: make check-core-container
diff --git a/.github/workflows/cache-warm.yml b/.github/workflows/cache-warm.yml
index 946466909..1471f5d52 100644
--- a/.github/workflows/cache-warm.yml
+++ b/.github/workflows/cache-warm.yml
@@ -33,7 +33,6 @@ jobs:
           node-version: '22.22.0'
           lockfiles: |
             packages/claude-sdk-adapter/pnpm-lock.yaml
-            packages/mcode-harness/package-lock.json
       - run: pnpm --dir packages/claude-sdk-adapter fetch
       - uses: ./.github/actions/mcode-companion
 
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 0a307c7ad..9ee59a3ab 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -49,8 +49,8 @@ jobs:
       - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.sha }}
-      - name: Verify names, documentation and CI selection invariants
-        run: make check-names check-docs check-ci
+      - name: Verify documentation and CI selection invariants
+        run: make check-docs check-ci
 
   # Parts run in parallel; the serial integration package is split into deterministic shards.
   backend:
@@ -76,12 +76,12 @@ jobs:
         image: postgres:16-alpine
         env:
           POSTGRES_DB: oac_core_ci_tests
-          POSTGRES_USER: agents_api
+          POSTGRES_USER: oac
           POSTGRES_PASSWORD: core_test_only
         ports:
           - 5432/tcp
         options: >-
-          --health-cmd "pg_isready -U agents_api -d oac_core_ci_tests"
+          --health-cmd "pg_isready -U oac -d oac_core_ci_tests"
           --health-interval 5s
           --health-timeout 5s
           --health-retries 10
@@ -119,7 +119,7 @@ jobs:
           sudo apt-get install -y build-essential pkg-config libssl-dev
       - name: Verify dedicated test database
         env:
-          OAC_TEST_DATABASE_URL: postgres://agents_api:core_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_core_ci_tests?sslmode=disable
+          OAC_TEST_DATABASE_URL: postgres://oac:core_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_core_ci_tests?sslmode=disable
         run: |
           echo "OAC_TEST_DATABASE_URL=$OAC_TEST_DATABASE_URL" >> "$GITHUB_ENV"
           make check-database
@@ -231,7 +231,6 @@ jobs:
         with:
           lockfiles: |
             packages/claude-sdk-adapter/pnpm-lock.yaml
-            packages/mcode-harness/package-lock.json
       - name: Test and package Harness adapters
         run: make check-claude-sdk check-mcode-harness
 
diff --git a/.github/workflows/ci-review.yml b/.github/workflows/ci-review.yml
index 2bc1069bd..0cd33e664 100644
--- a/.github/workflows/ci-review.yml
+++ b/.github/workflows/ci-review.yml
@@ -16,28 +16,12 @@ permissions:
 
 jobs:
   review:
-    name: ${{ matrix.name }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - kind: code
-            name: Code review
-            instructions: |
-              检查本次代码改动的正确性、仓库设计规则及已有 CI 结果。先读取 AGENTS.md 和 CONTRIBUTING.md，再查看相关实现和测试。
-              用 gh pr checks 查询这个 PR 已有的检查结果，必要时读取 Actions 日志。检查失败、缺失或尚未完成时如实报告，不把合并当作检查通过的证据。
-              报告包括实际行为变化（1–3 条）、代码审查结论和 CI 状态。全部正常时保持简短；有问题时给出文件与行号、证据和最小修改建议。
-          - kind: docs
-            name: Docs review
-            instructions: |
-              每次都检查文档与本次代码变化是否一致，即使 PR 没改文档。读取相关实现、测试和完整文档，核对平台、命令、配置、路径、默认值、接口和操作流程，找出遗漏更新或已经过时的说明。
-              文档有修改（包括新增、删除和重命名）时，再检查文档内部及同主题文档间的矛盾、重复维护的事实、主题归属和中英文含义。按 AGENTS.md 和 CONTRIBUTING.md 的 Documentation ownership 表判断位置。必要的概述加链接、中英文对照和同一来源生成的文档不算重复。
-              分别报告“文档与代码一致性”和“文档矛盾、重复与归属”。未改文档时，第二项写“本次未修改文档”。只报告本次修改引入或使之过时的、有依据的问题，给出文件与行号、对应代码或文档依据，以及最小修改建议。测试或链接检查通过不代表语义一致。只报告影响读者理解或操作的具体问题，不把未穷举实现细节当作文档缺陷。
     if: github.event.pull_request.merged == true
     runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-24.04' || 'blacksmith-2vcpu-ubuntu-2404' }}
     timeout-minutes: 30
     env:
-      # Keep GH_TOKEN available to read the PR and Actions logs.
+      # allowed_non_write_users turns on a subprocess secret scrub; opt out so Claude's
+      # commands can read GH_TOKEN and the Feishu webhook.
       CLAUDE_CODE_SUBPROCESS_ENV_SCRUB: '0'
     steps:
       # The triggering revision is already on main, so its rules and code are trusted.
@@ -46,15 +30,14 @@ jobs:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
           fetch-depth: 2
           persist-credentials: false
-      - name: Prepare the report schema
-        id: schema
-        run: python3 scripts/ci_review.py schema "${{ matrix.kind }}" >> "$GITHUB_OUTPUT"
-      - name: Review with Claude Code
-        id: llm
+      - name: Review and send Feishu card with Claude Code
+        # Notification is best effort: a failed review or delivery never fails the job.
         continue-on-error: true
         timeout-minutes: 25
         uses: anthropics/claude-code-action@12dd8d74c712f5f3669365b2369b558c495b1104 # v1
         env:
+          FEISHU_WEBHOOK_URL: ${{ secrets.FEISHU_WEBHOOK_URL }}
+          FEISHU_WEBHOOK_SECRET: ${{ secrets.FEISHU_WEBHOOK_SECRET }}
           ANTHROPIC_BASE_URL: https://api.minimax.cn/anthropic
           ANTHROPIC_AUTH_TOKEN: ${{ secrets.MINIMAX_API_KEY }}
           CLAUDE_CODE_AUTO_COMPACT_WINDOW: '524288'
@@ -71,57 +54,29 @@ jobs:
           allowed_bots: '*'
           allowed_non_write_users: '*'
           prompt: |
-            你负责本次 PR 的 ${{ matrix.name }}，在独立上下文中完成审查。
-            仓库：${{ github.repository }}；PR：#${{ github.event.pull_request.number }}。
-            合并提交：${{ github.event.pull_request.merge_commit_sha }}，已检出到当前目录。
-            先用 gh pr diff ${{ github.event.pull_request.number }} --repo ${{ github.repository }} 读取变更清单与完整差异，再检查相关文件。
+            你是 CI 的负责人，负责审核 CI 结果并给出结论。
+            仓库 ${{ github.repository }} 的 PR #${{ github.event.pull_request.number }} 已合入 main：
+            - PR：https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }}
+            - 合并 commit：${{ github.event.pull_request.merge_commit_sha }}（已 checkout 到当前目录）
 
-            ${{ matrix.instructions }}
+            用 gh pr checks ${{ github.event.pull_request.number }} --repo ${{ github.repository }} 查询这个 PR 已有的检查结果，必要时读取对应 Actions 日志。不要触发新的 CI，也不要把合并本身当作检查通过的证据；管理员可能绕过门禁。检查失败、缺失或尚未完成时如实报告。
 
-            按 JSON schema 返回中文报告。status 为 ok（未发现问题）、issues（发现有证据的问题）或 incomplete（审查失败、范围未检查完整或检查结果尚未完成）。有问题且仍有未检查项时，用 issues 并在对应字段中说明缺项。按 schema 把各项结论分别填入字段，不要重复标题；changes 用 1–3 条 Markdown 列表，其他字段无问题时一句话，有问题时保留依据和建议，遵守各字段长度限制。
-            围绕本次 diff 和受影响的文档展开，证据充分后输出结果，避免重复核对同一结论。
-            只读审查，不修改仓库，不触发新的 CI，不发送消息。两份报告会由后续 job 合并发送。
-          claude_args: >-
-            --allowedTools Bash Read Glob Grep
-            --json-schema '${{ steps.schema.outputs.schema }}'
-      - name: Save the review result
-        if: always()
-        env:
-          REVIEW_OUTCOME: ${{ steps.llm.outcome }}
-          REVIEW_RESULT: ${{ steps.llm.outputs.structured_output }}
-        run: python3 scripts/ci_review.py collect "${{ matrix.kind }}" "$RUNNER_TEMP/review-${{ matrix.kind }}.json"
-      - uses: actions/upload-artifact@v6
-        if: always()
-        with:
-          name: ci-review-${{ matrix.kind }}
-          path: ${{ runner.temp }}/review-${{ matrix.kind }}.json
-          if-no-files-found: error
-          overwrite: true
-          retention-days: 7
+            任务：给飞书群发一张中文卡片（Card 2.0）总结这次 CI，尽量在 10 轮以内给出结论，工具调用尽可能的并行。
+            环境里有 gh（已登录，GH_TOKEN）、git、node 和完整的仓库代码。
 
-  notify:
-    name: Combined Feishu notification
-    needs: review
-    if: always() && github.event.pull_request.merged == true
-    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-24.04' || 'blacksmith-2vcpu-ubuntu-2404' }}
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      actions: read
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event.pull_request.merge_commit_sha }}
-          persist-credentials: false
-      - uses: actions/download-artifact@v6
-        continue-on-error: true
-        with:
-          pattern: ci-review-*
-          merge-multiple: true
-          path: ${{ runner.temp }}/reviews
-      - name: Send one card with both results
-        continue-on-error: true
-        env:
-          FEISHU_WEBHOOK_URL: ${{ secrets.FEISHU_WEBHOOK_URL }}
-          FEISHU_WEBHOOK_SECRET: ${{ secrets.FEISHU_WEBHOOK_SECRET }}
-        run: python3 scripts/ci_review.py notify "$RUNNER_TEMP/reviews"
+            卡片要让手机上的读者快速看懂，如果一切正常，表达的尽可能简单，如果没有问题，尽量简洁：
+            1. 哪个 PR（github id + PR 标题 + 链接）
+              - 如：`github id: jing332, PR 标题: 添加一个新功能, 链接: https://github.com/org/repo/pull/123`
+            2. 改了什么（实际行为变化，1–3 条）
+              - 如：`添加了一个新功能、修改了 web 和 backend 的 CI`
+            3. 是否符合仓库规则（AGENTS.md、CONTRIBUTING.md 及相关文档）：未发现明确违规 / 发现需修复问题 / 信息不足，无法确认
+              - 如：`符合仓库规则`
+            4. CI 哪里失败、可能的原因（可以看日志），全部通过就直接说通过，不要给出细节。如果 CI 失败，则详细说明。
+              - 如：`CI 失败，具体是哪几个失败；全部通过 ✅`
+
+            发送：webhook 地址在环境变量 FEISHU_WEBHOOK_URL。
+            响应 code=0 才算成功，失败就排查并重试，直到发出去。最后用一句中文说明结果，如：`CI 结果已发送至飞书群`。
+            不要在输出里打印 webhook 地址和密钥。
+          claude_args: >-
+            --allowedTools Bash Read Write Edit Glob Grep WebFetch WebSearch
+            --max-turns 30
diff --git a/.github/workflows/e2b-template.yml b/.github/workflows/e2b-template.yml
index 692a11cbc..6537b838a 100644
--- a/.github/workflows/e2b-template.yml
+++ b/.github/workflows/e2b-template.yml
@@ -21,6 +21,13 @@ on:
         default: creative
         required: true
 
+      compute_profile:
+        description: Template CPU and memory allocation
+        type: choice
+        options: [2c2g, 2c8g, 4c8g]
+        default: 2c2g
+        required: true
+
       resume_build:
         description: Existing unsubmitted templateID:build_UUID after an upload failure; requires ref
         type: string
@@ -181,6 +188,7 @@ jobs:
         env:
           RESUME_BUILD: ${{ inputs.resume_build }}
           SOURCE_COMMIT: ${{ steps.source.outputs.revision }}
+          COMPUTE_PROFILE: ${{ inputs.compute_profile }}
           E2B_API_KEY: ${{ secrets.E2B_API_KEY }}
           E2B_API_URL: ${{ vars.E2B_API_URL }}
         run: |
@@ -191,9 +199,16 @@ jobs:
           printf '%s' "$E2B_API_KEY" > "$key"
           unset E2B_API_KEY
           mkdir -p "$RUNNER_TEMP/e2b-result"
+          compute_args=()
+          case "$COMPUTE_PROFILE" in
+            2c2g) ;;
+            2c8g|4c8g) compute_args=(--compute-profile "$COMPUTE_PROFILE") ;;
+            *) echo '::error::Unknown compute profile.'; exit 1 ;;
+          esac
           "$RUNNER_TEMP/e2b-sdk/bin/python" - source/services/core/deploy/e2b/build-template.py \
             --image "$(cat "$HOME/.oac/build/e2b-runtime/runtime-image.id")" \
             --name "sandbase-oac-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
+            "${compute_args[@]}" \
             --api-key-file "$key" --output "$RUNNER_TEMP/e2b-result/template.json" <<'PY'
           import hashlib, json, os, pathlib, runpy, sys
           from types import SimpleNamespace
@@ -252,7 +267,22 @@ jobs:
                   result = original_request(client, **kwargs)
               receipt = {'template': result.template_id + ':' + result.build_id,
                          'source_commit': os.environ['SOURCE_COMMIT'],
-                         'api_url': os.environ['E2B_API_URL'], 'resumed': bool(selector)}
+                         'api_url': os.environ['E2B_API_URL'], 'resumed': bool(selector),
+                         'resources_verified': False}
+              (output / 'build-request.json').write_text(json.dumps(receipt, indent=2) + '\n')
+              response = client.get_httpx_client().get(f'/templates/{result.template_id}')
+              response.raise_for_status()
+              detail = response.json()
+              builds = [build for build in detail.get('builds', [])
+                        if build.get('buildID') == result.build_id]
+              if (detail.get('templateID') != result.template_id or len(builds) != 1
+                      or type(builds[0].get('cpuCount')) is not int
+                      or type(builds[0].get('memoryMB')) is not int
+                      or builds[0]['cpuCount'] != kwargs['cpu_count']
+                      or builds[0]['memoryMB'] != kwargs['memory_mb']):
+                  raise RuntimeError('Template build CPU/memory does not match the requested compute profile')
+              receipt.update(cpu_count=builds[0]['cpuCount'], memory_mb=builds[0]['memoryMB'],
+                             resources_verified=True)
               (output / 'build-request.json').write_text(json.dumps(receipt, indent=2) + '\n')
               return result
           sdk.request_build = request
@@ -271,12 +301,18 @@ jobs:
           import json, os, pathlib
           report = pathlib.Path(os.environ['RUNNER_TEMP']) / 'e2b-result/template.json'
           value = json.loads(report.read_text())
+          receipt = json.loads(report.with_name('build-request.json').read_text())
+          if (receipt.get('resources_verified') is not True
+                  or receipt.get('template') != value['template']):
+              raise RuntimeError('Build report does not match a verified allocation receipt')
+          value.update(cpu_count=receipt['cpu_count'], memory_mb=receipt['memory_mb'])
           value.update(source_commit=os.environ['SOURCE_COMMIT'], source_branch=os.environ['SOURCE_BRANCH'],
                        api_url=os.environ['E2B_API_URL'], harnesses=['codex', 'claude_sdk', 'mcode'],
                        qualification='image identity and native package checks; no live Session/Turn')
           report.write_text(json.dumps(value, indent=2) + '\n')
           with open(os.environ['GITHUB_STEP_SUMMARY'], 'a') as out:
               out.write(f"Source: `{value['source_commit']}`\n\nTemplate: `{value['template']}`\n\nImage: `{value['image']}`\n\n")
+              out.write(f"Compute: `{value['cpu_count']} vCPU / {value['memory_mb']} MiB`\n\n")
               out.write('One combined Runtime template built. No Core configuration or production deployment was changed.\n')
           PY
       - uses: actions/upload-artifact@v6
diff --git a/.github/workflows/native.yml b/.github/workflows/native.yml
index 4047bdf3c..e5394a926 100644
--- a/.github/workflows/native.yml
+++ b/.github/workflows/native.yml
@@ -57,7 +57,6 @@ jobs:
           node-version: '22.22.0'
           lockfiles: |
             packages/claude-sdk-adapter/pnpm-lock.yaml
-            packages/mcode-harness/package-lock.json
       - name: Build the native daemon and test bundle boundaries
         id: build
         run: |
@@ -137,7 +136,11 @@ jobs:
           node scripts/build-native-installer-ci.mjs
       - name: Bootstrap, authenticate, install and connect natively
         id: onboarding
-        run: node scripts/native-onboarding-smoke.mjs
+        run: |
+          if [[ "$RUNNER_OS" == Windows ]]; then
+            export CLAUDE_CODE_GIT_BASH_PATH='C:\Program Files\Git\bin\bash.exe'
+          fi
+          node scripts/native-onboarding-smoke.mjs
       - name: Verify native Harness protocols without model requests
         id: protocol
         run: |
@@ -145,15 +148,11 @@ jobs:
             export CLAUDE_CODE_GIT_BASH_PATH='C:\Program Files\Git\bin\bash.exe'
           fi
           node scripts/native-harness-smoke.mjs --codex-binary "$RUNNER_TEMP/native-installer/components/codex/bin/codex${{ runner.os == 'Windows' && '.exe' || '' }}" --claude-runtime "$RUNNER_TEMP/native-installer/components/claude"
-      - name: Archive the native distribution
-        run: |
-          cd "$RUNNER_TEMP"
-          tar -C native-installer -czf "oac-native-installer-${{ runner.os }}-${{ runner.arch }}.tar.gz" .
       - uses: actions/upload-artifact@v6
         if: inputs.upload-artifacts
         with:
           name: oac-native-installer-${{ runner.os }}-${{ runner.arch }}
-          path: ${{ runner.temp }}/oac-native-installer-*.tar.gz
+          path: ${{ runner.temp }}/native-archives/*.tar.gz
           if-no-files-found: error
           retention-days: 7
           compression-level: 0
diff --git a/AGENTS.md b/AGENTS.md
index 70c113a2f..6bc0a950d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -28,37 +28,48 @@ Do not multiply entities without necessity. The long-term goal is minimal code,
 | Application–Core (`/v1`) | Official schema pinned by `contracts/agents-api/upstream.json` plus Go-owned `x_agents_core` fields and typed public extension routes; `make openapi` generates public Go types and `contracts/agents-api/openapi.yaml` | [Agents API guide](docs/api/public-agent-api.md) |
 | Web and operators–Core (`/core/v1`) | Route annotations in `services/core/internal/api/`; `make openapi` generates `contracts/agents-api/core.openapi.yaml` | [Core administration API](contracts/agents-api/admin-api.md) |
 | Nodes and daemons–Core (`/api/v1` HTTP routes; the node and daemon wire protocols are separate rows) | Route annotations in `services/core/internal/api/`; `make openapi` generates `contracts/agents-api/runtime.openapi.yaml` | [Machine connection API](contracts/agents-api/machine-api.md) |
-| Core and sandbox nodes–Workspace filesystem | `services/core/internal/workspacefs/workspacefs.go` | [Workspace filesystem providers](docs/workspace-provider.md) |
-| Core–Sandbox Provider | `services/core/internal/sandbox/sandbox_provider.go` | [Sandbox Provider guide](docs/sandbox-provider.md) |
+| Core and sandbox nodes–Workspace filesystem | `services/core/internal/workspacefs/workspacefs.go` | [Workspace filesystem protocol](docs/workspace-provider.md) |
+| Core–Sandbox Provider | `services/core/internal/sandbox/sandbox_provider.go` | [Sandbox Provider protocol](docs/sandbox-provider.md) |
 | Core–sandbox node | `services/core/internal/sandbox/node/wire.go` | [Sandbox node protocol](contracts/agents-api/node-generation-protocol.md) |
 | Provider–Runtime startup | `internal/runtimebootstrap/bootstrap.go` | [Runtime bootstrap](docs/runtime-bootstrap.md) |
 | Core–Runtime wire | `internal/agentdaemon/proto/` | [Core–Runtime protocol](docs/runtime-protocol.md) |
-| Runtime–Harness | `apps/daemon/internal/agent/harness.go` | [Harness onboarding](contracts/agents-api/harness-onboarding.md) |
+| Runtime–Harness | `apps/daemon/internal/agent/harness.go` | [Harness protocol](contracts/agents-api/harness-onboarding.md) |
 | Harness–Model provider | `internal/modelprovider/config.go` | [Model execution](contracts/agents-api/model-execution.md) |
 
 ### Complexity stays in the adapter
 
-- A new Sandbox Provider, Harness, model provider or vendor feature changes only its adapter. It adds no Core execution path, store table or column, migration, deployment or configuration field, API field or Web UI specific to one vendor or Harness. The [Sandbox Provider guide](docs/sandbox-provider.md) and [Harness onboarding](contracts/agents-api/harness-onboarding.md) describe how to add an adapter.
+- A new Sandbox Provider, Harness, model provider or vendor feature changes only its adapter. It adds no Core execution path, store table or column, migration, deployment or configuration field, API field or Web UI specific to one vendor or Harness. The [Sandbox Provider protocol](docs/sandbox-provider.md) and [Harness protocol](contracts/agents-api/harness-onboarding.md) describe how to add an adapter.
 - When the protocol cannot express what an adapter needs, change the protocol. Never add an optional side interface for one implementation.
 - Implementing the declared checkpoint lifecycle in one vendor's Provider is an adapter change. A vendor-only pause interface, a Core path for that vendor, vendor receipts in the store or a vendor idle setting in the deployment is not.
 - Fix shared lifecycle, admission, cancellation, reuse and performance problems in the common flow, never in a branch selected by Harness, Runtime or vendor name. Core preparation and execution never branch on operating system or Environment source; platform support requires native CI builds and automated tests.
 - Each Harness runs its own model and tool loop through a maintained upstream SDK or native protocol, in the Environment's declared workspace directory. Its native history or configuration directory is never the workspace. Never build a second executor, a hand-written model/tool loop or a compatibility framework to fabricate parity. The public API and persistence never depend on one engine's native item types.
 
+### Core assembles, Harnesses run natively
+
+Choosing a Harness and a model behaves like running that Harness locally with that model. The only differences are the cloud Environment, isolation, credentials and unattended operation.
+
+- Core assembles configuration and passes it through. When a Harness or model natively supports what an official field expresses, the adapter maps the field to the native setting and the native side runs it. If the provider cannot run it, the provider's own error returns unchanged. Core qualifies nothing on a provider's behalf. It adds nothing to model input and has no fallback, retry or substitute path. Authentication, isolation and credential protection are assembly and stay in Core.
+- A Harness joins through one declaration file, `internal/harnessconfig/<package>/declaration.go`, plus its adapter code ([declare the Harness](contracts/agents-api/harness-onboarding.md#declare-the-harness)). The declaration is the only source of support facts, and every other projection is generated from it.
+- An official field with no native home returns a typed error. Dropping it silently would be a fallback.
+- A default defined by the pinned official API applies. Everything else follows the native default, and Core sends nothing for it.
+- An adapter overrides a native default only when the Harness cannot otherwise run unattended in the cloud. The allowed reasons are: tools run without approval prompts, no ask-the-user tool, the workspace and state paths, credential isolation, bounded failure instead of waiting, no work that outlives its Turn, and no feature that needs an account credential Core does not hold. Each override has a one-line reason beside it, and the adapter guide lists it.
+- Never branch on the model or provider. When a model lacks a feature, the Harness handles it as it would locally.
+
 ### Public API
 
 - The target is the complete OpenAI Agents API (`openai/openai-python` `beta/agents`) as pinned in [`contracts/agents-api/upstream.json`](contracts/agents-api/upstream.json): paths, methods, headers, field presence, nullability, discriminators, defaults, status transitions, pagination, errors and streaming. Engine limitations are gaps to close, never grounds to narrow or redefine the contract. Operations or fields newer than the pinned baseline wait for a protocol upgrade.
-- Record each native Harness difference, and any unspecified or unverified behavior, in the [coverage ledger](contracts/agents-api/index.md). Reject explicit enablement of an unsupported feature and never invent official semantics. When a material difference has no clear mapping, stop and ask before changing its semantics. Native differences never relax authentication, isolation, credential protection or data consistency.
+- Record each native Harness difference, and any unspecified or unverified behavior, in the [OpenAI compatibility](contracts/agents-api/index.md). Reject explicit enablement of an unsupported feature and never invent official semantics. When a material difference has no clear mapping, stop and ask before changing its semantics. Native differences never relax authentication, isolation, credential protection or data consistency.
 - Applications, including the Parsar product, reach Core only through the public contract, with no privileged endpoint and no shared tables. Core never interprets their product payloads.
 
 ### One home for each setting and datum
 
 Each setting and each piece of data is written in one place and read from that place: no second copy, no environment-variable or file fallback and no alias. A new setting joins its category and lives beside its peers.
 
-The categories are [process settings](docs/configuration.md#process-settings), [secrets](docs/configuration.md#compose-installations), and Core's database for [runtime settings](docs/configuration.md#runtime-settings-web) and execution data. [Configuration](docs/configuration.md) owns the installation layout and the settings themselves.
+The categories are [process settings](docs/configuration.md#process-settings), [secrets](docs/configuration.md#compose-installations), and Core's database for [runtime settings](docs/configuration.md#runtime-settings-web) and execution data. [Configuration reference](docs/configuration.md) owns the installation layout and the settings themselves.
 
 ### Pre-release: no compatibility layers
 
-OpenAgentCore is pre-release. Replace superseded interfaces, execution paths and files outright. Keep no version fallback, compatibility shim or migration for superseded behavior unless an explicit upgrade contract requires it. The [in-place upgrade](docs/getting-started/operations.md#upgrade) from v0.0.10 or later is that contract: persisted changes ship as forward migrations (goose for PostgreSQL, `oac init` for the data volume), and a landed migration is never edited. Protocols may change; the release notes list each change with the operator actions it requires. Keep the pinned official public protocol, valid data and still-used, verified infrastructure. Do not rewrite working infrastructure only to rename it.
+OpenAgentCore has had no public release. Replace superseded interfaces, execution paths and files outright. Keep no version fallback, compatibility shim or migration for superseded behavior. An installation of another release is reinstalled, never upgraded. A schema change adds a forward migration, so existing development and test databases follow it; the migrations may be folded into one baseline at any time. Keep the pinned official public protocol, valid data and still-used, verified infrastructure. Do not rewrite working infrastructure only to rename it.
 
 ## Documentation
 
@@ -75,6 +86,8 @@ OpenAgentCore is pre-release. Replace superseded interfaces, execution paths and
 
 - For each new task, create a new Git worktree. Name its directory after that change's commit subject, in kebab-case, beside the checkout. Run `git pull --ff-only` on the base branch, and create the feature branch in that worktree before development.
 - After every push to a pull request, wait 60 seconds, then run `gh pr checks` and confirm CI passes. Fix any failure before reporting the work as done.
+- When documents conflict, apply the latest explicit user decision and update the affected current guidance; recorded evidence does not override it.
+- Review the complete diff with a fresh independent subagent that receives only the requirements, acceptance criteria, boundaries, repository path and comparison baseline, with no implementation summary, self-assessment or earlier findings. Explain these criteria to the user. Do not use `codex exec` as a substitute reviewer. [CONTRIBUTING.md](CONTRIBUTING.md#review) states the review contract.
 - [CONTRIBUTING.md](CONTRIBUTING.md): documentation ownership, repository boundary, workflow, independent review, required checks and naming.
 - [Develop OpenAgentCore](docs/development.md): setup, the repository map, focused checks and [each extension boundary](docs/development.md#choose-an-extension-boundary).
-- [API index](docs/api/index.md): each route's caller and credential.
+- [API namespaces and credentials](docs/api/index.md): each route's caller and credential.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d581c0b0e..6901af58d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -4,41 +4,23 @@ This guide owns how to work in the repository: documentation ownership, the repo
 
 ## Documentation ownership
 
+Every subject has one owner. Most owners are the page whose title names the subject in the [documentation sidebar](docs.json), such as Configuration reference, Operations or Architecture. This table lists the owners a title does not reveal.
+
 | Subject | Canonical source |
 | --- | --- |
 | Design principles, public API fidelity, settings and data ownership, documentation rules | [AGENTS.md](AGENTS.md) |
 | Protocol code and documents at each component boundary | [Protocol map](AGENTS.md#protocols-at-every-boundary) |
-| Projects, keys, resource isolation, administrator authority, secrets and audit concepts | [Concepts](docs/concepts.md) |
-| Component responsibilities and Session flow | [Architecture](docs/architecture.md) |
-| Developer setup, repository map and focused checks | [Develop OpenAgentCore](docs/development.md) |
-| API callers, credentials and route inventory | [API index](docs/api/index.md) |
-| Public wire semantics and protocol coverage | [Agents API contracts](contracts/agents-api/index.md) |
-| Machine connection routes | [Machine connection API](contracts/agents-api/machine-api.md) |
+| Generated files (OpenAPI documents, Harness catalog reference, architecture diagram) | The source and generator named in [Contract and schema rules](#contract-and-schema-rules) and [Branding](#branding); never edit the output by hand |
 | Core service setup, tests and generation | [Core service guide](services/core/README.md) |
 | Core implementation constraints beyond the public contracts | [Implementation constraints](services/core/IMPLEMENTATION.md) |
-| Environment ownership, preparation, Skills, Plugins, packages and MCP bindings | [Environments](contracts/agents-api/environments.md) |
-| Built-in Harness identifiers and display names | `internal/harnessconfig/builtin/catalog.json` and its [generated reference](contracts/agents-api/harness-catalog.md) |
-| Harness registration, service qualification and acceptance | [Harness onboarding](contracts/agents-api/harness-onboarding.md) |
-| Harness capabilities by placement | [Harness capabilities](contracts/agents-api/harness-capabilities.md) |
-| Harness selection, model providers and native parameters | [Model execution](contracts/agents-api/model-execution.md) |
-| Independent workspace filesystem protocol and adapter behavior | [Workspace filesystem providers](docs/workspace-provider.md) |
-| Provider registration and lifecycle | [Sandbox Provider guide](docs/sandbox-provider.md) |
-| Sandbox deployment, selection and administrative transitions | [Sandbox deployment](contracts/agents-api/sandbox-deployment.md) |
-| Operator node tasks | [Nodes guide](docs/getting-started/nodes.md) |
+| Built-in Harness identifiers and display names | `internal/harnessconfig/<package>/declaration.go` and its [generated reference](contracts/agents-api/harness-catalog.md) |
 | Codex, Claude and MiniMax Runtime adapters and images | [Codex](services/core/deploy/codex/README.md), [Claude](services/core/deploy/claude/README.md), [MiniMax](services/core/deploy/mcode/README.md) |
 | Claude private SDK bridge | [Claude SDK adapter](packages/claude-sdk-adapter/README.md) |
 | E2B template construction | [E2B template builder](services/core/deploy/e2b/README.md) |
 | E2B and microsandbox Provider helper implementation | [E2B helper](services/core/tools/e2b-provider/README.md), [microsandbox helper](services/core/tools/microsandbox-provider/README.md) |
-| Runtime telemetry responses | [Runtime telemetry API](contracts/agents-api/runtime-observability-api.md) |
-| Runtime observation, sampling, retention and export | [Runtime observability](contracts/agents-api/runtime-observability.md) |
-| Distribution builds, Runtime image builds, CI and publication | [Maintainer guide](docs/maintainers.md) |
+| Distribution builds, Runtime image builds, CI and publication | [Build and release OpenAgentCore](docs/maintainers.md) |
 | Website: landing page, bilingual documentation maintenance, documentation site build and GitHub Pages publication | [Website guide](website/README.md) |
-| Self-hosted Runtime installation, recovery and local operation | [Self-hosted execution](docs/getting-started/self-hosted.md) |
 | Installer lifecycle, locking, generated state, managed HTTPS and downloads | [Deployment](deploy/README.md) and [Node installer](deploy/node/README.md) |
-| Operator installation and alternatives | [Installation](docs/getting-started/install.md), [installation options](docs/getting-started/install-options.md) |
-| Settings, defaults, files and installation layout | [Configuration](docs/configuration.md) |
-| Operator commands, keys, backup and upgrades | [Operations](docs/getting-started/operations.md) |
-| Web console request boundary and sign-in | [Console server](docs/web/console-server.md) |
 | Web page behavior and visual rules | [Web product](apps/web/PRODUCT.md), [Web design](apps/web/DESIGN.md) |
 | Application example behavior and local operation | [Application example](example/parsar/README.md) |
 
@@ -48,11 +30,11 @@ This repository contains the Core API and database, Runtime daemon, Harness and
 
 ### Product and execution service separation
 
-Core must build, deploy and run independently of product services, frontends and databases. Applications follow the [public API boundary](AGENTS.md#public-api); their feature backlogs do not define Core's public protocol or storage model. Applications that share a PostgreSQL server with Core must use separate databases, credentials and migrations.
+Core builds, deploys and runs independently of product services, frontends and databases. Applications follow the [public API boundary](AGENTS.md#public-api) and, when they share a PostgreSQL server with Core, use separate databases, credentials and migrations.
 
 - Parsar owns users, workspaces, business authorization, Agent/Team definitions, capabilities, product conversations, IM/sharing, approval decisions and billing. It uses Core for execution.
 - A product conversation may reference several execution Sessions. Core owns native engine session identities; an execution Session has its own lifetime, separate from a daemon connection, process or sandbox.
-- Build application orchestration on the [public Session and event contract](docs/api/public-agent-api.md). Product cursor replay must be an explicit product extension. Business Team orchestration belongs to the application; Core's pinned `multi_agent` and Subagent resources remain part of the public contract.
+- Build application orchestration on the public Session and event contract in the [Agents API guide](docs/api/public-agent-api.md). Product cursor replay must be an explicit product extension. Business Team orchestration belongs to the application; Core's pinned `multi_agent` and Subagent resources remain part of the public contract.
 
 ### Optional application example
 
@@ -70,11 +52,7 @@ Core must build, deploy and run independently of product services, frontends and
 
 Follow the [worktree rule](AGENTS.md#working-in-this-repository). Do not edit or commit implementation directly on `main`.
 
-When documents conflict, apply the latest explicit user decision and update the affected current guidance. Recorded evidence does not override it.
-
-If requirements are unresolved, object ownership is unclear, or a design would need parallel compatibility paths, raise it with a concrete recommendation and tradeoffs before implementing. Continue independent work meanwhile. Do not silently preserve obsolete private designs.
-
-Record unrelated findings without starting them. Scope compatibility claims to the operations and placements verified.
+If requirements are unresolved, object ownership is unclear, or a design would need parallel compatibility paths, raise it with a concrete recommendation and tradeoffs before implementing, and continue independent work meanwhile. Record unrelated findings without starting them. Scope compatibility claims to the operations and placements verified.
 
 ### Implementation conventions
 
@@ -84,16 +62,11 @@ Record unrelated findings without starting them. Scope compatibility claims to t
 - Use `internal/obs/log` for logs. Keep credentials out of source and logs. Harness profiles must not copy Runtime tool environment values; see the [environment contract](contracts/agents-api/environments.md#explicit-local-tool-environment).
 - Require absolute user-supplied working directories.
 - Keep test artifacts under `~/.oac/`.
-- New or changed routes identify their caller and credential in the [API index](docs/api/index.md) and link their detailed contract.
+- New or changed routes identify their caller and credential in [API namespaces and credentials](docs/api/index.md) and link their detailed contract.
 
 ### Review
 
-1. After implementation and validation, have a fresh independent subagent review the complete diff.
-2. Give it only the requirements, acceptance criteria, boundaries, repository path and comparison baseline. Do not give an implementation summary, self-assessment or earlier findings. Explain these criteria to the user.
-3. Fix substantiated in-scope findings, validate, then use another fresh reviewer.
-4. If the cycle repeats, reassess design and scope before adding changes. Report an unresolved blocker instead of broadening the task.
-
-Do not use `codex exec` as a substitute reviewer.
+Every change gets an independent review of the complete diff against its requirements, acceptance criteria and boundaries. The reviewer receives no implementation summary or earlier findings. Fix substantiated in-scope findings, validate and review again; if the cycle repeats, reassess design and scope instead of adding changes, and report an unresolved blocker instead of broadening the task.
 
 ## Required checks
 
@@ -101,7 +74,7 @@ Toolchain setup and focused commands are in [Develop OpenAgentCore](docs/develop
 
 ### Checks for a change
 
-Validate the current diff and the behavior it directly affects, with the smallest checks that establish correctness. Include migration or cross-component tests only when those behaviors change. A review, documentation edit or CI configuration change does not need a full repository test run. After a follow-up edit, rerun only the checks that edit affects, and record what passed and any limits.
+Validate the current diff and the behavior it directly affects, with the smallest checks that establish correctness. Include cross-component tests only when those behaviors change. A review, documentation edit or CI configuration change does not need a full repository test run. After a follow-up edit, rerun only the checks that edit affects, and record what passed and any limits.
 
 The [CI selection policy](docs/maintainers.md#continuous-integration) names affected groups. A narrower check is enough when it covers the change. `make check` is the full gate for an explicitly requested full validation and for releases. [Live acceptance](#live-acceptance) applies when native execution behavior changes.
 
@@ -116,21 +89,26 @@ The role needs `CREATE DATABASE`: tests of database-wide state, such as the exec
 
 ### Contract and schema rules
 
-- `internal/harnessconfig/builtin/catalog.json` is the single authored public Harness registration list. `make generate-harness-catalog` generates Go configuration/profile registration, client identifiers/names and the reference, and projects the model-provider protocol names of `internal/modelprovider/config.go` to the client; `make openapi` derives the matching enums. `make check-harness-catalog` verifies freshness in the full gate. Native configuration rules stay in their adapter declarations; Core qualification and Runtime availability stay separate.
-- `make sqlc-generate` owns only `services/core/internal/db/sqlc` (sqlc v1.29.0). Do not rewrite landed migrations.
+- Each `internal/harnessconfig/<package>/declaration.go` is the single authored declaration of one Harness, read by Core admission and the Runtime. `make generate-harness-catalog` generates the Go registrations, client identifiers/names and the reference, and projects the model-provider protocol names of `internal/modelprovider/config.go` to the client; `make openapi` derives the matching enums. `make check-harness-catalog` verifies freshness in the full gate. Native restrictions stay in the declaration; Runtime availability stays separate and discovery only narrows the declaration.
+- `make openapi` regenerates the public Go types, the Agent request shapes, the route inventory and all three OpenAPI documents; run it after changing the pinned public schema, Go bindings, Core extensions or handler annotations, and commit the generated diffs. `make check-openapi` checks freshness and the generator, and also runs through `make check-go`.
+- `scripts/generate-public-api.py` reads the checked-in, checksum-verified official source without network access. It selects Agents, Vaults, Files and Skills and follows their schema references, preserving union types, nullability, required fields and constraints. The request shapes in `services/core/internal/api/official_shapes.gen.go` project `CreateAgentParams`, `UpdateAgentParams` and `SessionAgentConfigParam`; Core checks request bodies against them before it reads an Agent configuration. Core's extension types in `contracts/agents-api/v1/` stay authored in Go and are added to the public schema during generation.
+- The standard fields are generated into `v1/official.gen.go`. `go-bindings.json` lists the types Core consumes and overrides only the Go representation or field order that existing storage or custom JSON encoding requires; shared shapes use one Go type. Selected discriminated unions also generate JSON serializers that keep required nullable fields for each variant. Go input projections exclude `packages.system` to preserve its explicit rejection. Other union serializers, Core's local limits, execution admission and state transitions remain implementation code.
+- `packages/agents-client/src/generated/public-api.ts` generates the TypeScript client's types, enum values and field names from the resulting public schema. The same generator projects the `/core/v1` document into `core-api.ts`, which imports the public types it references from `public-api.ts`. The internal `/core/v1` and `/api/v1` documents come from handler annotations: a response field Core always sends carries `binding:"required"`, a nullable field carries `extensions:"x-nullable"`, and a Core-owned closed set uses a named Go type with typed constants in its producing package, from which Swag derives one shared enum definition. Single-value discriminators keep `enums:` tags; fields mirroring official or Runtime-owned sets keep tags that contract tests check against their owners. The annotations only shape the documents, and the client rejects a response that breaks them.
+- Contract tests verify that the public schema preserves the official definitions, extensions stay in `x_agents_core`, and all documents match registered routes. Official-client and raw HTTP tests verify behavior. Schema generation does not qualify an unimplemented feature; the known gaps in [OpenAI compatibility](contracts/agents-api/index.md#known-gaps) still apply. Upstream upgrades update the OpenAPI and SDK pins together after comparison and compatibility tests.
+- `make sqlc-generate` owns only `services/core/internal/db/sqlc` (sqlc v1.29.0).
 - `make check-runtime-contract` is the focused Core–Runtime contract entry point; see [Contract verification](docs/runtime-protocol.md#contract-verification). It also runs through `check-go` and `check-core`.
 
 ### Compatibility evidence
 
-Use official SDKs and upstream types or schemas. Validate raw HTTP payloads and observable workflows alongside SDK behavior. API changes preserve the pinned contracts, coverage ledger, official-client tests and Core's independent build. Verify the official-client workflow before application integration. An OpenAI endpoint is a test target only when the required capabilities and credentials are available.
+Use official SDKs and upstream types or schemas. Validate raw HTTP payloads and observable workflows alongside SDK behavior. API changes preserve the pinned contracts, [OpenAI compatibility](contracts/agents-api/index.md), official-client tests and Core's independent build. Verify the official-client workflow before application integration. An OpenAI endpoint is a test target only when the required capabilities and credentials are available.
 
 Controlled fixtures and synthetic model responses qualify deterministic behavior. Live acceptance calls a real model API through Core, the daemon and the Harness adapter. Direct native probes establish feasibility only. Keep provider credentials in private test configuration, outside source, logs and task records.
 
-For wire details the pinned SDK does not specify, probe resources you own and retain the request evidence. In the [coverage ledger](contracts/agents-api/index.md), keep observed behavior distinct from guarantees, accepted profiles distinct from complete coverage, and provider connectivity distinct from deployment qualification.
+For wire details the pinned SDK does not specify, probe resources you own and retain the request evidence. In the [OpenAI compatibility](contracts/agents-api/index.md), keep observed behavior distinct from guarantees, accepted profiles distinct from complete coverage, and provider connectivity distinct from deployment qualification.
 
 ### Live acceptance
 
-Native adapter changes require their build/check targets and live provider acceptance. Follow [Harness qualification](contracts/agents-api/harness-onboarding.md#qualify-the-adapter) for native model execution. State which checks ran, which used fixtures and which lacked prerequisites. Changes to native package pins require the same qualification; build the MiniMax companion from this revision's pinned patched sources.
+Native adapter changes require their build/check targets and live provider acceptance. Follow [Qualify the adapter](contracts/agents-api/harness-onboarding.md#qualify-the-adapter) in the Harness protocol for native model execution. State which checks ran, which used fixtures and which lacked prerequisites. Changes to native package pins require the same qualification; build the MiniMax companion from this revision's pinned patched sources.
 
 ## OpenAgentCore Runtime names
 
@@ -145,23 +123,6 @@ Native adapter changes require their build/check targets and live provider accep
 
 Provider bootstrap, Runtime images and Harness adapters must agree on these names.
 
-[Upgrade](docs/getting-started/operations.md#upgrade) owns release changes and preservation of installed data and resources.
-
 ## Branding
 
-Use OpenAgentCore for public project branding. The canonical mark is `docs/assets/openagentcore-logo.svg`; Web uses its outline with cropped transparent margins, theme-aware favicon colors and dark-surface inversion. The README banner is `docs/assets/openagentcore-banner.jpeg`. The architecture diagram that README and the website show, `docs/assets/architecture.svg`, is generated by `scripts/generate-architecture-diagram.py`; change the script and run it again. The `example/parsar/` workbench keeps its own name, logo and favicon. Preserve external repository URLs and data identifiers when changing display copy.
-
-## OpenAgentCore name guard
-
-`make check-names` scans tracked text for retired branding, GitHub organization, settings and installed command names. Each exception in `scripts/name-allowlist.json` names a path glob, a regular expression and a reason.
-
-- An exception covers only its matched text: an allowed repository import cannot hide a retired setting elsewhere on the line.
-- Keep exceptions narrow and explain the preserved contract or detection input.
-- The guard fails on an exception that excuses no retired identifier. Remove an exception together with the last text it covers.
-
-These identities stay unchanged:
-
-- public `AgentCoreError`, upstream contract fields and the separate Parsar product;
-- persisted credential encryption domains and native-session resume keys, so existing data can be decrypted and Sessions can resume.
-
-Detection inputs name the identifiers they reject. Landed migrations keep their original identifiers; application and operator examples use the current names.
+Use OpenAgentCore for public project branding. The canonical mark is `docs/assets/openagentcore-logo.svg`; Web uses its outline with cropped transparent margins, theme-aware favicon colors and dark-surface inversion. The README wordmark is `docs/assets/openagentcore-wordmark-light.svg` with a dark variant, and `docs/assets/og-image.png` is the social preview. The architecture diagram that README and the website show, `docs/assets/architecture.svg` and `architecture-dark.svg`, is generated by `scripts/generate-architecture-diagram.py`; change the script and run it again. The `example/parsar/` workbench keeps its own name, logo and favicon. Preserve external repository URLs and data identifiers when changing display copy.
diff --git a/Makefile b/Makefile
index cc2c6b4bf..2e73eade1 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ SWAG_VERSION ?= v1.16.4
 help:
 	@printf '%s\n' 'make build-core        Build standalone Core commands' 'make build-daemon      Build the execution daemon' 'make check             Run Core, persistence and runtime checks' 'See README.md for runtime prerequisites and deployment.'
 
-check: check-ci check-harness-catalog check-names check-distribution check-database check-sqlc check-go check-microsandbox-provider check-core check-claude-sdk check-web check-example check-mcode-harness
+check: check-ci check-harness-catalog check-distribution check-database check-sqlc check-go check-microsandbox-provider check-core check-claude-sdk check-web check-example check-mcode-harness
 	@printf 'OpenAgentCore checks passed.\n'
 
 .PHONY: generate-harness-catalog check-harness-catalog
@@ -19,11 +19,6 @@ check-harness-catalog:
 	python3 scripts/generate-harness-catalog.py --check
 	python3 scripts/generate-harness-catalog.test.py
 
-.PHONY: check-names
-check-names:
-	python3 scripts/check-names.test.py
-	python3 scripts/check-names.py
-
 check-database:
 	@test -n "$${OAC_TEST_DATABASE_URL:-}" || { echo 'Set OAC_TEST_DATABASE_URL to a dedicated test PostgreSQL database' >&2; exit 1; }
 
diff --git a/README.ja.md b/README.ja.md
index 5d15a9c99..e12d93c55 100644
--- a/README.ja.md
+++ b/README.ja.md
@@ -1,78 +1,87 @@
 <div align="center">
 
-![OpenAgentCore — One core. Many agents.](docs/assets/openagentcore-banner.jpeg)
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/assets/openagentcore-wordmark-dark.svg">
+  <img alt="OpenAgentCore" src="docs/assets/openagentcore-wordmark-light.svg" width="440">
+</picture>
 
-# OpenAgentCore
+オープンソースでセルフホストできる OpenAI Agents API。公式 OpenAI SDK から、自分のマシンと自分のモデルで Codex、Claude Code、MiniMax Code を実行できます。
 
-複数のネイティブ実行エンジンに対応し、自分のインフラにデプロイできる OpenAI Agents API のオープンソース実装です。
+[![Release](https://img.shields.io/github/v/release/MiniMax-AI/OpenAgentCore)](https://github.com/MiniMax-AI/OpenAgentCore/releases/latest) [![License](https://img.shields.io/github/license/MiniMax-AI/OpenAgentCore)](LICENSE)
 
-[公式サイト](https://openagentcore.dev/) · [インストール](#インストール) · [API を使う](https://openagentcore.dev/docs/getting-started/quickstart) · [ドキュメント](https://openagentcore.dev/docs/getting-started/) · [コントリビューション](CONTRIBUTING.md)
+[公式サイト](https://openagentcore.dev/) · [ドキュメント](https://openagentcore.dev/docs/getting-started/) · [クイックスタート](#クイックスタート) · [コントリビューション](CONTRIBUTING.md)
 
 [English](README.md) · [简体中文](README.zh-CN.md) · **日本語**
 
 </div>
 
-## コンポーネントの関係
+- **OpenAI と同じ API。** `OPENAI_BASE_URL` を設定すれば、[公式 OpenAI SDK](https://developers.openai.com/api/docs/libraries)または直接の HTTP リクエストがそのまま動作します。
+- **自分のエージェント、自分のモデル。** 各 Session は Codex、Claude Code、MiniMax Code のいずれかを手元のマシンと同じようにネイティブに実行し、設定したモデルプロバイダーを使用します。詳しくは [Harness の機能](https://openagentcore.dev/contracts/agents-api/harness-capabilities)をご覧ください。
+- **計算資源は休止し、ワークスペースは残る。** microsandbox と独立したワークスペースストレージの組み合わせでは、アイドル状態のサンドボックスが計算資源を解放し、互換性のあるノードでファイルをそのまま再開します。E2B、Docker、自分の Linux、macOS、Windows マシンでも Session を実行できます。詳しくは[Sandbox Provider protocol](https://openagentcore.dev/docs/sandbox-provider)をご覧ください。
+- **置き換え可能なコンポーネント。** サンドボックスプロバイダー、ワークスペースファイルシステム、Harness、モデルプロバイダーは、[定義されたプロトコル](AGENTS.md#protocols-at-every-boundary)を通じて接続されます。
 
-![OpenAgentCore のアーキテクチャ](docs/assets/architecture.svg)
+![デプロイの概要](docs/assets/console-overview-en.webp)
 
-アプリケーションと管理者は、次の Core API を使用します。
-
-| API | パス | 利用者 |
-| --- | --- | --- |
-| **[Agents API](https://openagentcore.dev/docs/api/public-agent-api)** | `/v1` | アプリケーション。[OpenAI の Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) と同じプロトコルを使用 |
-| **[Core API](https://openagentcore.dev/contracts/agents-api/admin-api)** | `/core/v1` | 管理者。Web 経由で利用 |
-
-Core は実行状態を永続化し、Runtime は Environment 内で選択した Harness を実行します。各コンポーネントは定義されたプロトコルで接続されているため、個別に置き換えられます。詳しくは[アーキテクチャガイド](https://openagentcore.dev/docs/architecture)をご覧ください。
+## クイックスタート
 
-## OpenAgentCore とは
+[前提条件](https://openagentcore.dev/docs/getting-started/install#prerequisites)に従って Docker をセットアップした Linux または macOS で、Core、Web、PostgreSQL をインストールします。
 
-OpenAgentCore は、自分のインフラ上で AI エージェントを実行し、[OpenAI Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) を提供します。
+```sh
+curl -fsSL https://openagentcore.dev/install.sh | bash
+```
 
-- **OpenAI と同じ API。** [公式 OpenAI SDK](https://developers.openai.com/api/docs/guides/agents/sdk) または直接の HTTP リクエストで、接続先を変更するだけで利用できます。新しいクライアントを覚える必要はありません。
-- **エージェントを選択可能。** 各 [Session](https://openagentcore.dev/docs/api/public-agent-api) は、[Codex](https://github.com/openai/codex)、[Claude Code](https://code.claude.com/docs/en/overview)、[MiniMax Code](https://github.com/MiniMax-AI/minimax-code) のいずれかの[ネイティブ Harness](https://openagentcore.dev/contracts/agents-api/harness-onboarding) を実行し、[設定したモデルプロバイダー](https://openagentcore.dev/contracts/agents-api/model-execution)を使用します。
-- **計算資源を再利用し、ワークスペースを永続化。** [microsandbox](https://github.com/zerocore-ai/microsandbox) と[独立したワークスペースストレージ](https://openagentcore.dev/docs/workspace-provider)の組み合わせを推奨します。アイドル状態のサンドボックスは休止して計算資源を解放し、互換性のあるノードで再開できます。[E2B](https://e2b.dev/) はマネージド環境の選択肢です。Docker や自分の Linux、macOS、Windows マシンでの実行もサポートします。
-- **すべてのコンポーネントを置き換え可能。** [サンドボックス](https://openagentcore.dev/docs/sandbox-provider)、[ワークスペースファイルシステム](https://openagentcore.dev/docs/workspace-provider)、[Harness](https://openagentcore.dev/contracts/agents-api/harness-onboarding)、[モデルプロバイダー](https://openagentcore.dev/contracts/agents-api/model-execution)は、[定義されたプロトコル](AGENTS.md#protocols-at-every-boundary)を通じて接続されます。
+Windows では PowerShell で実行します。
 
-## スクリーンショット
+```powershell
+irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1 | iex
+```
 
-| 概要 | エージェントの監視 |
-| --- | --- |
-| ![デプロイの概要](docs/assets/console-overview-en.webp) | ![エージェントの監視](docs/assets/console-agent-metrics-en.webp) |
+Web で、インストーラーが表示する Core key でサインインし、パブリックアドレスを設定し、デフォルトモデルを設定し、Project API key を発行して、サンドボックスの容量（ノードまたは E2B）を追加します。各手順は[Core と Web のインストール](https://openagentcore.dev/docs/getting-started/install)をご覧ください。
 
-## インストール
+続いて OpenAI SDK から呼び出します。`OPENAI_BASE_URL` に API のベース URL（`https://core.example/v1`）、`OPENAI_API_KEY` に Project API key を設定してください。
 
-[前提条件](https://openagentcore.dev/docs/getting-started/install#prerequisites)に従って Docker をセットアップした Linux または macOS で、次のコマンドを実行します。
+```python
+from openai import OpenAI
 
-```sh
-curl -fsSL https://openagentcore.dev/install.sh | bash
+client = OpenAI()  # reads OPENAI_BASE_URL and OPENAI_API_KEY
+session = client.beta.agents.sessions.create(
+    environment={"type": "openai_hosted"},
+    input="Create /workspace/hello.txt with a short greeting, then describe it.",
+    extra_body={"agent": {"x_agents_core": {"harness": "codex"}}},
+)
+print(session.id)
 ```
 
-Windows PowerShell の場合：
+[最初の Session を実行](https://openagentcore.dev/docs/getting-started/quickstart)では、結果を待って読み戻します。
 
-```powershell
-irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1 | iex
-```
+## 仕組み
 
-続いて、以下の手順で設定します。
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/assets/architecture-dark.svg">
+  <img alt="OpenAgentCore のアーキテクチャ" src="docs/assets/architecture.svg">
+</picture>
 
-1. インストーラーが生成した Core key で **Web（管理コンソール）にサインイン**し、**ドメインと HTTPS を設定**します。
-2. **デフォルトモデルを設定**し、**Project API key を発行**します。
-3. ノード、E2B、または自分のマシンを**実行リソースとして追加**します。
-4. OpenAI SDK で **[最初の Session を実行](https://openagentcore.dev/docs/getting-started/quickstart)** します。
+アプリケーションと管理者は、次の Core API を使用します。
 
-[インストールガイド](https://openagentcore.dev/docs/getting-started/install)では、各手順に加え、HTTPS の設定とローカルで手軽に試す方法を説明しています。リッスンアドレスやポートなどの設定は、[インストールオプション](https://openagentcore.dev/docs/getting-started/install-options)をご覧ください。
+| API | パス | 利用者 |
+| --- | --- | --- |
+| **[Agents API](https://openagentcore.dev/docs/api/public-agent-api)** | `/v1` | アプリケーション。[OpenAI の Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) と同じプロトコルを使用 |
+| **[Core API](https://openagentcore.dev/contracts/agents-api/admin-api)** | `/core/v1` | 管理者。Web 経由で利用 |
+
+Core は実行状態を永続化し、Runtime は Environment 内で選択した Harness を実行します。各コンポーネントは定義されたプロトコルで接続されているため、個別に置き換えられます。詳しくは[アーキテクチャ](https://openagentcore.dev/docs/architecture)をご覧ください。
 
 ## ドキュメント
 
 | 目的 | 参照先 |
 | --- | --- |
-| インストールと運用 | [インストールガイド](https://openagentcore.dev/docs/getting-started/install)、続いて[運用ガイド](https://openagentcore.dev/docs/getting-started/operations) |
-| API を使ったアプリケーション開発 | [クイックスタート](https://openagentcore.dev/docs/getting-started/quickstart)、続いて [Agents API ガイド](https://openagentcore.dev/docs/api/public-agent-api) |
+| インストールと運用 | [Core と Web のインストール](https://openagentcore.dev/docs/getting-started/install)、続いて[運用](https://openagentcore.dev/docs/getting-started/operations) |
+| API を使ったアプリケーション開発 | [最初の Session を実行](https://openagentcore.dev/docs/getting-started/quickstart)、続いて [Agents API ガイド](https://openagentcore.dev/docs/api/public-agent-api) |
 | 完成したアプリケーションの確認 | [サンプル](https://openagentcore.dev/docs/examples) |
 | 自分のマシンでエージェントを実行 | [セルフホスト実行](https://openagentcore.dev/docs/getting-started/self-hosted) |
 | Harness の機能と制限の確認 | [Harness の機能](https://openagentcore.dev/contracts/agents-api/harness-capabilities) |
-| 設計の理解 | [アーキテクチャガイド](https://openagentcore.dev/docs/architecture) |
-| 新しいサンドボックス、Harness などのコンポーネントの追加 | [開発ガイド](https://openagentcore.dev/docs/development) |
+| 設計の理解 | [アーキテクチャ](https://openagentcore.dev/docs/architecture) |
+| 新しいサンドボックス、Harness などのコンポーネントの追加 | [OpenAgentCore の開発](https://openagentcore.dev/docs/development) |
+
+## コントリビューションとライセンス
 
-すべてのドキュメントは[ドキュメント一覧](https://openagentcore.dev/docs/getting-started/)から参照できます。コードを変更する前に、[コントリビューションガイド](CONTRIBUTING.md)をお読みください。
+コードを変更する前に [CONTRIBUTING.md](CONTRIBUTING.md) をお読みください。バグ報告と質問は [GitHub Issues](https://github.com/MiniMax-AI/OpenAgentCore/issues) へお寄せください。[MIT License](LICENSE) で公開しています。
diff --git a/README.md b/README.md
index dacf6142f..83ef3704b 100644
--- a/README.md
+++ b/README.md
@@ -1,78 +1,87 @@
 <div align="center">
 
-![OpenAgentCore — One core. Many agents.](docs/assets/openagentcore-banner.jpeg)
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/assets/openagentcore-wordmark-dark.svg">
+  <img alt="OpenAgentCore" src="docs/assets/openagentcore-wordmark-light.svg" width="440">
+</picture>
 
-# OpenAgentCore
+The OpenAI Agents API, open source and self-hosted. Run Codex, Claude Code or MiniMax Code on your own machines with your own models, through the official OpenAI SDK.
 
-An open-source, self-hosted implementation of the OpenAI Agents API with multiple native Harnesses.
+[![Release](https://img.shields.io/github/v/release/MiniMax-AI/OpenAgentCore)](https://github.com/MiniMax-AI/OpenAgentCore/releases/latest) [![License](https://img.shields.io/github/license/MiniMax-AI/OpenAgentCore)](LICENSE)
 
-[Website](https://openagentcore.dev/) · [Install](#install) · [Call the API](https://openagentcore.dev/docs/getting-started/quickstart) · [Documentation](https://openagentcore.dev/docs/getting-started/) · [Contributing](CONTRIBUTING.md)
+[Website](https://openagentcore.dev/) · [Documentation](https://openagentcore.dev/docs/getting-started/) · [Quickstart](#quickstart) · [Contributing](CONTRIBUTING.md)
 
 **English** · [简体中文](README.zh-CN.md) · [日本語](README.ja.md)
 
 </div>
 
-## What it is
+- **Same API as OpenAI.** Set `OPENAI_BASE_URL` and the [official OpenAI SDK](https://developers.openai.com/api/docs/libraries), or plain HTTP, works unchanged.
+- **Your agent, your model.** Each Session runs Codex, Claude Code or MiniMax Code natively, as it runs on your machine, with the model provider you configure. See [Harness capabilities](https://openagentcore.dev/contracts/agents-api/harness-capabilities).
+- **Compute that sleeps, workspaces that stay.** On microsandbox, which keeps every workspace on independent storage, idle sandboxes release compute and resume on a compatible node with their files intact. E2B, Docker and your own Linux, macOS or Windows machine also run Sessions. See [Sandbox Provider protocol](https://openagentcore.dev/docs/sandbox-provider).
+- **Replaceable parts.** Sandbox Providers, workspace filesystems, Harnesses and model providers plug in through [defined protocols](AGENTS.md#protocols-at-every-boundary).
 
-OpenAgentCore runs AI agents on your own infrastructure behind the [OpenAI Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview).
+![Deployment overview](docs/assets/console-overview-en.webp)
 
-- **Same API as OpenAI.** Point the [OpenAI Agent API](https://developers.openai.com/api/docs/guides/agents/sdk), or plain HTTP, at your installation. No new client to learn.
-- **Your choice of agent.** Each [Session](https://openagentcore.dev/docs/api/public-agent-api) runs a [native Harness](https://openagentcore.dev/contracts/agents-api/harness-onboarding): [Codex](https://github.com/openai/codex), [Claude Code](https://code.claude.com/docs/en/overview) or [MiniMax Code](https://github.com/MiniMax-AI/minimax-code), with the [model provider you configure](https://openagentcore.dev/contracts/agents-api/model-execution).
-- **Reusable compute, persistent workspaces.** We recommend [microsandbox](https://github.com/zerocore-ai/microsandbox) with [independent workspace storage](https://openagentcore.dev/docs/workspace-provider): idle sandboxes suspend, release compute and resume on compatible nodes. [E2B](https://e2b.dev/) is the managed alternative; Docker and your own Linux, macOS or Windows machine remain supported execution choices.
-- **Every part is replaceable.** [Sandboxes](https://openagentcore.dev/docs/sandbox-provider), [workspace filesystems](https://openagentcore.dev/docs/workspace-provider), [Harnesses](https://openagentcore.dev/contracts/agents-api/harness-onboarding) and [model providers](https://openagentcore.dev/contracts/agents-api/model-execution) plug in through [defined protocols](AGENTS.md#protocols-at-every-boundary).
+## Quickstart
 
-## How it fits together
+Install Core, Web and PostgreSQL on Linux or macOS with [Docker](https://openagentcore.dev/docs/getting-started/install#prerequisites):
 
-![OpenAgentCore architecture](docs/assets/architecture.svg)
-
-Applications and operators use these Core APIs:
-
-| API | Path | Used by |
-| --- | --- | --- |
-| **[Agents API](https://openagentcore.dev/docs/api/public-agent-api)** | `/v1` | Your applications. Same protocol as [OpenAI's Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) |
-| **[Core API](https://openagentcore.dev/contracts/agents-api/admin-api)** | `/core/v1` | Operators, through Web |
+```sh
+curl -fsSL https://openagentcore.dev/install.sh | bash
+```
 
-Core keeps durable execution state. The Runtime runs the chosen Harness inside the Environment. Each connection is a defined protocol, so any part can be replaced on its own. See the [architecture guide](https://openagentcore.dev/docs/architecture).
+On Windows, in PowerShell:
 
-## Screenshots
+```powershell
+irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1 | iex
+```
 
-| Overview | Agent metrics |
-| --- | --- |
-| ![Deployment overview](docs/assets/console-overview-en.webp) | ![Agent metrics](docs/assets/console-agent-metrics-en.webp) |
+In Web, sign in with the Core key the installer prints, configure the public address, set a default model, issue a Project API key and add sandbox capacity (a node or E2B). [Install Core and Web](https://openagentcore.dev/docs/getting-started/install) covers each step.
 
-## Install
+Then call it with the OpenAI SDK, with `OPENAI_BASE_URL` set to your API base URL (`https://core.example/v1`) and `OPENAI_API_KEY` to the Project API key:
 
-On Linux or macOS with [Docker configured](https://openagentcore.dev/docs/getting-started/install#prerequisites):
+```python
+from openai import OpenAI
 
-```sh
-curl -fsSL https://openagentcore.dev/install.sh | bash
+client = OpenAI()  # reads OPENAI_BASE_URL and OPENAI_API_KEY
+session = client.beta.agents.sessions.create(
+    environment={"type": "openai_hosted"},
+    input="Create /workspace/hello.txt with a short greeting, then describe it.",
+    extra_body={"agent": {"x_agents_core": {"harness": "codex"}}},
+)
+print(session.id)
 ```
 
-Windows PowerShell:
+[Run your first Session](https://openagentcore.dev/docs/getting-started/quickstart) waits for the result and reads it back.
 
-```powershell
-irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1 | iex
-```
+## How it works
 
-Then:
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/assets/architecture-dark.svg">
+  <img alt="OpenAgentCore architecture" src="docs/assets/architecture.svg">
+</picture>
 
-1. **Sign in to Web**, the admin console, with the Core key the installer created, and **configure the domain and HTTPS**.
-2. **Set a default model** and **issue a Project API key**.
-3. **Add execution capacity:** a node, E2B, or your own machine.
-4. **[Run your first Session](https://openagentcore.dev/docs/getting-started/quickstart)** with the OpenAI SDK.
+Applications and operators use these Core APIs:
 
-The [installation guide](https://openagentcore.dev/docs/getting-started/install) covers each step, HTTPS and a quick local trial. Listen addresses, ports and other options: [installation options](https://openagentcore.dev/docs/getting-started/install-options).
+| API | Path | Used by |
+| --- | --- | --- |
+| **[Agents API](https://openagentcore.dev/docs/api/public-agent-api)** | `/v1` | Your applications. Same protocol as [OpenAI's Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) |
+| **[Core API](https://openagentcore.dev/contracts/agents-api/admin-api)** | `/core/v1` | Operators, through Web |
+
+Core keeps durable execution state. The Runtime runs the chosen Harness inside the Environment. Each connection is a defined protocol, so any part can be replaced on its own. See [Architecture](https://openagentcore.dev/docs/architecture).
 
 ## Documentation
 
 | I want to | Start with |
 | --- | --- |
-| Install and operate an installation | [Installation](https://openagentcore.dev/docs/getting-started/install), then [operations](https://openagentcore.dev/docs/getting-started/operations) |
-| Build an application on the API | [Quickstart](https://openagentcore.dev/docs/getting-started/quickstart), then the [Agents API guide](https://openagentcore.dev/docs/api/public-agent-api) |
+| Install and operate an installation | [Install Core and Web](https://openagentcore.dev/docs/getting-started/install), then [Operations](https://openagentcore.dev/docs/getting-started/operations) |
+| Build an application on the API | [Run your first Session](https://openagentcore.dev/docs/getting-started/quickstart), then the [Agents API guide](https://openagentcore.dev/docs/api/public-agent-api) |
 | See a complete application | [Examples](https://openagentcore.dev/docs/examples) |
-| Run agents on my own machine | [Self-hosted execution](https://openagentcore.dev/docs/getting-started/self-hosted) |
+| Run agents on my own machine | [Run self-hosted Sessions](https://openagentcore.dev/docs/getting-started/self-hosted) |
 | Check Harness capabilities and limits | [Harness capabilities](https://openagentcore.dev/contracts/agents-api/harness-capabilities) |
 | Understand the design | [Architecture](https://openagentcore.dev/docs/architecture) |
-| Add a sandbox, Harness or other component | [Developer guide](https://openagentcore.dev/docs/development) |
+| Add a sandbox, Harness or other component | [Develop OpenAgentCore](https://openagentcore.dev/docs/development) |
+
+## Contributing and license
 
-All pages: [documentation index](https://openagentcore.dev/docs/getting-started/). Before changing code, read the [contributor rules](CONTRIBUTING.md).
+Read [CONTRIBUTING.md](CONTRIBUTING.md) before changing code. Report bugs and ask questions in [GitHub Issues](https://github.com/MiniMax-AI/OpenAgentCore/issues). Released under the [MIT License](LICENSE).
diff --git a/README.zh-CN.md b/README.zh-CN.md
index dee2b6a84..535f2252e 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -1,78 +1,87 @@
 <div align="center">
 
-![OpenAgentCore — One core. Many agents.](docs/assets/openagentcore-banner.jpeg)
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/assets/openagentcore-wordmark-dark.svg">
+  <img alt="OpenAgentCore" src="docs/assets/openagentcore-wordmark-light.svg" width="440">
+</picture>
 
-# OpenAgentCore
+开源、可自部署的 OpenAI Agents API。用官方 OpenAI SDK，在你自己的机器上用你自己的模型运行 Codex、Claude Code 或 MiniMax Code。
 
-OpenAI Agents API 的开源实现，支持多种原生 Harness，可部署在自己的基础设施上。
+[![Release](https://img.shields.io/github/v/release/MiniMax-AI/OpenAgentCore)](https://github.com/MiniMax-AI/OpenAgentCore/releases/latest) [![License](https://img.shields.io/github/license/MiniMax-AI/OpenAgentCore)](LICENSE)
 
-[官网](https://openagentcore.dev/zh/) · [安装](#安装) · [调用 API](https://openagentcore.dev/zh/docs/getting-started/quickstart) · [文档](https://openagentcore.dev/zh/docs/getting-started/) · [参与贡献](CONTRIBUTING.md)
+[官网](https://openagentcore.dev/zh/) · [文档](https://openagentcore.dev/zh/docs/getting-started/) · [快速开始](#快速开始) · [参与贡献](CONTRIBUTING.md)
 
 [English](README.md) · **简体中文** · [日本語](README.ja.md)
 
 </div>
 
-## 组件关系
+- **与 OpenAI 相同的 API。** 设置 `OPENAI_BASE_URL` 后，[官方 OpenAI SDK](https://developers.openai.com/api/docs/libraries)或直接的 HTTP 调用无需改动即可使用。
+- **你的 Agent，你的模型。** 每个 Session 原生运行 Codex、Claude Code 或 MiniMax Code，使用你配置的模型提供商，与在本机运行一致。详见 [Harness 能力](https://openagentcore.dev/zh/contracts/agents-api/harness-capabilities)。
+- **计算会休眠，工作区会保留。** 在 microsandbox 上（每个工作区都保存在独立存储中），空闲沙箱释放计算资源，并在兼容节点上带着文件恢复。E2B、Docker 以及你自己的 Linux、macOS 或 Windows 机器同样可以运行 Session。详见[沙箱提供商协议](https://openagentcore.dev/zh/docs/sandbox-provider)。
+- **部件可替换。** 沙箱提供商、工作区文件系统、Harness 和模型提供商都通过[既定协议](AGENTS.md#protocols-at-every-boundary)接入。
 
-![OpenAgentCore 架构](docs/assets/architecture.svg)
+![部署概览](docs/assets/console-overview-zh.webp)
 
-应用和管理员使用以下 Core API：
-
-| API | 路径 | 调用方 |
-| --- | --- | --- |
-| **[Agents API](https://openagentcore.dev/zh/docs/api/public-agent-api)** | `/v1` | 你的应用，与 [OpenAI 的 Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) 协议一致 |
-| **[Core API](https://openagentcore.dev/zh/contracts/agents-api/admin-api)** | `/core/v1` | 管理员，通过 Web 调用 |
-
-持久化执行状态由 Core 保存；Runtime 在 Environment 中运行所选 Harness。各部件之间都通过既定协议连接， 任何一个都可以单独替换。详见[架构说明](https://openagentcore.dev/zh/docs/architecture)。
+## 快速开始
 
-## 这是什么
+在 Linux 或 macOS 上，按[前置条件](https://openagentcore.dev/zh/docs/getting-started/install#prerequisites)准备好 Docker 后，安装 Core、Web 和 PostgreSQL：
 
-OpenAgentCore 在你自己的基础设施上运行 AI Agent，对外提供 [OpenAI Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview)。
+```sh
+curl -fsSL https://openagentcore.dev/install.sh | bash
+```
 
-- **与 OpenAI 相同的 API。** [官方 OpenAI SDK](https://developers.openai.com/api/docs/guides/agents/sdk) 或直接 HTTP 调用，改一下地址即可，无需学习新客户端。
-- **自选 Agent。** 每个 [Session](https://openagentcore.dev/zh/docs/api/public-agent-api) 运行一个[原生 Harness](https://openagentcore.dev/zh/contracts/agents-api/harness-onboarding)：[Codex](https://github.com/openai/codex)、[Claude Code](https://code.claude.com/docs/en/overview) 或 [MiniMax Code](https://github.com/MiniMax-AI/minimax-code)， 使用[你配置的模型供应商](https://openagentcore.dev/zh/contracts/agents-api/model-execution)。
-- **计算可复用，工作区持久化。** 推荐 [microsandbox](https://github.com/zerocore-ai/microsandbox) 配合[独立工作区存储](https://openagentcore.dev/zh/docs/workspace-provider)：空闲沙箱挂起、释放计算资源，并在兼容节点上恢复。[E2B](https://e2b.dev/) 是托管计算的另一选择；也支持 Docker 和你自己的 Linux、macOS 或 Windows 机器。
-- **每个部件都可替换。** [沙箱](https://openagentcore.dev/zh/docs/sandbox-provider)、[工作区文件系统](https://openagentcore.dev/zh/docs/workspace-provider)、[Harness](https://openagentcore.dev/zh/contracts/agents-api/harness-onboarding) 和[模型供应商](https://openagentcore.dev/zh/contracts/agents-api/model-execution)都通过[既定协议](AGENTS.md#protocols-at-every-boundary)接入。
+在 Windows 上，使用 PowerShell：
 
-## 界面预览
+```powershell
+irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1 | iex
+```
 
-| 概览 | Agent 监控 |
-| --- | --- |
-| ![部署概览](docs/assets/console-overview-zh.webp) | ![Agent 监控](docs/assets/console-agent-metrics-zh.webp) |
+在 Web 中，用安装程序输出的 Core 密钥登录，配置公共地址，设置默认模型，签发项目 API 密钥，并添加沙箱容量（节点或 E2B）。每一步见[安装 Core 和 Web](https://openagentcore.dev/zh/docs/getting-started/install)。
 
-## 安装
+然后用 OpenAI SDK 调用，将 `OPENAI_BASE_URL` 设为你的 API 基础地址（`https://core.example/v1`），`OPENAI_API_KEY` 设为项目 API 密钥：
 
-在已按[前置条件](https://openagentcore.dev/zh/docs/getting-started/install#prerequisites)准备 Docker 的 Linux 或 macOS 上：
+```python
+from openai import OpenAI
 
-```sh
-curl -fsSL https://openagentcore.dev/install.sh | bash
+client = OpenAI()  # reads OPENAI_BASE_URL and OPENAI_API_KEY
+session = client.beta.agents.sessions.create(
+    environment={"type": "openai_hosted"},
+    input="Create /workspace/hello.txt with a short greeting, then describe it.",
+    extra_body={"agent": {"x_agents_core": {"harness": "codex"}}},
+)
+print(session.id)
 ```
 
-Windows PowerShell:
+[运行第一个 Session](https://openagentcore.dev/zh/docs/getting-started/quickstart)会等待结果并读回。
 
-```powershell
-irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1 | iex
-```
+## 工作原理
 
-然后：
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/assets/architecture-dark.svg">
+  <img alt="OpenAgentCore 架构" src="docs/assets/architecture.svg">
+</picture>
 
-1. 用安装器生成的 Core 密钥 **登录 Web**（管理控制台），并**配置域名和 HTTPS**。
-2. **设置默认模型**，并**签发项目 API 密钥**。
-3. **添加执行资源**：节点、E2B，或你自己的机器。
-4. 用 OpenAI SDK **[运行第一个 Session](https://openagentcore.dev/zh/docs/getting-started/quickstart)**。
+应用和管理员使用以下 Core API：
 
-[安装指南](https://openagentcore.dev/zh/docs/getting-started/install)详细介绍每一步，以及 HTTPS 配置和本地快速试用。监听地址、端口等参数见[安装配置选项](https://openagentcore.dev/zh/docs/getting-started/install-options)。
+| API | 路径 | 调用方 |
+| --- | --- | --- |
+| **[Agents API](https://openagentcore.dev/zh/docs/api/public-agent-api)** | `/v1` | 你的应用，与 [OpenAI 的 Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) 协议一致 |
+| **[Core API](https://openagentcore.dev/zh/contracts/agents-api/admin-api)** | `/core/v1` | 管理员，通过 Web 调用 |
+
+持久化执行状态由 Core 保存；Runtime 在 Environment 中运行所选 Harness。各部件之间都通过既定协议连接，任何一个都可以单独替换。详见[架构](https://openagentcore.dev/zh/docs/architecture)。
 
 ## 文档
 
 | 我想要 | 从这里开始 |
 | --- | --- |
-| 安装并运维 | [安装指南](https://openagentcore.dev/zh/docs/getting-started/install)，然后看[运维](https://openagentcore.dev/zh/docs/getting-started/operations) |
-| 基于 API 开发应用 | [快速开始](https://openagentcore.dev/zh/docs/getting-started/quickstart)，然后看 [Agents API 指南](https://openagentcore.dev/zh/docs/api/public-agent-api) |
+| 安装并运维 | [安装 Core 和 Web](https://openagentcore.dev/zh/docs/getting-started/install)，然后看[运维](https://openagentcore.dev/zh/docs/getting-started/operations) |
+| 基于 API 开发应用 | [运行第一个 Session](https://openagentcore.dev/zh/docs/getting-started/quickstart)，然后看 [Agents API 指南](https://openagentcore.dev/zh/docs/api/public-agent-api) |
 | 看一个完整的应用 | [示例](https://openagentcore.dev/zh/docs/examples) |
-| 在自己的机器上运行 Agent | [自托管执行](https://openagentcore.dev/zh/docs/getting-started/self-hosted) |
+| 在自己的机器上运行 Agent | [自托管执行器](https://openagentcore.dev/zh/docs/getting-started/self-hosted) |
 | 查看 Harness 能力和限制 | [Harness 能力](https://openagentcore.dev/zh/contracts/agents-api/harness-capabilities) |
-| 了解设计 | [架构说明](https://openagentcore.dev/zh/docs/architecture) |
-| 接入新的沙箱、Harness 或其他组件 | [开发指南](https://openagentcore.dev/zh/docs/development) |
+| 了解设计 | [架构](https://openagentcore.dev/zh/docs/architecture) |
+| 接入新的沙箱、Harness 或其他组件 | [开发 OpenAgentCore](https://openagentcore.dev/zh/docs/development) |
+
+## 参与贡献与许可证
 
-全部文档见[文档目录](https://openagentcore.dev/zh/docs/getting-started/)。修改代码前请阅读[贡献规范](CONTRIBUTING.md)。
+修改代码前请阅读 [CONTRIBUTING.md](CONTRIBUTING.md)。缺陷和问题请提交到 [GitHub Issues](https://github.com/MiniMax-AI/OpenAgentCore/issues)。基于 [MIT 许可证](LICENSE)发布。
diff --git a/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go
index 4cbab1ca5..157133232 100644
--- a/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go
@@ -65,7 +65,7 @@ func TestLiveClaudeSDKCancelResume(t *testing.T) {
 		ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
 		defer cancel()
 		out := make(chan proto.Envelope, 64)
-		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": "Follow the user's requested format. Preserve the exact verification value in conversation history. Use no tools."}}
+		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": "Follow the user's requested format. Preserve the exact verification value in conversation history. Use no tools."}}
 		running, err := startSingleTurn(ctx, config, request, out)
 		if err != nil {
 			t.Fatal(err)
diff --git a/apps/daemon/internal/agent/claudesdk/cancellation_test.go b/apps/daemon/internal/agent/claudesdk/cancellation_test.go
index 2ef7efc62..8d1bf3503 100644
--- a/apps/daemon/internal/agent/claudesdk/cancellation_test.go
+++ b/apps/daemon/internal/agent/claudesdk/cancellation_test.go
@@ -44,7 +44,7 @@ func TestCancellationWaitsForDrainAndPublishesOutcome(t *testing.T) {
 	if got := running.CancellationOutcome(); !reflect.DeepEqual(got, proto.DonePayload{}) {
 		t.Fatal("unsettled outcome was exposed", got)
 	}
-	if err := running.(*session).Steer(ctx, proto.PromptSteerPayload{InputID: "later", Input: proto.TextInput("later")}); !errors.Is(err, agent.ErrSteeringInactive) {
+	if err := running.(*session).SteerWithReceipt(ctx, proto.PromptSteerPayload{InputID: "later", Input: proto.TextInput("later")}, func() {}); !errors.Is(err, agent.ErrSteeringInactive) {
 		t.Fatal("cancelled execution accepted steering", err)
 	}
 	if err := os.WriteFile(filepath.Join(config.StateDir, "release"), nil, 0o600); err != nil {
@@ -168,7 +168,7 @@ func cancellationRequest() proto.PromptRequestPayload {
 
 func runCancellationHelper(request startRequest, mode string, scanner *bufio.Scanner, emit func(bridgeEvent)) {
 	if mode == "cancellation-wait" {
-		emit(bridgeEvent{Type: "delta", Delta: "partial"})
+		emit(bridgeEvent{Type: "delta", ItemID: "item", Delta: "partial"})
 		if !scanner.Scan() {
 			return
 		}
@@ -179,7 +179,7 @@ func runCancellationHelper(request startRequest, mode string, scanner *bufio.Sca
 		// These valid observations were in flight when cancellation started.
 		emit(bridgeEvent{Type: "input_ready", SessionID: request.Resume})
 		emit(bridgeEvent{Type: "usage", ResultID: "native-result", SessionID: request.Resume, Usage: json.RawMessage(usageFixture)})
-		emit(bridgeEvent{Type: "delta", Delta: "tail"})
+		emit(bridgeEvent{Type: "delta", ItemID: "item", Delta: "tail"})
 		for {
 			if _, err := os.Stat(filepath.Join(os.Getenv("CLAUDE_CONFIG_DIR"), "release")); err == nil {
 				break
@@ -187,7 +187,7 @@ func runCancellationHelper(request startRequest, mode string, scanner *bufio.Sca
 			time.Sleep(time.Millisecond)
 		}
 		_, _ = os.Stderr.WriteString(strings.Repeat("x", 2*1024*1024))
-		emit(bridgeEvent{Type: "delta", Delta: "drained"})
+		emit(bridgeEvent{Type: "delta", ItemID: "item", Delta: "drained"})
 		emit(bridgeEvent{Type: "input_closed", SessionID: request.Resume})
 		emit(bridgeEvent{Type: "error", Code: "cancelled"})
 		return
@@ -199,7 +199,7 @@ func runCancellationHelper(request startRequest, mode string, scanner *bufio.Sca
 		}
 		emit(bridgeEvent{Type: "input_ready", SessionID: id})
 		emit(bridgeEvent{Type: "usage", ResultID: "native-result", SessionID: id, Usage: json.RawMessage(usageFixture)})
-		emit(bridgeEvent{Type: "delta", Delta: "partial"})
+		emit(bridgeEvent{Type: "delta", ItemID: "item", Delta: "partial"})
 	}
 	emit(bridgeEvent{Type: "error", Code: "execution_failed"})
 }
diff --git a/apps/daemon/internal/agent/claudesdk/combination_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/combination_live_linux_test.go
new file mode 100644
index 000000000..776fe8f17
--- /dev/null
+++ b/apps/daemon/internal/agent/claudesdk/combination_live_linux_test.go
@@ -0,0 +1,140 @@
+//go:build linux
+
+package claudesdk
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/google/uuid"
+)
+
+// TestLiveClaudeSDKNativeCombinations proves structured output beside multi_agent,
+// a function tool and deferred tool search on the real SDK and provider.
+func TestLiveClaudeSDKNativeCombinations(t *testing.T) {
+	entrypoint, keyFile, proofRoot := os.Getenv("OAC_RUNTIME_CLAUDE_SDK_ENTRYPOINT"), os.Getenv("OAC_TEST_CLAUDE_SDK_MINIMAX_KEY_FILE"), os.Getenv("OAC_TEST_CLAUDE_SDK_PROOF_DIR")
+	endpoint, model := os.Getenv("OAC_TEST_CLAUDE_SDK_BASE_URL"), os.Getenv("OAC_TEST_CLAUDE_SDK_MODEL")
+	if entrypoint == "" || keyFile == "" || endpoint == "" || model == "" || !filepath.IsAbs(proofRoot) {
+		t.Skip("real SDK/provider acceptance requires an entrypoint, a private key file, an endpoint, a model and an absolute proof directory")
+	}
+	key, err := os.ReadFile(keyFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(proofRoot, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	root, err := os.MkdirTemp(proofRoot, "claude-combination-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("OAC_RUNTIME_HOME", root)
+	config := Config{Entrypoint: entrypoint, StateDir: filepath.Join(root, "state"), Env: []string{
+		"ANTHROPIC_BASE_URL=" + endpoint, "ANTHROPIC_AUTH_TOKEN=" + strings.TrimSpace(string(key)),
+		"ANTHROPIC_API_KEY=", "CLAUDE_CODE_OAUTH_TOKEN=",
+		"ANTHROPIC_DEFAULT_SONNET_MODEL=" + model, "ANTHROPIC_DEFAULT_OPUS_MODEL=" + model, "ANTHROPIC_DEFAULT_HAIKU_MODEL=" + model,
+	}}
+	schema := json.RawMessage(`{"type":"object","properties":{"answer":{"type":"string"}},"required":["answer"],"additionalProperties":false}`)
+	lookup := func(deferred bool) []proto.FunctionTool {
+		return []proto.FunctionTool{{Name: "lookup", Description: "Return the synthetic verification value.", Parameters: json.RawMessage(`{"type":"object","properties":{},"additionalProperties":false}`), DeferLoading: deferred}}
+	}
+	// A stateless JSON-RPC MCP server with one tool.
+	mcpServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		var rpc struct {
+			ID     json.RawMessage `json:"id"`
+			Method string          `json:"method"`
+		}
+		_ = json.Unmarshal(body, &rpc)
+		var result string
+		switch rpc.Method {
+		case "initialize":
+			result = `{"protocolVersion":"2025-06-18","capabilities":{"tools":{}},"serverInfo":{"name":"proof","version":"0"}}`
+		case "tools/list":
+			result = `{"tools":[{"name":"echo","description":"Return the synthetic MCP value.","inputSchema":{"type":"object","properties":{}}}]}`
+		case "tools/call":
+			result = `{"content":[{"type":"text","text":"synthetic-mcp-value"}]}`
+		default:
+			w.WriteHeader(http.StatusAccepted)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"jsonrpc":"2.0","id":` + string(rpc.ID) + `,"result":` + result + `}`))
+	}))
+	defer mcpServer.Close()
+	mcp := func(req *proto.PromptRequestPayload) {
+		req.MCPHTTPServers = &[]proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "proof", ServerURL: mcpServer.URL}}
+	}
+	cases := map[string]func(*proto.PromptRequestPayload){
+		"multi_agent": func(req *proto.PromptRequestPayload) {
+			req.DisableSubagents, req.ObserveSubagentIdentities = false, true
+		},
+		"mcp": mcp,
+		"mcp_tool_search": func(req *proto.PromptRequestPayload) {
+			mcp(req)
+			req.FunctionTools, req.ToolSearch = lookup(true), true
+		},
+		"function": func(req *proto.PromptRequestPayload) { req.FunctionTools = lookup(false) },
+		"tool_search": func(req *proto.PromptRequestPayload) {
+			req.FunctionTools, req.ToolSearch = lookup(true), true
+		},
+	}
+	for name, configure := range cases {
+		t.Run(name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 180*time.Second)
+			defer cancel()
+			req := proto.PromptRequestPayload{RunID: uuid.NewString(), DisableExecutionEnvironment: true, DisableSubagents: true,
+				Input:             proto.TextInput("Call the lookup tool if one is available and put its value in answer. Otherwise answer with the word ready."),
+				ExecutionControls: &proto.ExecutionControls{TextVerbosity: "medium", OutputFormat: &proto.OutputFormat{Type: "json_schema", Schema: schema}},
+				AgentOptions:      map[string]any{"model": model, "system_prompt": "Reply only through the structured output."}}
+			configure(&req)
+			out := make(chan proto.Envelope, 64)
+			running, err := startSingleTurn(ctx, config, req, out)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer running.Cancel(context.Background())
+			s := running.(*session)
+			var done, called bool
+			var content, failure string
+			for event := range out {
+				switch event.Type {
+				case proto.TypeFunctionCall:
+					var call proto.FunctionCallPayload
+					if err := event.DecodePayload(&call); err != nil {
+						t.Fatal(err)
+					}
+					called = true
+					text := "synthetic-verification-value"
+					if err := s.SubmitFunctionResult(ctx, proto.FunctionResultPayload{CallID: call.CallID, DeliveryID: uuid.NewString(), Success: true, Content: []proto.InputContent{{Type: "input_text", Text: &text}}}); err != nil {
+						t.Fatal(err)
+					}
+				case proto.TypeError:
+					var payload proto.ErrorPayload
+					_ = json.Unmarshal(event.Payload, &payload)
+					failure = payload.Error
+				case proto.TypeDone:
+					var payload proto.DonePayload
+					_ = json.Unmarshal(event.Payload, &payload)
+					done, content = true, payload.Content
+				}
+			}
+			var answer struct {
+				Answer string `json:"answer"`
+			}
+			if !done || failure != "" || json.Unmarshal([]byte(content), &answer) != nil || answer.Answer == "" {
+				t.Fatalf("structured output failed: done=%v failure=%q content=%q", done, failure, content)
+			}
+			t.Logf("%s: function_called=%v answer=%q", name, called, answer.Answer)
+		})
+	}
+}
diff --git a/apps/daemon/internal/agent/claudesdk/contracts.go b/apps/daemon/internal/agent/claudesdk/contracts.go
index 3d6be7a98..939607cf9 100644
--- a/apps/daemon/internal/agent/claudesdk/contracts.go
+++ b/apps/daemon/internal/agent/claudesdk/contracts.go
@@ -9,7 +9,6 @@ var (
 	_ agent.Turn                     = (*session)(nil)
 	_ agent.Session                  = (*session)(nil)
 	_ agent.DurableSteerer           = (*session)(nil)
-	_ agent.Steerer                  = (*session)(nil)
 	_ agent.FunctionResultSubmitter  = (*session)(nil)
 	_ agent.WorkspaceReader          = (*session)(nil)
 	_ agent.WorkspaceDirectoryLister = (*session)(nil)
diff --git a/apps/daemon/internal/agent/claudesdk/declaration.go b/apps/daemon/internal/agent/claudesdk/declaration.go
index c1d903d98..5e0447bb7 100644
--- a/apps/daemon/internal/agent/claudesdk/declaration.go
+++ b/apps/daemon/internal/agent/claudesdk/declaration.go
@@ -1,7 +1,5 @@
 package claudesdk
 
-import configuration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/claudesdk"
-
 import (
 	"context"
 	"fmt"
@@ -13,43 +11,14 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/localworkspace"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	declaration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/claudesdk"
 )
 
 const claudeSDKEntrypointEnv = "OAC_RUNTIME_CLAUDE_SDK_ENTRYPOINT"
 const claudeSDKNodeEnv = "OAC_RUNTIME_CLAUDE_SDK_NODE"
 
-// Declaration owns Claude SDK discovery, configuration and execution factories.
-var Declaration = agent.Declaration{Info: proto.SupportedAgentKind{Kind: "claude_sdk", Capabilities: proto.AgentKindCapabilities{
-	SubagentObservations:           proto.CapabilityUnsupported,
-	Streaming:                      proto.CapabilitySupported,
-	Usage:                          proto.CapabilitySupported,
-	Resume:                         proto.CapabilitySupported,
-	RetainedNativeHistory:          proto.CapabilityUnsupported,
-	NativeSessionRecovery:          proto.CapabilityUnsupported,
-	Steering:                       proto.CapabilitySupported,
-	MessageItems:                   proto.CapabilitySupported,
-	ToolObservations:               proto.CapabilitySupported,
-	EnvironmentNone:                proto.CapabilitySupported,
-	LocalEnvironment:               proto.CapabilityUnsupported,
-	Preparation:                    proto.CapabilityUnsupported,
-	WorkspaceReadPreparation:       proto.CapabilityUnsupported,
-	WorkspaceOutputExport:          proto.CapabilityUnsupported,
-	ProgrammaticToolCallingDisable: proto.CapabilitySupported,
-	WebSearchControl:               proto.CapabilityUnsupported,
-	ExecutionControls:              proto.CapabilitySupported,
-	TextVerbosity:                  proto.CapabilityUnsupported,
-	StructuredOutput:               proto.CapabilityUnsupported,
-	ToolSearch:                     proto.CapabilityUnsupported,
-	MessageImages:                  proto.CapabilityUnsupported,
-	FunctionResultImages:           proto.CapabilityUnsupported,
-	SubagentControl:                proto.CapabilitySupported,
-	DurableInputReceipts:           proto.CapabilitySupported,
-	DurableTurns:                   proto.CapabilitySupported,
-	FunctionTools:                  proto.CapabilitySupported,
-	MCPHTTPTools:                   proto.CapabilityUnsupported,
-	MCPHTTPRequired:                proto.CapabilityUnsupported,
-	MCPHTTPBearerAuth:              proto.CapabilityUnsupported,
-}}, Configuration: configuration.Configuration(), Discover: discover}
+// Declaration binds the shared Claude Code declaration to discovery and execution factories.
+var Declaration = agent.Declaration{Declaration: declaration.Declaration, Discover: discover}
 
 func discover(ctx context.Context, options agent.DiscoveryOptions, info proto.SupportedAgentKind) *agent.Runtime {
 	return discoverWithCheck(ctx, options, info, CheckRuntime)
@@ -64,7 +33,7 @@ func discoverWithCheck(parent context.Context, options agent.DiscoveryOptions, d
 
 	fail := func(err error) *agent.Runtime {
 		fmt.Fprintf(options.Stderr, "oac-daemon: configured Claude SDK runtime unavailable: %v\n", err)
-		return out
+		return agent.Unavailable(descriptor)
 	}
 	if !filepath.IsAbs(entrypoint) {
 		return fail(fmt.Errorf("%s must be absolute", claudeSDKEntrypointEnv))
@@ -100,7 +69,7 @@ func discoverWithCheck(parent context.Context, options agent.DiscoveryOptions, d
 		if err != nil {
 			return fail(err)
 		}
-		config, err = ConfigureLocal(config, options.StateRoot, options.RuntimeRoot, os.Getenv("OAC_RUNTIME_WORKSPACE"), binding.NetworkPolicy())
+		config, err = ConfigureLocal(config, options.StateRoot, options.RuntimeRoot, os.Getenv("OAC_RUNTIME_WORKSPACE"))
 		if err != nil {
 			return fail(err)
 		}
@@ -109,35 +78,28 @@ func discoverWithCheck(parent context.Context, options agent.DiscoveryOptions, d
 	if err != nil {
 		return fail(err)
 	}
-	if config.Workspace != nil {
-		if !info.SupportsLocalRuntime() {
-			return fail(fmt.Errorf("Claude SDK bundle does not support the local Runtime contract"))
-		}
-		caps := &out.Info.Capabilities
-		caps.EnvironmentNone, caps.FunctionTools = proto.CapabilityUnsupported, proto.CapabilityFromBool(info.SupportsWorkspaceFunctions())
-		caps.LocalEnvironment, caps.WorkspaceReadPreparation = proto.CapabilitySupported, proto.CapabilitySupported
-		caps.NativeSessionRecovery = proto.CapabilitySupported
-		caps.RetainedNativeHistory = proto.CapabilityFromBool(info.SDK == "0.3.269" && info.Native == "2.1.269 (Claude Code)")
+	local := config.Workspace != nil
+	if local && !info.SupportsLocalRuntime() {
+		return fail(fmt.Errorf("Claude SDK bundle does not support the local Runtime contract"))
 	}
 	out.Info.Available, out.Info.Version = true, info.SDK
-	out.Info.Capabilities.MessageImages = proto.CapabilityFromBool(info.SupportsMessageImages())
-	out.Info.Capabilities.FunctionResultImages = proto.CapabilityFromBool(info.SupportsFunctionResultImages())
-	out.Info.Capabilities.ToolSearch = proto.CapabilityFromBool(info.SupportsToolSearch())
-	if config.Workspace != nil {
-		out.Info.Capabilities.ToolSearch = proto.CapabilityFromBool(info.SupportsWorkspaceToolSearch())
-	}
-	out.Info.Capabilities.StructuredOutput = proto.CapabilityFromBool(info.SupportsStructuredOutput())
-	if config.Workspace != nil {
-		out.Info.Capabilities.StructuredOutput = proto.CapabilityFromBool(info.SupportsWorkspaceStructuredOutput())
-	}
-	out.Info.Capabilities.SubagentObservations = proto.CapabilityFromBool(info.SupportsSubagents())
-	out.Info.Capabilities.MCPHTTPTools = proto.CapabilityFromBool(info.SupportsHTTPMCP())
-	out.Info.Capabilities.MCPHTTPBearerAuth = proto.CapabilityFromBool(info.SupportsHTTPMCPBearer())
-	out.Info.Capabilities.MCPHTTPRequired = proto.CapabilityFromBool(info.SupportsHTTPMCPRequired())
-	if config.Workspace != nil && !info.SupportsWorkspaceMCP() {
-		out.Info.Capabilities.MCPHTTPTools, out.Info.Capabilities.MCPHTTPBearerAuth = proto.CapabilityUnsupported, proto.CapabilityUnsupported
-		out.Info.Capabilities.MCPHTTPRequired = proto.CapabilityUnsupported
-	}
+	caps := &out.Info.Capabilities
+	// The local workspace layout replaces environment:none.
+	agent.Narrow(&caps.EnvironmentNone, !local)
+	for _, capability := range []*proto.CapabilitySupport{&caps.LocalEnvironment, &caps.WorkspaceReadPreparation, &caps.WorkspaceOutputExport, &caps.NativeSessionRecovery} {
+		agent.Narrow(capability, local)
+	}
+	agent.Narrow(&caps.RetainedNativeHistory, local && info.SDK == "0.3.269" && info.Native == "2.1.269 (Claude Code)")
+	agent.Narrow(&caps.FunctionTools, !local || info.SupportsWorkspaceFunctions())
+	agent.Narrow(&caps.MessageImages, info.SupportsMessageImages())
+	agent.Narrow(&caps.FunctionResultImages, info.SupportsFunctionResultImages())
+	agent.Narrow(&caps.ToolSearch, info.SupportsToolSearch() && (!local || info.SupportsWorkspaceToolSearch()))
+	agent.Narrow(&caps.StructuredOutput, info.SupportsStructuredOutput() && (!local || info.SupportsWorkspaceStructuredOutput()))
+	agent.Narrow(&caps.SubagentObservations, info.SupportsSubagents())
+	mcp := !local || info.SupportsWorkspaceMCP()
+	agent.Narrow(&caps.MCPHTTPTools, mcp && info.SupportsHTTPMCP())
+	agent.Narrow(&caps.MCPHTTPBearerAuth, mcp && info.SupportsHTTPMCPBearer())
+	agent.Narrow(&caps.MCPHTTPRequired, mcp && info.SupportsHTTPMCPRequired())
 	out.Executor = NewExecutorFactory(config)
 
 	fmt.Fprintf(options.Stdout, "Claude SDK preflight ok (SDK %s, %s)\n", info.SDK, info.Native)
diff --git a/apps/daemon/internal/agent/claudesdk/declaration_test.go b/apps/daemon/internal/agent/claudesdk/declaration_test.go
index de5271b7b..f5376c81b 100644
--- a/apps/daemon/internal/agent/claudesdk/declaration_test.go
+++ b/apps/daemon/internal/agent/claudesdk/declaration_test.go
@@ -6,13 +6,12 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"reflect"
 	"slices"
 	"strings"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/contracttest"
 )
 
 func TestClaudeSDKInvalidPathsFailBeforeProbe(t *testing.T) {
@@ -26,7 +25,7 @@ func TestClaudeSDKInvalidPathsFailBeforeProbe(t *testing.T) {
 			} else {
 				root = "relative-home"
 			}
-			out := discoverWithCheck(t.Context(), agent.DiscoveryOptions{RuntimeRoot: root, StateRoot: t.TempDir(), Profile: "default", Stdout: &strings.Builder{}, Stderr: &strings.Builder{}}, Declaration.Info, func(context.Context, Config) (RuntimeInfo, error) {
+			out := discoverWithCheck(t.Context(), agent.DiscoveryOptions{RuntimeRoot: root, StateRoot: t.TempDir(), Profile: "default", Stdout: &strings.Builder{}, Stderr: &strings.Builder{}}, Declaration.Info(), func(context.Context, Config) (RuntimeInfo, error) {
 				t.Fatal("invalid paths reached runtime probe")
 				return RuntimeInfo{}, nil
 			})
@@ -47,7 +46,7 @@ func TestClaudeSDKFeatureDiscovery(t *testing.T) {
 	}
 	t.Setenv(claudeSDKNodeEnv, node)
 	for _, features := range [][]string{nil, {"mcp_http_tools"}, {"mcp_http_bearer_auth"}, {"mcp_http_tools", "mcp_http_bearer_auth"}, {"mcp_http_required"}, {"mcp_http_tools", "mcp_http_required"}, {"subagent_resources"}, {"structured_output"}} {
-		out := discoverWithCheck(t.Context(), agent.DiscoveryOptions{RuntimeRoot: root, StateRoot: t.TempDir(), Profile: "default", Stdout: &strings.Builder{}, Stderr: &strings.Builder{}}, Declaration.Info, func(context.Context, Config) (RuntimeInfo, error) {
+		out := discoverWithCheck(t.Context(), agent.DiscoveryOptions{RuntimeRoot: root, StateRoot: t.TempDir(), Profile: "default", Stdout: &strings.Builder{}, Stderr: &strings.Builder{}}, Declaration.Info(), func(context.Context, Config) (RuntimeInfo, error) {
 			info := RuntimeInfo{SDK: "0.3.269", Native: "2.1.269 (Claude Code)", Features: features}
 			return info, nil
 		})
@@ -64,23 +63,24 @@ func TestClaudeSDKFeatureDiscovery(t *testing.T) {
 	}
 }
 
-// The declaration must retain the complete baseline capability descriptor.
-func TestDeclaredCapabilityBaseline(t *testing.T) {
-	expected := map[string]bool{"Streaming": true, "Usage": true, "Resume": true, "Steering": true, "MessageItems": true, "ToolObservations": true, "EnvironmentNone": true, "ProgrammaticToolCallingDisable": true, "ExecutionControls": true, "SubagentControl": true, "DurableInputReceipts": true, "DurableTurns": true, "FunctionTools": true}
-	value := reflect.ValueOf(Declaration.Info.Capabilities)
-	for i := 0; i < value.NumField(); i++ {
-		name := value.Type().Field(i).Name
-		want := proto.CapabilityUnsupported
-		if expected[name] {
-			want = proto.CapabilitySupported
-		}
-		if got := value.Field(i).Interface(); got != want {
-			t.Errorf("%s = %v, want %v", name, got, want)
-		}
-	}
-	if err := Declaration.Info.ValidateDeclaration(); err != nil {
+// Discovery narrows the declaration to the installed bundle and never widens it.
+func TestDiscoveryOnlyNarrowsDeclaration(t *testing.T) {
+	root := t.TempDir()
+	t.Setenv("OAC_RUNTIME_HOME", root)
+	t.Setenv(claudeSDKEntrypointEnv, filepath.Join(root, "main.js"))
+	node, err := os.Executable()
+	if err != nil {
 		t.Fatal(err)
 	}
+	t.Setenv(claudeSDKNodeEnv, node)
+	features := []string{"message_images", "function_result_images", "tool_search", "structured_output", "subagent_resources", "mcp_http_tools", "mcp_http_bearer_auth", "mcp_http_required"}
+	out := discoverWithCheck(t.Context(), agent.DiscoveryOptions{RuntimeRoot: root, StateRoot: t.TempDir(), Profile: "default", Stdout: io.Discard, Stderr: io.Discard}, Declaration.Info(), func(context.Context, Config) (RuntimeInfo, error) {
+		return RuntimeInfo{SDK: "0.3.269", Native: "2.1.269 (Claude Code)", Features: features}, nil
+	})
+	if out == nil || !out.Info.Available {
+		t.Fatal("runtime unavailable")
+	}
+	contracttest.RequireNarrowed(t, Declaration.Capabilities, out.Info.Capabilities)
 }
 
 func TestRuntimeDiscoveryConfigurationAndRegistration(t *testing.T) {
@@ -100,7 +100,7 @@ func TestRuntimeDiscoveryConfigurationAndRegistration(t *testing.T) {
 				t.Setenv(claudeSDKEntrypointEnv, entrypoint)
 			}
 			calls := 0
-			runtime := discoverWithCheck(t.Context(), options, Declaration.Info, func(_ context.Context, c Config) (RuntimeInfo, error) {
+			runtime := discoverWithCheck(t.Context(), options, Declaration.Info(), func(_ context.Context, c Config) (RuntimeInfo, error) {
 				calls++
 				if c.Node != node || c.Entrypoint != entrypoint || c.StateDir != filepath.Join(options.StateRoot, "daemon", "test", "runtime", "claude-sdk") || c.Env != nil {
 					t.Fatalf("configuration: %+v", c)
diff --git a/apps/daemon/internal/agent/claudesdk/execution_controls_test.go b/apps/daemon/internal/agent/claudesdk/execution_controls_test.go
index 0381cf750..e35e48068 100644
--- a/apps/daemon/internal/agent/claudesdk/execution_controls_test.go
+++ b/apps/daemon/internal/agent/claudesdk/execution_controls_test.go
@@ -22,27 +22,57 @@ func TestExecutionControlsPreserveNativeDefaultsAndInstructions(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	request.ExecutionControls = &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}
+	request.ExecutionControls = &proto.ExecutionControls{WebSearch: &proto.WebSearchControl{Mode: "disabled", ContextSize: "medium"}, TextVerbosity: "medium"}
 	before, _ := json.Marshal(request)
 	controlled, _, err := prepare(config, request)
 	if err != nil {
 		t.Fatal(err)
 	}
 	after, _ := json.Marshal(request)
+	if controlled.WebSearch != "disabled" || ordinary.WebSearch != "" {
+		t.Fatal("disabled web search did not reach the bridge")
+	}
+	controlled.WebSearch = ""
 	if !reflect.DeepEqual(ordinary, controlled) || string(before) != string(after) {
 		t.Fatal("default controls changed native input, instructions, continuation or caller options")
 	}
+	// Without a search control Claude Code keeps its native web tools.
+	request.ExecutionControls = &proto.ExecutionControls{TextVerbosity: "medium"}
+	absent, _, err := prepare(config, request)
+	if err != nil || !reflect.DeepEqual(ordinary, absent) {
+		t.Fatal("absent search control changed the native configuration", err)
+	}
+}
+
+func TestLiveWebSearchReachesTheBridgeOnEveryPlacement(t *testing.T) {
+	live := &proto.ExecutionControls{WebSearch: &proto.WebSearchControl{Mode: "live", ContextSize: "medium"}, TextVerbosity: "medium"}
+	root := t.TempDir()
+	t.Setenv("OAC_RUNTIME_HOME", root)
+	none, _, err := prepare(Config{Entrypoint: filepath.Join(root, "worker"), StateDir: filepath.Join(root, "state")}, proto.PromptRequestPayload{
+		RunID: "run", Input: proto.TextInput("Search."), ExecutionControls: live, AgentOptions: map[string]any{"model": "native-model"}})
+	if err != nil || none.WebSearch != "live" {
+		t.Fatal("live search on environment none did not reach the bridge", err)
+	}
+	request := workspaceRequest()
+	request.ExecutionControls = live
+	workspace, _, err := prepare(workspaceFixture(t), request)
+	if err != nil || workspace.WebSearch != "live" {
+		t.Fatal("live search on a workspace did not reach the bridge", err)
+	}
 }
 
 func TestExecutionControlsRejectUnsupportedProfilesBeforeLaunch(t *testing.T) {
+	enabled := true
 	cases := map[string]proto.ExecutionControls{
-		"empty": {}, "missing-search": {TextVerbosity: "medium"}, "missing-verbosity": {WebSearch: "disabled"},
-		"cached-search":     {WebSearch: "cached", TextVerbosity: "medium"},
-		"live-search":       {WebSearch: "live", TextVerbosity: "medium"},
-		"unknown-search":    {WebSearch: "invalid", TextVerbosity: "medium"},
-		"low-verbosity":     {WebSearch: "disabled", TextVerbosity: "low"},
-		"high-verbosity":    {WebSearch: "disabled", TextVerbosity: "high"},
-		"unknown-verbosity": {WebSearch: "disabled", TextVerbosity: "invalid"},
+		"cached-search":     {WebSearch: &proto.WebSearchControl{Mode: "cached", ContextSize: "medium"}},
+		"enabled-ptc":       {ProgrammaticToolCalling: &enabled},
+		"low-verbosity":     {TextVerbosity: "low"},
+		"high-verbosity":    {TextVerbosity: "high"},
+		"unknown-verbosity": {TextVerbosity: "invalid"},
+		"no-effort":         {ReasoningEffort: "none"},
+		"minimal-effort":    {ReasoningEffort: "minimal"},
+		"summary":           {ReasoningSummary: "concise"},
+		"service-tier":      {ServiceTier: "priority"},
 	}
 	for name, controls := range cases {
 		t.Run(name, func(t *testing.T) {
@@ -51,7 +81,7 @@ func TestExecutionControlsRejectUnsupportedProfilesBeforeLaunch(t *testing.T) {
 			config := Config{Node: "must-not-run", Entrypoint: filepath.Join(root, "worker"), StateDir: filepath.Join(root, "state")}
 			request := proto.PromptRequestPayload{RunID: "run", Input: proto.TextInput("Original input."), ExecutionControls: &controls, AgentOptions: map[string]any{"model": "native-model"}}
 			_, err := startSingleTurn(t.Context(), config, request, make(chan proto.Envelope, 1))
-			if err == nil || !strings.Contains(err.Error(), "execution controls require") {
+			if err == nil || !strings.Contains(err.Error(), "not supported by this Harness") {
 				t.Fatal("unsupported controls did not fail at admission", err)
 			}
 			if _, err := os.Stat(config.StateDir); !os.IsNotExist(err) {
@@ -61,6 +91,22 @@ func TestExecutionControlsRejectUnsupportedProfilesBeforeLaunch(t *testing.T) {
 	}
 }
 
+func TestReasoningEffortReachesNativeOptions(t *testing.T) {
+	root := t.TempDir()
+	t.Setenv("OAC_RUNTIME_HOME", root)
+	config := Config{Entrypoint: filepath.Join(root, "worker"), StateDir: filepath.Join(root, "state")}
+	for _, effort := range []string{"low", "medium", "high", "xhigh", "max"} {
+		request := proto.PromptRequestPayload{RunID: "run", Input: proto.TextInput("hello"), ExecutionControls: &proto.ExecutionControls{TextVerbosity: "medium", ReasoningEffort: effort}, AgentOptions: map[string]any{"model": "native-model", "harness_config": map[string]any{"thinking": map[string]any{"type": "adaptive"}}}}
+		start, _, err := prepare(config, request)
+		if err != nil {
+			t.Fatal(effort, err)
+		}
+		if start.NativeModelOptions == nil || start.NativeModelOptions.Effort != effort || start.NativeModelOptions.Thinking["type"] != "adaptive" {
+			t.Fatalf("effort %s: %+v", effort, start.NativeModelOptions)
+		}
+	}
+}
+
 func TestMCPWithoutEnvironmentNoneRejectedBeforeSetup(t *testing.T) {
 	root := t.TempDir()
 	t.Setenv("OAC_RUNTIME_HOME", root)
@@ -81,7 +127,7 @@ func TestStructuredOutputConfigurationReachesNativeUnchanged(t *testing.T) {
 	t.Setenv("OAC_RUNTIME_HOME", root)
 	config := Config{Entrypoint: filepath.Join(root, "worker"), StateDir: filepath.Join(root, "state")}
 	schema := json.RawMessage(`{"type":"object","properties":{"n":{"const":9007199254740992}}}`)
-	request := proto.PromptRequestPayload{RunID: "run", Input: proto.TextInput("Original input."), ObserveMessages: true, DisableSubagents: true, AgentOptions: map[string]any{"model": "model", "system_prompt": "Original instructions."}, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium", OutputFormat: &proto.OutputFormat{Type: "json_schema", Schema: schema}}}
+	request := proto.PromptRequestPayload{RunID: "run", Input: proto.TextInput("Original input."), DisableSubagents: true, AgentOptions: map[string]any{"model": "model", "system_prompt": "Original instructions."}, ExecutionControls: &proto.ExecutionControls{TextVerbosity: "medium", OutputFormat: &proto.OutputFormat{Type: "json_schema", Schema: schema}}}
 	start, _, err := prepare(config, request)
 	if err != nil {
 		t.Fatal(err)
@@ -94,13 +140,14 @@ func TestStructuredOutputConfigurationReachesNativeUnchanged(t *testing.T) {
 		t.Fatal("lossy schema accepted")
 	}
 	request.ExecutionControls.OutputFormat.Schema = schema
-	request.DisableSubagents = false
-	if _, _, err := prepare(config, request); err == nil {
-		t.Fatal("unqualified subagent combination accepted")
+	request.DisableExecutionEnvironment = true
+	request.MCPHTTPServers = &[]proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "fixture", ServerURL: "https://example.invalid/mcp"}}
+	if start, _, err := prepare(config, request); err != nil || start.OutputFormat == nil {
+		t.Fatal("native structured output was narrowed by MCP", err)
 	}
 }
 
-func TestToolDiscoveryPreservesFrozenFunctionsAndRejectsOtherProfiles(t *testing.T) {
+func TestToolDiscoveryPreservesFrozenFunctionsBesideOtherProfiles(t *testing.T) {
 	root := t.TempDir()
 	t.Setenv("OAC_RUNTIME_HOME", root)
 	config := Config{Entrypoint: filepath.Join(root, "worker"), StateDir: filepath.Join(root, "state")}
@@ -112,13 +159,27 @@ func TestToolDiscoveryPreservesFrozenFunctionsAndRejectsOtherProfiles(t *testing
 	if err != nil || !start.ToolSearch || !reflect.DeepEqual(start.Functions, request.FunctionTools) {
 		t.Fatal("function discovery changed native definitions", err)
 	}
-	request.DisableSubagents = false
-	if _, _, err := prepare(config, request); err == nil {
-		t.Fatal("unqualified combination admitted")
+	request.ExecutionControls = &proto.ExecutionControls{TextVerbosity: "medium", OutputFormat: &proto.OutputFormat{Type: "json_schema", Schema: json.RawMessage(`{"type":"object"}`)}}
+	if start, _, err := prepare(config, request); err != nil || !start.ToolSearch || start.OutputFormat == nil {
+		t.Fatal("native tool search was narrowed by structured output", err)
 	}
-	request.DisableSubagents = true
+	request.ExecutionControls = nil
 	request.ToolSearch = false
 	if _, _, err := prepare(config, request); err == nil {
 		t.Fatal("deferred definitions became eager")
 	}
 }
+
+func TestReasoningSummaryReachesTheBridgeOnlyWhenRequested(t *testing.T) {
+	root := t.TempDir()
+	t.Setenv("OAC_RUNTIME_HOME", root)
+	config := Config{Entrypoint: filepath.Join(root, "worker"), StateDir: filepath.Join(root, "state")}
+	request := proto.PromptRequestPayload{RunID: "run", Input: proto.TextInput("Input."), AgentOptions: map[string]any{"model": "native-model"}}
+	for _, summary := range []string{"", "auto"} {
+		request.ExecutionControls = &proto.ExecutionControls{TextVerbosity: "medium", ReasoningSummary: summary}
+		start, _, err := prepare(config, request)
+		if err != nil || start.ReasoningSummary != (summary != "") {
+			t.Fatalf("summary %q: reasoning flag %v, err %v", summary, start.ReasoningSummary, err)
+		}
+	}
+}
diff --git a/apps/daemon/internal/agent/claudesdk/executor_confirmation_test.go b/apps/daemon/internal/agent/claudesdk/executor_confirmation_test.go
index bba0b7099..1079eb29c 100644
--- a/apps/daemon/internal/agent/claudesdk/executor_confirmation_test.go
+++ b/apps/daemon/internal/agent/claudesdk/executor_confirmation_test.go
@@ -38,7 +38,7 @@ func TestExecutorNativeConfirmationSurvivesCleanup(t *testing.T) {
 			if mode == "pending_input" {
 				inputReceipt = make(chan error, 1)
 				go func() {
-					inputReceipt <- turn.(*session).SteerWithReceipt(t.Context(), proto.PromptSteerPayload{InputID: "input", Input: proto.TextInput("extra")}, nil)
+					inputReceipt <- turn.(*session).SteerWithReceipt(t.Context(), proto.PromptSteerPayload{InputID: "input", Input: proto.TextInput("extra")}, func() {})
 				}()
 				if event := <-out; event.Type != proto.TypeDelta {
 					t.Fatal("input write barrier missing")
diff --git a/apps/daemon/internal/agent/claudesdk/executor_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/executor_live_linux_test.go
index 669f2dce1..16059494d 100644
--- a/apps/daemon/internal/agent/claudesdk/executor_live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/executor_live_linux_test.go
@@ -80,7 +80,7 @@ func TestLiveClaudeExecutorReuseAndCancel(t *testing.T) {
 		_ = os.WriteFile(filepath.Join(proof, "executor-evidence.json"), raw, 0600)
 	}
 	defer persist()
-	request := proto.PromptRequestPayload{DisableExecutionEnvironment: true, DisableSubagents: true, ObserveMessages: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": model, "system_prompt": "Follow requested formats briefly. Remember the exact verification marker across the conversation. Use no tools."}}
+	request := proto.PromptRequestPayload{DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": model, "system_prompt": "Follow requested formats briefly. Remember the exact verification marker across the conversation. Use no tools."}}
 	factory := NewExecutorFactory(config)
 	prepared := time.Now()
 	owner, err := factory(ctx, request)
diff --git a/apps/daemon/internal/agent/claudesdk/executor_test.go b/apps/daemon/internal/agent/claudesdk/executor_test.go
index 7dab4ca5c..05fdb543e 100644
--- a/apps/daemon/internal/agent/claudesdk/executor_test.go
+++ b/apps/daemon/internal/agent/claudesdk/executor_test.go
@@ -95,12 +95,12 @@ func runPersistentExecutorHelper() {
 			}
 			active = command.TurnID
 			if os.Getenv("SDK_EXECUTOR_MODE") == "late" && old != "" {
-				encode(bridgeEvent{Type: "delta", TurnID: old, Delta: "late"})
+				encode(bridgeEvent{Type: "delta", TurnID: old, ItemID: "item", Delta: "late"})
 				continue
 			}
 			encode(bridgeEvent{Type: "turn_started", TurnID: active})
 			encode(bridgeEvent{Type: "input_ready", TurnID: active, SessionID: "native-persistent"})
-			encode(bridgeEvent{Type: "delta", TurnID: active, Delta: "partial"})
+			encode(bridgeEvent{Type: "delta", TurnID: active, ItemID: "item", Delta: "partial"})
 			if strings.HasPrefix(os.Getenv("SDK_EXECUTOR_MODE"), "pending_function") {
 				encode(bridgeEvent{Type: "function_call", TurnID: active, Call: &proto.FunctionCallPayload{CallID: "call", Name: "lookup", Arguments: json.RawMessage("{}")}})
 			}
@@ -114,7 +114,7 @@ func runPersistentExecutorHelper() {
 				continue
 			}
 			// A full bridge write has happened, but no native input receipt exists.
-			encode(bridgeEvent{Type: "delta", TurnID: active, Delta: "steer-written"})
+			encode(bridgeEvent{Type: "delta", TurnID: active, ItemID: "item", Delta: "steer-written"})
 		case "turn_cancel":
 			if active == command.TurnID {
 				settle(true)
diff --git a/apps/daemon/internal/agent/claudesdk/executor_turn.go b/apps/daemon/internal/agent/claudesdk/executor_turn.go
index 97c6638cf..418de6b14 100644
--- a/apps/daemon/internal/agent/claudesdk/executor_turn.go
+++ b/apps/daemon/internal/agent/claudesdk/executor_turn.go
@@ -57,6 +57,7 @@ func (s *session) runTurn(start startRequest, out chan<- proto.Envelope) {
 	terminal := false
 	mcp := mcpState{calls: map[string]proto.ToolObservation{}}
 	commands := commandState{calls: map[string]proto.ToolObservation{}}
+	searches := searchState{calls: map[string]proto.ToolObservation{}}
 	settlementReceived := false
 	settlementConfirmed := false
 	cancelled := false
@@ -92,13 +93,18 @@ func (s *session) runTurn(start startRequest, out chan<- proto.Envelope) {
 				failure = err
 				s.invalidate()
 			}
+		case "search_observation":
+			if err := searches.receive(event, start, s.inputSessionID(), emit); err != nil {
+				failure = err
+				s.invalidate()
+			}
 		case "mcp_observation":
 			if err := mcp.receive(event, start, emit); err != nil {
 				failure = err
 				s.invalidate()
 			}
 		case "delta":
-			if start.ObserveMessages && event.ItemID == "" || !start.ObserveMessages && event.ItemID != "" {
+			if event.ItemID == "" {
 				failure = fmt.Errorf("claudesdk: invalid message delta identity")
 				s.invalidate()
 				break
@@ -108,7 +114,7 @@ func (s *session) runTurn(start startRequest, out chan<- proto.Envelope) {
 			emit(proto.TypeDelta, proto.DeltaPayload{ItemID: event.ItemID, Delta: event.Delta, Sequence: sequence})
 		case "output_message":
 			message := event.Message
-			if !start.ObserveMessages || message == nil || message.ID == "" ||
+			if message == nil || message.ID == "" ||
 				(message.Status != "in_progress" && message.Status != "completed") ||
 				(message.Status == "completed") != (message.Text != nil) {
 				failure = fmt.Errorf("claudesdk: invalid message observation")
@@ -116,7 +122,15 @@ func (s *session) runTurn(start startRequest, out chan<- proto.Envelope) {
 				break
 			}
 			emit(proto.TypeOutputMessage, message)
-		case "function_call", "function_applied":
+		case "reasoning":
+			reasoning := event.Reasoning
+			if !start.ReasoningSummary || reasoning == nil || !reasoning.Valid() {
+				failure = fmt.Errorf("claudesdk: invalid reasoning observation")
+				s.invalidate()
+				break
+			}
+			emit(proto.TypeReasoning, reasoning)
+		case "function_call", "function_withdrawn", "function_applied":
 			if err := s.receiveFunction(event, start, emit); err != nil {
 				failure = err
 				s.invalidate()
@@ -159,7 +173,7 @@ func (s *session) runTurn(start startRequest, out chan<- proto.Envelope) {
 			}
 			emit(proto.TypeUsage, proto.UsagePayload{Usage: usage})
 		case "result":
-			if !s.matchesInputSession(event.SessionID) || event.SessionID == "" || start.Resume != "" && event.SessionID != start.Resume || usageSession != "" && event.SessionID != usageSession || !s.functionsComplete(false) || !s.steeringComplete() || !mcp.complete() || !commands.complete() {
+			if !s.matchesInputSession(event.SessionID) || event.SessionID == "" || start.Resume != "" && event.SessionID != start.Resume || usageSession != "" && event.SessionID != usageSession || !s.functionsComplete(false) || !s.steeringComplete() || !mcp.complete() || !commands.complete() || !searches.complete() {
 				failure = fmt.Errorf("claudesdk: invalid native completion or unconfirmed input/result")
 				s.settlementErr = failure
 				s.invalidate()
@@ -194,11 +208,12 @@ func (s *session) runTurn(start startRequest, out chan<- proto.Envelope) {
 	}
 	// Close result admission before deciding which unanswered calls cancellation settled.
 	s.stopFunctions()
-	if !s.functionsComplete(cancelled && settlementConfirmed) || !s.steeringComplete() || !mcp.complete() || !commands.complete() {
+	if !s.functionsComplete(cancelled && settlementConfirmed) || !s.steeringComplete() || !mcp.complete() || !commands.complete() || !searches.complete() {
 		settlementConfirmed, reusable, reason = false, false, "unsettled_native_operations"
 	}
 	mcp.close(emit)
 	commands.close(emit)
+	searches.close(emit)
 	s.stopSteering()
 	metadata := map[string]any{proto.DoneMetaAgentSessionType: "claude_session"}
 	if id := s.inputSessionID(); id != "" {
@@ -223,7 +238,6 @@ func (s *session) runTurn(start startRequest, out chan<- proto.Envelope) {
 	}
 	close(s.settled)
 	if failure != nil {
-		// A valid Turn boundary replaces the former process-exit boundary.
 		// A native diagnostic does not itself confirm cancellation or reuse.
 		if failure != classifiedFailure || !settlementReceived {
 			engineCode = ""
diff --git a/apps/daemon/internal/agent/claudesdk/functions.go b/apps/daemon/internal/agent/claudesdk/functions.go
index 752d1347f..6aef261f1 100644
--- a/apps/daemon/internal/agent/claudesdk/functions.go
+++ b/apps/daemon/internal/agent/claudesdk/functions.go
@@ -41,8 +41,11 @@ func validateFunctions(tools []proto.FunctionTool) error {
 
 func (s *session) receiveFunction(event bridgeEvent, start startRequest, emit func(string, any)) error {
 	var call *proto.FunctionCallPayload
+	var withdrawn *proto.FunctionCallWithdrawnPayload
 	var observation *proto.ToolObservation
 	var receipt chan error
+	// A Subagent's call is Core's to resolve through the child; the root's tool observation does not describe it.
+	child := false
 	err := func() error {
 		s.functions.mu.Lock()
 		defer s.functions.mu.Unlock()
@@ -61,16 +64,31 @@ func (s *session) receiveFunction(event bridgeEvent, start startRequest, emit fu
 					}
 				}
 			}
-			if !declared || call.CallID == "" || !json.Valid(call.Arguments) || s.functions.calls[call.CallID] != nil {
+			child = call != nil && call.NativeID != ""
+			if !declared || call.CallID == "" || !json.Valid(call.Arguments) || s.functions.calls[call.CallID] != nil ||
+				(call.NativeID == "") != (call.TurnID == "") || child && start.Subagents == nil {
 				return fmt.Errorf("claudesdk: invalid function call")
 			}
 			s.functions.calls[call.CallID] = &pendingFunction{call: *call, receipt: make(chan error, 1)}
 			observation = &proto.ToolObservation{Kind: "function", Status: "in_progress", Name: call.Name, Arguments: call.Arguments}
+		case "function_withdrawn":
+			withdrawn = event.Withdrawn
+			var pending *pendingFunction
+			if withdrawn != nil {
+				pending = s.functions.calls[withdrawn.CallID]
+			}
+			if pending == nil || pending.applied || pending.call.NativeID == "" || pending.call.NativeID != withdrawn.NativeID || pending.call.TurnID != withdrawn.TurnID {
+				return fmt.Errorf("claudesdk: invalid function withdrawal")
+			}
+			// Native stopped waiting for the child's call, so a result in flight is never applied.
+			delete(s.functions.calls, withdrawn.CallID)
+			pending.receipt <- agent.ErrUnknownFunctionCall
 		case "function_applied":
 			pending := s.functions.calls[event.CallID]
 			if pending == nil || pending.result == nil || pending.applied || pending.result.DeliveryID != event.DeliveryID {
 				return fmt.Errorf("claudesdk: invalid native function receipt")
 			}
+			child = pending.call.NativeID != ""
 			pending.applied = true
 			receipt = pending.receipt
 			status := "completed"
@@ -84,11 +102,17 @@ func (s *session) receiveFunction(event bridgeEvent, start startRequest, emit fu
 	if err != nil {
 		return err
 	}
+	if withdrawn != nil {
+		emit(proto.TypeFunctionCallWithdrawn, withdrawn)
+		return nil
+	}
 	id, stage := event.CallID, "after"
 	if call != nil {
 		id, stage = call.CallID, "before"
 	}
-	emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: observation.Name, Stage: stage, Observation: observation})
+	if !child {
+		emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: observation.Name, Stage: stage, Observation: observation})
+	}
 	if call != nil {
 		emit(proto.TypeFunctionCall, call)
 	} else {
@@ -104,14 +128,6 @@ func (s *session) SubmitFunctionResult(ctx context.Context, result proto.Functio
 	if err := result.ValidateContent(); err != nil {
 		return err
 	}
-	for _, part := range result.Content {
-		if part.Type == "input_image" && !result.Success {
-			return fmt.Errorf("claudesdk: native error results cannot retain images")
-		}
-	}
-	if err := (proto.MessageInput{{Content: result.Content}}).ValidateInlineImages(); err != nil {
-		return err
-	}
 	data, err := json.Marshal(struct {
 		Type   string `json:"type"`
 		TurnID string `json:"turn_id"`
diff --git a/apps/daemon/internal/agent/claudesdk/functions_test.go b/apps/daemon/internal/agent/claudesdk/functions_test.go
index d9c358b83..5f99ec7bb 100644
--- a/apps/daemon/internal/agent/claudesdk/functions_test.go
+++ b/apps/daemon/internal/agent/claudesdk/functions_test.go
@@ -51,11 +51,6 @@ func TestFunctionFactoryNativeReceipts(t *testing.T) {
 					if err := submitter.SubmitFunctionResult(ctx, invalid); err == nil {
 						t.Fatal("missing content consumed call")
 					}
-					image := "https://example.invalid/image"
-					invalid.Content = []proto.InputContent{{Type: "input_image", ImageURL: &image}}
-					if err := submitter.SubmitFunctionResult(ctx, invalid); err == nil {
-						t.Fatal("image should fail before delivery")
-					}
 					first, second := "first-"+call.CallID, "second-"+call.CallID
 					value := proto.FunctionResultPayload{DeliveryID: "delivery-" + call.CallID, CallID: call.CallID, Success: call.CallID == "b", Content: []proto.InputContent{{Type: "input_text", Text: &first}, {Type: "input_text", Text: &second}}}
 					go func() { submissions <- submitter.SubmitFunctionResult(ctx, value) }()
@@ -126,7 +121,7 @@ func runFunctionHelper(request startRequest, mode string, scanner *bufio.Scanner
 		results[value.CallID] = value
 	}
 	if mode == "functions-cancel" {
-		emit(bridgeEvent{Type: "delta", Delta: "waiting for confirmation"})
+		emit(bridgeEvent{Type: "delta", ItemID: "item", Delta: "waiting for confirmation"})
 		if scanner.Scan() {
 			emit(bridgeEvent{Type: "error", Code: "cancelled"})
 		}
@@ -144,3 +139,26 @@ func runFunctionHelper(request startRequest, mode string, scanner *bufio.Scanner
 	}
 	emit(bridgeEvent{Type: "result", SessionID: request.Resume, Text: "done"})
 }
+
+func TestSubagentFunctionCallWithdrawal(t *testing.T) {
+	s := &session{functions: functionState{calls: map[string]*pendingFunction{}}}
+	start := startRequest{Functions: []proto.FunctionTool{{Name: "lookup"}}, Subagents: &subagentOptions{}}
+	var emitted []string
+	emit := func(kind string, _ any) { emitted = append(emitted, kind) }
+	call := &proto.FunctionCallPayload{CallID: "a", Name: "lookup", Arguments: json.RawMessage(`{}`), NativeID: "child", TurnID: "child-turn"}
+	if err := s.receiveFunction(bridgeEvent{Type: "function_call", Call: call}, start, emit); err != nil {
+		t.Fatal(err)
+	}
+	receipt := s.functions.calls["a"].receipt
+	withdrawn := &proto.FunctionCallWithdrawnPayload{CallID: "a", NativeID: "child", TurnID: "child-turn"}
+	if err := s.receiveFunction(bridgeEvent{Type: "function_withdrawn", Withdrawn: withdrawn}, start, emit); err != nil {
+		t.Fatal(err)
+	}
+	// A child's call has no root tool observation, and a result in flight learns that it was never applied.
+	if strings.Join(emitted, ",") != proto.TypeFunctionCall+","+proto.TypeFunctionCallWithdrawn || <-receipt != agent.ErrUnknownFunctionCall {
+		t.Fatal(emitted)
+	}
+	if s.receiveFunction(bridgeEvent{Type: "function_withdrawn", Withdrawn: withdrawn}, start, emit) == nil {
+		t.Fatal("repeated withdrawal accepted")
+	}
+}
diff --git a/apps/daemon/internal/agent/claudesdk/harness_config_test.go b/apps/daemon/internal/agent/claudesdk/harness_config_test.go
index cf5dbd5a0..ae4dc36e1 100644
--- a/apps/daemon/internal/agent/claudesdk/harness_config_test.go
+++ b/apps/daemon/internal/agent/claudesdk/harness_config_test.go
@@ -12,8 +12,8 @@ func TestHarnessConfigReachesBridgeAndOwnsSnapshot(t *testing.T) {
 	root := t.TempDir()
 	t.Setenv("OAC_RUNTIME_HOME", root)
 	config := Config{Entrypoint: filepath.Join(root, "main.js"), StateDir: filepath.Join(root, "state")}
-	native := map[string]any{"effort": "high", "thinking": map[string]any{"type": "enabled", "budgetTokens": 1024}}
-	req := proto.PromptRequestPayload{AgentOptions: map[string]any{"model": "fixture", "harness_config": native}}
+	native := map[string]any{"thinking": map[string]any{"type": "enabled", "budgetTokens": 1024}}
+	req := proto.PromptRequestPayload{AgentOptions: map[string]any{"model": "fixture", "harness_config": native}, ExecutionControls: &proto.ExecutionControls{TextVerbosity: "medium", ReasoningEffort: "high"}}
 	start, _, err := prepareConfiguration(config, req)
 	if err != nil {
 		t.Fatal(err)
diff --git a/apps/daemon/internal/agent/claudesdk/live_linux_test.go b/apps/daemon/internal/agent/claudesdk/live_linux_test.go
index 1f534d1a4..c3da9e8ef 100644
--- a/apps/daemon/internal/agent/claudesdk/live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/live_linux_test.go
@@ -137,7 +137,7 @@ func TestLiveClaudeSDKTextResume(t *testing.T) {
 		requestStart := len(requests)
 		mu.Unlock()
 		out := make(chan proto.Envelope, 64)
-		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": "Answer briefly and preserve the exact verification value in the conversation. Use no tools."}}
+		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": "Answer briefly and preserve the exact verification value in the conversation. Use no tools."}}
 		if success != nil {
 			request.AgentOptions["system_prompt"] = "Call lookup exactly once as requested, then report both result parts and any prior verification value. Never retry a failed tool."
 			request.FunctionTools = []proto.FunctionTool{{Name: "lookup", Description: "Return a synthetic verification value.", Parameters: json.RawMessage(`{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}`)}}
diff --git a/apps/daemon/internal/agent/claudesdk/local.go b/apps/daemon/internal/agent/claudesdk/local.go
index d8bf94c47..d6a465cda 100644
--- a/apps/daemon/internal/agent/claudesdk/local.go
+++ b/apps/daemon/internal/agent/claudesdk/local.go
@@ -5,25 +5,20 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
 )
 
 // ConfigureLocal selects the qualified, dedicated Runtime layout. The shared
 // localworkspace binding still authorizes every request against its Session.
-func ConfigureLocal(config Config, stateRoot, root, workspace string, network agentnetwork.Policy) (Config, error) {
+func ConfigureLocal(config Config, stateRoot, root, workspace string) (Config, error) {
 	if !filepath.IsAbs(stateRoot) || filepath.Clean(stateRoot) != stateRoot {
 		return Config{}, fmt.Errorf("claudesdk: state root must be a clean absolute directory")
 	}
 	config.StateDir = filepath.Join(stateRoot, "runtime", "claude-sdk", "history")
 	config.Workspace = &WorkspaceConfig{
-		Directory: workspace, PublicDirectory: workspace, NetworkAccess: network.Access, AllowedDomains: network.Hosts(),
+		Directory:  workspace,
 		HomeDir:    filepath.Join(root, "runtime", "claude-sdk", "home"),
 		ScratchDir: filepath.Join(root, "runtime", "claude-sdk", "scratch"),
 	}
-	if network.Validate() != nil {
-		return Config{}, fmt.Errorf("claudesdk: dedicated Runtime requires an explicit network policy")
-	}
 	for _, dir := range []string{config.StateDir, config.Workspace.HomeDir, config.Workspace.ScratchDir} {
 		if err := os.MkdirAll(dir, 0700); err != nil {
 			return Config{}, err
diff --git a/apps/daemon/internal/agent/claudesdk/local_test.go b/apps/daemon/internal/agent/claudesdk/local_test.go
index 797562ebc..951fa0ae8 100644
--- a/apps/daemon/internal/agent/claudesdk/local_test.go
+++ b/apps/daemon/internal/agent/claudesdk/local_test.go
@@ -2,69 +2,30 @@ package claudesdk
 
 import (
 	"encoding/json"
-	"os"
 	"path/filepath"
 	"slices"
 	"strings"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
 )
 
-func TestLocalWorkspaceBindingNetworkAndRequiredHistory(t *testing.T) {
+func TestLocalWorkspaceBindingAndRequiredHistory(t *testing.T) {
 	config := workspaceFixture(t)
-	config.Workspace.PublicDirectory = config.Workspace.Directory
-	config.Workspace.NetworkAccess = "enabled"
 	req := workspaceRequest()
-	req.LocalEnvironment = &proto.LocalEnvironment{ID: "environment", NetworkAccess: "enabled", WorkspaceRoot: config.Workspace.Directory}
+	req.LocalEnvironment = &proto.LocalEnvironment{ID: "environment", WorkspaceRoot: config.Workspace.Directory}
 	req.RequireExistingNativeSession = true
 	start, _, err := prepare(config, req)
-	if err != nil || !start.RequireHistory || start.Workspace.NetworkAccess != "enabled" {
+	if err != nil || !start.RequireHistory {
 		t.Fatal(start, err)
 	}
-	req.LocalEnvironment.NetworkAccess = "disabled"
-	if _, _, err := prepare(config, req); err == nil {
-		t.Fatal("accepted different Runtime network policy")
-	}
-	req.LocalEnvironment.NetworkAccess = "enabled"
-	config.Workspace.PublicDirectory = config.Workspace.HomeDir
-	if _, _, err := prepare(config, req); err == nil {
-		t.Fatal("accepted a different public workspace")
-	}
-	alias := filepath.Join(filepath.Dir(config.Workspace.Directory), "alias")
-	if err := os.Symlink(config.Workspace.Directory, alias); err != nil {
-		t.Fatal(err)
-	}
-	config.Workspace.PublicDirectory = alias
-	if _, _, err := prepare(config, req); err != nil {
-		t.Fatal("same workspace alias rejected", err)
-	}
-
-}
-
-func TestRestrictedWorkspacePolicyUsesExactBoundAuthority(t *testing.T) {
-	config := workspaceFixture(t)
-	config.Workspace.NetworkAccess = "restricted"
-	config.Workspace.AllowedDomains = []string{"Example.com", "api.example.com", "example.com"}
-	req := workspaceRequest()
-	req.LocalEnvironment = &proto.LocalEnvironment{ID: "environment", NetworkAccess: "restricted", AllowedDomains: []string{"api.example.com", "EXAMPLE.COM"}, WorkspaceRoot: config.Workspace.Directory}
-	if _, _, err := prepare(config, req); err == nil {
-		t.Fatal("Runtime must not promise inner network isolation")
-	}
-	for _, domains := range [][]string{{"example.com"}, {"example.org"}, nil} {
-		req.LocalEnvironment.AllowedDomains = domains
-		if _, _, err := prepare(config, req); err == nil {
-			t.Fatal("different policy entered bound Runtime", domains)
-		}
-	}
 }
 
 func TestWorkspaceProviderCredentialsReplaceAmbientSelection(t *testing.T) {
 	config := workspaceFixture(t)
 	original := slices.Clone(config.Env)
 	req := workspaceRequest()
-	req.AgentOptions["model_provider"] = map[string]any{"protocol": "anthropic", "base_url": "https://provider.example/anthropic", "api_key": "selected-secret"}
+	req.AgentOptions["model_provider"] = map[string]any{"protocol": "anthropic", "base_url": "https://provider.example/anthropic", "api_key": "selected-secret", "context_window": 64000, "max_output_tokens": 4096}
 	start, env, err := prepare(config, req)
 	if err != nil {
 		t.Fatal(err)
@@ -76,6 +37,9 @@ func TestWorkspaceProviderCredentialsReplaceAmbientSelection(t *testing.T) {
 	if !slices.Contains(env, "ANTHROPIC_AUTH_TOKEN=selected-secret") || slices.Contains(env, "ANTHROPIC_AUTH_TOKEN=selected-provider-fixture") {
 		t.Fatal("provider selection was not exclusive")
 	}
+	if !slices.Contains(env, "CLAUDE_CODE_MAX_CONTEXT_TOKENS=64000") || !slices.Contains(env, "CLAUDE_CODE_MAX_OUTPUT_TOKENS=4096") {
+		t.Fatal("token limits were not native")
+	}
 	for _, value := range []any{nil, "secret", map[string]any{"protocol": "anthropic", "base_url": "http://provider.example", "api_key": "secret"}, map[string]any{"protocol": "anthropic", "base_url": "https://user:pass@provider.example", "api_key": "secret"}} {
 		req.AgentOptions["model_provider"] = value
 		if _, _, err := prepare(config, req); err == nil || strings.Contains(err.Error(), "secret") {
@@ -87,11 +51,11 @@ func TestWorkspaceProviderCredentialsReplaceAmbientSelection(t *testing.T) {
 func TestLocalHistorySurvivesChangingInstanceRoot(t *testing.T) {
 	config := workspaceFixture(t)
 	retained, instance := t.TempDir(), t.TempDir()
-	first, err := ConfigureLocal(config, retained, instance, config.Workspace.Directory, agentnetwork.Policy{Access: "enabled"})
+	first, err := ConfigureLocal(config, retained, instance, config.Workspace.Directory)
 	if err != nil {
 		t.Fatal(err)
 	}
-	second, err := ConfigureLocal(config, retained, t.TempDir(), config.Workspace.Directory, agentnetwork.Policy{Access: "enabled"})
+	second, err := ConfigureLocal(config, retained, t.TempDir(), config.Workspace.Directory)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -101,7 +65,7 @@ func TestLocalHistorySurvivesChangingInstanceRoot(t *testing.T) {
 	if first.Workspace.HomeDir == second.Workspace.HomeDir || first.Workspace.ScratchDir == second.Workspace.ScratchDir {
 		t.Fatal("instance HOME or scratch retained across compute")
 	}
-	if _, err := ConfigureLocal(config, "relative", instance, config.Workspace.Directory, agentnetwork.Policy{Access: "enabled"}); err == nil {
+	if _, err := ConfigureLocal(config, "relative", instance, config.Workspace.Directory); err == nil {
 		t.Fatal("invalid state root accepted")
 	}
 }
diff --git a/apps/daemon/internal/agent/claudesdk/mcp.go b/apps/daemon/internal/agent/claudesdk/mcp.go
index b193136d7..c71b83b24 100644
--- a/apps/daemon/internal/agent/claudesdk/mcp.go
+++ b/apps/daemon/internal/agent/claudesdk/mcp.go
@@ -12,10 +12,10 @@ import (
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	declaration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/claudesdk"
 )
 
 var mcpLabel = regexp.MustCompile(`^[a-zA-Z0-9_-]+$`)
-var mcpTool = regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`)
 
 func validateMCP(req proto.PromptRequestPayload) error {
 	if req.MCPHTTPServers == nil {
@@ -31,35 +31,39 @@ func validateMCP(req proto.PromptRequestPayload) error {
 func validateMCPServers(servers []proto.MCPHTTPServer) error {
 	labels := map[string]bool{}
 	for _, server := range servers {
+		if server.Stdio != nil {
+			if !mcpLabel.MatchString(server.ServerLabel) || server.ServerLabel == "functions" || labels[server.ServerLabel] {
+				return fmt.Errorf("claudesdk: unsupported MCP stdio declaration")
+			}
+			labels[server.ServerLabel] = true
+			continue
+		}
 		endpoint, err := url.Parse(server.ServerURL)
 		if !mcpLabel.MatchString(server.ServerLabel) || server.ServerLabel == "functions" || labels[server.ServerLabel] ||
 			err != nil || (endpoint.Scheme != "http" && endpoint.Scheme != "https") || endpoint.Hostname() == "" || endpoint.User != nil ||
-			strings.ContainsAny(server.ServerURL, "?#") || endpoint.Opaque != "" {
+			strings.Contains(server.ServerURL, "#") || endpoint.Opaque != "" {
 			return fmt.Errorf("claudesdk: unsupported HTTP MCP declaration")
 		}
 		if server.BearerToken != nil && (endpoint.Scheme != "https" || !agent.ValidMCPHTTPBearerToken(*server.BearerToken)) {
 			return fmt.Errorf("claudesdk: unsupported HTTPS MCP bearer credential")
 		}
-		labels[server.ServerLabel] = true
-		if server.AllowedTools != nil {
-			for _, name := range *server.AllowedTools {
-				if !mcpTool.MatchString(name) {
-					return fmt.Errorf("claudesdk: unsupported MCP tool allowlist")
-				}
-			}
+		if declaration.ExpandsEnvironment(server) {
+			return fmt.Errorf("claudesdk: MCP URLs and header values cannot contain ${")
 		}
+		labels[server.ServerLabel] = true
 	}
 	return nil
 }
 
-// Only generated references cross the private bridge; secrets stay in the owned
-// process environment and are expanded by the native HTTP client.
+// Bearer tokens cross the private bridge only as generated references; they stay
+// in the owned process environment and are expanded by the native HTTP client.
 type mcpHTTPServer struct {
-	ServerLabel       string    `json:"server_label"`
-	ServerURL         string    `json:"server_url,omitempty"`
-	AllowedTools      *[]string `json:"allowed_tools"`
-	Required          bool      `json:"required,omitempty"`
-	BearerTokenEnvVar string    `json:"bearer_token_env_var,omitempty"`
+	ServerLabel       string            `json:"server_label"`
+	ServerURL         string            `json:"server_url,omitempty"`
+	AllowedTools      *[]string         `json:"allowed_tools"`
+	Required          bool              `json:"required,omitempty"`
+	BearerTokenEnvVar string            `json:"bearer_token_env_var,omitempty"`
+	Headers           map[string]string `json:"headers,omitempty"`
 }
 
 func prepareMCPHTTP(declarations *[]proto.MCPHTTPServer) (*[]mcpHTTPServer, []string) {
@@ -69,7 +73,7 @@ func prepareMCPHTTP(declarations *[]proto.MCPHTTPServer) (*[]mcpHTTPServer, []st
 	servers := make([]mcpHTTPServer, len(*declarations))
 	var env []string
 	for i, declaration := range *declarations {
-		server := mcpHTTPServer{ServerLabel: declaration.ServerLabel, ServerURL: declaration.ServerURL, Required: declaration.Required}
+		server := mcpHTTPServer{ServerLabel: declaration.ServerLabel, ServerURL: declaration.ServerURL, Required: declaration.Required, Headers: declaration.Headers}
 		if declaration.AllowedTools != nil {
 			tools := append([]string{}, (*declaration.AllowedTools)...)
 			server.AllowedTools = &tools
diff --git a/apps/daemon/internal/agent/claudesdk/mcp_bearer_test.go b/apps/daemon/internal/agent/claudesdk/mcp_bearer_test.go
index 21997b158..69a52785b 100644
--- a/apps/daemon/internal/agent/claudesdk/mcp_bearer_test.go
+++ b/apps/daemon/internal/agent/claudesdk/mcp_bearer_test.go
@@ -75,7 +75,7 @@ func TestMCPBearerRejectsInvalidCredentialBeforeStateCreation(t *testing.T) {
 			t.Fatal("invalid credential wrote execution state", err)
 		}
 	}
-	for _, url := range []string{"http://example.invalid/mcp", "https://example.invalid/mcp#", "https://example.invalid/mcp?", "https://user:secret@example.invalid/mcp"} {
+	for _, url := range []string{"http://example.invalid/mcp", "https://example.invalid/mcp#", "https://user:secret@example.invalid/mcp"} {
 		token := "synthetic-token"
 		servers := []proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "fixture", ServerURL: url, BearerToken: &token}}
 		if err := validateMCP(proto.PromptRequestPayload{DisableExecutionEnvironment: true, MCPHTTPServers: &servers}); err == nil {
diff --git a/apps/daemon/internal/agent/claudesdk/mcp_environment.go b/apps/daemon/internal/agent/claudesdk/mcp_environment.go
index 5c9e1db31..06562bb78 100644
--- a/apps/daemon/internal/agent/claudesdk/mcp_environment.go
+++ b/apps/daemon/internal/agent/claudesdk/mcp_environment.go
@@ -2,6 +2,7 @@ package claudesdk
 
 import (
 	"fmt"
+	"path/filepath"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/localworkspace"
@@ -12,8 +13,11 @@ import (
 // transport projection crosses this private bridge, never package configuration.
 type environmentMCPServer struct {
 	mcpHTTPServer
-	Command string   `json:"command,omitempty"`
-	Args    []string `json:"args,omitempty"`
+	Command string `json:"command,omitempty"`
+	// A pointer keeps an empty stdio argument list, which the bridge requires.
+	Args *[]string `json:"args,omitempty"`
+	// Declared marks a public stdio server: its command is the caller's, not the installed launcher.
+	Declared bool `json:"declared,omitempty"`
 }
 
 func prepareRuntimeMCP(req proto.PromptRequestPayload) ([]environmentMCPServer, []string, error) {
@@ -27,17 +31,22 @@ func prepareRuntimeMCP(req proto.PromptRequestPayload) ([]environmentMCPServer,
 		if !mcpLabel.MatchString(binding.ServerLabel) || binding.ServerLabel == "functions" {
 			return nil, nil, fmt.Errorf("claudesdk: unsupported MCP identity")
 		}
+		if process := binding.Process; process != nil {
+			// Native starts stdio servers in its workspace, which the declared
+			// directory names directly or through the hosted /workspace alias.
+			if req.LocalEnvironment == nil || filepath.Clean(process.Cwd) != req.LocalEnvironment.WorkspaceDirectory {
+				return nil, nil, fmt.Errorf("claudesdk: MCP stdio cwd must be the workspace directory")
+			}
+			args := append([]string{}, process.Args...)
+			servers = append(servers, environmentMCPServer{mcpHTTPServer: mcpHTTPServer{ServerLabel: binding.ServerLabel, Required: binding.Required}, Command: process.Command, Args: &args, Declared: true})
+			continue
+		}
 		if binding.Stdio != nil {
 			command, args := localworkspace.MCPStdioCommand(*binding.Stdio)
-			servers = append(servers, environmentMCPServer{mcpHTTPServer: mcpHTTPServer{ServerLabel: binding.ServerLabel}, Command: command, Args: args})
+			servers = append(servers, environmentMCPServer{mcpHTTPServer: mcpHTTPServer{ServerLabel: binding.ServerLabel}, Command: command, Args: &args})
 			continue
 		}
-		// Native header interpolation and redirect behavior cannot preserve literal
-		// custom-header authority. Reject this unqualified combination explicitly.
-		if len(binding.HTTPHeaders) != 0 {
-			return nil, nil, fmt.Errorf("claudesdk: literal MCP HTTP headers are not supported")
-		}
-		declarations := []proto.MCPHTTPServer{{ServerLabel: binding.ServerLabel, ServerURL: binding.ServerURL, AllowedTools: binding.AllowedTools, Required: binding.Required, BearerToken: binding.BearerToken}}
+		declarations := []proto.MCPHTTPServer{{ServerLabel: binding.ServerLabel, ServerURL: binding.ServerURL, AllowedTools: binding.AllowedTools, Required: binding.Required, BearerToken: binding.BearerToken, Headers: binding.HTTPHeaders}}
 		if err := validateMCPServers(declarations); err != nil {
 			return nil, nil, err
 		}
diff --git a/apps/daemon/internal/agent/claudesdk/mcp_environment_test.go b/apps/daemon/internal/agent/claudesdk/mcp_environment_test.go
index ab84b3b9e..d1c87211e 100644
--- a/apps/daemon/internal/agent/claudesdk/mcp_environment_test.go
+++ b/apps/daemon/internal/agent/claudesdk/mcp_environment_test.go
@@ -3,6 +3,7 @@ package claudesdk
 import (
 	"encoding/json"
 	"os"
+	"slices"
 	"strings"
 	"testing"
 
@@ -12,11 +13,10 @@ import (
 
 func TestEnvironmentMCPUsesInstalledLauncherAndSelectedCredential(t *testing.T) {
 	config := workspaceFixture(t)
-	config.Workspace.NetworkAccess = "enabled"
 	req := workspaceRequest()
 	token := "selected-user-token"
 	t.Setenv("MCP_TOKEN", "unselected-native-token")
-	req.LocalEnvironment = &proto.LocalEnvironment{CapabilityRoot: "/private/runtime/capabilities", NetworkAccess: "enabled", WorkspaceRoot: config.Workspace.Directory, MCP: []proto.EnvironmentMCP{
+	req.LocalEnvironment = &proto.LocalEnvironment{CapabilityRoot: "/private/runtime/capabilities", WorkspaceRoot: config.Workspace.Directory, MCP: []proto.EnvironmentMCP{
 		{InstallationRoot: "/private/runtime/capabilities", WorkspaceRoot: "/private/runtime/workspace", PackageRoot: "plugins/local", Server: agentplugin.MCPServer{Name: "local", Type: "stdio", Command: "untrusted-package-command", Args: []string{"package-argument"}, EnvVars: []string{"MCP_TOKEN"}}},
 		{InstallationRoot: "/private/runtime/capabilities", WorkspaceRoot: "/private/runtime/workspace", PackageRoot: "plugins/remote", Server: agentplugin.MCPServer{Name: "remote", Type: "http", URL: "https://example.invalid/mcp", BearerTokenEnvVar: "MCP_TOKEN"}, BearerToken: &token},
 	}}
@@ -29,7 +29,7 @@ func TestEnvironmentMCPUsesInstalledLauncherAndSelectedCredential(t *testing.T)
 	}
 	stdio := start.Workspace.MCP[0]
 	executable, _ := os.Executable()
-	if stdio.Command != executable || len(stdio.Args) != 4 || stdio.Args[0] != "runtime-mcp-exec" || stdio.Args[1] != "/private/runtime/capabilities" || stdio.Args[2] != "plugins/local" || stdio.Args[3] != "local" {
+	if stdio.Command != executable || stdio.Args == nil || !slices.Equal(*stdio.Args, []string{"runtime-mcp-exec", "/private/runtime/capabilities", "plugins/local", "local"}) {
 		t.Fatal("stdio bypassed the shared installed entry")
 	}
 	raw, _ := json.Marshal(start)
@@ -52,11 +52,10 @@ func TestEnvironmentMCPUsesInstalledLauncherAndSelectedCredential(t *testing.T)
 
 func TestEnvironmentMCPRejectsUnqualifiedCombinations(t *testing.T) {
 	for _, mutate := range []func(*proto.LocalEnvironment){
-		func(e *proto.LocalEnvironment) { e.NetworkAccess = "restricted" },
 		func(e *proto.LocalEnvironment) { e.MCP[0].Server.Name = "functions" },
 		func(e *proto.LocalEnvironment) { e.MCP = append(e.MCP, e.MCP[0]) },
 		func(e *proto.LocalEnvironment) { e.MCP[0].Server.Type = "sse" },
-		func(e *proto.LocalEnvironment) { e.MCP[0].Server.HTTPHeaders = map[string]string{"X-Key": "literal"} },
+		func(e *proto.LocalEnvironment) { e.MCP[0].Server.HTTPHeaders = map[string]string{"X-Key": "${HOME}"} },
 		func(e *proto.LocalEnvironment) { e.MCP[0].Server.BearerTokenEnvVar = "MISSING" },
 		func(e *proto.LocalEnvironment) {
 			token := "token"
@@ -64,7 +63,7 @@ func TestEnvironmentMCPRejectsUnqualifiedCombinations(t *testing.T) {
 			e.MCP[0].Server.URL = "http://example.invalid/mcp"
 		},
 	} {
-		environment := &proto.LocalEnvironment{NetworkAccess: "enabled", MCP: []proto.EnvironmentMCP{{InstallationRoot: "/private/runtime/capabilities", WorkspaceRoot: "/private/runtime/workspace", PackageRoot: "plugins/remote", Server: agentplugin.MCPServer{Name: "remote", Type: "http", URL: "https://example.invalid/mcp"}}}}
+		environment := &proto.LocalEnvironment{MCP: []proto.EnvironmentMCP{{InstallationRoot: "/private/runtime/capabilities", WorkspaceRoot: "/private/runtime/workspace", PackageRoot: "plugins/remote", Server: agentplugin.MCPServer{Name: "remote", Type: "http", URL: "https://example.invalid/mcp"}}}}
 		mutate(environment)
 		if _, _, err := prepareRuntimeMCP(proto.PromptRequestPayload{LocalEnvironment: environment}); err == nil {
 			t.Fatal("unsupported declaration accepted")
@@ -90,3 +89,20 @@ func TestEnvironmentMCPObservationsUseInstalledDeclarations(t *testing.T) {
 		t.Fatal("undeclared observation accepted")
 	}
 }
+
+// Native starts a stdio server in the directory of its own process, so the
+// declared cwd must be the declared workspace directory.
+func TestPublicMCPStdioStartsInTheWorkspaceDirectory(t *testing.T) {
+	servers := []proto.MCPHTTPServer{{ConnectionOrigin: "environment", ServerLabel: "local",
+		Stdio: &proto.MCPStdio{Command: "run", Cwd: "/workspace", EnvVars: []string{"TOKEN"}}}}
+	req := proto.PromptRequestPayload{LocalEnvironment: &proto.LocalEnvironment{WorkspaceDirectory: "/workspace", WorkspaceRoot: "/environment/workspace"}, MCPHTTPServers: &servers}
+	projected, _, err := prepareRuntimeMCP(req)
+	raw, _ := json.Marshal(projected)
+	if err != nil || string(raw) != `[{"server_label":"local","allowed_tools":null,"command":"run","args":[],"declared":true}]` {
+		t.Fatal("public stdio server was not projected", string(raw), err)
+	}
+	req.LocalEnvironment.WorkspaceDirectory = "/elsewhere"
+	if _, _, err := prepareRuntimeMCP(req); err == nil {
+		t.Fatal("stdio cwd outside the workspace directory was accepted")
+	}
+}
diff --git a/apps/daemon/internal/agent/claudesdk/mcp_test.go b/apps/daemon/internal/agent/claudesdk/mcp_test.go
index a8ad18877..f219d101d 100644
--- a/apps/daemon/internal/agent/claudesdk/mcp_test.go
+++ b/apps/daemon/internal/agent/claudesdk/mcp_test.go
@@ -35,7 +35,7 @@ func TestHTTPMCPDeclaration(t *testing.T) {
 			case "url-auth":
 				servers[0].ServerURL = "https://user:secret@example.invalid/mcp"
 			case "query":
-				servers[0].ServerURL += "?"
+				servers[0].ServerURL += "?tenant=a"
 			case "wildcard":
 				tools = []string{"*"}
 				servers[0].AllowedTools = &tools
@@ -47,7 +47,7 @@ func TestHTTPMCPDeclaration(t *testing.T) {
 				req.DisableExecutionEnvironment = false
 			}
 			start, _, err := prepare(config, req)
-			valid := mode == "unrestricted" || mode == "selected" || mode == "empty" || mode == "nil-slice" || mode == "auth" || mode == "required"
+			valid := mode == "unrestricted" || mode == "selected" || mode == "empty" || mode == "nil-slice" || mode == "auth" || mode == "required" || mode == "query" || mode == "wildcard"
 			if (err == nil) != valid {
 				t.Fatalf("unexpected admission: %v", err)
 			}
diff --git a/apps/daemon/internal/agent/claudesdk/messages_test.go b/apps/daemon/internal/agent/claudesdk/messages_test.go
index feaf594e7..7a6c0ffa1 100644
--- a/apps/daemon/internal/agent/claudesdk/messages_test.go
+++ b/apps/daemon/internal/agent/claudesdk/messages_test.go
@@ -15,12 +15,12 @@ import (
 )
 
 func TestMessageObservations(t *testing.T) {
-	for _, mode := range []string{"messages-success", "messages-partial", "messages-unrequested", "messages-missing-id", "messages-invalid-snapshot"} {
+	for _, mode := range []string{"messages-success", "messages-partial", "messages-missing-id", "messages-invalid-snapshot"} {
 		t.Run(mode, func(t *testing.T) {
 			root := t.TempDir()
 			t.Setenv("OAC_RUNTIME_HOME", root)
 			config := Config{Node: os.Args[0], Entrypoint: filepath.Join(root, "worker"), StateDir: filepath.Join(root, "state"), Env: []string{"GO_CLAUDE_SDK_HELPER=1", "SDK_HELPER_MODE=" + mode, "GORACE=atexit_sleep_ms=0"}}
-			request := proto.PromptRequestPayload{RunID: "run", Input: proto.TextInput("hello"), ObserveMessages: mode != "messages-unrequested", AgentSessionID: "native-session", AgentOptions: map[string]any{"model": "fake-model", "system_prompt": "instructions"}}
+			request := proto.PromptRequestPayload{RunID: "run", Input: proto.TextInput("hello"), AgentSessionID: "native-session", AgentOptions: map[string]any{"model": "fake-model", "system_prompt": "instructions"}}
 			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 			defer cancel()
 			out := make(chan proto.Envelope, 16)
@@ -60,7 +60,7 @@ func TestMessageObservations(t *testing.T) {
 				if len(events) != 4 || events[0].Type != proto.TypeOutputMessage || events[1].Type != proto.TypeDelta {
 					t.Fatalf("lost partial output: %+v", events)
 				}
-			case "messages-unrequested", "messages-missing-id":
+			case "messages-missing-id":
 				if len(events) != 2 {
 					t.Fatalf("invalid bridge observation escaped: %+v", events)
 				}
@@ -77,13 +77,7 @@ func runMessageHelper(request startRequest, mode string, emit func(bridgeEvent))
 		emit(bridgeEvent{Type: "delta", Delta: "unidentified"})
 		return
 	}
-	if mode != "messages-unrequested" && !request.ObserveMessages {
-		os.Exit(4)
-	}
 	message("message-1", "in_progress", nil)
-	if mode == "messages-unrequested" {
-		return
-	}
 	emit(bridgeEvent{Type: "delta", ItemID: "message-1", Delta: "partial"})
 	if mode == "messages-partial" {
 		emit(bridgeEvent{Type: "error", Code: "execution_failed"})
diff --git a/apps/daemon/internal/agent/claudesdk/native_controls_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/native_controls_live_linux_test.go
new file mode 100644
index 000000000..d3170948f
--- /dev/null
+++ b/apps/daemon/internal/agent/claudesdk/native_controls_live_linux_test.go
@@ -0,0 +1,87 @@
+//go:build linux
+
+package claudesdk
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/google/uuid"
+)
+
+// TestLiveClaudeSDKNativeControls proves, on the real SDK and provider, a whitespace-only message
+// and live web search on environment none.
+func TestLiveClaudeSDKNativeControls(t *testing.T) {
+	entrypoint, keyFile, proofRoot := os.Getenv("OAC_RUNTIME_CLAUDE_SDK_ENTRYPOINT"), os.Getenv("OAC_TEST_CLAUDE_SDK_MINIMAX_KEY_FILE"), os.Getenv("OAC_TEST_CLAUDE_SDK_PROOF_DIR")
+	endpoint, model := os.Getenv("OAC_TEST_CLAUDE_SDK_BASE_URL"), os.Getenv("OAC_TEST_CLAUDE_SDK_MODEL")
+	if entrypoint == "" || keyFile == "" || endpoint == "" || model == "" || !filepath.IsAbs(proofRoot) {
+		t.Skip("real SDK/provider acceptance requires an entrypoint, a private key file, an endpoint, a model and an absolute proof directory")
+	}
+	key, err := os.ReadFile(keyFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(proofRoot, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	root, err := os.MkdirTemp(proofRoot, "claude-controls-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("OAC_RUNTIME_HOME", root)
+	config := Config{Entrypoint: entrypoint, StateDir: filepath.Join(root, "state"), Env: []string{
+		"ANTHROPIC_BASE_URL=" + endpoint, "ANTHROPIC_AUTH_TOKEN=" + strings.TrimSpace(string(key)),
+		"ANTHROPIC_API_KEY=", "CLAUDE_CODE_OAUTH_TOKEN=",
+		"ANTHROPIC_DEFAULT_SONNET_MODEL=" + model, "ANTHROPIC_DEFAULT_OPUS_MODEL=" + model, "ANTHROPIC_DEFAULT_HAIKU_MODEL=" + model,
+	}}
+	run := func(t *testing.T, prompt proto.MessageInput, configure func(*proto.PromptRequestPayload)) (items []string, content, failure string) {
+		t.Helper()
+		ctx, cancel := context.WithTimeout(context.Background(), 180*time.Second)
+		defer cancel()
+		req := proto.PromptRequestPayload{RunID: uuid.NewString(), DisableExecutionEnvironment: true, DisableSubagents: true, Input: prompt,
+			ExecutionControls: &proto.ExecutionControls{TextVerbosity: "medium"},
+			AgentOptions:      map[string]any{"model": model, "system_prompt": "Answer briefly."}}
+		configure(&req)
+		out := make(chan proto.Envelope, 64)
+		running, err := startSingleTurn(ctx, config, req, out)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer running.Cancel(context.Background())
+		for event := range out {
+			items = append(items, event.Type)
+			switch event.Type {
+			case proto.TypeError:
+				var payload proto.ErrorPayload
+				_ = json.Unmarshal(event.Payload, &payload)
+				failure = payload.Error
+			case proto.TypeDone:
+				var payload proto.DonePayload
+				_ = json.Unmarshal(event.Payload, &payload)
+				content = payload.Content
+			}
+		}
+		return
+	}
+	t.Run("whitespace_only_message", func(t *testing.T) {
+		items, content, failure := run(t, proto.TextInput(" \n\t"), func(*proto.PromptRequestPayload) {})
+		if failure != "" || content == "" {
+			t.Fatalf("whitespace-only message failed: items=%v failure=%q", items, failure)
+		}
+	})
+	t.Run("live_search_on_none", func(t *testing.T) {
+		items, content, failure := run(t, proto.TextInput("Search the web for the current stable version of Go and report it in one sentence."), func(req *proto.PromptRequestPayload) {
+			req.ExecutionControls.WebSearch = &proto.WebSearchControl{Mode: "live", ContextSize: "medium"}
+		})
+		if failure != "" || content == "" || !slices.Contains(items, proto.TypeToolCall) {
+			t.Fatalf("live search failed: items=%v failure=%q", items, failure)
+		}
+	})
+}
diff --git a/apps/daemon/internal/agent/claudesdk/native_model_options.go b/apps/daemon/internal/agent/claudesdk/native_model_options.go
index 65ea8248c..b378e2b12 100644
--- a/apps/daemon/internal/agent/claudesdk/native_model_options.go
+++ b/apps/daemon/internal/agent/claudesdk/native_model_options.go
@@ -9,14 +9,11 @@ type nativeModelOptions struct {
 	Thinking map[string]any `json:"thinking,omitempty"`
 }
 
-func compileNativeModelOptions(config proto.HarnessConfig) *nativeModelOptions {
-	if len(config) == 0 {
+func compileNativeModelOptions(config proto.HarnessConfig, effort string) *nativeModelOptions {
+	if len(config) == 0 && effort == "" {
 		return nil
 	}
-	options := &nativeModelOptions{}
-	if value, exists := config["effort"]; exists {
-		options.Effort = value.(string)
-	}
+	options := &nativeModelOptions{Effort: effort}
 	if value, exists := config["thinking"]; exists {
 		options.Thinking = value.(map[string]any)
 	}
diff --git a/apps/daemon/internal/agent/claudesdk/options.go b/apps/daemon/internal/agent/claudesdk/options.go
index 81f968eff..665896f47 100644
--- a/apps/daemon/internal/agent/claudesdk/options.go
+++ b/apps/daemon/internal/agent/claudesdk/options.go
@@ -25,6 +25,8 @@ type subagentOptions struct {
 type startRequest struct {
 	NativeModelOptions *nativeModelOptions  `json:"native_model_options,omitempty"`
 	ToolSearch         bool                 `json:"tool_search,omitempty"`
+	WebSearch          string               `json:"web_search,omitempty"`
+	ReasoningSummary   bool                 `json:"reasoning_summary,omitempty"`
 	Subagents          *subagentOptions     `json:"subagents,omitempty"`
 	OutputFormat       *proto.OutputFormat  `json:"output_format,omitempty"`
 	Type               string               `json:"type"`
@@ -33,7 +35,6 @@ type startRequest struct {
 	SystemPrompt       string               `json:"system_prompt"`
 	Cwd                string               `json:"cwd"`
 	Resume             string               `json:"resume,omitempty"`
-	ObserveMessages    bool                 `json:"observe_messages,omitempty"`
 	Functions          []proto.FunctionTool `json:"functions,omitempty"`
 	MCPHTTPServers     *[]mcpHTTPServer     `json:"mcp_http_servers,omitempty"`
 	Workspace          *workspaceProfile    `json:"workspace,omitempty"`
@@ -53,36 +54,38 @@ func prepare(config Config, req proto.PromptRequestPayload) (startRequest, []str
 }
 
 func prepareConfiguration(config Config, req proto.PromptRequestPayload) (startRequest, []string, error) {
-	start := startRequest{Type: "start", Resume: req.AgentSessionID, RequireHistory: req.RequireExistingNativeSession, ObserveMessages: req.ObserveMessages, Functions: req.FunctionTools}
+	start := startRequest{Type: "start", Resume: req.AgentSessionID, RequireHistory: req.RequireExistingNativeSession, Functions: req.FunctionTools}
 	fail := func(reason string) (startRequest, []string, error) {
 		return startRequest{}, nil, fmt.Errorf("claudesdk: %s", reason)
 	}
-	modelConfiguration, err := harnessconfiguration.Configuration().Prepare(req.AgentOptions)
+	modelConfiguration, err := harnessconfiguration.Declaration.Configuration.Prepare(req.AgentOptions)
 	if err != nil {
 		return startRequest{}, nil, err
 	}
-	start.NativeModelOptions = compileNativeModelOptions(modelConfiguration.HarnessConfig)
+	if err := harnessconfiguration.Declaration.ValidateExecutionControls(req.ExecutionControls); err != nil {
+		return fail(err.Error())
+	}
+	effort := ""
+	if req.ExecutionControls != nil {
+		effort = req.ExecutionControls.ReasoningEffort
+	}
+	start.NativeModelOptions = compileNativeModelOptions(modelConfiguration.HarnessConfig, effort)
 	if err := req.ValidateToolSearch(true); err != nil {
 		return startRequest{}, nil, err
 	}
-	if req.ToolSearch {
-		if (req.LocalEnvironment != nil && (len(req.LocalEnvironment.Skills) != 0 || len(req.LocalEnvironment.MCP) != 0)) || req.MCPHTTPServers != nil || !req.DisableSubagents || (req.ExecutionControls != nil && req.ExecutionControls.OutputFormat != nil) {
-			return fail("tool discovery requires the single-agent text/function profile")
-		}
-		start.ToolSearch = true
-	}
+	start.ToolSearch = req.ToolSearch
 	if err := validateMCP(req); err != nil {
 		return startRequest{}, nil, err
 	}
-	// Search is disabled by the fixed native tool profile. Medium selects the
-	// SDK's default text generation; it has no native verbosity-level option.
-	if controls := req.ExecutionControls; controls != nil && (controls.WebSearch != "disabled" || controls.TextVerbosity != "medium") {
-		return fail("execution controls require disabled web search and medium text verbosity")
+	// Without a search control Claude Code keeps its native web tools.
+	if controls := req.ExecutionControls; controls != nil && controls.WebSearch != nil {
+		start.WebSearch = controls.WebSearch.Mode
 	}
+	start.ReasoningSummary = req.ExecutionControls != nil && req.ExecutionControls.ReasoningSummary != ""
 	if req.ExecutionControls != nil && req.ExecutionControls.OutputFormat != nil {
 		format := req.ExecutionControls.OutputFormat
-		if format.Type != "json_schema" || !req.ObserveMessages || !req.DisableSubagents || req.MCPHTTPServers != nil || (req.LocalEnvironment != nil && (len(req.LocalEnvironment.MCP) != 0 || len(req.LocalEnvironment.Skills) != 0)) {
-			return fail("structured output requires the qualified message-observing single-agent function profile")
+		if format.Type != "json_schema" {
+			return fail("structured output requires a JSON schema format")
 		}
 		if err := proto.ValidateBinary64Schema(format.Schema); err != nil {
 			return startRequest{}, nil, err
@@ -90,8 +93,8 @@ func prepareConfiguration(config Config, req proto.PromptRequestPayload) (startR
 		start.OutputFormat = format
 	}
 	if req.ObserveSubagentIdentities {
-		if req.DisableSubagents || len(req.FunctionTools) != 0 || req.MCPHTTPServers != nil || (req.LocalEnvironment != nil && len(req.LocalEnvironment.MCP) != 0) {
-			return fail("subagent execution does not support this tool combination")
+		if req.DisableSubagents {
+			return fail("subagent observation conflicts with disabled subagents")
 		}
 		limit := 6
 		if req.MaxConcurrentSubagents != nil {
@@ -145,7 +148,7 @@ func prepareConfiguration(config Config, req proto.PromptRequestPayload) (startR
 			return startRequest{}, nil, err
 		}
 		start.Workspace = profile
-		start.Cwd = workspaceCwd(config.Workspace)
+		start.Cwd = config.Workspace.Directory
 		return start, env, nil
 	}
 	if req.LocalEnvironment != nil || req.RequireExistingNativeSession {
@@ -161,7 +164,7 @@ func prepareConfiguration(config Config, req proto.PromptRequestPayload) (startR
 		}
 	}
 	env := withProvider(append(append([]string{}, os.Environ()...), config.Env...), provider)
-	env = append(env, "CLAUDE_CONFIG_DIR="+config.StateDir, "TMPDIR="+filepath.Join(config.StateDir, "tmp"), "DISABLE_TELEMETRY=1", "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1")
+	env = append(env, "CLAUDE_CONFIG_DIR="+config.StateDir, "TMPDIR="+filepath.Join(config.StateDir, "tmp"))
 	projectedMCP, mcpEnv, err := prepareRuntimeMCP(req)
 	if err != nil {
 		return startRequest{}, nil, err
diff --git a/apps/daemon/internal/agent/claudesdk/preparation_fixture_test.go b/apps/daemon/internal/agent/claudesdk/preparation_fixture_test.go
index 081a199b9..67e60abc9 100644
--- a/apps/daemon/internal/agent/claudesdk/preparation_fixture_test.go
+++ b/apps/daemon/internal/agent/claudesdk/preparation_fixture_test.go
@@ -111,12 +111,8 @@ func runPreparationHelper() {
 		return
 	}
 	emit(bridgeEvent{Type: "input_ready", SessionID: request.Resume})
-	if request.ObserveMessages {
-		text := "completed"
-		emit(bridgeEvent{Type: "output_message", Message: &proto.OutputMessagePayload{ID: "native-message", Status: "completed", Text: &text}})
-	} else {
-		emit(bridgeEvent{Type: "delta", Delta: "partial"})
-	}
+	text := "completed"
+	emit(bridgeEvent{Type: "output_message", Message: &proto.OutputMessagePayload{ID: "native-message", Status: "completed", Text: &text}})
 	emit(bridgeEvent{Type: "usage", ResultID: "native-result", SessionID: request.Resume, Usage: json.RawMessage(usageFixture)})
 	emit(bridgeEvent{Type: "input_closed", SessionID: request.Resume})
 	emit(bridgeEvent{Type: "result", SessionID: request.Resume, Text: "completed"})
diff --git a/apps/daemon/internal/agent/claudesdk/preparation_test.go b/apps/daemon/internal/agent/claudesdk/preparation_test.go
index 5c03d23c5..8040a0b4d 100644
--- a/apps/daemon/internal/agent/claudesdk/preparation_test.go
+++ b/apps/daemon/internal/agent/claudesdk/preparation_test.go
@@ -117,7 +117,7 @@ func TestPreparationRejectsInputAndUnavailableProfilesBeforeLaunch(t *testing.T)
 			case "mcp":
 				req.MCPHTTPServers = &[]proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "remote", ServerURL: "https://example.test/mcp"}}
 			case "controls":
-				req.ExecutionControls = &proto.ExecutionControls{WebSearch: "enabled", TextVerbosity: "medium"}
+				req.ExecutionControls = &proto.ExecutionControls{WebSearch: &proto.WebSearchControl{Mode: "cached", ContextSize: "medium"}}
 			}
 			if _, err := NewExecutorFactory(config)(t.Context(), req); err == nil {
 				t.Fatal("invalid preparation was accepted")
diff --git a/apps/daemon/internal/agent/claudesdk/provider.go b/apps/daemon/internal/agent/claudesdk/provider.go
index 18114ea1e..22b86dcd6 100644
--- a/apps/daemon/internal/agent/claudesdk/provider.go
+++ b/apps/daemon/internal/agent/claudesdk/provider.go
@@ -2,6 +2,7 @@ package claudesdk
 
 import (
 	"sort"
+	"strconv"
 	"strings"
 
 	harnessconfiguration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/claudesdk"
@@ -9,7 +10,7 @@ import (
 
 // Validate the frozen native provider before producing launch variables.
 func providerEnvironment(value any) ([]string, error) {
-	provider, err := harnessconfiguration.Configuration().ParseProvider(value)
+	provider, err := harnessconfiguration.Declaration.Configuration.ParseProvider(value)
 	if err != nil {
 		return nil, err
 	}
@@ -23,7 +24,15 @@ func providerEnvironment(value any) ([]string, error) {
 		headers = append(headers, name+": "+provider.Headers[name])
 	}
 	// An explicit empty value clears any previous native header selection.
-	return []string{"ANTHROPIC_BASE_URL=" + provider.BaseURL, "ANTHROPIC_AUTH_TOKEN=" + provider.APIKey, "ANTHROPIC_CUSTOM_HEADERS=" + strings.Join(headers, "\n")}, nil
+	env := []string{"ANTHROPIC_BASE_URL=" + provider.BaseURL, "ANTHROPIC_AUTH_TOKEN=" + provider.APIKey, "ANTHROPIC_CUSTOM_HEADERS=" + strings.Join(headers, "\n")}
+	// Native uses the context window only for a model it does not know.
+	if provider.ContextWindow > 0 {
+		env = append(env, "CLAUDE_CODE_MAX_CONTEXT_TOKENS="+strconv.Itoa(int(provider.ContextWindow)))
+	}
+	if provider.MaxOutputTokens > 0 {
+		env = append(env, "CLAUDE_CODE_MAX_OUTPUT_TOKENS="+strconv.Itoa(int(provider.MaxOutputTokens)))
+	}
+	return env, nil
 }
 
 func withProvider(env, provider []string) []string {
@@ -33,7 +42,7 @@ func withProvider(env, provider []string) []string {
 	out := make([]string, 0, len(env)+len(provider))
 	for _, entry := range env {
 		key, _, _ := strings.Cut(entry, "=")
-		if key != "ANTHROPIC_API_KEY" && key != "ANTHROPIC_AUTH_TOKEN" && key != "ANTHROPIC_BASE_URL" && key != "ANTHROPIC_CUSTOM_HEADERS" {
+		if key != "ANTHROPIC_CUSTOM_HEADERS" && key != "ANTHROPIC_API_KEY" && key != "ANTHROPIC_AUTH_TOKEN" && key != "ANTHROPIC_BASE_URL" && key != "CLAUDE_CODE_MAX_CONTEXT_TOKENS" && key != "CLAUDE_CODE_MAX_OUTPUT_TOKENS" {
 			out = append(out, entry)
 		}
 	}
diff --git a/apps/daemon/internal/agent/claudesdk/restrictions_test.go b/apps/daemon/internal/agent/claudesdk/restrictions_test.go
index a574a5009..494e32727 100644
--- a/apps/daemon/internal/agent/claudesdk/restrictions_test.go
+++ b/apps/daemon/internal/agent/claudesdk/restrictions_test.go
@@ -19,7 +19,7 @@ func TestTextFactoryAcceptsRestrictiveCapabilities(t *testing.T) {
 		controls               *proto.ExecutionControls
 	}{
 		{"environment", true, false, nil}, {"subagents", false, true, nil}, {"both", true, true, nil},
-		{"execution-controls", true, true, &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}},
+		{"execution-controls", true, true, &proto.ExecutionControls{TextVerbosity: "medium"}},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			root := t.TempDir()
diff --git a/apps/daemon/internal/agent/claudesdk/searches.go b/apps/daemon/internal/agent/claudesdk/searches.go
new file mode 100644
index 000000000..ffd9f85e4
--- /dev/null
+++ b/apps/daemon/internal/agent/claudesdk/searches.go
@@ -0,0 +1,52 @@
+package claudesdk
+
+import (
+	"fmt"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+)
+
+type searchState struct {
+	calls map[string]proto.ToolObservation
+}
+
+func (c *searchState) receive(event bridgeEvent, start startRequest, sessionID string, emit func(string, any)) error {
+	n := event.Observation
+	if start.Workspace == nil && start.WebSearch != "live" || sessionID == "" || event.SessionID != sessionID || event.ID == "" || n == nil ||
+		n.Kind != "web_search" || n.Action == nil || (n.Action.Type != "search" && n.Action.Type != "open_page") ||
+		(n.Action.Type == "search") != (n.Action.Query != nil) || (n.Action.Type == "open_page") != (n.Action.URL != nil) ||
+		n.Name != "" || n.Command != "" || n.Cwd != nil || n.ExitCode != nil || n.DurationMS != nil || n.Server != "" ||
+		len(n.Arguments) != 0 || len(n.Output) != 0 || len(n.Error) != 0 || n.Content != nil {
+		return fmt.Errorf("claudesdk: invalid web search observation")
+	}
+	previous, exists := c.calls[event.ID]
+	if (event.Stage == "before" && (exists || n.Status != "in_progress")) ||
+		(event.Stage == "after" && (!exists || previous.Status != "in_progress" ||
+			(n.Status != "completed" && n.Status != "failed" && n.Status != "incomplete"))) ||
+		(event.Stage != "before" && event.Stage != "after") {
+		return fmt.Errorf("claudesdk: inconsistent web search observation")
+	}
+	c.calls[event.ID] = *n
+	emit(proto.TypeToolCall, proto.ToolCallPayload{ID: event.ID, Name: "web_search", Stage: event.Stage, Observation: n})
+	return nil
+}
+
+func (c *searchState) complete() bool {
+	for _, call := range c.calls {
+		if call.Status == "in_progress" {
+			return false
+		}
+	}
+	return true
+}
+
+func (c *searchState) close(emit func(string, any)) {
+	for id, call := range c.calls {
+		if call.Status != "in_progress" {
+			continue
+		}
+		call.Status = "incomplete"
+		c.calls[id] = call
+		emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: "web_search", Stage: "after", Observation: &call})
+	}
+}
diff --git a/apps/daemon/internal/agent/claudesdk/searches_test.go b/apps/daemon/internal/agent/claudesdk/searches_test.go
new file mode 100644
index 000000000..019a5a16d
--- /dev/null
+++ b/apps/daemon/internal/agent/claudesdk/searches_test.go
@@ -0,0 +1,59 @@
+package claudesdk
+
+import (
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+)
+
+func searchEvent(id, stage, status string, action *proto.ToolWebSearchAction) bridgeEvent {
+	return bridgeEvent{Type: "search_observation", SessionID: "native-session", ID: id, Stage: stage,
+		Observation: &proto.ToolObservation{Kind: "web_search", Status: status, Action: action}}
+}
+
+func TestSearchObservationLifecycle(t *testing.T) {
+	state := searchState{calls: map[string]proto.ToolObservation{}}
+	start := startRequest{Workspace: &workspaceProfile{}}
+	var events []proto.ToolCallPayload
+	emit := func(kind string, payload any) { events = append(events, payload.(proto.ToolCallPayload)) }
+	query, url := "agents api", "https://example.com"
+	search := &proto.ToolWebSearchAction{Type: "search", Query: &query}
+	if err := state.receive(searchEvent("one", "before", "in_progress", search), start, "native-session", emit); err != nil || state.complete() {
+		t.Fatal("search was not pending", err)
+	}
+	if err := state.receive(searchEvent("one", "before", "in_progress", search), start, "native-session", emit); err == nil {
+		t.Fatal("duplicate search accepted")
+	}
+	if err := state.receive(searchEvent("one", "after", "completed", search), start, "native-session", emit); err != nil || !state.complete() {
+		t.Fatal("search did not complete", err)
+	}
+	open := &proto.ToolWebSearchAction{Type: "open_page", URL: &url}
+	if err := state.receive(searchEvent("two", "before", "in_progress", open), start, "native-session", emit); err != nil {
+		t.Fatal(err)
+	}
+	state.close(emit)
+	if state.calls["two"].Status != "incomplete" || len(events) != 4 || events[3].Observation.Action.URL == nil {
+		t.Fatal("unfinished page open was not closed", events)
+	}
+	for name, event := range map[string]bridgeEvent{
+		"action":  searchEvent("bad", "before", "in_progress", &proto.ToolWebSearchAction{Type: "find_in_page", Pattern: &query}),
+		"missing": searchEvent("bad", "before", "in_progress", &proto.ToolWebSearchAction{Type: "search"}),
+		"session": {Type: "search_observation", SessionID: "other", ID: "bad", Stage: "before", Observation: &proto.ToolObservation{Kind: "web_search", Status: "in_progress", Action: search}},
+	} {
+		if err := state.receive(event, start, "native-session", emit); err == nil {
+			t.Fatal("invalid observation accepted", name)
+		}
+	}
+}
+
+func TestSearchObservationOnEnvironmentNoneNeedsLiveSearch(t *testing.T) {
+	query := "agents api"
+	event := searchEvent("one", "before", "in_progress", &proto.ToolWebSearchAction{Type: "search", Query: &query})
+	emit := func(string, any) {}
+	for _, mode := range []string{"", "live"} {
+		state := searchState{calls: map[string]proto.ToolObservation{}}
+		if err := state.receive(event, startRequest{WebSearch: mode}, "native-session", emit); (err == nil) != (mode == "live") {
+			t.Fatalf("mode %q: %v", mode, err)
+		}
+	}
+}
diff --git a/apps/daemon/internal/agent/claudesdk/session.go b/apps/daemon/internal/agent/claudesdk/session.go
index f252ce14f..b5e55ee34 100644
--- a/apps/daemon/internal/agent/claudesdk/session.go
+++ b/apps/daemon/internal/agent/claudesdk/session.go
@@ -41,23 +41,25 @@ type bridgeEvent struct {
 	Reason          string          `json:"reason"`
 	Protocol        int             `json:"protocol"`
 
-	Fact        json.RawMessage             `json:"fact"`
-	InputID     string                      `json:"input_id"`
-	ResultID    string                      `json:"result_id"`
-	Usage       json.RawMessage             `json:"usage,omitempty"`
-	Type        string                      `json:"type"`
-	Delta       string                      `json:"delta"`
-	SessionID   string                      `json:"session_id"`
-	Text        string                      `json:"text"`
-	Code        string                      `json:"code"`
-	ItemID      string                      `json:"item_id"`
-	Message     *proto.OutputMessagePayload `json:"message"`
-	Call        *proto.FunctionCallPayload  `json:"call"`
-	CallID      string                      `json:"call_id"`
-	DeliveryID  string                      `json:"delivery_id"`
-	ID          string                      `json:"id"`
-	Stage       string                      `json:"stage"`
-	Observation *proto.ToolObservation      `json:"observation"`
+	Fact        json.RawMessage                     `json:"fact"`
+	InputID     string                              `json:"input_id"`
+	ResultID    string                              `json:"result_id"`
+	Usage       json.RawMessage                     `json:"usage,omitempty"`
+	Type        string                              `json:"type"`
+	Delta       string                              `json:"delta"`
+	SessionID   string                              `json:"session_id"`
+	Text        string                              `json:"text"`
+	Code        string                              `json:"code"`
+	ItemID      string                              `json:"item_id"`
+	Message     *proto.OutputMessagePayload         `json:"message"`
+	Reasoning   *proto.ReasoningPayload             `json:"reasoning"`
+	Call        *proto.FunctionCallPayload          `json:"call"`
+	Withdrawn   *proto.FunctionCallWithdrawnPayload `json:"withdrawn"`
+	CallID      string                              `json:"call_id"`
+	DeliveryID  string                              `json:"delivery_id"`
+	ID          string                              `json:"id"`
+	Stage       string                              `json:"stage"`
+	Observation *proto.ToolObservation              `json:"observation"`
 }
 
 func launch(ctx context.Context, config Config, start startRequest, env []string) (*session, error) {
@@ -65,7 +67,9 @@ func launch(ctx context.Context, config Config, start startRequest, env []string
 	if binary == "" {
 		binary = "node"
 	}
-	process, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: binary, Args: []string{config.Entrypoint}, Dir: start.Cwd, Env: env, NeedStdin: true})
+	// Node's fetch honours the operator's proxy only when asked; unlike NODE_USE_ENV_PROXY, the flag stays with
+	// the bridge, so native tools run with the environment they would have locally.
+	process, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: binary, Args: []string{"--use-env-proxy", config.Entrypoint}, Dir: start.Cwd, Env: env, NeedStdin: true})
 	if err != nil {
 		return nil, err
 	}
diff --git a/apps/daemon/internal/agent/claudesdk/session_test.go b/apps/daemon/internal/agent/claudesdk/session_test.go
index 7c0f094c2..e885c51a8 100644
--- a/apps/daemon/internal/agent/claudesdk/session_test.go
+++ b/apps/daemon/internal/agent/claudesdk/session_test.go
@@ -42,9 +42,6 @@ func TestTextFactoryCompletionAndFailures(t *testing.T) {
 				case proto.TypeDelta:
 					var payload proto.DeltaPayload
 					_ = json.Unmarshal(event.Payload, &payload)
-					if payload.ItemID != "" {
-						t.Fatal("ordinary deltas acquired message identity")
-					}
 					deltas += payload.Delta
 				case proto.TypeOutputMessage:
 					t.Fatal("ordinary requests acquired message observations")
@@ -82,7 +79,7 @@ func TestTextFactoryRejectsUnsupportedInput(t *testing.T) {
 			request := proto.PromptRequestPayload{RunID: "run", Input: proto.TextInput("hello"), AgentOptions: map[string]any{"model": "fake"}}
 			switch kind {
 			case "execution-controls":
-				request.ExecutionControls = &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "low"}
+				request.ExecutionControls = &proto.ExecutionControls{TextVerbosity: "low"}
 			case "tool":
 				request.FunctionTools = []proto.FunctionTool{{}}
 			case "outside":
@@ -167,7 +164,7 @@ func runSDKHelper() {
 		encode(bridgeEvent{Type: "error", Code: "execution_failed"})
 		return
 	}
-	encode(bridgeEvent{Type: "delta", Delta: "partial"})
+	encode(bridgeEvent{Type: "delta", ItemID: "item", Delta: "partial"})
 	id := request.Resume
 	if mode == "wrong-resume" {
 		id = "different-session"
@@ -177,7 +174,7 @@ func runSDKHelper() {
 		os.Exit(7)
 	}
 	if mode == "after-result" {
-		encode(bridgeEvent{Type: "delta", Delta: "too late"})
+		encode(bridgeEvent{Type: "delta", ItemID: "item", Delta: "too late"})
 		return
 	}
 	time.Sleep(50 * time.Millisecond)
diff --git a/apps/daemon/internal/agent/claudesdk/steering.go b/apps/daemon/internal/agent/claudesdk/steering.go
index c64b55d72..4db08b1b3 100644
--- a/apps/daemon/internal/agent/claudesdk/steering.go
+++ b/apps/daemon/internal/agent/claudesdk/steering.go
@@ -24,15 +24,8 @@ type steeringState struct {
 	seen      map[string]bool
 }
 
-var _ agent.Steerer = (*session)(nil)
-
-// Steer waits for native consumption, which may occur in a later native turn
-// within this one SDK query. A completed stdin write is not a receipt.
-func (s *session) Steer(ctx context.Context, input proto.PromptSteerPayload) error {
-	return s.SteerWithReceipt(ctx, input, nil)
-}
-
-// SteerWithReceipt separates a complete bridge write from native consumption.
+// SteerWithReceipt separates a complete bridge write from native consumption,
+// which may occur in a later native turn within this one SDK query.
 func (s *session) SteerWithReceipt(ctx context.Context, input proto.PromptSteerPayload, written func()) error {
 	select {
 	case <-s.cancelOutput:
@@ -91,9 +84,7 @@ func (s *session) SteerWithReceipt(ctx context.Context, input proto.PromptSteerP
 		s.invalidate()
 		return fmt.Errorf("claudesdk: input transport failed")
 	}
-	if written != nil {
-		written()
-	}
+	written()
 	select {
 	case err := <-pending.receipt:
 		return err
diff --git a/apps/daemon/internal/agent/claudesdk/steering_test.go b/apps/daemon/internal/agent/claudesdk/steering_test.go
index b59f5107f..2313476b6 100644
--- a/apps/daemon/internal/agent/claudesdk/steering_test.go
+++ b/apps/daemon/internal/agent/claudesdk/steering_test.go
@@ -67,7 +67,7 @@ func TestSteeringReceiptsAndLifecycle(t *testing.T) {
 						}
 					})
 				} else {
-					reply <- s.Steer(receiptCtx, input)
+					reply <- s.SteerWithReceipt(receiptCtx, input, func() {})
 				}
 			}()
 			if mode == "blocked-write" {
@@ -144,7 +144,7 @@ func TestSteeringReceiptsAndLifecycle(t *testing.T) {
 			if mode == "duplicate-usage" && measurements != 1 {
 				t.Fatal("duplicate measurement was published")
 			}
-			if err := s.Steer(ctx, input); !errors.Is(err, agent.ErrSteeringInactive) {
+			if err := s.SteerWithReceipt(ctx, input, func() {}); !errors.Is(err, agent.ErrSteeringInactive) {
 				t.Fatal("completed execution accepted input", err)
 			}
 			if _, err := s.AwaitSettlement(ctx); err != nil && (mode == "success" || mode == "phased" || mode == "timeout") {
@@ -159,18 +159,18 @@ func TestSteeringReceiptsAndLifecycle(t *testing.T) {
 
 func TestSteeringDoesNotSendBeforeReadiness(t *testing.T) {
 	s := &session{process: &clirunner.Process{}}
-	if err := s.Steer(context.Background(), proto.PromptSteerPayload{InputID: "one", Input: proto.TextInput("hello")}); !errors.Is(err, agent.ErrSteeringNotReady) {
+	if err := s.SteerWithReceipt(context.Background(), proto.PromptSteerPayload{InputID: "one", Input: proto.TextInput("hello")}, func() {}); !errors.Is(err, agent.ErrSteeringNotReady) {
 		t.Fatal(err)
 	}
 	s.stopSteering()
-	if err := s.Steer(context.Background(), proto.PromptSteerPayload{InputID: "one", Input: proto.TextInput("hello")}); !errors.Is(err, agent.ErrSteeringInactive) {
+	if err := s.SteerWithReceipt(context.Background(), proto.PromptSteerPayload{InputID: "one", Input: proto.TextInput("hello")}, func() {}); !errors.Is(err, agent.ErrSteeringInactive) {
 		t.Fatal(err)
 	}
 }
 
 func runSteeringHelper(request startRequest, mode string, scanner *bufio.Scanner, emit func(bridgeEvent)) {
 	emit(bridgeEvent{Type: "input_ready", SessionID: request.Resume})
-	emit(bridgeEvent{Type: "delta", Delta: "ready"})
+	emit(bridgeEvent{Type: "delta", ItemID: "item", Delta: "ready"})
 	if mode == "steering-blocked-write" {
 		time.Sleep(time.Hour)
 		return
diff --git a/apps/daemon/internal/agent/claudesdk/subagents_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/subagents_live_linux_test.go
new file mode 100644
index 000000000..586c4c0b6
--- /dev/null
+++ b/apps/daemon/internal/agent/claudesdk/subagents_live_linux_test.go
@@ -0,0 +1,197 @@
+//go:build linux
+
+package claudesdk
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/google/uuid"
+)
+
+// liveSubagentConfig reads the private provider settings of the real-provider Subagent tests.
+func liveSubagentConfig(t *testing.T) (config Config, key []byte, root string) {
+	entrypoint, keyFile, proofRoot := os.Getenv("OAC_RUNTIME_CLAUDE_SDK_ENTRYPOINT"), os.Getenv("OAC_TEST_CLAUDE_SDK_MINIMAX_KEY_FILE"), os.Getenv("OAC_TEST_CLAUDE_SDK_PROOF_DIR")
+	endpoint, model := os.Getenv("OAC_TEST_CLAUDE_SDK_BASE_URL"), os.Getenv("OAC_TEST_CLAUDE_SDK_MODEL")
+	if entrypoint == "" || keyFile == "" || proofRoot == "" || endpoint == "" || model == "" {
+		t.Skip("real SDK/provider acceptance requires explicit entrypoint, key file, proof directory, base URL and model")
+	}
+	key, err := os.ReadFile(keyFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	key = bytes.TrimSpace(key)
+	root, err = os.MkdirTemp(proofRoot, "claude-subagent-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("OAC_RUNTIME_HOME", root)
+	return Config{Entrypoint: entrypoint, StateDir: filepath.Join(root, "state"), Env: []string{
+		"ANTHROPIC_BASE_URL=" + endpoint, "ANTHROPIC_AUTH_TOKEN=" + string(key), "ANTHROPIC_API_KEY=", "CLAUDE_CODE_OAUTH_TOKEN=",
+		"CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1", "ANTHROPIC_DEFAULT_SONNET_MODEL=" + model, "ANTHROPIC_DEFAULT_OPUS_MODEL=" + model, "ANTHROPIC_DEFAULT_HAIKU_MODEL=" + model,
+	}}, key, root
+}
+
+// saveEvidence stores the observed events of a live run, unless they would contain the provider key.
+func saveEvidence(t *testing.T, root string, key []byte, evidence any) {
+	encoded, _ := json.MarshalIndent(evidence, "", "  ")
+	if bytes.Contains(encoded, key) {
+		t.Error("evidence contains the provider key")
+		return
+	}
+	_ = os.WriteFile(filepath.Join(root, "evidence.json"), encoded, 0o600)
+	t.Logf("evidence: %s/evidence.json", root)
+}
+
+// TestLiveClaudeSDKNativeSubagent runs one Turn in which the model spawns a native general-purpose Subagent with a per-call model.
+func TestLiveClaudeSDKNativeSubagent(t *testing.T) {
+	config, key, root := liveSubagentConfig(t)
+	model := os.Getenv("OAC_TEST_CLAUDE_SDK_MODEL")
+	ctx, cancel := context.WithTimeout(context.Background(), 150*time.Second)
+	defer cancel()
+	out := make(chan proto.Envelope, 256)
+	request := proto.PromptRequestPayload{RunID: uuid.NewString(), ObserveSubagentIdentities: true,
+		Input:        proto.TextInput("Call the Agent tool exactly once with subagent_type \"general-purpose\", model \"sonnet\", name \"helper\" and a prompt asking it to reply with the single word PONG. Then report what it replied."),
+		AgentOptions: map[string]any{"model": model}}
+	turn, err := startSingleTurn(ctx, config, request, out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer turn.Cancel(context.Background())
+	counts := map[string]int{}
+	var coordination []map[string]any
+	var events []proto.Envelope
+	defer func() {
+		saveEvidence(t, root, key, map[string]any{"counts": counts, "coordination": coordination, "events": events})
+	}()
+	for event := range out {
+		events = append(events, event)
+		counts[event.Type]++
+		switch event.Type {
+		case proto.TypeError:
+			t.Fatalf("native failure: %s", event.Payload)
+		case proto.TypeSubagentCoordination:
+			var fact map[string]any
+			_ = json.Unmarshal(event.Payload, &fact)
+			coordination = append(coordination, fact)
+		}
+	}
+	if _, err := turn.AwaitSettlement(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if counts[proto.TypeSubagentIdentity] != 1 || counts[proto.TypeSubagentTurn] < 2 || counts[proto.TypeSubagentItem] == 0 {
+		t.Fatal("native Subagent was not observed")
+	}
+	var spawn map[string]any
+	for _, fact := range coordination {
+		if fact["kind"] == "create_subagent_call" {
+			spawn = fact
+		}
+	}
+	if spawn == nil || spawn["status"] != "completed" || spawn["model"] != "sonnet" {
+		t.Fatalf("spawn coordination did not report the requested model: %v", spawn)
+	}
+}
+
+// TestLiveClaudeSDKSubagentFunctionCall runs one Turn in which a native Subagent calls the Agent's function. The call reaches Core with the child's
+// identity after the child's facts, the submitted result is confirmed by the child's own native tool result, and the Turn reports no root tool call for it.
+func TestLiveClaudeSDKSubagentFunctionCall(t *testing.T) {
+	config, key, root := liveSubagentConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 240*time.Second)
+	defer cancel()
+	out := make(chan proto.Envelope, 256)
+	request := proto.PromptRequestPayload{RunID: uuid.NewString(), ObserveSubagentIdentities: true,
+		FunctionTools: []proto.FunctionTool{{Name: "lookup", Description: "Returns the secret code of a topic.", Parameters: json.RawMessage(`{"type":"object","properties":{"topic":{"type":"string"}},"required":["topic"]}`)}},
+		Input:         proto.TextInput("Call the Agent tool exactly once with subagent_type \"general-purpose\", name \"helper\" and a prompt telling it to call the mcp__functions__lookup tool with topic \"sky\" and reply with exactly the code it returned. Then report that code."),
+		AgentOptions:  map[string]any{"model": os.Getenv("OAC_TEST_CLAUDE_SDK_MODEL")}}
+	turn, err := startSingleTurn(ctx, config, request, out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer turn.Cancel(context.Background())
+	submitter := turn.(agent.FunctionResultSubmitter)
+	var events []proto.Envelope
+	var call proto.FunctionCallPayload
+	var tools, subagentTools, factsBefore int
+	submitted := make(chan error, 1)
+	defer func() { saveEvidence(t, root, key, events) }()
+	for event := range out {
+		events = append(events, event)
+		switch event.Type {
+		case proto.TypeError:
+			t.Fatalf("native failure: %s", event.Payload)
+		case proto.TypeSubagentIdentity, proto.TypeSubagentTurn:
+			if call.CallID == "" {
+				factsBefore++
+			}
+		case proto.TypeToolCall:
+			tools++
+		case proto.TypeSubagentItem:
+			if bytes.Contains(event.Payload, []byte(`"kind":"function"`)) {
+				subagentTools++
+			}
+		case proto.TypeFunctionCall:
+			if err := event.DecodePayload(&call); err != nil {
+				t.Fatal(err)
+			}
+			text := "CODE-4821"
+			result := proto.FunctionResultPayload{DeliveryID: "delivery", CallID: call.CallID, Success: true, Content: []proto.InputContent{{Type: "input_text", Text: &text}}}
+			go func() { submitted <- submitter.SubmitFunctionResult(ctx, result) }()
+		}
+	}
+	if _, err := turn.AwaitSettlement(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if call.NativeID == "" || call.TurnID == "" || factsBefore < 2 || tools != 0 || subagentTools == 0 {
+		t.Fatalf("child call %+v, facts before it %d, root tool calls %d, child function items %d", call, factsBefore, tools, subagentTools)
+	}
+	if err := <-submitted; err != nil {
+		t.Fatalf("child result was not confirmed: %v", err)
+	}
+}
+
+// TestLiveClaudeSDKSubagentFunctionCallWithdrawn cancels the Turn while a Subagent's function call waits. Native stops the child, and the call is withdrawn.
+func TestLiveClaudeSDKSubagentFunctionCallWithdrawn(t *testing.T) {
+	config, key, root := liveSubagentConfig(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 240*time.Second)
+	defer cancel()
+	out := make(chan proto.Envelope, 256)
+	request := proto.PromptRequestPayload{RunID: uuid.NewString(), ObserveSubagentIdentities: true,
+		FunctionTools: []proto.FunctionTool{{Name: "lookup", Description: "Returns the secret code of a topic.", Parameters: json.RawMessage(`{"type":"object","properties":{"topic":{"type":"string"}},"required":["topic"]}`)}},
+		Input:         proto.TextInput("Call the Agent tool exactly once with subagent_type \"general-purpose\" and a prompt telling it to call the mcp__functions__lookup tool with topic \"sky\" and reply with the code it returned."),
+		AgentOptions:  map[string]any{"model": os.Getenv("OAC_TEST_CLAUDE_SDK_MODEL")}}
+	turn, err := startSingleTurn(ctx, config, request, out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer turn.Cancel(context.Background())
+	var events []proto.Envelope
+	var call, withdrawn proto.FunctionCallWithdrawnPayload
+	var pending proto.FunctionCallPayload
+	defer func() { saveEvidence(t, root, key, events) }()
+	for event := range out {
+		events = append(events, event)
+		switch event.Type {
+		case proto.TypeFunctionCall:
+			if err := event.DecodePayload(&pending); err != nil {
+				t.Fatal(err)
+			}
+			go turn.Cancel(ctx)
+		case proto.TypeFunctionCallWithdrawn:
+			if err := event.DecodePayload(&withdrawn); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	call = proto.FunctionCallWithdrawnPayload{CallID: pending.CallID, NativeID: pending.NativeID, TurnID: pending.TurnID}
+	if pending.NativeID == "" || withdrawn != call {
+		t.Fatalf("call %+v was not withdrawn: %+v", pending, withdrawn)
+	}
+}
diff --git a/apps/daemon/internal/agent/claudesdk/subagents_test.go b/apps/daemon/internal/agent/claudesdk/subagents_test.go
index 6cb3e7467..0acaef1b4 100644
--- a/apps/daemon/internal/agent/claudesdk/subagents_test.go
+++ b/apps/daemon/internal/agent/claudesdk/subagents_test.go
@@ -32,8 +32,6 @@ func TestSubagentConfigurationRejectsUnqualifiedAuthority(t *testing.T) {
 	for _, change := range []func(*proto.PromptRequestPayload){
 		func(r *proto.PromptRequestPayload) { r.DisableSubagents = true },
 		func(r *proto.PromptRequestPayload) { n := 0; r.MaxConcurrentSubagents = &n },
-		func(r *proto.PromptRequestPayload) { r.FunctionTools = []proto.FunctionTool{{Name: "function"}} },
-		func(r *proto.PromptRequestPayload) { v := []proto.MCPHTTPServer{}; r.MCPHTTPServers = &v },
 	} {
 		req := workspaceRequest()
 		req.DisableSubagents, req.ObserveSubagentIdentities = false, true
diff --git a/apps/daemon/internal/agent/claudesdk/tool_environment_test.go b/apps/daemon/internal/agent/claudesdk/tool_environment_test.go
index 7b53ca139..873bc281f 100644
--- a/apps/daemon/internal/agent/claudesdk/tool_environment_test.go
+++ b/apps/daemon/internal/agent/claudesdk/tool_environment_test.go
@@ -10,14 +10,13 @@ import (
 
 func TestSelfHostedToolEnvironment(t *testing.T) {
 	config := workspaceFixture(t)
-	config.Workspace.NetworkAccess = "enabled"
 	file := filepath.Join(t.TempDir(), "tool-env.json")
 	if err := os.WriteFile(file, []byte(`{"USER_VALUE":"ready"}`), 0600); err != nil {
 		t.Fatal(err)
 	}
 	t.Setenv("OAC_RUNTIME_TOOL_ENV_FILE", file)
 	req := workspaceRequest()
-	req.LocalEnvironment = &proto.LocalEnvironment{NetworkAccess: "enabled", WorkspaceRoot: config.Workspace.Directory}
+	req.LocalEnvironment = &proto.LocalEnvironment{WorkspaceRoot: config.Workspace.Directory}
 	profile, _, err := prepareWorkspace(config, req)
 	if err != nil {
 		t.Fatal(err)
diff --git a/apps/daemon/internal/agent/claudesdk/workspace.go b/apps/daemon/internal/agent/claudesdk/workspace.go
index dddda2cfc..e554a0581 100644
--- a/apps/daemon/internal/agent/claudesdk/workspace.go
+++ b/apps/daemon/internal/agent/claudesdk/workspace.go
@@ -4,26 +4,22 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/localworkspace"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentcapabilities"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
 )
 
 // WorkspaceConfig binds one trusted private placement. It does not create an
 // isolation boundary or authorize a public Environment. The operator must place
 // the entire factory inside the qualified outer mount/process boundary first.
 // State directories must already exist.
-// PublicDirectory may name a second mount of the same workspace inode.
 type WorkspaceConfig struct {
-	Directory       string
-	PublicDirectory string
-	NetworkAccess   string
-	AllowedDomains  []string
-	HomeDir         string
-	ScratchDir      string
+	Directory  string
+	HomeDir    string
+	ScratchDir string
 }
 
 type workspaceProfile struct {
@@ -35,8 +31,6 @@ type workspaceProfile struct {
 	State          string                             `json:"state"`
 	Scratch        string                             `json:"scratch"`
 	EnvNames       []string                           `json:"env_names"`
-	NetworkAccess  string                             `json:"network_access,omitempty"`
-	AllowedDomains []string                           `json:"allowed_domains,omitempty"`
 }
 
 func prepareWorkspace(config Config, req proto.PromptRequestPayload) (*workspaceProfile, []string, error) {
@@ -46,9 +40,6 @@ func prepareWorkspace(config Config, req proto.PromptRequestPayload) (*workspace
 	if req.LocalEnvironment != nil && req.LocalEnvironment.WorkspaceRoot != config.Workspace.Directory {
 		return nil, nil, fmt.Errorf("claudesdk: workspace root conflicts with the trusted workspace binding")
 	}
-	if req.LocalEnvironment != nil && !(agentnetwork.Policy{Access: config.Workspace.NetworkAccess, AllowedDomains: config.Workspace.AllowedDomains}).Equal(agentnetwork.Policy{Access: req.LocalEnvironment.NetworkAccess, AllowedDomains: req.LocalEnvironment.AllowedDomains}) {
-		return nil, nil, fmt.Errorf("claudesdk: local Runtime network policy mismatch")
-	}
 	profile, env, err := workspaceEnvironment(config)
 	if err != nil {
 		return nil, nil, err
@@ -72,20 +63,13 @@ func prepareWorkspace(config Config, req proto.PromptRequestPayload) (*workspace
 	return profile, append(env, credentials...), nil
 }
 
-func workspaceCwd(w *WorkspaceConfig) string {
-	if w.PublicDirectory != "" {
-		return w.PublicDirectory
-	}
-	return w.Directory
-}
-
 // Harness state paths and selected model credentials overlay the user environment.
 func workspaceEnvironment(config Config) (*workspaceProfile, []string, error) {
 	fail := func() (*workspaceProfile, []string, error) {
 		return nil, nil, fmt.Errorf("claudesdk: invalid trusted workspace configuration")
 	}
 	w := config.Workspace
-	if w == nil || (w.NetworkAccess != "" && w.NetworkAccess != "enabled") || len(w.AllowedDomains) != 0 {
+	if w == nil {
 		return fail()
 	}
 	for _, path := range []string{config.Node, config.Entrypoint, filepath.Join(filepath.Dir(config.Entrypoint), "runtime_check.js")} {
@@ -94,27 +78,20 @@ func workspaceEnvironment(config Config) (*workspaceProfile, []string, error) {
 			return fail()
 		}
 	}
-	for _, path := range []string{workspaceCwd(w), config.StateDir, w.HomeDir, w.ScratchDir} {
+	for _, path := range []string{w.Directory, config.StateDir, w.HomeDir, w.ScratchDir} {
 		if !canonicalWorkspaceDir(path) {
 			return fail()
 		}
 	}
-	if w.PublicDirectory != "" {
-		actual, err := os.Stat(w.Directory)
-		alias, aliasErr := os.Stat(w.PublicDirectory)
-		if err != nil || aliasErr != nil || !os.SameFile(actual, alias) {
-			return fail()
-		}
-	}
-	profile := &workspaceProfile{Home: w.HomeDir, State: config.StateDir, Scratch: w.ScratchDir, EnvNames: []string{}, NetworkAccess: w.NetworkAccess, AllowedDomains: []string{}}
+	profile := &workspaceProfile{Home: w.HomeDir, State: config.StateDir, Scratch: w.ScratchDir, EnvNames: []string{}}
 	env := []string{}
 	for _, entry := range os.Environ() {
 		name, _, _ := strings.Cut(entry, "=")
-		if name != "ANTHROPIC_API_KEY" && name != "ANTHROPIC_AUTH_TOKEN" && name != "ANTHROPIC_CUSTOM_HEADERS" && name != "CLAUDE_CODE_OAUTH_TOKEN" && name != "CLAUDE_CONFIG_DIR" && name != "HOME" && name != "TMPDIR" {
+		if !slices.Contains([]string{"ANTHROPIC_CUSTOM_HEADERS", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_CODE_MAX_CONTEXT_TOKENS", "CLAUDE_CODE_MAX_OUTPUT_TOKENS", "CLAUDE_CONFIG_DIR", "HOME", "TMPDIR"}, name) {
 			env = append(env, entry)
 		}
 	}
-	env = append(env, "HOME="+w.HomeDir, "TMPDIR="+w.ScratchDir, "CLAUDE_CONFIG_DIR="+config.StateDir, "DISABLE_TELEMETRY=1", "DISABLE_ERROR_REPORTING=1", "DISABLE_AUTOUPDATER=1", "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1", "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1")
+	env = append(env, "HOME="+w.HomeDir, "TMPDIR="+w.ScratchDir, "CLAUDE_CONFIG_DIR="+config.StateDir)
 	seen := map[string]bool{}
 	for _, entry := range config.Env {
 		name, _, ok := strings.Cut(entry, "=")
@@ -132,7 +109,8 @@ func workspaceEnvName(name string) bool {
 	switch name {
 	case "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL", "ANTHROPIC_CUSTOM_HEADERS",
 		"ANTHROPIC_DEFAULT_SONNET_MODEL", "ANTHROPIC_DEFAULT_OPUS_MODEL", "ANTHROPIC_DEFAULT_HAIKU_MODEL",
-		"CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS", "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY":
+		"CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS", "CLAUDE_CODE_MAX_CONTEXT_TOKENS", "CLAUDE_CODE_MAX_OUTPUT_TOKENS",
+		"HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY":
 		return true
 	default:
 		return false
diff --git a/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go
index b0143e694..df08c4bb2 100644
--- a/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go
@@ -91,7 +91,6 @@ func TestLiveClaudeWorkspaceFactory(t *testing.T) {
 		out := make(chan proto.Envelope, 64)
 		req := workspaceRequest()
 		req.RunID, req.Input, req.AgentSessionID = uuid.NewString(), proto.TextInput(prompt), resume
-		req.ObserveMessages = true
 		req.AgentOptions = map[string]any{"model": "MiniMax-M3", "system_prompt": "Follow the exact verification instructions using the requested native tools. Preserve conversation facts. No other files, network operations or background work."}
 		proof := evidence{RunID: req.RunID}
 		running, err := startSingleTurn(ctx, config, req, out)
@@ -155,6 +154,12 @@ func TestLiveClaudeWorkspaceFactory(t *testing.T) {
 				t.Fatal("cancellation outcome differs from terminal Done")
 			}
 		}
+		// Native history settles when the executor closes after Done; the next step must not race that close.
+		select {
+		case <-s.process.Done():
+		case <-ctx.Done():
+			t.Fatal("native process did not exit after the Turn")
+		}
 		writeEvidence(name, proof)
 		if proof.Terminals != 1 || (cancelOnEffect && !proof.Cancelled) {
 			t.Fatal("missing actual cancellation or unique completion")
diff --git a/apps/daemon/internal/agent/claudesdk/workspace_structured_test.go b/apps/daemon/internal/agent/claudesdk/workspace_structured_test.go
index ec627a49e..4b77d59ee 100644
--- a/apps/daemon/internal/agent/claudesdk/workspace_structured_test.go
+++ b/apps/daemon/internal/agent/claudesdk/workspace_structured_test.go
@@ -18,9 +18,8 @@ func TestWorkspaceStructuredPreparationQualificationAndFrozenSchema(t *testing.T
 		t.Run(mode, func(t *testing.T) {
 			config := preparationFixture(t, mode)
 			req := preparationRequest()
-			req.ObserveMessages = true
 			schema := `{"type":"object","properties":{"n":{"const":9007199254740992}}}`
-			req.ExecutionControls = &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium", OutputFormat: &proto.OutputFormat{Type: "json_schema", Schema: json.RawMessage(schema)}}
+			req.ExecutionControls = &proto.ExecutionControls{TextVerbosity: "medium", OutputFormat: &proto.OutputFormat{Type: "json_schema", Schema: json.RawMessage(schema)}}
 			e, err := NewExecutorFactory(config)(t.Context(), req)
 			if mode == "structured-missing" {
 				if err == nil || !strings.Contains(err.Error(), "workspace structured output") {
diff --git a/apps/daemon/internal/agent/claudesdk/workspace_test.go b/apps/daemon/internal/agent/claudesdk/workspace_test.go
index 2dab86f61..c5949c07b 100644
--- a/apps/daemon/internal/agent/claudesdk/workspace_test.go
+++ b/apps/daemon/internal/agent/claudesdk/workspace_test.go
@@ -84,8 +84,7 @@ func TestWorkspaceRejectsConflictsBeforeSideEffects(t *testing.T) {
 			case "none":
 				req.DisableExecutionEnvironment = true
 			case "workspace-root":
-				config.Workspace.NetworkAccess = "enabled"
-				req.LocalEnvironment = &proto.LocalEnvironment{ID: "environment", NetworkAccess: "enabled", WorkspaceRoot: config.Workspace.ScratchDir}
+				req.LocalEnvironment = &proto.LocalEnvironment{ID: "environment", WorkspaceRoot: config.Workspace.ScratchDir}
 			case "mcp":
 				req.MCPHTTPServers = &[]proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "remote", ServerURL: "https://example.test/mcp"}}
 			case "relative":
@@ -139,9 +138,8 @@ func TestWorkspaceRetainsDeclaredFunctions(t *testing.T) {
 
 func TestPublicMCPUsesWorkspaceProjectionWithoutCredentialCopy(t *testing.T) {
 	config := workspaceFixture(t)
-	config.Workspace.NetworkAccess = "enabled"
 	req := workspaceRequest()
-	req.LocalEnvironment = &proto.LocalEnvironment{NetworkAccess: "enabled", WorkspaceRoot: config.Workspace.Directory}
+	req.LocalEnvironment = &proto.LocalEnvironment{WorkspaceRoot: config.Workspace.Directory}
 	token := "vault-selected-canary"
 	tools := []string{"prove"}
 	req.MCPHTTPServers = &[]proto.MCPHTTPServer{{ConnectionOrigin: "environment", ServerLabel: "remote", ServerURL: "https://example.test/mcp", AllowedTools: &tools, Required: true, BearerToken: &token}}
diff --git a/apps/daemon/internal/agent/codex/boundary_independent_qa_test.go b/apps/daemon/internal/agent/codex/boundary_independent_qa_test.go
index 83e4dece1..4600e547b 100644
--- a/apps/daemon/internal/agent/codex/boundary_independent_qa_test.go
+++ b/apps/daemon/internal/agent/codex/boundary_independent_qa_test.go
@@ -85,7 +85,6 @@ func TestQANativeBoundaryActualLifecycle(t *testing.T) {
 func TestQANativeFirstTextFiltering(t *testing.T) {
 	var logs bytes.Buffer
 	s := boundaryTestSession(&logs)
-	s.observeMessages = true
 	for _, raw := range []string{
 		`{"threadId":"root","turnId":"stale","itemId":"i","delta":"SECRET_CANARY"}`,
 		`{"threadId":"root","turnId":"55555555-5555-4555-8555-555555555555","itemId":"i","delta":""}`,
diff --git a/apps/daemon/internal/agent/codex/contracts.go b/apps/daemon/internal/agent/codex/contracts.go
index 1304b87e5..97859b972 100644
--- a/apps/daemon/internal/agent/codex/contracts.go
+++ b/apps/daemon/internal/agent/codex/contracts.go
@@ -9,7 +9,6 @@ var (
 	_ agent.Turn                     = (*Session)(nil)
 	_ agent.Session                  = (*Session)(nil)
 	_ agent.DurableSteerer           = (*Session)(nil)
-	_ agent.Steerer                  = (*Session)(nil)
 	_ agent.FunctionResultSubmitter  = (*Session)(nil)
 	_ agent.WorkspaceReader          = (*Session)(nil)
 	_ agent.WorkspaceDirectoryLister = (*Session)(nil)
diff --git a/apps/daemon/internal/agent/codex/declaration.go b/apps/daemon/internal/agent/codex/declaration.go
index 6d02affce..ff96549d3 100644
--- a/apps/daemon/internal/agent/codex/declaration.go
+++ b/apps/daemon/internal/agent/codex/declaration.go
@@ -7,44 +7,11 @@ import (
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	configuration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/codex"
+	declaration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/codex"
 )
 
-// Declaration owns Codex discovery, configuration and execution factories.
-var Declaration = agent.Declaration{Info: proto.SupportedAgentKind{
-	Kind: "codex",
-	Capabilities: proto.AgentKindCapabilities{
-		SubagentObservations:           proto.CapabilitySupported,
-		Streaming:                      proto.CapabilitySupported,
-		Usage:                          proto.CapabilitySupported,
-		Resume:                         proto.CapabilitySupported,
-		RetainedNativeHistory:          proto.CapabilityUnsupported,
-		NativeSessionRecovery:          proto.CapabilityUnsupported,
-		Steering:                       proto.CapabilitySupported,
-		MessageItems:                   proto.CapabilitySupported,
-		ToolObservations:               proto.CapabilitySupported,
-		EnvironmentNone:                proto.CapabilitySupported,
-		LocalEnvironment:               proto.CapabilityUnsupported,
-		Preparation:                    proto.CapabilityUnsupported,
-		WorkspaceReadPreparation:       proto.CapabilityUnsupported,
-		WorkspaceOutputExport:          proto.CapabilityUnsupported,
-		ProgrammaticToolCallingDisable: proto.CapabilitySupported,
-		WebSearchControl:               proto.CapabilitySupported,
-		ExecutionControls:              proto.CapabilityFromBool(SupportsTextVerbosity),
-		TextVerbosity:                  proto.CapabilityFromBool(SupportsTextVerbosity),
-		StructuredOutput:               proto.CapabilityUnsupported,
-		ToolSearch:                     proto.CapabilityUnsupported,
-		MessageImages:                  proto.CapabilitySupported,
-		FunctionResultImages:           proto.CapabilitySupported,
-		SubagentControl:                proto.CapabilitySupported,
-		DurableInputReceipts:           proto.CapabilitySupported,
-		DurableTurns:                   proto.CapabilitySupported,
-		FunctionTools:                  proto.CapabilitySupported,
-		MCPHTTPTools:                   proto.CapabilitySupported,
-		MCPHTTPRequired:                proto.CapabilityUnsupported,
-		MCPHTTPBearerAuth:              proto.CapabilitySupported,
-	},
-}, Configuration: configuration.Configuration(), Discover: discover}
+// Declaration binds the shared Codex declaration to discovery and execution factories.
+var Declaration = agent.Declaration{Declaration: declaration.Declaration, Discover: discover}
 
 func discover(ctx context.Context, options agent.DiscoveryOptions, info proto.SupportedAgentKind) *agent.Runtime {
 	return discoverWithCheck(ctx, options, info, CheckCLIAvailable)
@@ -56,15 +23,16 @@ func discoverWithCheck(parent context.Context, options agent.DiscoveryOptions, i
 	version, err := check(ctx, "")
 	if err != nil {
 		fmt.Fprintf(options.Stderr, "oac-daemon: codex unavailable: %v\n  Install: %s\n", err, InstallURL)
-		return runtime
+		return agent.Unavailable(info)
 	}
 	runtime.Info.Available, runtime.Info.Version = true, version
 	caps := &runtime.Info.Capabilities
-	caps.NativeSessionRecovery = proto.CapabilityFromBool(SupportsNativeSessionRecovery(version))
-	caps.LocalEnvironment = proto.CapabilityFromBool(SupportsLocalEnvironment(version))
-	caps.WorkspaceReadPreparation = caps.LocalEnvironment
-	caps.RetainedNativeHistory = caps.LocalEnvironment
-	caps.MCPHTTPRequired = proto.CapabilityFromBool(SupportsNativeSessionRecovery(version))
+	recovery, local := SupportsNativeSessionRecovery(version), SupportsLocalEnvironment(version)
+	agent.Narrow(&caps.NativeSessionRecovery, recovery)
+	agent.Narrow(&caps.MCPHTTPRequired, recovery)
+	for _, capability := range []*proto.CapabilitySupport{&caps.LocalEnvironment, &caps.WorkspaceReadPreparation, &caps.WorkspaceOutputExport, &caps.RetainedNativeHistory} {
+		agent.Narrow(capability, local)
+	}
 	runtime.Executor = NewExecutorFactory(options.StateRoot)
 	fmt.Fprintf(options.Stdout, "Codex preflight ok (%s)\n", version)
 	return runtime
diff --git a/apps/daemon/internal/agent/codex/declaration_test.go b/apps/daemon/internal/agent/codex/declaration_test.go
index 87f94299c..0a929a68d 100644
--- a/apps/daemon/internal/agent/codex/declaration_test.go
+++ b/apps/daemon/internal/agent/codex/declaration_test.go
@@ -4,16 +4,15 @@ import (
 	"context"
 	"errors"
 	"io"
-	"reflect"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/contracttest"
 )
 
 func TestMCPRequiredDiscoveryRequiresPinnedNative(t *testing.T) {
 	for _, version := range []string{"codex-cli 0.153.4", "codex-cli 0.153.3", "codex-cli 0.154.0"} {
-		runtime := discoverWithCheck(t.Context(), agent.DiscoveryOptions{Stdout: io.Discard, Stderr: io.Discard}, Declaration.Info, func(context.Context, string) (string, error) { return version, nil })
+		runtime := discoverWithCheck(t.Context(), agent.DiscoveryOptions{Stdout: io.Discard, Stderr: io.Discard}, Declaration.Info(), func(context.Context, string) (string, error) { return version, nil })
 
 		if !runtime.Info.Available || runtime.Executor == nil || runtime.Info.Capabilities.WorkspaceReadPreparation.IsSupported() != SupportsLocalEnvironment(version) {
 			t.Fatalf("factories: %+v", runtime)
@@ -27,28 +26,16 @@ func TestMCPRequiredDiscoveryRequiresPinnedNative(t *testing.T) {
 	}
 }
 
-// The declaration must retain the complete baseline capability descriptor.
-func TestDeclaredCapabilityBaseline(t *testing.T) {
-	expected := map[string]bool{"SubagentObservations": true, "Streaming": true, "Usage": true, "Resume": true, "Steering": true, "MessageItems": true, "ToolObservations": true, "EnvironmentNone": true, "ProgrammaticToolCallingDisable": true, "WebSearchControl": true, "MessageImages": true, "FunctionResultImages": true, "SubagentControl": true, "DurableInputReceipts": true, "DurableTurns": true, "FunctionTools": true, "MCPHTTPTools": true, "MCPHTTPBearerAuth": true}
-	expected["ExecutionControls"], expected["TextVerbosity"] = SupportsTextVerbosity, SupportsTextVerbosity
-	value := reflect.ValueOf(Declaration.Info.Capabilities)
-	for i := 0; i < value.NumField(); i++ {
-		name := value.Type().Field(i).Name
-		want := proto.CapabilityUnsupported
-		if expected[name] {
-			want = proto.CapabilitySupported
-		}
-		if got := value.Field(i).Interface(); got != want {
-			t.Errorf("%s = %v, want %v", name, got, want)
-		}
-	}
-	if err := Declaration.Info.ValidateDeclaration(); err != nil {
-		t.Fatal(err)
+// Discovery narrows the declaration for the installed host and never widens it.
+func TestDiscoveryOnlyNarrowsDeclaration(t *testing.T) {
+	for _, version := range []string{"codex-cli 0.153.4", "codex-cli 0.153.3"} {
+		runtime := discoverWithCheck(t.Context(), agent.DiscoveryOptions{Stdout: io.Discard, Stderr: io.Discard}, Declaration.Info(), func(context.Context, string) (string, error) { return version, nil })
+		contracttest.RequireNarrowed(t, Declaration.Capabilities, runtime.Info.Capabilities)
 	}
 }
 
 func TestUnavailableRuntimeHasNoExecutionFactories(t *testing.T) {
-	runtime := discoverWithCheck(t.Context(), agent.DiscoveryOptions{Stdout: io.Discard, Stderr: io.Discard}, Declaration.Info, func(context.Context, string) (string, error) { return "", errors.New("missing") })
+	runtime := discoverWithCheck(t.Context(), agent.DiscoveryOptions{Stdout: io.Discard, Stderr: io.Discard}, Declaration.Info(), func(context.Context, string) (string, error) { return "", errors.New("missing") })
 	if runtime.Info.Available || runtime.Executor != nil {
 		t.Fatalf("unavailable runtime: %+v", runtime)
 	}
diff --git a/apps/daemon/internal/agent/codex/environment.go b/apps/daemon/internal/agent/codex/environment.go
index 725e5ef58..4eefb7b9c 100644
--- a/apps/daemon/internal/agent/codex/environment.go
+++ b/apps/daemon/internal/agent/codex/environment.go
@@ -37,7 +37,7 @@ func nativeEnvironmentStatus(ctx context.Context, rpc *JSONRPCClient, id string)
 	return result.Status, nil
 }
 
-// Native still recognizes the retired transport variables. Reject them before
+// Native Codex honors the executor transport variables. Reject them before
 // setup so the inherited environment cannot select a separate executor.
 // The explicit none selector remains part of native execution isolation.
 func validateNativeTransportEnvironment() error {
@@ -47,7 +47,7 @@ func validateNativeTransportEnvironment() error {
 			continue
 		}
 		if (key == "CODEX_EXEC_SERVER_URL" && value != "none") || strings.HasPrefix(key, "CODEX_EXEC_SERVER_NOISE_") {
-			return errors.New("codex: retired executor transport configuration is not supported")
+			return errors.New("codex: executor transport configuration is not supported")
 		}
 	}
 	return nil
diff --git a/apps/daemon/internal/agent/codex/environment_retired_test.go b/apps/daemon/internal/agent/codex/environment_transport_test.go
similarity index 86%
rename from apps/daemon/internal/agent/codex/environment_retired_test.go
rename to apps/daemon/internal/agent/codex/environment_transport_test.go
index f3e070843..36ed0e9e3 100644
--- a/apps/daemon/internal/agent/codex/environment_retired_test.go
+++ b/apps/daemon/internal/agent/codex/environment_transport_test.go
@@ -24,7 +24,7 @@ func TestReadOnlyPreparationRejectedBeforeNativeSetup(t *testing.T) {
 	}
 }
 
-func TestRetiredNativeTransportEnvironmentRejectedBeforeState(t *testing.T) {
+func TestNativeTransportEnvironmentRejectedBeforeState(t *testing.T) {
 	for _, key := range []string{"CODEX_EXEC_SERVER_URL", "CODEX_EXEC_SERVER_NOISE_REGISTRY_URL", "CODEX_EXEC_SERVER_NOISE_ENVIRONMENT_ID", "CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN"} {
 		for _, none := range []bool{false, true} {
 			t.Run(key+"/"+map[bool]string{false: "local", true: "none"}[none], func(t *testing.T) {
@@ -33,16 +33,16 @@ func TestRetiredNativeTransportEnvironmentRejectedBeforeState(t *testing.T) {
 				if !none {
 					req.LocalEnvironment = &proto.LocalEnvironment{ID: "local"}
 				}
-				t.Setenv(key, "retired-private-value")
+				t.Setenv(key, "private-value")
 				p, err := newPreparation(t.Context(), req, cfg)
-				if p != nil || err == nil || !strings.Contains(err.Error(), "retired executor transport") || strings.Contains(err.Error(), "retired-private-value") {
+				if p != nil || err == nil || !strings.Contains(err.Error(), "executor transport") || strings.Contains(err.Error(), "private-value") {
 					t.Fatal("transport override admitted or disclosed", err)
 				}
 				if len(preparationFrames(t, root)) != 0 {
-					t.Fatal("retired transport started native process")
+					t.Fatal("transport override started native process")
 				}
 				if _, err := os.Stat(filepath.Join(root, "daemon", "agent-sessions")); !os.IsNotExist(err) {
-					t.Fatal("retired transport created state", err)
+					t.Fatal("transport override created state", err)
 				}
 			})
 		}
diff --git a/apps/daemon/internal/agent/codex/execution_controls_test.go b/apps/daemon/internal/agent/codex/execution_controls_test.go
index 374e0e1a0..12d072865 100644
--- a/apps/daemon/internal/agent/codex/execution_controls_test.go
+++ b/apps/daemon/internal/agent/codex/execution_controls_test.go
@@ -7,32 +7,59 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func TestExecutionControlsSelectNativeSettings(t *testing.T) {
+func ptr[T any](v T) *T { return &v }
+
+func TestExecutionControlsMapToNativeSettings(t *testing.T) {
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-	for _, search := range []string{"disabled", "cached", "live"} {
-		for _, verbosity := range []string{"low", "medium", "high"} {
-			plan, err := BuildSessionPlan(testStateRoot(t), "state", map[string]any{"model": "test-model"}, &proto.ExecutionControls{WebSearch: search, TextVerbosity: verbosity})
+	base := [][2]string{{"tools.experimental_request_user_input.enabled", "false"}}
+	for _, tc := range []struct {
+		name     string
+		controls *proto.ExecutionControls
+		want     [][2]string
+	}{
+		{"absent controls turn summaries off", nil, nil},
+		{"empty controls turn summaries off", &proto.ExecutionControls{}, nil},
+		{"verbosity", &proto.ExecutionControls{TextVerbosity: "high"}, [][2]string{{"model_verbosity", `"high"`}}},
+		{"search without settings", &proto.ExecutionControls{WebSearch: &proto.WebSearchControl{Mode: "live", ContextSize: "medium"}},
+			[][2]string{{"web_search", `"live"`}, {"tools.web_search.context_size", `"medium"`}}},
+		{"search settings", &proto.ExecutionControls{WebSearch: &proto.WebSearchControl{Mode: "cached", ContextSize: "high", AllowedDomains: []string{"a.example", "b.example"},
+			Location: &proto.SearchLocation{City: ptr("Paris"), Timezone: ptr("Europe/Paris")}}},
+			[][2]string{{"web_search", `"cached"`}, {"tools.web_search.context_size", `"high"`}, {"tools.web_search.allowed_domains", `["a.example","b.example"]`},
+				{"tools.web_search.location.city", `"Paris"`}, {"tools.web_search.location.timezone", `"Europe/Paris"`}}},
+		{"empty domain list stays distinct from null", &proto.ExecutionControls{WebSearch: &proto.WebSearchControl{Mode: "disabled", ContextSize: "low", AllowedDomains: []string{}}},
+			[][2]string{{"web_search", `"disabled"`}, {"tools.web_search.context_size", `"low"`}, {"tools.web_search.allowed_domains", `[]`}}},
+		{"reasoning and tier", &proto.ExecutionControls{ReasoningEffort: "max", ReasoningSummary: "concise", ServiceTier: "priority"},
+			[][2]string{{"model_reasoning_effort", `"max"`}, {"model_reasoning_summary", `"concise"`}, {"service_tier", `"priority"`}}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			plan, err := BuildSessionPlan(testStateRoot(t), "state", map[string]any{"model": "test-model"}, tc.controls)
 			if err != nil {
 				t.Fatal(err)
 			}
 			plan.Cleanup()
-			want := [][2]string{{"tools.experimental_request_user_input.enabled", "false"}, {"web_search", `"` + search + `"`}, {"model_verbosity", `"` + verbosity + `"`}}
-			if !reflect.DeepEqual(plan.ExtraConfig, want) {
+			want := append([][2]string{}, base...)
+			if tc.controls == nil || tc.controls.ReasoningSummary == "" {
+				want = append(want, [2]string{"model_reasoning_summary", `"none"`})
+			}
+			if want = append(want, tc.want...); !reflect.DeepEqual(plan.ExtraConfig, want) {
 				t.Fatalf("config = %v, want %v", plan.ExtraConfig, want)
 			}
-		}
+			if plan.ReasoningSummary != (tc.controls != nil && tc.controls.ReasoningSummary != "") {
+				t.Fatalf("reasoning summary gate = %v", plan.ReasoningSummary)
+			}
+		})
 	}
 }
 
-func TestExecutionControlsRejectIncompleteOrInvalidValues(t *testing.T) {
+func TestExecutionControlsRejectUndeclaredValues(t *testing.T) {
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
 	for _, controls := range []proto.ExecutionControls{
-		{}, {WebSearch: "disabled"}, {TextVerbosity: "medium"},
-		{WebSearch: "invalid", TextVerbosity: "medium"}, {WebSearch: "disabled", TextVerbosity: "invalid"},
+		{WebSearch: &proto.WebSearchControl{Mode: "indexed", ContextSize: "medium"}},
+		{TextVerbosity: "invalid"}, {ReasoningEffort: "ultra"}, {ReasoningSummary: "none"}, {ServiceTier: "scale"},
 	} {
 		if plan, err := BuildSessionPlan(testStateRoot(t), "state", nil, &controls); err == nil {
 			plan.Cleanup()
-			t.Fatal("invalid controls accepted", controls)
+			t.Fatal("undeclared controls accepted", controls)
 		}
 	}
 }
diff --git a/apps/daemon/internal/agent/codex/executor.go b/apps/daemon/internal/agent/codex/executor.go
index 2cdb0fe49..0b2ca1a6a 100644
--- a/apps/daemon/internal/agent/codex/executor.go
+++ b/apps/daemon/internal/agent/codex/executor.go
@@ -70,10 +70,10 @@ func (e *Executor) StartTurn(ctx context.Context, runID string, input proto.Mess
 	functions := &functionCalls{definitions: base.functions.definitions, names: base.functions.names, pending: map[string]*pendingFunction{}}
 	turnCtx, cancel := context.WithCancel(base.cancelCtx)
 	s := &Session{boundary: newNativeBoundary(ctx, entered), executor: e, nativeHome: base.nativeHome,
-		functions: functions, observeMessages: base.observeMessages, observeSubagentIdentities: base.observeSubagentIdentities,
+		functions: functions, observeSubagentIdentities: base.observeSubagentIdentities,
 		cfg: base.cfg, rpc: base.rpc, cancelCtx: turnCtx, cancelFn: cancel,
 		waitDone: make(chan struct{}), outputDone: make(chan struct{}), cleanup: func() {},
-		bufs: NewItemBuffers(), resolvedModel: base.resolvedModel, runID: runID, out: out}
+		bufs: NewItemBuffers(), resolvedModel: base.resolvedModel, reasoningSummary: base.reasoningSummary, runID: runID, out: out}
 	if previous != nil {
 		s.threadID = previous.currentThreadID()
 		s.retiredTurns = make(map[string]bool, len(previous.retiredTurns)+1)
diff --git a/apps/daemon/internal/agent/codex/executor_native_test.go b/apps/daemon/internal/agent/codex/executor_native_test.go
index faee82904..2f6150630 100644
--- a/apps/daemon/internal/agent/codex/executor_native_test.go
+++ b/apps/daemon/internal/agent/codex/executor_native_test.go
@@ -14,9 +14,12 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-// This opt-in test uses the real pinned harness and an explicitly configured
-// Responses provider. Credentials are read from a private file, never arguments.
-func TestExecutorNativeReuse(t *testing.T) {
+// nativeAcceptanceConfig returns the pinned binary and the explicitly
+// configured Responses provider of an opt-in native test, and gives the test an
+// isolated Runtime home. Credentials are read from a private file, never
+// arguments.
+func nativeAcceptanceConfig(t *testing.T) (binary string, options map[string]any) {
+	t.Helper()
 	if os.Getenv("OAC_TEST_CODEX_EXECUTOR_NATIVE") != "1" {
 		t.Skip("requires an authorized native model acceptance environment")
 	}
@@ -45,13 +48,18 @@ func TestExecutorNativeReuse(t *testing.T) {
 	for _, name := range []string{"CODEX_EXEC_SERVER_URL", "CODEX_EXEC_SERVER_NOISE_REGISTRY_URL", "CODEX_EXEC_SERVER_NOISE_ENVIRONMENT_ID", "CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN"} {
 		t.Setenv(name, "")
 	}
+	return binary, map[string]any{"model": model, "model_provider": map[string]any{"base_url": endpoint, "protocol": "responses", "api_key": strings.TrimSpace(string(key))}}
+}
+
+func TestExecutorNativeReuse(t *testing.T) {
+	binary, options := nativeAcceptanceConfig(t)
 	cfg := defaultSessionConfig(testStateRoot(t))
 	cfg.codexBinary = binary
 	cfg.logger = slog.New(slog.DiscardHandler)
 	req := proto.PromptRequestPayload{
 		AgentKind: "codex", AgentStateKey: "executor-native",
-		DisableExecutionEnvironment: true, DisableSubagents: true, ObserveMessages: true,
-		AgentOptions:  map[string]any{"model": model, "model_provider": map[string]any{"base_url": endpoint, "protocol": "responses", "api_key": strings.TrimSpace(string(key))}},
+		DisableExecutionEnvironment: true, DisableSubagents: true,
+		AgentOptions:  options,
 		FunctionTools: []proto.FunctionTool{{Name: "hold", Description: "Wait until the host supplies a result.", Parameters: json.RawMessage("{\"type\":\"object\",\"properties\":{},\"additionalProperties\":false}")}},
 	}
 	ctx, cancel := context.WithTimeout(t.Context(), 4*time.Minute)
diff --git a/apps/daemon/internal/agent/codex/executor_turn.go b/apps/daemon/internal/agent/codex/executor_turn.go
index 6fa3cebb4..5752cf667 100644
--- a/apps/daemon/internal/agent/codex/executor_turn.go
+++ b/apps/daemon/internal/agent/codex/executor_turn.go
@@ -44,7 +44,7 @@ func (s *Session) settleExecutorTurn(startErr error) {
 	s.operationsClosed = true
 	s.operationMu.Unlock()
 	s.stopSteering()
-	s.stopFunctionCalls()
+	s.stopFunctionCalls(false)
 	if !s.nativeSettled.Load() || startErr != nil || !s.rpc.Alive() {
 		s.cancelFn()
 		s.settlementErr = errors.Join(s.settlementErr, s.rpc.Close())
@@ -118,7 +118,7 @@ func (s *Session) cancelExecutorTurn(ctx context.Context) error {
 		s.cancelReady = make(chan struct{})
 		go func() {
 			defer close(s.cancelReady)
-			s.stopFunctionCalls()
+			s.stopFunctionCalls(false)
 			turnID, active := s.stopSteering()
 			if !s.terminal.Load() && active {
 				if turnID == "" {
@@ -149,19 +149,8 @@ func (s *Session) cancelExecutorTurn(ctx context.Context) error {
 
 var _ agent.Turn = (*Session)(nil)
 
-// Server callbacks retain their originating Turn, whose ID must match exactly.
 func (s *Session) onServerRequest(method string, handler ServerRequestHandler) {
 	s.rpc.OnServerRequest(method, func(raw json.RawMessage, id any) (any, error) {
-		if s.executor != nil {
-			var scope struct {
-				ThreadID string `json:"threadId"`
-				TurnID   string `json:"turnId"`
-			}
-			if json.Unmarshal(raw, &scope) != nil || !s.isRootThread(scope.ThreadID) || s.terminal.Load() ||
-				scope.TurnID == "" || !s.isRootTurn(scope.ThreadID, scope.TurnID) {
-				return nil, errors.New("codex: request does not belong to the active turn")
-			}
-		}
 		if !s.beginOperation() {
 			return nil, errors.New("codex: turn has settled")
 		}
diff --git a/apps/daemon/internal/agent/codex/function_receipt_test.go b/apps/daemon/internal/agent/codex/function_receipt_test.go
index fd138a009..63ce1f357 100644
--- a/apps/daemon/internal/agent/codex/function_receipt_test.go
+++ b/apps/daemon/internal/agent/codex/function_receipt_test.go
@@ -137,7 +137,7 @@ func TestFunctionReceiptResultIsFrozenAndSubmittedOnce(t *testing.T) {
 	if err := s.SubmitFunctionResult(t.Context(), result); err == nil {
 		t.Fatal("settled result admitted again")
 	}
-	s.stopFunctionCalls()
+	s.stopFunctionCalls(false)
 }
 
 func TestFunctionReceiptShutdownDoesNotConfirmApplication(t *testing.T) {
@@ -151,7 +151,7 @@ func TestFunctionReceiptShutdownDoesNotConfirmApplication(t *testing.T) {
 			case "run cancellation":
 				s.cancelFn()
 			case "terminal":
-				s.stopFunctionCalls()
+				s.stopFunctionCalls(false)
 			}
 			select {
 			case err := <-done:
@@ -161,7 +161,7 @@ func TestFunctionReceiptShutdownDoesNotConfirmApplication(t *testing.T) {
 			case <-time.After(time.Second):
 				t.Fatal("shutdown did not settle receipt")
 			}
-			s.stopFunctionCalls()
+			s.stopFunctionCalls(false)
 		})
 	}
 }
@@ -199,7 +199,7 @@ func TestFunctionReceiptDeadlineEndsUncertainExecution(t *testing.T) {
 	if s.cancelCtx.Err() == nil {
 		t.Fatal("uncertain native execution remains active")
 	}
-	s.stopFunctionCalls()
+	s.stopFunctionCalls(false)
 }
 
 // The receipt and deadline are both ready when the waiter resumes. Either select
@@ -211,7 +211,7 @@ func TestFunctionReceiptWinsSimultaneousDeadline(t *testing.T) {
 		s.setThreadID("thread")
 		s.startSteering("thread", "turn")
 		s.functions, _ = prepareFunctionTools(nil)
-		pending := &pendingFunction{turnID: "turn", name: "lookup", reply: &functionReply{Success: true, ContentItems: []functionContent{}}, receipt: make(chan error, 1)}
+		pending := &pendingFunction{thread: "thread", turnID: "turn", name: "lookup", reply: &functionReply{Success: true, ContentItems: []functionContent{}}, receipt: make(chan error, 1)}
 		s.functions.pending["call"] = pending
 		s.confirmFunctionResult(nativeFunctionReceipt("thread", "turn", "call", "lookup", "true", "completed", "[]"))
 		ctx, cancel := context.WithCancel(t.Context())
@@ -254,11 +254,11 @@ func TestFunctionReceiptSurvivesObservationBackpressure(t *testing.T) {
 				cancel()
 			case "cancel":
 				s.cancelled.Store(true)
-				s.stopFunctionCalls()
+				s.stopFunctionCalls(false)
 				s.cancelFn()
 			case "terminal":
 				s.terminal.Store(true)
-				s.stopFunctionCalls()
+				s.stopFunctionCalls(false)
 			}
 			select {
 			case err := <-receipt:
diff --git a/apps/daemon/internal/agent/codex/function_receipts.go b/apps/daemon/internal/agent/codex/function_receipts.go
index ba6727b16..f9264de9f 100644
--- a/apps/daemon/internal/agent/codex/function_receipts.go
+++ b/apps/daemon/internal/agent/codex/function_receipts.go
@@ -18,8 +18,11 @@ type functionReply struct {
 }
 
 type pendingFunction struct {
-	rpcID   any
-	turnID  string
+	rpcID  any
+	thread string
+	turnID string
+	// held is the Subagent call that waits for its child Turn fact.
+	held    *proto.Envelope
 	name    string
 	reply   *functionReply
 	receipt chan error
@@ -51,7 +54,7 @@ func (s *Session) SubmitFunctionResult(ctx context.Context, result proto.Functio
 	}
 	s.functions.mu.Lock()
 	pending := s.functions.pending[result.CallID]
-	if pending == nil || pending.reply != nil || s.functions.closed || s.cancelled.Load() || s.terminal.Load() {
+	if pending == nil || pending.reply != nil || s.functions.closed || s.cancelled.Load() || (pending.thread == s.currentThreadID() && s.terminal.Load()) {
 		s.functions.mu.Unlock()
 		return agent.ErrUnknownFunctionCall
 	}
@@ -129,13 +132,13 @@ func (s *Session) confirmFunctionResult(raw json.RawMessage) {
 		TurnID   string                `json:"turnId"`
 		Item     toolObservationSource `json:"item"`
 	}
-	if json.Unmarshal(raw, &event) != nil || event.Item.Type != "dynamicToolCall" || !s.isRootTurn(event.ThreadID, event.TurnID) {
+	if json.Unmarshal(raw, &event) != nil || event.Item.Type != "dynamicToolCall" {
 		return
 	}
 	s.functions.mu.Lock()
 	defer s.functions.mu.Unlock()
 	pending := s.functions.pending[event.Item.ID]
-	if pending == nil || pending.reply == nil || s.functions.closed || s.cancelled.Load() {
+	if pending == nil || pending.thread != event.ThreadID || pending.turnID != event.TurnID || pending.reply == nil || s.functions.closed || s.cancelled.Load() {
 		return
 	}
 	item := event.Item
@@ -144,7 +147,7 @@ func (s *Session) confirmFunctionResult(raw json.RawMessage) {
 		status = "failed"
 	}
 	var err error
-	if pending.turnID != event.TurnID || pending.name != item.Tool || item.Namespace != "" || item.Status != status || item.Success == nil || *item.Success != pending.reply.Success || item.ContentItems == nil || !reflect.DeepEqual(*item.ContentItems, pending.reply.ContentItems) {
+	if pending.name != item.Tool || item.Namespace != "" || item.Status != status || item.Success == nil || *item.Success != pending.reply.Success || item.ContentItems == nil || !reflect.DeepEqual(*item.ContentItems, pending.reply.ContentItems) {
 		err = errors.New("codex: native function receipt does not match submitted result")
 	}
 	delete(s.functions.pending, item.ID)
diff --git a/apps/daemon/internal/agent/codex/functions.go b/apps/daemon/internal/agent/codex/functions.go
index e2a359d4b..925f50e3a 100644
--- a/apps/daemon/internal/agent/codex/functions.go
+++ b/apps/daemon/internal/agent/codex/functions.go
@@ -1,6 +1,7 @@
 package codex
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"strings"
@@ -28,9 +29,6 @@ type functionCalls struct {
 
 func prepareFunctionTools(tools []proto.FunctionTool) (*functionCalls, error) {
 	state := &functionCalls{names: map[string]bool{}, pending: map[string]*pendingFunction{}}
-	if len(tools) > 64 {
-		return nil, errors.New("at most 64 function tools are supported")
-	}
 	for _, tool := range tools {
 		var schema map[string]any
 		if strings.TrimSpace(tool.Name) == "" || state.names[tool.Name] || json.Unmarshal(tool.Parameters, &schema) != nil || schema == nil {
@@ -54,21 +52,38 @@ func (s *Session) handleFunctionCall(raw json.RawMessage, rpcID any) (any, error
 	if err := json.Unmarshal(raw, &call); err != nil {
 		return nil, err
 	}
-	if s.functions == nil || !s.functions.names[call.Tool] || call.Namespace != nil || call.CallID == "" || !s.isRootTurn(call.ThreadID, call.TurnID) || !json.Valid(call.Arguments) {
+	root := s.isRootTurn(call.ThreadID, call.TurnID)
+	child := !root && s.subagents != nil && call.TurnID != "" && call.ThreadID != "" && !s.isRootThread(call.ThreadID)
+	if s.functions == nil || !s.functions.names[call.Tool] || call.Namespace != nil || call.CallID == "" || !(root || child) || !json.Valid(call.Arguments) {
 		return nil, errors.New("unexpected function call")
 	}
+	payload := proto.FunctionCallPayload{CallID: call.CallID, Name: call.Tool, Arguments: call.Arguments}
+	if child {
+		payload.NativeID, payload.TurnID = call.ThreadID, call.TurnID
+	}
+	env, err := proto.NewEnvelope(proto.TypeFunctionCall, s.runID, payload)
+	if err != nil {
+		return nil, err
+	}
 	s.functions.mu.Lock()
-	if s.functions.closed || s.cancelled.Load() || s.terminal.Load() || s.functions.pending[call.CallID] != nil || len(s.functions.pending) >= 64 {
+	if s.functions.closed || s.cancelled.Load() || (root && s.terminal.Load()) || s.functions.pending[call.CallID] != nil || len(s.functions.pending) >= 64 {
 		s.functions.mu.Unlock()
 		return nil, errors.New("function call cannot be admitted")
 	}
-	s.functions.pending[call.CallID] = &pendingFunction{rpcID: rpcID, turnID: call.TurnID, name: call.Tool, receipt: make(chan error, 1)}
+	pending := &pendingFunction{rpcID: rpcID, thread: call.ThreadID, turnID: call.TurnID, name: call.Tool, receipt: make(chan error, 1)}
+	if child {
+		pending.held = &env
+	}
+	s.functions.pending[call.CallID] = pending
 	s.functions.mu.Unlock()
-	env, err := proto.NewEnvelope(proto.TypeFunctionCall, s.runID, proto.FunctionCallPayload{CallID: call.CallID, Name: call.Tool, Arguments: call.Arguments})
-	if err == nil {
-		err = s.sendFunctionCall(env)
+	if child {
+		select {
+		case s.subagents.wake <- struct{}{}:
+		default:
+		}
+		return DeferReply, nil
 	}
-	if err != nil {
+	if err = s.sendFunctionCall(env); err != nil {
 		s.functions.mu.Lock()
 		delete(s.functions.pending, call.CallID)
 		s.functions.mu.Unlock()
@@ -101,14 +116,72 @@ type functionContent struct {
 	ImageURL *string `json:"imageUrl,omitempty"`
 }
 
-func (s *Session) stopFunctionCalls() {
+// stopFunctionCalls ends every pending call. With rootOnly it ends the root's
+// calls and keeps accepting those of Subagents, which outlive the root Turn.
+func (s *Session) stopFunctionCalls(rootOnly bool) {
 	if s.functions != nil {
 		s.functions.mu.Lock()
-		s.functions.closed = true
-		for _, pending := range s.functions.pending {
-			pending.receipt <- agent.ErrUnknownFunctionCall
+		s.functions.closed = s.functions.closed || !rootOnly
+		for id, pending := range s.functions.pending {
+			if !rootOnly || pending.thread == s.currentThreadID() {
+				pending.receipt <- agent.ErrUnknownFunctionCall
+				delete(s.functions.pending, id)
+			}
 		}
-		clear(s.functions.pending)
 		s.functions.mu.Unlock()
 	}
 }
+
+// withdrawChildCalls removes the pending calls of a child Turn that ended and
+// reports them to Core as withdrawn. Native drops their requests without a
+// reply, so no result can be applied. A call still held was never reported.
+func (s *Session) withdrawChildCalls(ctx context.Context, thread, turn string) error {
+	if s.functions == nil {
+		return nil
+	}
+	var withdrawn []proto.Envelope
+	s.functions.mu.Lock()
+	for id, pending := range s.functions.pending {
+		if pending.thread != thread || pending.turnID != turn {
+			continue
+		}
+		delete(s.functions.pending, id)
+		pending.receipt <- agent.ErrUnknownFunctionCall
+		if pending.held != nil {
+			continue
+		}
+		env, err := proto.NewEnvelope(proto.TypeFunctionCallWithdrawn, s.runID, proto.FunctionCallWithdrawnPayload{CallID: id, NativeID: thread, TurnID: turn})
+		if err != nil {
+			s.functions.mu.Unlock()
+			return err
+		}
+		withdrawn = append(withdrawn, env)
+	}
+	s.functions.mu.Unlock()
+	for _, env := range withdrawn {
+		if !s.sendWithin(ctx, env) {
+			return errors.New("codex: function call withdrawal delivery unavailable")
+		}
+	}
+	return nil
+}
+
+// sendHeldFunctionCalls sends the Subagent calls whose child Turn Core already
+// has, because Core resolves a child's call through its identity.
+func (s *Session) sendHeldFunctionCalls(ctx context.Context) {
+	if s.functions == nil {
+		return
+	}
+	var ready []proto.Envelope
+	s.functions.mu.Lock()
+	for _, pending := range s.functions.pending {
+		if _, sent := s.subagents.sent[proto.TypeSubagentTurn+":"+pending.thread+":"+pending.turnID]; sent && pending.held != nil {
+			ready = append(ready, *pending.held)
+			pending.held = nil
+		}
+	}
+	s.functions.mu.Unlock()
+	for _, env := range ready {
+		s.sendWithin(ctx, env)
+	}
+}
diff --git a/apps/daemon/internal/agent/codex/functions_test.go b/apps/daemon/internal/agent/codex/functions_test.go
index a2fd9c752..6019a1680 100644
--- a/apps/daemon/internal/agent/codex/functions_test.go
+++ b/apps/daemon/internal/agent/codex/functions_test.go
@@ -109,7 +109,7 @@ func TestFunctionCallRejectsUnregisteredAndClosedRuns(t *testing.T) {
 			t.Fatal("unexpected call accepted", params)
 		}
 	}
-	s.stopFunctionCalls()
+	s.stopFunctionCalls(false)
 	if _, err := s.handleFunctionCall(json.RawMessage(`{"threadId":"thread","turnId":"turn","callId":"a","tool":"lookup","arguments":{}}`), "rpc"); err == nil {
 		t.Fatal("closed run accepted call")
 	}
@@ -118,6 +118,56 @@ func TestFunctionCallRejectsUnregisteredAndClosedRuns(t *testing.T) {
 	}
 }
 
+func TestSubagentFunctionCallWaitsForChildTurnAndOutlivesRoot(t *testing.T) {
+	tc, srv, cleanup := NewTestClient()
+	defer cleanup()
+	s, out := newFunctionTestSession(tc.JSONRPCClient)
+	s.subagents = &subagentObservations{wake: make(chan struct{}, 1), sent: map[string]string{}}
+	s.functions, _ = prepareFunctionTools([]proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{"type":"object"}`)}})
+	s.setThreadID("root")
+	s.startSteering("root", "turn")
+	if err := SendServerRequest(srv, "rpc-call", "item/tool/call", map[string]any{"threadId": "child", "turnId": "child-turn", "callId": "call", "tool": "lookup", "arguments": map[string]string{}}); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-s.subagents.wake:
+	case <-time.After(time.Second):
+		t.Fatal("child call did not wake the observer")
+	}
+	// The root Turn ends while the child still waits for its answer.
+	s.terminal.Store(true)
+	s.stopFunctionCalls(true)
+	s.sendHeldFunctionCalls(t.Context())
+	select {
+	case env := <-out:
+		t.Fatal("call sent before its child Turn fact", env)
+	default:
+	}
+	s.subagents.sent[proto.TypeSubagentTurn+":child:child-turn"] = "{}"
+	s.sendHeldFunctionCalls(t.Context())
+	var call proto.FunctionCallPayload
+	if env := <-out; env.DecodePayload(&call) != nil || call.CallID != "call" || call.NativeID != "child" || call.TurnID != "child-turn" {
+		t.Fatal(env)
+	}
+	text := "answer"
+	finished := make(chan error, 1)
+	go func() {
+		finished <- s.SubmitFunctionResult(t.Context(), proto.FunctionResultPayload{CallID: "call", Success: true, Content: []proto.InputContent{{Type: "input_text", Text: &text}}})
+	}()
+	var reply struct {
+		Result map[string]any `json:"result"`
+	}
+	if err := json.NewDecoder(srv.FromClient).Decode(&reply); err != nil {
+		t.Fatal(err)
+	}
+	reply.Result["type"], reply.Result["id"], reply.Result["tool"], reply.Result["status"] = "dynamicToolCall", "call", "lookup", "completed"
+	native, _ := json.Marshal(map[string]any{"threadId": "child", "turnId": "child-turn", "item": reply.Result})
+	s.onItemCompleted(native)
+	if err := <-finished; err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestFunctionToolDefinitionsRejectAmbiguousInput(t *testing.T) {
 	for _, tools := range [][]proto.FunctionTool{
 		{{Name: "", Parameters: json.RawMessage(`{}`)}},
@@ -130,3 +180,34 @@ func TestFunctionToolDefinitionsRejectAmbiguousInput(t *testing.T) {
 		}
 	}
 }
+
+func TestEndedChildTurnWithdrawsItsPendingCall(t *testing.T) {
+	tc, srv, cleanup := NewTestClient()
+	defer cleanup()
+	s, out := newFunctionTestSession(tc.JSONRPCClient)
+	s.subagents = &subagentObservations{wake: make(chan struct{}, 1), sent: map[string]string{proto.TypeSubagentTurn + ":child:child-turn": "{}"}}
+	s.functions, _ = prepareFunctionTools([]proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{"type":"object"}`)}})
+	s.setThreadID("root")
+	s.startSteering("root", "turn")
+	if err := SendServerRequest(srv, "rpc-call", "item/tool/call", map[string]any{"threadId": "child", "turnId": "child-turn", "callId": "call", "tool": "lookup", "arguments": map[string]string{}}); err != nil {
+		t.Fatal(err)
+	}
+	<-s.subagents.wake
+	s.sendHeldFunctionCalls(t.Context())
+	<-out
+	if err := s.withdrawChildCalls(t.Context(), "child", "child-turn"); err != nil {
+		t.Fatal(err)
+	}
+	var withdrawn proto.FunctionCallWithdrawnPayload
+	if env := <-out; env.Type != proto.TypeFunctionCallWithdrawn || env.DecodePayload(&withdrawn) != nil || withdrawn != (proto.FunctionCallWithdrawnPayload{CallID: "call", NativeID: "child", TurnID: "child-turn"}) {
+		t.Fatal(env)
+	}
+	if err := s.SubmitFunctionResult(t.Context(), proto.FunctionResultPayload{CallID: "call", Success: true, Content: []proto.InputContent{}}); !errors.Is(err, agent.ErrUnknownFunctionCall) {
+		t.Fatal(err)
+	}
+	select {
+	case <-s.rpc.Done():
+		t.Fatal("a late result closed the native process")
+	default:
+	}
+}
diff --git a/apps/daemon/internal/agent/codex/harness_config_test.go b/apps/daemon/internal/agent/codex/harness_config_test.go
index 7ca086aa9..7b9150ccc 100644
--- a/apps/daemon/internal/agent/codex/harness_config_test.go
+++ b/apps/daemon/internal/agent/codex/harness_config_test.go
@@ -8,24 +8,32 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
 	"slices"
+	"strings"
 	"testing"
 )
 
-func TestHarnessConfigAppliedWithoutChangingProvider(t *testing.T) {
+func TestReasoningEffortAppliedWithoutChangingProvider(t *testing.T) {
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
 	plan, err := BuildSessionPlan(testStateRoot(t), "native-config", map[string]any{
-		"model": "fixture", "harness_config": map[string]any{"model_reasoning_effort": "high"},
+		"model":          "fixture",
 		"model_provider": map[string]any{"base_url": "https://provider.invalid/v1", "protocol": "responses", "api_key": "test-key"},
-	}, nil)
+	}, &proto.ExecutionControls{ReasoningEffort: "max"})
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer plan.Cleanup()
-	if plan.Model != "fixture" || plan.ModelProvider != oacProviderSlug || !slices.Contains(plan.ExtraConfig, [2]string{"model_reasoning_effort", `"high"`}) {
+	if plan.Model != "fixture" || plan.ModelProvider != oacProviderSlug || !slices.Contains(plan.ExtraConfig, [2]string{"model_reasoning_effort", `"max"`}) {
 		t.Fatalf("native configuration not applied: %+v", plan.ExtraConfig)
 	}
 }
 
+func TestReasoningEffortHasNoHarnessConfigHome(t *testing.T) {
+	_, err := BuildSessionPlan(testStateRoot(t), "", map[string]any{"harness_config": map[string]any{"model_reasoning_effort": "high"}}, nil)
+	if err != harnessconfig.ErrHarnessConfig {
+		t.Fatalf("duplicate effort home accepted: %v", err)
+	}
+}
+
 func TestHarnessConfigConflictFailsBeforePreparation(t *testing.T) {
 	_, err := BuildSessionPlan(testStateRoot(t), "", map[string]any{"harness_config": map[string]any{"model_provider": "bypass"}}, nil)
 	if err != harnessconfig.ErrHarnessConfig {
@@ -33,14 +41,14 @@ func TestHarnessConfigConflictFailsBeforePreparation(t *testing.T) {
 	}
 }
 
-func TestHarnessConfigReachesEveryNativeTurn(t *testing.T) {
+func TestNativeTurnsCarryNoCollaborationMode(t *testing.T) {
 	for _, resumeID := range []string{"", "fixture-native-thread"} {
 		t.Run("resume="+resumeID, func(t *testing.T) {
 			req, cfg, root := preparationFixture(t)
 			t.Setenv("OAC_TEST_EXECUTOR_MODE", "complete")
 			req.AgentSessionID = resumeID
-			native := map[string]any{"model_reasoning_effort": "high"}
-			req.AgentOptions["harness_config"] = native
+			controls := &proto.ExecutionControls{TextVerbosity: "medium", ReasoningEffort: "high"}
+			req.ExecutionControls = controls
 			ownerCtx, cancelOwner := context.WithCancel(context.Background())
 			t.Cleanup(cancelOwner)
 			e, err := newExecutor(ownerCtx, req, cfg)
@@ -54,7 +62,7 @@ func TestHarnessConfigReachesEveryNativeTurn(t *testing.T) {
 					t.Error(err)
 				}
 			})
-			native["model_reasoning_effort"] = "low"
+			controls.ReasoningEffort = "low"
 			for _, id := range []string{"one", "two"} {
 				out := make(chan proto.Envelope, 20)
 				turn, err := e.StartTurn(t.Context(), id, proto.TextInput("answer"), out)
@@ -71,13 +79,8 @@ func TestHarnessConfigReachesEveryNativeTurn(t *testing.T) {
 				if frame.Method != "turn/start" {
 					continue
 				}
-				var wire struct {
-					CollaborationMode struct {
-						Settings map[string]any `json:"settings"`
-					} `json:"collaborationMode"`
-				}
-				if json.Unmarshal(frame.Params, &wire) != nil || wire.CollaborationMode.Settings["reasoning_effort"] != "high" {
-					t.Fatal("Turn lost the frozen native reasoning effort", string(frame.Params))
+				if strings.Contains(string(frame.Params), "ollaborationMode") {
+					t.Fatal("turn/start must not carry a collaboration mode", string(frame.Params))
 				}
 			}
 			method := "thread/start"
@@ -90,3 +93,52 @@ func TestHarnessConfigReachesEveryNativeTurn(t *testing.T) {
 		})
 	}
 }
+
+func TestOutputSchemaReachesEveryNativeTurn(t *testing.T) {
+	for _, resumeID := range []string{"", "fixture-native-thread"} {
+		t.Run("resume="+resumeID, func(t *testing.T) {
+			req, cfg, root := preparationFixture(t)
+			t.Setenv("OAC_TEST_EXECUTOR_MODE", "complete")
+			req.AgentSessionID = resumeID
+			schema := json.RawMessage(`{"type":"object","properties":{"answer":{"type":"string"}},"required":["answer"],"additionalProperties":false}`)
+			req.ExecutionControls = &proto.ExecutionControls{OutputFormat: &proto.OutputFormat{Type: "json_schema", Schema: schema}}
+			ownerCtx, cancelOwner := context.WithCancel(context.Background())
+			t.Cleanup(cancelOwner)
+			e, err := newExecutor(ownerCtx, req, cfg)
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() {
+				ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+				defer cancel()
+				if err := e.Close(ctx); err != nil {
+					t.Error(err)
+				}
+			})
+			for _, id := range []string{"one", "two"} {
+				out := make(chan proto.Envelope, 20)
+				turn, err := e.StartTurn(t.Context(), id, proto.TextInput("answer"), out)
+				if err != nil {
+					t.Fatal(err)
+				}
+				awaitExecutorTurn(t, turn, out)
+			}
+			turns := 0
+			for _, frame := range preparationFrames(t, root) {
+				if frame.Method != "turn/start" {
+					continue
+				}
+				turns++
+				var wire struct {
+					OutputSchema json.RawMessage `json:"outputSchema"`
+				}
+				if json.Unmarshal(frame.Params, &wire) != nil || string(wire.OutputSchema) != string(schema) {
+					t.Fatal("Turn lost the frozen output schema", string(frame.Params))
+				}
+			}
+			if turns != 2 {
+				t.Fatal("expected two Turns", turns)
+			}
+		})
+	}
+}
diff --git a/apps/daemon/internal/agent/codex/hosted_skills.go b/apps/daemon/internal/agent/codex/hosted_skills.go
deleted file mode 100644
index 7b20452cb..000000000
--- a/apps/daemon/internal/agent/codex/hosted_skills.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package codex
-
-import (
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/localworkspace"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentcapabilities"
-)
-
-func verifyHostedSkills(skills []agentcapabilities.InstalledSkill) error {
-	for _, skill := range skills {
-		if err := verifyHostedSkillLayout(localworkspace.SkillPath(skill)); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func verifyHostedSkillLayout(root string) error {
-	// Native dependency declarations may start MCP installation outside the
-	// workspace tool sandbox. They are not qualified by an inert Skill upload.
-	if _, err := os.Lstat(filepath.Join(root, "agents", "openai.yaml")); err == nil {
-		return fmt.Errorf("codex: native Skill configuration is unsupported")
-	} else if !os.IsNotExist(err) {
-		return err
-	}
-	// Extra roots are scanned recursively. One public Skill must not silently
-	// introduce additional native Skills with their own activation metadata.
-	return filepath.WalkDir(root, func(path string, entry fs.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		if entry.Name() == "SKILL.md" && path != filepath.Join(root, "SKILL.md") {
-			return fmt.Errorf("codex: nested native Skills are unsupported")
-		}
-		return nil
-	})
-}
diff --git a/apps/daemon/internal/agent/codex/hosted_skills_test.go b/apps/daemon/internal/agent/codex/hosted_skills_test.go
deleted file mode 100644
index 0c7455687..000000000
--- a/apps/daemon/internal/agent/codex/hosted_skills_test.go
+++ /dev/null
@@ -1,36 +0,0 @@
-package codex
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestHostedSkillDoesNotActivateAdditionalNativeResources(t *testing.T) {
-	for _, tc := range []struct {
-		name     string
-		files    []string
-		rejected bool
-	}{
-		{"ordinary supporting files", []string{"SKILL.md", "scripts/check.py", "references/guide.md"}, false},
-		{"native dependency configuration", []string{"SKILL.md", "agents/openai.yaml"}, true},
-		{"nested discovery", []string{"SKILL.md", "references/other/SKILL.md"}, true},
-		{"nested dependencies", []string{"SKILL.md", "references/other/SKILL.md", "references/other/agents/openai.yaml"}, true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			root := t.TempDir()
-			for _, name := range tc.files {
-				path := filepath.Join(root, name)
-				if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
-					t.Fatal(err)
-				}
-				if err := os.WriteFile(path, []byte("fixture"), 0400); err != nil {
-					t.Fatal(err)
-				}
-			}
-			if err := verifyHostedSkillLayout(root); (err != nil) != tc.rejected {
-				t.Fatalf("rejected=%v err=%v", tc.rejected, err)
-			}
-		})
-	}
-}
diff --git a/apps/daemon/internal/agent/codex/mcp_config.go b/apps/daemon/internal/agent/codex/mcp_config.go
index 653726a43..27133314c 100644
--- a/apps/daemon/internal/agent/codex/mcp_config.go
+++ b/apps/daemon/internal/agent/codex/mcp_config.go
@@ -16,11 +16,12 @@ type mcpServerConfig struct {
 	URL               string
 	Command           string
 	Args              []string
+	Cwd               string
+	EnvVars           []string
 	EnabledTools      *[]string
 	Required          bool
 	BearerTokenEnvVar string
-	EnvHTTPHeaders    map[string]string
-	ApproveTools      bool
+	HTTPHeaders       map[string]string
 }
 
 // writeCodexMCPConfig writes a `[mcp_servers.<name>]` TOML table per
@@ -48,9 +49,6 @@ func writeCodexMCPConfig(codexHome string, servers map[string]mcpServerConfig) e
 		b.WriteString("[mcp_servers.")
 		b.WriteString(tomlQuoteString(name))
 		b.WriteString("]\n")
-		if srv.ApproveTools {
-			b.WriteString("default_tools_approval_mode = \"approve\"\n")
-		}
 		if srv.Required {
 			b.WriteString("required = true\n")
 		}
@@ -63,32 +61,20 @@ func writeCodexMCPConfig(codexHome string, servers map[string]mcpServerConfig) e
 				b.WriteString(tomlQuoteString(srv.BearerTokenEnvVar))
 				b.WriteByte('\n')
 			}
-			if srv.EnabledTools != nil {
-				b.WriteString("enabled_tools = [")
-				for i, name := range *srv.EnabledTools {
-					if i > 0 {
-						b.WriteString(", ")
-					}
-					b.WriteString(tomlQuoteString(name))
-				}
-				b.WriteString("]\n")
-			}
-			writeMCPHeaderMap(&b, "env_http_headers", srv.EnvHTTPHeaders)
+			writeMCPHeaderMap(&b, "http_headers", srv.HTTPHeaders)
+		} else {
+			b.WriteString(`command = `)
+			b.WriteString(tomlQuoteString(srv.Command))
 			b.WriteByte('\n')
-			continue
-		}
-		b.WriteString(`command = `)
-		b.WriteString(tomlQuoteString(srv.Command))
-		b.WriteByte('\n')
-		if len(srv.Args) > 0 {
-			b.WriteString("args = [")
-			for i, a := range srv.Args {
-				if i > 0 {
-					b.WriteString(", ")
-				}
-				b.WriteString(tomlQuoteString(a))
+			writeMCPList(&b, "args", srv.Args)
+			if srv.Cwd != "" {
+				b.WriteString("cwd = " + tomlQuoteString(srv.Cwd) + "\n")
 			}
-			b.WriteString("]\n")
+			writeMCPList(&b, "env_vars", srv.EnvVars)
+		}
+		if srv.EnabledTools != nil {
+			b.WriteString("enabled_tools = ")
+			writeMCPList(&b, "", *srv.EnabledTools)
 		}
 		b.WriteByte('\n')
 	}
@@ -97,6 +83,24 @@ func writeCodexMCPConfig(codexHome string, servers map[string]mcpServerConfig) e
 	return appendConfigTOML(path, b.String())
 }
 
+// writeMCPList writes a TOML string array, as a "name = " line unless name is empty.
+func writeMCPList(b *strings.Builder, name string, values []string) {
+	if name != "" {
+		if len(values) == 0 {
+			return
+		}
+		b.WriteString(name + " = ")
+	}
+	b.WriteByte('[')
+	for i, value := range values {
+		if i > 0 {
+			b.WriteString(", ")
+		}
+		b.WriteString(tomlQuoteString(value))
+	}
+	b.WriteString("]\n")
+}
+
 func writeMCPHeaderMap(b *strings.Builder, field string, values map[string]string) {
 	if len(values) == 0 {
 		return
@@ -118,7 +122,8 @@ func writeMCPHeaderMap(b *strings.Builder, field string, values map[string]strin
 
 // tomlQuoteString returns a TOML basic-string literal (double-quoted)
 // with the documented escape set applied — \" \\ \n \r \t plus
-// \uXXXX for control chars. Matches the TOML 1.0 spec for basic strings.
+// \uXXXX for the other control characters, DEL included. Matches the TOML 1.0
+// spec for basic strings.
 func tomlQuoteString(s string) string {
 	var b strings.Builder
 	b.WriteByte('"')
@@ -135,7 +140,7 @@ func tomlQuoteString(s string) string {
 		case '\t':
 			b.WriteString(`\t`)
 		default:
-			if r < 0x20 {
+			if r < 0x20 || r == 0x7f {
 				fmt.Fprintf(&b, `\u%04X`, r)
 			} else {
 				b.WriteRune(r)
diff --git a/apps/daemon/internal/agent/codex/mcp_environment_test.go b/apps/daemon/internal/agent/codex/mcp_environment_test.go
index 0013b3a76..147a2e7c3 100644
--- a/apps/daemon/internal/agent/codex/mcp_environment_test.go
+++ b/apps/daemon/internal/agent/codex/mcp_environment_test.go
@@ -13,30 +13,29 @@ import (
 
 func TestEnvironmentMCPProjectsIsolatedStdioAndPrivateHTTPReferences(t *testing.T) {
 	token := "user-token"
-	local := &proto.LocalEnvironment{NetworkAccess: "enabled", MCP: []proto.EnvironmentMCP{
+	local := &proto.LocalEnvironment{MCP: []proto.EnvironmentMCP{
 		{InstallationRoot: "/private/runtime/capabilities", WorkspaceRoot: "/private/runtime/workspace", PackageRoot: "plugins/0", Server: agentplugin.MCPServer{Name: "local", Type: "stdio", Command: "must-not-be-native-command", Args: []string{"private-argument"}}},
 		{InstallationRoot: "/private/runtime/capabilities", WorkspaceRoot: "/private/runtime/workspace", PackageRoot: "plugins/1", BearerToken: &token, Server: agentplugin.MCPServer{Name: "remote", Type: "http", URL: "https://example.com/mcp", HTTPHeaders: map[string]string{"X-Key": "literal-${DO_NOT_EXPAND}"}}},
 	}}
 	servers, env, err := runtimeMCPServers(proto.PromptRequestPayload{LocalEnvironment: local})
-	if err != nil || len(servers) != 2 || len(env) != 2 {
+	if err != nil || len(servers) != 2 || len(env) != 1 {
 		t.Fatal("environment declarations were not projected", err)
 	}
 	executable, _ := os.Executable()
-	if servers["local"].Command != executable || !servers["local"].ApproveTools ||
+	if servers["local"].Command != executable ||
 		!slices.Equal(servers["local"].Args, []string{"runtime-mcp-exec", "/private/runtime/capabilities", "plugins/0", "local"}) {
 		t.Fatal("native stdio bypasses the packaged launcher")
 	}
 	remote := servers["remote"]
-	if remote.BearerTokenEnvVar == "" || remote.EnvHTTPHeaders["X-Key"] == "" ||
-		!slices.Contains(env, remote.BearerTokenEnvVar+"="+token) ||
-		!slices.Contains(env, remote.EnvHTTPHeaders["X-Key"]+"=literal-${DO_NOT_EXPAND}") {
+	if remote.BearerTokenEnvVar == "" || remote.HTTPHeaders["X-Key"] != "literal-${DO_NOT_EXPAND}" ||
+		!slices.Contains(env, remote.BearerTokenEnvVar+"="+token) {
 		t.Fatal("private header values changed")
 	}
 	fixture := map[string]any{"config": map[string]any{
-		"mcp_oauth_credentials_store": "file", "features": map[string]bool{"plugins": false, "apps": false},
+		"mcp_oauth_credentials_store": "file",
 		"mcp_servers": map[string]any{
-			"local":  map[string]any{"command": servers["local"].Command, "args": servers["local"].Args, "environment_id": "local", "enabled": true, "tool_timeout_sec": nil, "default_tools_approval_mode": "approve"},
-			"remote": map[string]any{"url": remote.URL, "environment_id": "local", "enabled": true, "tool_timeout_sec": nil, "default_tools_approval_mode": "approve", "bearer_token_env_var": remote.BearerTokenEnvVar, "env_http_headers": remote.EnvHTTPHeaders},
+			"local":  map[string]any{"command": servers["local"].Command, "args": servers["local"].Args, "environment_id": "local", "enabled": true, "tool_timeout_sec": nil},
+			"remote": map[string]any{"url": remote.URL, "environment_id": "local", "enabled": true, "tool_timeout_sec": nil, "bearer_token_env_var": remote.BearerTokenEnvVar, "http_headers": remote.HTTPHeaders},
 		},
 	}}
 	raw, _ := json.Marshal(fixture)
@@ -49,15 +48,17 @@ func TestEnvironmentMCPProjectsIsolatedStdioAndPrivateHTTPReferences(t *testing.
 	}
 }
 
-func TestEnvironmentMCPRejectsUnqualifiedNetworkAndCredentialChanges(t *testing.T) {
-	for _, access := range []string{"", "restricted", "disabled"} {
-		local := &proto.LocalEnvironment{NetworkAccess: access, MCP: []proto.EnvironmentMCP{{Server: agentplugin.MCPServer{Name: "local", Type: "stdio"}}}}
-		if _, _, err := runtimeMCPServers(proto.PromptRequestPayload{LocalEnvironment: local}); err == nil {
-			t.Errorf("unqualified MCP network accepted: %s", access)
-		}
+func TestSessionMCPHeadersReachNativeConfig(t *testing.T) {
+	req := proto.PromptRequestPayload{DisableExecutionEnvironment: true, MCPHTTPServers: &[]proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "remote", ServerURL: "https://example.com/mcp", Headers: map[string]string{"X-Tenant": "a"}}}}
+	servers, env, err := runtimeMCPServers(req)
+	if err != nil || servers["remote"].HTTPHeaders["X-Tenant"] != "a" || len(env) != 0 {
+		t.Fatal("Session headers were not projected", err)
 	}
+}
+
+func TestEnvironmentMCPRejectsUnqualifiedCredentialChanges(t *testing.T) {
 	token := "user-token"
-	local := &proto.LocalEnvironment{NetworkAccess: "enabled", MCP: []proto.EnvironmentMCP{{BearerToken: &token, Server: agentplugin.MCPServer{Name: "remote", Type: "http", URL: "http://example.com/mcp"}}}}
+	local := &proto.LocalEnvironment{MCP: []proto.EnvironmentMCP{{BearerToken: &token, Server: agentplugin.MCPServer{Name: "remote", Type: "http", URL: "http://example.com/mcp"}}}}
 	if _, _, err := runtimeMCPServers(proto.PromptRequestPayload{LocalEnvironment: local}); err == nil {
 		t.Fatal("plaintext bearer accepted")
 	}
diff --git a/apps/daemon/internal/agent/codex/mcp_http.go b/apps/daemon/internal/agent/codex/mcp_http.go
index d5a935f7d..11358de3a 100644
--- a/apps/daemon/internal/agent/codex/mcp_http.go
+++ b/apps/daemon/internal/agent/codex/mcp_http.go
@@ -5,15 +5,13 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
-	"slices"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/localworkspace"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-// One projection consumes both public and installed Runtime bindings. A non-nil
-// empty public declaration still owns the complete native MCP configuration.
+// One projection consumes both public and installed Runtime bindings.
 func runtimeMCPServers(req proto.PromptRequestPayload) (map[string]mcpServerConfig, []string, error) {
 	bindings, err := agent.ResolveMCPBindings(req)
 	if err != nil {
@@ -28,22 +26,17 @@ func runtimeMCPServers(req proto.PromptRequestPayload) (map[string]mcpServerConf
 		if binding.ServerLabel == "codex_apps" {
 			return nil, nil, errors.New("codex: reserved MCP server label")
 		}
-		server := mcpServerConfig{Name: binding.ServerLabel, URL: binding.ServerURL, Required: binding.Required, EnabledTools: binding.AllowedTools, ApproveTools: binding.ConnectionOrigin == "environment"}
+		server := mcpServerConfig{Name: binding.ServerLabel, URL: binding.ServerURL, Required: binding.Required, EnabledTools: binding.AllowedTools, HTTPHeaders: binding.HTTPHeaders}
 		if binding.Stdio != nil {
 			server.Command, server.Args = localworkspace.MCPStdioCommand(*binding.Stdio)
 		}
+		if process := binding.Process; process != nil {
+			server.Command, server.Args, server.Cwd, server.EnvVars = process.Command, process.Args, process.Cwd, process.EnvVars
+		}
 		if binding.BearerToken != nil {
 			server.BearerTokenEnvVar = "OAC_RUNTIME_MCP_BEARER_" + rand.Text()
 			env = append(env, server.BearerTokenEnvVar+"="+*binding.BearerToken)
 		}
-		if len(binding.HTTPHeaders) > 0 {
-			server.EnvHTTPHeaders = map[string]string{}
-			for name, value := range binding.HTTPHeaders {
-				reference := "OAC_RUNTIME_MCP_HEADER_" + rand.Text()
-				server.EnvHTTPHeaders[name] = reference
-				env = append(env, reference+"="+value)
-			}
-		}
 		servers[server.Name] = server
 	}
 	return servers, env, nil
@@ -62,11 +55,8 @@ func configureMCP(plan *SessionPlan, servers map[string]mcpServerConfig) error {
 	if err := writeCodexMCPConfig(codexHome, servers); err != nil {
 		return errors.New("codex: cannot write public MCP configuration")
 	}
-	for _, feature := range []string{"plugins", "apps"} {
-		if !slices.Contains(plan.DisableFeatures, feature) {
-			plan.DisableFeatures = append(plan.DisableFeatures, feature)
-		}
-	}
+	// Native shell tools must not inherit the per-server secret variables.
+	excludeFromShellEnvironment(plan, "OAC_RUNTIME_MCP_*")
 	plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"mcp_oauth_credentials_store", `"file"`})
 	plan.mcpServers = servers
 	return nil
diff --git a/apps/daemon/internal/agent/codex/mcp_http_bearer_test.go b/apps/daemon/internal/agent/codex/mcp_http_bearer_test.go
index 5a68ce270..c7dcaf0b5 100644
--- a/apps/daemon/internal/agent/codex/mcp_http_bearer_test.go
+++ b/apps/daemon/internal/agent/codex/mcp_http_bearer_test.go
@@ -68,39 +68,13 @@ func TestMCPHTTPBearerRejectsInvalidTokensWithoutPersistence(t *testing.T) {
 	}
 }
 
-func TestMCPHTTPBearerDoesNotReachModelCatalogProbe(t *testing.T) {
-	if !SupportsTextVerbosity {
-		t.Skip("catalog probe requires Unix")
-	}
-	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-	binary := filepath.Join(t.TempDir(), "catalog-probe")
-	script := "#!/bin/sh\nif env | grep -q '^OAC_RUNTIME_MCP_BEARER_'; then exit 9; fi\nprintf '%s' '{\"models\":[{\"slug\":\"fixture-model\",\"support_verbosity\":true}]}'\n"
-	if err := os.WriteFile(binary, []byte(script), 0o700); err != nil {
-		t.Fatal(err)
-	}
-	token := "synthetic-catalog-secret"
-	servers := []proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "tools", ServerURL: "https://tools.example/mcp", BearerToken: &token}}
-	req := proto.PromptRequestPayload{AgentStateKey: "catalog", DisableExecutionEnvironment: true, MCPHTTPServers: &servers,
-		AgentOptions: map[string]any{"model": "fixture-model"}, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
-	cfg := defaultSessionConfig(testStateRoot(t))
-	cfg.codexBinary = binary
-	plan, _, err := prepareSessionPlan(t.Context(), req, cfg)
-	if err != nil {
-		t.Fatal("catalog probe inherited bearer or failed", err)
-	}
-	defer plan.Cleanup()
-	if !slices.Contains(plan.Env, plan.mcpServers["tools"].BearerTokenEnvVar+"="+token) {
-		t.Fatal("app-server did not receive bearer after catalog probe")
-	}
-}
-
 func TestMCPHTTPBearerPreflightMatchesOnlyItsServerReference(t *testing.T) {
 	servers := map[string]mcpServerConfig{
 		"first":  {URL: "https://first.example/mcp", BearerTokenEnvVar: "OAC_RUNTIME_MCP_BEARER_FIRST"},
 		"second": {URL: "https://second.example/mcp", BearerTokenEnvVar: "OAC_RUNTIME_MCP_BEARER_SECOND"},
 		"public": {URL: "http://public.example/mcp"},
 	}
-	for _, mutation := range []string{"none", "missing", "ambient", "swapped", "extra", "header", "helper"} {
+	for _, mutation := range []string{"none", "missing", "ambient", "swapped", "extra", "header"} {
 		t.Run(mutation, func(t *testing.T) {
 			response := mcpHTTPConfigResponse(servers)
 			entries := response["config"].(map[string]any)["mcp_servers"].(map[string]any)
@@ -116,8 +90,6 @@ func TestMCPHTTPBearerPreflightMatchesOnlyItsServerReference(t *testing.T) {
 				entries["public"].(map[string]any)["bearer_token_env_var"] = servers["first"].BearerTokenEnvVar
 			case "header":
 				first["http_headers"] = map[string]string{"Authorization": "Bearer synthetic-private"}
-			case "helper":
-				first["http_headers_helper"] = "operator-helper"
 			}
 			raw, err := json.Marshal(response)
 			if err != nil || matchesMCPConfig(raw, servers) != (mutation == "none") {
diff --git a/apps/daemon/internal/agent/codex/mcp_http_preflight.go b/apps/daemon/internal/agent/codex/mcp_http_preflight.go
index b499038fb..6c257777e 100644
--- a/apps/daemon/internal/agent/codex/mcp_http_preflight.go
+++ b/apps/daemon/internal/agent/codex/mcp_http_preflight.go
@@ -8,9 +8,15 @@ import (
 	"time"
 )
 
-// config/read loads the same cwd and CLI layers without MCP discovery. Native
-// mcpServerStatus/list instead opens eager discovery connections; do not use it
-// to decide whether undeclared servers are safe to contact.
+// errMCPBindingChanged reports that the effective native configuration moved a
+// declared server's credential binding or the credential store.
+var errMCPBindingChanged = errors.New("codex: effective native MCP configuration differs from the public declaration")
+
+// verifyMCPConfig runs after the workspace trust entry is in the generated
+// configuration, so config/read sees the same project layer thread/start and
+// thread/resume load. It runs before any native connection that carries a Core
+// credential. config/read loads the layers without MCP discovery; native
+// mcpServerStatus/list instead opens eager discovery connections.
 func verifyMCPConfig(ctx context.Context, rpc *JSONRPCClient, plan SessionPlan) error {
 	check, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
@@ -20,16 +26,19 @@ func verifyMCPConfig(ctx context.Context, rpc *JSONRPCClient, plan SessionPlan)
 		return errors.New("codex: cannot verify public MCP configuration")
 	}
 	if !matchesMCPConfig(raw, plan.mcpServers) {
-		return errors.New("codex: effective native MCP configuration differs from the public declaration")
+		return errMCPBindingChanged
 	}
 	return nil
 }
 
+// matchesMCPConfig checks only what binds a Core credential to a declared
+// server: where the server runs and connects, which variables carry its bearer
+// and headers, and the declared tool policy. Other servers and settings follow
+// native defaults.
 func matchesMCPConfig(raw json.RawMessage, declared map[string]mcpServerConfig) bool {
 	var response struct {
 		Config struct {
 			Servers         map[string]map[string]any `json:"mcp_servers"`
-			Features        map[string]any            `json:"features"`
 			CredentialStore string                    `json:"mcp_oauth_credentials_store"`
 		} `json:"config"`
 	}
@@ -37,103 +46,87 @@ func matchesMCPConfig(raw json.RawMessage, declared map[string]mcpServerConfig)
 		return false
 	}
 	config := response.Config
-	if config.CredentialStore != "file" || config.Features["plugins"] != false || config.Features["apps"] != false || config.Servers == nil || len(config.Servers) != len(declared) {
+	if config.CredentialStore != "file" || (len(declared) > 0 && config.Servers == nil) {
 		return false
 	}
 	for name, expected := range declared {
 		server, exists := config.Servers[name]
-		if !exists || server["environment_id"] != "local" || server["enabled"] != true {
+		if !exists || server["environment_id"] != "local" {
 			return false
 		}
 		if expected.URL != "" {
-			if server["url"] != expected.URL || !matchesMCPHeaderMap(server, "env_http_headers", expected.EnvHTTPHeaders) {
+			if server["url"] != expected.URL {
 				return false
 			}
-			delete(server, "url")
 		} else {
-			args, err := json.Marshal(expected.Args)
-			var want any
-			if err != nil || json.Unmarshal(args, &want) != nil || server["command"] != expected.Command || !reflect.DeepEqual(server["args"], want) {
-				return false
-			}
-			delete(server, "command")
-			delete(server, "args")
-		}
-		delete(server, "environment_id")
-		delete(server, "enabled")
-		if expected.ApproveTools {
-			if server["default_tools_approval_mode"] != "approve" {
-				return false
-			}
-			delete(server, "default_tools_approval_mode")
-		}
-		if expected.Required {
-			if server["required"] != true {
+			if server["command"] != expected.Command || !matchesMCPList(server["args"], expected.Args) ||
+				server["cwd"] != nilIfEmpty(expected.Cwd) || !matchesMCPList(server["env_vars"], expected.EnvVars) {
 				return false
 			}
-			delete(server, "required")
 		}
-		if expected.BearerTokenEnvVar != "" {
-			if server["bearer_token_env_var"] != expected.BearerTokenEnvVar {
-				return false
-			}
-			delete(server, "bearer_token_env_var")
+		if server["bearer_token_env_var"] != nilIfEmpty(expected.BearerTokenEnvVar) ||
+			!matchesMCPHeaderMap(server, "http_headers", expected.HTTPHeaders) ||
+			!matchesMCPHeaderMap(server, "env_http_headers", nil) {
+			return false
 		}
-		if expected.EnabledTools != nil {
-			// Compare sets: native enabled_tools is an allowlist, not an ordered program.
-			actual, ok := server["enabled_tools"].([]any)
-			if !ok {
-				return false
-			}
-			want := make(map[string]bool, len(*expected.EnabledTools))
-			for _, tool := range *expected.EnabledTools {
-				want[tool] = true
-			}
-			got := make(map[string]bool, len(actual))
-			for _, tool := range actual {
-				name, ok := tool.(string)
-				if !ok {
-					return false
-				}
-				got[name] = true
-			}
-			if !reflect.DeepEqual(want, got) {
-				return false
-			}
-			delete(server, "enabled_tools")
+		if expected.Required && server["required"] != true {
+			return false
 		}
-		// These are the native serializer's inert defaults. Reject all additional
-		// settings, including headers, credential helpers, tool policies and filters.
-		for key, value := range server {
-			switch key {
-			case "tool_timeout_sec":
-				if value != nil {
-					return false
-				}
-			case "required", "supports_parallel_tool_calls":
-				if value != false {
-					return false
-				}
-			default:
-				return false
-			}
+		if expected.EnabledTools != nil && !matchesEnabledTools(server["enabled_tools"], *expected.EnabledTools) {
+			return false
 		}
 	}
 	return true
 }
 
+func nilIfEmpty(value string) any {
+	if value == "" {
+		return nil
+	}
+	return value
+}
+
+// matchesEnabledTools compares sets: native enabled_tools is an allowlist, not an ordered program.
+func matchesEnabledTools(actual any, expected []string) bool {
+	tools, ok := actual.([]any)
+	if !ok {
+		return false
+	}
+	want := make(map[string]bool, len(expected))
+	for _, tool := range expected {
+		want[tool] = true
+	}
+	got := make(map[string]bool, len(tools))
+	for _, tool := range tools {
+		name, ok := tool.(string)
+		if !ok {
+			return false
+		}
+		got[name] = true
+	}
+	return reflect.DeepEqual(want, got)
+}
+
 func matchesMCPHeaderMap(server map[string]any, field string, expected map[string]string) bool {
 	actual, present := server[field]
 	if len(expected) == 0 {
-		return !present
+		return !present || actual == nil
 	}
 	want := make(map[string]any, len(expected))
 	for key, value := range expected {
 		want[key] = value
 	}
-	if !reflect.DeepEqual(actual, want) {
-		return false
+	return reflect.DeepEqual(actual, want)
+}
+
+// matchesMCPList compares an ordered string list; native omits an empty one.
+func matchesMCPList(actual any, expected []string) bool {
+	if len(expected) == 0 {
+		return actual == nil || reflect.DeepEqual(actual, []any{})
 	}
-	delete(server, field)
-	return true
+	want := make([]any, len(expected))
+	for i, value := range expected {
+		want[i] = value
+	}
+	return reflect.DeepEqual(actual, want)
 }
diff --git a/apps/daemon/internal/agent/codex/mcp_http_preflight_test.go b/apps/daemon/internal/agent/codex/mcp_http_preflight_test.go
index 138a97182..297725749 100644
--- a/apps/daemon/internal/agent/codex/mcp_http_preflight_test.go
+++ b/apps/daemon/internal/agent/codex/mcp_http_preflight_test.go
@@ -13,7 +13,9 @@ import (
 func TestPublicMCPHTTPEffectiveConfiguration(t *testing.T) {
 	for _, allowlist := range []*[]string{nil, new([]string), {"lookup", "query"}} {
 		servers := map[string]mcpServerConfig{"docs": {URL: "https://docs.example/mcp", EnabledTools: allowlist}}
-		for _, mutation := range []string{"none", "ambient", "url", "header", "header helper", "env header", "auth", "required", "tools", "disabled", "remote", "plugins", "apps", "keyring", "policy"} {
+		// Only what binds a credential to the declared server is checked; every
+		// other native setting and undeclared server keeps its native value.
+		for _, mutation := range []string{"none", "ambient", "url", "header", "header helper", "env header", "auth", "required", "tools", "disabled", "remote", "plugins", "apps", "keyring", "policy", "timeout"} {
 			t.Run(mutation+"/"+allowlistName(allowlist), func(t *testing.T) {
 				response := mcpHTTPConfigResponse(servers)
 				config := response["config"].(map[string]any)
@@ -41,17 +43,20 @@ func TestPublicMCPHTTPEffectiveConfiguration(t *testing.T) {
 				case "remote":
 					server["environment_id"] = "remote"
 				case "plugins", "apps":
-					config["features"].(map[string]any)[mutation] = true
+					config["features"] = map[string]any{mutation: true}
 				case "keyring":
 					config["mcp_oauth_credentials_store"] = "auto"
 				case "policy":
 					server["tools"] = map[string]any{"lookup": map[string]any{"enabled": false}}
+				case "timeout":
+					server["tool_timeout_sec"] = 5
 				}
 				data, err := json.Marshal(response)
 				if err != nil {
 					t.Fatal(err)
 				}
-				if matchesMCPConfig(data, servers) != (mutation == "none") {
+				rejected := map[string]bool{"url": true, "header": true, "env header": true, "remote": true, "keyring": true, "tools": allowlist != nil}
+				if matchesMCPConfig(data, servers) == rejected[mutation] {
 					t.Fatal("effective configuration decision differed", mutation)
 				}
 			})
@@ -122,7 +127,7 @@ func TestPublicMCPHTTPPreflightRedactsNativeErrors(t *testing.T) {
 }
 
 func TestPublicMCPHTTPPreparationChecksBeforeNewAndResumedThread(t *testing.T) {
-	for _, mode := range []string{"new", "resume", "reject", "reject bearer reference"} {
+	for _, mode := range []string{"new", "resume", "extra server", "reject url", "reject bearer reference"} {
 		t.Run(mode, func(t *testing.T) {
 			req, cfg, root := preparationFixture(t)
 			req.AgentOptions = map[string]any{"model": "fixture-model"}
@@ -144,9 +149,12 @@ func TestPublicMCPHTTPPreparationChecksBeforeNewAndResumedThread(t *testing.T) {
 				t.Fatal(err)
 			}
 			response := mcpHTTPConfigResponse(declarations)
-			if mode == "reject" {
+			if mode == "extra server" {
 				response["config"].(map[string]any)["mcp_servers"].(map[string]any)["operator"] = map[string]any{"url": "https://operator.example/private"}
 			}
+			if mode == "reject url" {
+				response["config"].(map[string]any)["mcp_servers"].(map[string]any)["docs"].(map[string]any)["url"] = "https://workspace.example/redirect"
+			}
 			if mode == "reject bearer reference" {
 				response["config"].(map[string]any)["mcp_servers"].(map[string]any)["docs"].(map[string]any)["bearer_token_env_var"] = "OPERATOR_SECRET"
 			}
@@ -156,7 +164,7 @@ func TestPublicMCPHTTPPreparationChecksBeforeNewAndResumedThread(t *testing.T) {
 			e, err := testExecutor(t, "complete", req, cfg)
 			if strings.HasPrefix(mode, "reject") {
 				if err == nil || e != nil {
-					t.Fatal("ambient MCP configuration admitted")
+					t.Fatal("redirected credential binding admitted")
 				}
 				assertPreparationOnly(t, root)
 				waitPreparationMethod(t, root, "config/read")
@@ -204,3 +212,32 @@ func TestPublicMCPHTTPPreparationChecksBeforeNewAndResumedThread(t *testing.T) {
 		})
 	}
 }
+
+func TestPublicMCPStdioReachesNativeConfiguration(t *testing.T) {
+	tools := []string{"lookup"}
+	servers := []proto.MCPHTTPServer{{ConnectionOrigin: "environment", ServerLabel: "local", AllowedTools: &tools,
+		Stdio: &proto.MCPStdio{Command: "run", Args: []string{"-x"}, Cwd: "/work", EnvVars: []string{"TOKEN"}}}}
+	declared, _, err := runtimeMCPServers(proto.PromptRequestPayload{LocalEnvironment: &proto.LocalEnvironment{}, MCPHTTPServers: &servers})
+	if err != nil {
+		t.Fatal(err)
+	}
+	home := t.TempDir()
+	if err := writeCodexMCPConfig(home, declared); err != nil {
+		t.Fatal(err)
+	}
+	config, err := os.ReadFile(filepath.Join(home, "config.toml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, expected := range []string{`command = "run"`, `args = ["-x"]`, `cwd = "/work"`, `env_vars = ["TOKEN"]`, `enabled_tools = ["lookup"]`} {
+		if !strings.Contains(string(config), expected) {
+			t.Fatalf("missing native config %q", expected)
+		}
+	}
+	read := func(cwd string) json.RawMessage {
+		return json.RawMessage(`{"config":{"mcp_oauth_credentials_store":"file","mcp_servers":{"local":{"environment_id":"local","command":"run","args":["-x"],"cwd":"` + cwd + `","env_vars":["TOKEN"],"enabled_tools":["lookup"]}}}}`)
+	}
+	if !matchesMCPConfig(read("/work"), declared) || matchesMCPConfig(read("/elsewhere"), declared) {
+		t.Fatal("effective native stdio configuration was not verified")
+	}
+}
diff --git a/apps/daemon/internal/agent/codex/mcp_http_test.go b/apps/daemon/internal/agent/codex/mcp_http_test.go
index 015c0e939..75610d9fa 100644
--- a/apps/daemon/internal/agent/codex/mcp_http_test.go
+++ b/apps/daemon/internal/agent/codex/mcp_http_test.go
@@ -26,8 +26,10 @@ func TestPublicMCPHTTPPlanOwnsConfigurationAndPreservesHistory(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer plan.Cleanup()
-	if !slices.Contains(plan.DisableFeatures, "apps") || !slices.Contains(plan.DisableFeatures, "plugins") || !slices.Contains(plan.ExtraConfig, [2]string{"mcp_oauth_credentials_store", `"file"`}) {
-		t.Fatal("native profile was not pinned")
+	if slices.Contains(plan.DisableFeatures, "apps") || slices.Contains(plan.DisableFeatures, "plugins") ||
+		!slices.Contains(plan.ExtraConfig, [2]string{"mcp_oauth_credentials_store", `"file"`}) ||
+		!slices.Contains(plan.ExtraConfig, [2]string{"shell_environment_policy.exclude", `["OAC_RUNTIME_MCP_*"]`}) {
+		t.Fatal("native profile kept only credential isolation")
 	}
 	home, err := allocCodexHome(testStateRoot(t), req.AgentStateKey)
 	if err != nil {
@@ -81,7 +83,6 @@ func TestPublicMCPHTTPRejectsInvalidProfileAndStoredCredentials(t *testing.T) {
 	for _, server := range []proto.MCPHTTPServer{
 		{ConnectionOrigin: "service", ServerLabel: "codex_apps", ServerURL: "https://docs.example/mcp"},
 		{ConnectionOrigin: "service", ServerLabel: "docs", ServerURL: "https://user:synthetic-secret@docs.example/mcp"},
-		{ConnectionOrigin: "service", ServerLabel: "docs", ServerURL: "https://docs.example/mcp?token=synthetic-secret"},
 		{ConnectionOrigin: "service", ServerLabel: "docs", ServerURL: "file:///tmp/mcp"},
 	} {
 		servers := []proto.MCPHTTPServer{server}
@@ -121,7 +122,7 @@ func mcpHTTPConfigResponse(servers map[string]mcpServerConfig) map[string]any {
 		}
 		entries[name] = entry
 	}
-	return map[string]any{"config": map[string]any{"mcp_servers": entries, "features": map[string]any{"plugins": false, "apps": false}, "mcp_oauth_credentials_store": "file"}}
+	return map[string]any{"config": map[string]any{"mcp_servers": entries, "mcp_oauth_credentials_store": "file"}}
 }
 
 func writeMCPHTTPConfigResponse(t *testing.T, path string, response any) {
diff --git a/apps/daemon/internal/agent/codex/model_catalog_command_other.go b/apps/daemon/internal/agent/codex/model_catalog_command_other.go
deleted file mode 100644
index 38a3fb6ae..000000000
--- a/apps/daemon/internal/agent/codex/model_catalog_command_other.go
+++ /dev/null
@@ -1,16 +0,0 @@
-//go:build !unix
-
-package codex
-
-import (
-	"context"
-	"errors"
-	"os/exec"
-)
-
-// SupportsTextVerbosity requires bounded cancellation of the catalog probe.
-const SupportsTextVerbosity = false
-
-func modelCatalogCommand(context.Context, string, ...string) (*exec.Cmd, error) {
-	return nil, errors.New("codex: text verbosity requires Unix process-group cancellation support")
-}
diff --git a/apps/daemon/internal/agent/codex/model_catalog_command_unix.go b/apps/daemon/internal/agent/codex/model_catalog_command_unix.go
deleted file mode 100644
index 949b3b86e..000000000
--- a/apps/daemon/internal/agent/codex/model_catalog_command_unix.go
+++ /dev/null
@@ -1,21 +0,0 @@
-//go:build unix
-
-package codex
-
-import (
-	"context"
-	"os/exec"
-	"syscall"
-	"time"
-)
-
-// SupportsTextVerbosity requires bounded cancellation of the catalog probe.
-const SupportsTextVerbosity = true
-
-func modelCatalogCommand(ctx context.Context, binary string, args ...string) (*exec.Cmd, error) {
-	cmd := exec.CommandContext(ctx, binary, args...)
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
-	cmd.Cancel = func() error { return syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL) }
-	cmd.WaitDelay = time.Second
-	return cmd, nil
-}
diff --git a/apps/daemon/internal/agent/codex/model_catalog_command_unix_test.go b/apps/daemon/internal/agent/codex/model_catalog_command_unix_test.go
deleted file mode 100644
index 79b74bf3a..000000000
--- a/apps/daemon/internal/agent/codex/model_catalog_command_unix_test.go
+++ /dev/null
@@ -1,56 +0,0 @@
-//go:build unix
-
-package codex
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-func TestModelCatalogCancellationStopsDescendants(t *testing.T) {
-	for _, finish := range []string{"wait", "exit 0"} {
-		t.Run(finish, func(t *testing.T) {
-			checkCatalogDescendantCancellation(t, finish)
-		})
-	}
-}
-
-func checkCatalogDescendantCancellation(t *testing.T, finish string) {
-	t.Helper()
-	started := time.Now()
-	dir := t.TempDir()
-	binary := filepath.Join(dir, "codex")
-	if err := os.WriteFile(binary, []byte("#!/bin/sh\n(sleep 2; printf leaked > leaked) &\nprintf ready > ready\n"+finish+"\n"), 0700); err != nil {
-		t.Fatal(err)
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	done := make(chan error, 1)
-	go func() { done <- prepareModelVerbosity(ctx, binary, &SessionPlan{Cwd: dir}) }()
-	deadline := time.Now().Add(3 * time.Second)
-	for {
-		if _, err := os.Stat(filepath.Join(dir, "ready")); err == nil {
-			break
-		}
-		if time.Now().After(deadline) {
-			t.Fatal("catalog launcher did not start")
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-	cancel()
-	select {
-	case err := <-done:
-		if err == nil {
-			t.Fatal("cancelled catalog probe succeeded")
-		}
-	case <-time.After(1500 * time.Millisecond):
-		t.Fatal("catalog probe kept waiting on child output pipes")
-	}
-	time.Sleep(time.Until(started.Add(2200 * time.Millisecond)))
-	if _, err := os.Stat(filepath.Join(dir, "leaked")); !os.IsNotExist(err) {
-		t.Fatalf("catalog child survived cancellation: %v", err)
-	}
-}
diff --git a/apps/daemon/internal/agent/codex/model_route_test.go b/apps/daemon/internal/agent/codex/model_route_test.go
index c18fecfe9..74ad45684 100644
--- a/apps/daemon/internal/agent/codex/model_route_test.go
+++ b/apps/daemon/internal/agent/codex/model_route_test.go
@@ -2,6 +2,7 @@ package codex
 
 import (
 	"reflect"
+	"slices"
 	"strings"
 	"testing"
 )
@@ -35,3 +36,17 @@ func TestPlanRejectsIncompleteExplicitProvider(t *testing.T) {
 		}
 	}
 }
+
+func TestPlanMapsTheContextWindowNatively(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	provider := map[string]any{"protocol": "responses", "base_url": "https://model.example/v1", "api_key": "fixture", "context_window": 64000}
+	plan, err := BuildSessionPlan(testStateRoot(t), "limits", map[string]any{"model": "m", "model_provider": provider}, nil)
+	if err != nil || !slices.Contains(plan.ExtraConfig, [2]string{"model_context_window", "64000"}) {
+		t.Fatalf("context window not native: %v %v", plan.ExtraConfig, err)
+	}
+	plan.Cleanup()
+	provider["max_output_tokens"] = 4096
+	if _, err := BuildSessionPlan(testStateRoot(t), "limits", map[string]any{"model": "m", "model_provider": provider}, nil); err == nil {
+		t.Fatal("max_output_tokens without a native home accepted")
+	}
+}
diff --git a/apps/daemon/internal/agent/codex/model_verbosity.go b/apps/daemon/internal/agent/codex/model_verbosity.go
deleted file mode 100644
index 5bab427be..000000000
--- a/apps/daemon/internal/agent/codex/model_verbosity.go
+++ /dev/null
@@ -1,129 +0,0 @@
-package codex
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"time"
-)
-
-// Validate against the binary's active catalog and use that same snapshot for
-// execution. A CLI override alone is silently ignored for unsupported models.
-func prepareModelVerbosity(ctx context.Context, binary string, plan *SessionPlan) (resultErr error) {
-	started := time.Now()
-	defer func() { observePreparationStage(ctx, "model_catalog", started, resultErr) }()
-	args := []string{}
-	for _, kv := range plan.ExtraConfig {
-		args = append(args, "-c", kv[0]+"="+kv[1])
-	}
-	args = append(args, "debug", "models")
-	ctx, cancel := context.WithTimeout(ctx, rpcDefaultRequestTimeout)
-	defer cancel()
-	cmd, err := modelCatalogCommand(ctx, binary, args...)
-	if err != nil {
-		return err
-	}
-	cmd.Dir = plan.Cwd
-	cmd.Env = append(os.Environ(), plan.Env...)
-	commandStarted := time.Now()
-	catalog, err := cmd.Output()
-	commandEnded := time.Now()
-	// The launcher can exit before its children, ending the context watcher.
-	cleanupStarted := time.Now()
-	var cleanupErr error
-	if cmd.Process != nil {
-		cleanupErr = cmd.Cancel()
-	}
-	cleanupEnded := time.Now()
-	observePreparationInterval(ctx, "model_catalog_command", commandStarted, commandEnded, err)
-	// This is the existing best-effort process-group signal, not a second Wait.
-	if cmd.Process != nil {
-		observePreparationInterval(ctx, "model_catalog_cleanup", cleanupStarted, cleanupEnded, cleanupErr)
-	}
-	if err != nil {
-		return fmt.Errorf("codex: cannot verify model verbosity support: %w", err)
-	}
-	validationStarted := time.Now()
-	defer func() {
-		if !validationStarted.IsZero() {
-			observePreparationStage(ctx, "model_catalog_validation", validationStarted, resultErr)
-		}
-	}()
-	supported, err := catalogSupportsVerbosity(catalog, plan.Model)
-	if err != nil {
-		return fmt.Errorf("codex: cannot read model verbosity support: %w", err)
-	}
-	if !supported {
-		if !slices.Contains(plan.ExtraConfig, [2]string{"model_verbosity", `"medium"`}) {
-			return fmt.Errorf("codex: model %q does not declare text verbosity support", plan.Model)
-		}
-		// Protocol medium means the default text amount, which needs no native override.
-		plan.ExtraConfig = slices.DeleteFunc(plan.ExtraConfig, func(kv [2]string) bool { return kv[0] == "model_verbosity" })
-	}
-	codexHome := nativeHomeFromPlan(*plan)
-	if !filepath.IsAbs(codexHome) {
-		return fmt.Errorf("codex: missing managed home for model catalog")
-	}
-	observePreparationStage(ctx, "model_catalog_validation", validationStarted, nil)
-	validationStarted = time.Time{}
-	snapshotStarted := time.Now()
-	defer func() { observePreparationStage(ctx, "model_catalog_snapshot", snapshotStarted, resultErr) }()
-	file, err := os.CreateTemp(codexHome, "model-catalog-*.json")
-	if err != nil {
-		return err
-	}
-	_, writeErr := file.Write(catalog)
-	closeErr := file.Close()
-	if writeErr != nil || closeErr != nil {
-		_ = os.Remove(file.Name())
-		if writeErr != nil {
-			return writeErr
-		}
-		return closeErr
-	}
-	cleanup := plan.Cleanup
-	plan.Cleanup = func() { _ = os.Remove(file.Name()); cleanup() }
-	plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"model_catalog_json", strconv(file.Name())})
-	return nil
-}
-
-func catalogSupportsVerbosity(raw []byte, model string) (bool, error) {
-	var catalog struct {
-		Models []struct {
-			Slug             string `json:"slug"`
-			SupportVerbosity bool   `json:"support_verbosity"`
-		} `json:"models"`
-	}
-	if err := json.Unmarshal(raw, &catalog); err != nil {
-		return false, err
-	}
-	// Match Codex models-manager's longest-prefix lookup, then its single,
-	// simple provider namespace fallback. Do not infer support from a model name.
-	match := func(name string) (bool, bool) {
-		longest, supported := 0, false
-		for _, candidate := range catalog.Models {
-			if len(candidate.Slug) > longest && strings.HasPrefix(name, candidate.Slug) {
-				longest, supported = len(candidate.Slug), candidate.SupportVerbosity
-			}
-		}
-		return supported, longest > 0
-	}
-	if supported, found := match(model); found {
-		return supported, nil
-	}
-	namespace, suffix, found := strings.Cut(model, "/")
-	if !found || namespace == "" || strings.Contains(suffix, "/") {
-		return false, nil
-	}
-	for _, c := range namespace {
-		if !(c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9' || c == '_' || c == '-') {
-			return false, nil
-		}
-	}
-	supported, _ := match(suffix)
-	return supported, nil
-}
diff --git a/apps/daemon/internal/agent/codex/model_verbosity_test.go b/apps/daemon/internal/agent/codex/model_verbosity_test.go
deleted file mode 100644
index 83a65e502..000000000
--- a/apps/daemon/internal/agent/codex/model_verbosity_test.go
+++ /dev/null
@@ -1,118 +0,0 @@
-package codex
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-func TestCatalogVerbositySupport(t *testing.T) {
-	catalog := []byte(`{"models":[{"slug":"gpt-5","support_verbosity":true},{"slug":"gpt-5-special","support_verbosity":false}]}`)
-	for model, want := range map[string]bool{
-		"gpt-5": true, "gpt-5.5": true, "provider/gpt-5.5": true,
-		"gpt-5-special": false, "provider/gpt-5-special": false,
-		"custom-provider-model": false, "": false, "a/b/gpt-5": false, "a b/gpt-5": false,
-	} {
-		got, err := catalogSupportsVerbosity(catalog, model)
-		if err != nil || got != want {
-			t.Errorf("%q: got %v, %v; want %v", model, got, err, want)
-		}
-	}
-	if _, err := catalogSupportsVerbosity([]byte(`{"models":false}`), "gpt-5"); err == nil {
-		t.Fatal("accepted malformed catalog")
-	}
-}
-
-func TestPrepareModelVerbosity(t *testing.T) {
-	if !SupportsTextVerbosity {
-		t.Skip("catalog probe requires Unix")
-	}
-	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-	binary := filepath.Join(t.TempDir(), "codex")
-	catalog := `{"models":[{"slug":"known-model","support_verbosity":true,"native_extra":{"keep":true}}]}`
-	if err := os.WriteFile(binary, []byte("#!/bin/sh\nprintf '%s' '"+catalog+"'\n"), 0700); err != nil {
-		t.Fatal(err)
-	}
-	plan, err := BuildSessionPlan(testStateRoot(t), "state", map[string]any{"model": "known-model"}, &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "high"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer plan.Cleanup()
-	if err := prepareModelVerbosity(context.Background(), binary, &plan); err != nil {
-		t.Fatal(err)
-	}
-	kv := plan.ExtraConfig[len(plan.ExtraConfig)-1]
-	if kv[0] != "model_catalog_json" {
-		t.Fatal("catalog was not pinned")
-	}
-	name := strings.Trim(kv[1], `"`)
-	got, err := os.ReadFile(name)
-	if err != nil || string(got) != catalog {
-		t.Fatalf("catalog changed: %s, %v", got, err)
-	}
-	plan.Cleanup()
-	if _, err := os.Stat(name); !os.IsNotExist(err) {
-		t.Fatalf("catalog was not removed: %v", err)
-	}
-	plan.Model = "custom-provider-model"
-	if err := prepareModelVerbosity(context.Background(), binary, &plan); err == nil {
-		t.Fatal("accepted model that would ignore verbosity")
-	}
-	if err := prepareModelVerbosity(context.Background(), "/missing-codex", &plan); err == nil {
-		t.Fatal("accepted unreadable catalog")
-	}
-}
-
-func TestPrepareDefaultModelVerbosity(t *testing.T) {
-	if !SupportsTextVerbosity {
-		t.Skip("catalog probe requires Unix")
-	}
-	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-	binary := filepath.Join(t.TempDir(), "codex")
-	catalog := `{"models":[{"slug":"supported","support_verbosity":true,"default_verbosity":"low"},{"slug":"unsupported","support_verbosity":false}]}`
-	if err := os.WriteFile(binary, []byte("#!/bin/sh\nprintf '%s' '"+catalog+"'\n"), 0700); err != nil {
-		t.Fatal(err)
-	}
-	for _, model := range []string{"supported", "unsupported", "unknown-provider-model"} {
-		for _, level := range []string{"low", "medium", "high"} {
-			t.Run(model+"/"+level, func(t *testing.T) {
-				plan, err := BuildSessionPlan(testStateRoot(t), "state", map[string]any{"model": model}, &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: level})
-				if err != nil {
-					t.Fatal(err)
-				}
-				defer func() { plan.Cleanup() }()
-				err = prepareModelVerbosity(context.Background(), binary, &plan)
-				if model != "supported" && level != "medium" {
-					if err == nil {
-						t.Fatal("accepted unsupported non-default verbosity")
-					}
-					return
-				}
-				if err != nil {
-					t.Fatal(err)
-				}
-				found := false
-				for _, kv := range plan.ExtraConfig {
-					if kv[0] == "model_verbosity" {
-						found = true
-						if kv[1] != `"`+level+`"` {
-							t.Fatal("configured verbosity changed", kv)
-						}
-					}
-				}
-				if found != (model == "supported") || plan.Model != model {
-					t.Fatal("native default or model identity changed", plan.ExtraConfig, plan.Model)
-				}
-				kv := plan.ExtraConfig[len(plan.ExtraConfig)-1]
-				raw, err := os.ReadFile(strings.Trim(kv[1], `"`))
-				if kv[0] != "model_catalog_json" || err != nil || string(raw) != catalog {
-					t.Fatal("native catalog snapshot changed", err)
-				}
-			})
-		}
-	}
-}
diff --git a/apps/daemon/internal/agent/codex/native_hooks.go b/apps/daemon/internal/agent/codex/native_hooks.go
deleted file mode 100644
index 962ca1969..000000000
--- a/apps/daemon/internal/agent/codex/native_hooks.go
+++ /dev/null
@@ -1,39 +0,0 @@
-package codex
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"time"
-)
-
-type nativeToolHook struct {
-	EventName   string `json:"eventName"`
-	Command     string `json:"command"`
-	Matcher     string `json:"matcher"`
-	Enabled     bool   `json:"enabled"`
-	IsManaged   bool   `json:"isManaged"`
-	Async       bool   `json:"async"`
-	SourcePath  string `json:"sourcePath"`
-	TrustStatus string `json:"trustStatus"`
-}
-
-func readNativeToolHooks(ctx context.Context, rpc *JSONRPCClient, cwd string) ([]nativeToolHook, error) {
-	operation, cancel := context.WithTimeout(ctx, 10*time.Second)
-	defer cancel()
-	raw, err := rpc.Request(operation, "hooks/list", map[string]any{"cwds": []string{cwd}})
-	if err != nil {
-		return nil, errors.New("codex: initialized tool hook unavailable")
-	}
-	var response struct {
-		Data []struct {
-			CWD    string            `json:"cwd"`
-			Hooks  []nativeToolHook  `json:"hooks"`
-			Errors []json.RawMessage `json:"errors"`
-		} `json:"data"`
-	}
-	if json.Unmarshal(raw, &response) != nil || len(response.Data) != 1 || response.Data[0].CWD != cwd || len(response.Data[0].Errors) != 0 {
-		return nil, errors.New("codex: initialized tool hook configuration unavailable")
-	}
-	return response.Data[0].Hooks, nil
-}
diff --git a/apps/daemon/internal/agent/codex/options.go b/apps/daemon/internal/agent/codex/options.go
index 0f7f26d26..4a696d994 100644
--- a/apps/daemon/internal/agent/codex/options.go
+++ b/apps/daemon/internal/agent/codex/options.go
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"slices"
 	"sort"
 	"strings"
 
@@ -57,6 +56,15 @@ type SessionPlan struct {
 	// ModelReasoningEffort is frozen for launch and every native Turn.
 	ModelReasoningEffort string
 
+	// ReasoningSummary reports that the Agent requested reasoning summaries.
+	ReasoningSummary bool
+
+	// OutputSchema is the frozen public JSON Schema sent as outputSchema on every
+	// native root Turn.
+	OutputSchema json.RawMessage
+
+	shellEnvExclude []string
+
 	// Cleanup is the deferred housekeeping the session must run after the child exits.
 	Cleanup func()
 }
@@ -69,7 +77,7 @@ type SessionPlan struct {
 //	model_provider  object  frozen upstream protocol, endpoint, credential and token limits
 //	harness_config  object  native parameters accepted by harnessconfig/codex
 //
-// Execution controls select the native web_search and model_verbosity settings.
+// Execution controls map one to one to native settings; see applyExecutionControls.
 // The codex binary itself is resolved via PATH only.
 func BuildSessionPlan(stateRoot, agentStateKey string, opts map[string]any, controls *proto.ExecutionControls) (SessionPlan, error) {
 	plan := SessionPlan{
@@ -81,8 +89,7 @@ func BuildSessionPlan(stateRoot, agentStateKey string, opts map[string]any, cont
 		Cleanup:         func() {},
 	}
 
-	nativeConfig, err := harnessconfiguration.Configuration().PrepareHarnessConfig(opts)
-	if err != nil {
+	if _, err := harnessconfiguration.Declaration.Configuration.PrepareHarnessConfig(opts); err != nil {
 		return plan, err
 	}
 
@@ -90,13 +97,8 @@ func BuildSessionPlan(stateRoot, agentStateKey string, opts map[string]any, cont
 		return plan, errors.New("codex: model and complete model_provider are required")
 	}
 
-	if controls != nil {
-		if !slices.Contains([]string{"disabled", "cached", "live"}, controls.WebSearch) {
-			return plan, errors.New("codex: web_search must be disabled, cached or live")
-		}
-		if !slices.Contains([]string{"low", "medium", "high"}, controls.TextVerbosity) {
-			return plan, errors.New("codex: text_verbosity must be low, medium or high")
-		}
+	if err := harnessconfiguration.Declaration.ValidateExecutionControls(controls); err != nil {
+		return plan, err
 	}
 
 	plan.Model = stringOpt(opts, "model")
@@ -109,7 +111,7 @@ func BuildSessionPlan(stateRoot, agentStateKey string, opts map[string]any, cont
 	if err := resetGeneratedConfig(codexHome); err != nil {
 		return plan, err
 	}
-	env := []string{"DISABLE_TELEMETRY=1", "CODEX_HOME=" + codexHome}
+	env := []string{"CODEX_HOME=" + codexHome}
 
 	provider, hasProvider, err := normaliseProviderConfig(opts["model_provider"])
 	if err != nil {
@@ -124,7 +126,10 @@ func BuildSessionPlan(stateRoot, agentStateKey string, opts map[string]any, cont
 		// shell_environment_policy is applied. Do not persist provider credentials.
 		plan.DisableFeatures = append(plan.DisableFeatures, "shell_snapshot")
 		env = append(env, providerAPIKeyEnv+"="+provider.BearerToken)
-		excluded := []string{strconv(providerAPIKeyEnv)}
+		excludeFromShellEnvironment(&plan, providerAPIKeyEnv)
+		if provider.ContextWindow > 0 {
+			plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"model_context_window", fmt.Sprint(provider.ContextWindow)})
+		}
 		names := make([]string, 0, len(provider.HTTPHeaders))
 		for name := range provider.HTTPHeaders {
 			names = append(names, name)
@@ -133,19 +138,12 @@ func BuildSessionPlan(stateRoot, agentStateKey string, opts map[string]any, cont
 		for i, name := range names {
 			reference := providerHeaderEnv(i)
 			env = append(env, reference+"="+provider.HTTPHeaders[name])
-			excluded = append(excluded, strconv(reference))
+			excludeFromShellEnvironment(&plan, reference)
 		}
-		plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"shell_environment_policy.exclude", "[" + strings.Join(excluded, ",") + "]"})
 	}
 
 	plan.Env = env
-	if controls != nil {
-		plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"web_search", strconv(controls.WebSearch)}, [2]string{"model_verbosity", strconv(controls.TextVerbosity)})
-	}
-	if effort, ok := nativeConfig["model_reasoning_effort"].(string); ok {
-		plan.ModelReasoningEffort = effort
-		plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"model_reasoning_effort", strconv(effort)})
-	}
+	applyExecutionControls(&plan, controls)
 	if plan.ModelProvider != "" {
 		// Pin model_provider at the CLI layer so codex skips its builtin
 		// "openai" provider — without this the [model_providers.oac]
@@ -157,6 +155,73 @@ func BuildSessionPlan(stateRoot, agentStateKey string, opts map[string]any, cont
 	return plan, nil
 }
 
+// excludeFromShellEnvironment keeps a Runtime secret out of native shell tools.
+// The pattern is a native case-insensitive wildcard; one setting holds them all.
+func excludeFromShellEnvironment(plan *SessionPlan, pattern string) {
+	const key = "shell_environment_policy.exclude"
+	plan.shellEnvExclude = append(plan.shellEnvExclude, strconv(pattern))
+	value := "[" + strings.Join(plan.shellEnvExclude, ",") + "]"
+	for i := range plan.ExtraConfig {
+		if plan.ExtraConfig[i][0] == key {
+			plan.ExtraConfig[i][1] = value
+			return
+		}
+	}
+	plan.ExtraConfig = append(plan.ExtraConfig, [2]string{key, value})
+}
+
+// applyExecutionControls maps each official value to its native setting. An
+// absent control sends nothing, so Codex keeps its native default; Codex itself
+// ignores a value the selected model does not support.
+func applyExecutionControls(plan *SessionPlan, controls *proto.ExecutionControls) {
+	set := func(key, value string) { plan.ExtraConfig = append(plan.ExtraConfig, [2]string{key, value}) }
+	if controls == nil || controls.ReasoningSummary == "" {
+		// The official default is no reasoning summary, while Codex defaults to a model-dependent one.
+		set("model_reasoning_summary", strconv("none"))
+	}
+	if controls == nil {
+		return
+	}
+	if search := controls.WebSearch; search != nil {
+		set("web_search", strconv(search.Mode))
+		set("tools.web_search.context_size", strconv(search.ContextSize))
+		if search.AllowedDomains != nil {
+			quoted := make([]string, len(search.AllowedDomains))
+			for i, domain := range search.AllowedDomains {
+				quoted[i] = strconv(domain)
+			}
+			set("tools.web_search.allowed_domains", "["+strings.Join(quoted, ",")+"]")
+		}
+		if location := search.Location; location != nil {
+			for _, field := range []struct {
+				key   string
+				value *string
+			}{{"city", location.City}, {"country", location.Country}, {"region", location.Region}, {"timezone", location.Timezone}} {
+				if field.value != nil {
+					set("tools.web_search.location."+field.key, strconv(*field.value))
+				}
+			}
+		}
+	}
+	if format := controls.OutputFormat; format != nil {
+		plan.OutputSchema = format.Schema
+	}
+	if controls.ReasoningEffort != "" {
+		plan.ModelReasoningEffort = controls.ReasoningEffort
+		set("model_reasoning_effort", strconv(controls.ReasoningEffort))
+	}
+	if controls.ReasoningSummary != "" {
+		plan.ReasoningSummary = true
+		set("model_reasoning_summary", strconv(controls.ReasoningSummary))
+	}
+	if controls.ServiceTier != "" {
+		set("service_tier", strconv(controls.ServiceTier))
+	}
+	if controls.TextVerbosity != "" {
+		set("model_verbosity", strconv(controls.TextVerbosity))
+	}
+}
+
 // ---------------------------------------------------------------------------
 // helpers
 // ---------------------------------------------------------------------------
@@ -211,11 +276,11 @@ func normaliseProviderConfig(raw any) (providerConfig, bool, error) {
 	if raw == nil {
 		return providerConfig{}, false, nil
 	}
-	provider, err := harnessconfiguration.Configuration().ParseProvider(raw)
+	provider, err := harnessconfiguration.Declaration.Configuration.ParseProvider(raw)
 	if err != nil {
 		return providerConfig{}, false, err
 	}
-	return providerConfig{BaseURL: provider.BaseURL, BearerToken: provider.APIKey, WireAPI: "responses", HTTPHeaders: provider.Headers}, true, nil
+	return providerConfig{BaseURL: provider.BaseURL, BearerToken: provider.APIKey, WireAPI: "responses", ContextWindow: provider.ContextWindow, HTTPHeaders: provider.Headers}, true, nil
 }
 
 func stringOpt(opts map[string]any, key string) string {
diff --git a/apps/daemon/internal/agent/codex/options_test.go b/apps/daemon/internal/agent/codex/options_test.go
index eb64d84de..a63c5db19 100644
--- a/apps/daemon/internal/agent/codex/options_test.go
+++ b/apps/daemon/internal/agent/codex/options_test.go
@@ -28,21 +28,17 @@ func TestBuildSessionPlan_AllocsCodexHomeAndEnv(t *testing.T) {
 	}
 	defer plan.Cleanup()
 	hasCodexHome := false
-	hasTelemetry := false
 	for _, kv := range plan.Env {
 		switch {
 		case strings.HasPrefix(kv, "CODEX_HOME="):
 			hasCodexHome = true
-		case kv == "DISABLE_TELEMETRY=1":
-			hasTelemetry = true
+		case strings.HasPrefix(kv, "DISABLE_TELEMETRY="):
+			t.Fatalf("env sets a variable Codex does not read: %+v", plan.Env)
 		}
 	}
 	if !hasCodexHome {
 		t.Fatalf("env missing CODEX_HOME: %+v", plan.Env)
 	}
-	if !hasTelemetry {
-		t.Fatalf("env missing DISABLE_TELEMETRY: %+v", plan.Env)
-	}
 }
 
 func TestBuildSessionPlan_StableCodexHomeByStateKey(t *testing.T) {
diff --git a/apps/daemon/internal/agent/codex/permission_profile.go b/apps/daemon/internal/agent/codex/permission_profile.go
index f5e7cb807..6ffcef841 100644
--- a/apps/daemon/internal/agent/codex/permission_profile.go
+++ b/apps/daemon/internal/agent/codex/permission_profile.go
@@ -7,8 +7,8 @@ import (
 
 // Runtime execution uses the current user; isolation belongs to its outer host.
 func validatePermissionProfile(req proto.PromptRequestPayload) error {
-	if req.LocalEnvironment != nil && (req.DisableExecutionEnvironment || req.WorkspaceReadOnly || req.LocalEnvironment.NetworkAccess != "enabled" || len(req.LocalEnvironment.AllowedDomains) != 0) {
-		return fmt.Errorf("codex: Runtime execution requires unrestricted host access")
+	if req.LocalEnvironment != nil && req.WorkspaceReadOnly {
+		return fmt.Errorf("codex: Runtime execution requires a writable workspace")
 	}
 	return nil
 }
diff --git a/apps/daemon/internal/agent/codex/permission_profile_test.go b/apps/daemon/internal/agent/codex/permission_profile_test.go
index c8bd52e71..9ff776baf 100644
--- a/apps/daemon/internal/agent/codex/permission_profile_test.go
+++ b/apps/daemon/internal/agent/codex/permission_profile_test.go
@@ -11,7 +11,7 @@ import (
 func TestRuntimeUsesHostPermissions(t *testing.T) {
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
 	{
-		req := proto.PromptRequestPayload{AgentStateKey: "session", DisableSubagents: true, LocalEnvironment: &proto.LocalEnvironment{NetworkAccess: "enabled", WorkspaceRoot: t.TempDir()}}
+		req := proto.PromptRequestPayload{AgentStateKey: "session", DisableSubagents: true, LocalEnvironment: &proto.LocalEnvironment{WorkspaceRoot: t.TempDir()}}
 		plan, _, err := prepareSessionPlan(t.Context(), req, sessionConfig{stateRoot: testStateRoot(t)})
 		if err != nil {
 			t.Fatal(err)
@@ -25,12 +25,6 @@ func TestRuntimeUsesHostPermissions(t *testing.T) {
 			}
 		}
 		plan.Cleanup()
-		for _, network := range []string{"disabled", "restricted"} {
-			req.LocalEnvironment.NetworkAccess = network
-			if _, _, err := prepareSessionPlan(t.Context(), req, sessionConfig{stateRoot: testStateRoot(t)}); err == nil {
-				t.Fatal("unsupported network admitted")
-			}
-		}
 	}
 }
 
@@ -45,10 +39,10 @@ func TestSelfHostedToolEnvironmentCannotRedirectNativeHistory(t *testing.T) {
 	if err := os.WriteFile(config, []byte(`{"CODEX_HOME":"wrong","HOME":"wrong","USERPROFILE":"wrong","USER_VALUE":"ready"}`), 0600); err != nil {
 		t.Fatal(err)
 	}
-	for key, value := range map[string]string{"OAC_RUNTIME_ENVIRONMENT_ID": "b3d154b8-543b-4248-97b1-665f9f418d52", "OAC_RUNTIME_SESSION_ID": "33e02e0d-6fc8-4904-9d7a-4b61b9094ae0", "OAC_RUNTIME_WORKSPACE": workspace, "OAC_RUNTIME_CAPABILITY_DIRECTORY": filepath.Join(root, "capabilities"), "OAC_RUNTIME_NETWORK_ACCESS": "enabled", "OAC_RUNTIME_TOOL_ENV_FILE": config} {
+	for key, value := range map[string]string{"OAC_RUNTIME_ENVIRONMENT_ID": "b3d154b8-543b-4248-97b1-665f9f418d52", "OAC_RUNTIME_SESSION_ID": "33e02e0d-6fc8-4904-9d7a-4b61b9094ae0", "OAC_RUNTIME_WORKSPACE": workspace, "OAC_RUNTIME_CAPABILITY_DIRECTORY": filepath.Join(root, "capabilities"), "OAC_RUNTIME_TOOL_ENV_FILE": config} {
 		t.Setenv(key, value)
 	}
-	req := proto.PromptRequestPayload{AgentStateKey: "session", DisableSubagents: true, LocalEnvironment: &proto.LocalEnvironment{NetworkAccess: "enabled"}}
+	req := proto.PromptRequestPayload{AgentStateKey: "session", DisableSubagents: true, LocalEnvironment: &proto.LocalEnvironment{}}
 	plan, _, err := prepareSessionPlan(t.Context(), req, sessionConfig{stateRoot: testStateRoot(t)})
 	if err != nil {
 		t.Fatal(err)
diff --git a/apps/daemon/internal/agent/codex/preparation.go b/apps/daemon/internal/agent/codex/preparation.go
index 468e08576..5b54cc40f 100644
--- a/apps/daemon/internal/agent/codex/preparation.go
+++ b/apps/daemon/internal/agent/codex/preparation.go
@@ -13,9 +13,6 @@ import (
 )
 
 func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg sessionConfig) (_ *Prepared, resultErr error) {
-	if req.ExecutionControls != nil && req.ExecutionControls.OutputFormat != nil {
-		return nil, errors.New("codex: structured output is not qualified")
-	}
 	if req.WorkspaceReadOnly {
 		return nil, errors.New("codex: workspace reads use the local Runtime interface")
 	}
@@ -62,7 +59,6 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 	s := &Session{
 		nativeHome:                nativeHomeFromPlan(plan),
 		functions:                 functions,
-		observeMessages:           req.ObserveMessages,
 		observeSubagentIdentities: req.ObserveSubagentIdentities && !req.DisableSubagents,
 		cfg:                       cfg,
 		rpc:                       rpc,
@@ -72,6 +68,7 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 		cleanup:                   sync.OnceFunc(plan.Cleanup),
 		bufs:                      NewItemBuffers(),
 		resolvedModel:             plan.Model,
+		reasoningSummary:          plan.ReasoningSummary,
 	}
 	plan.Cleanup = s.cleanup
 	p := &Prepared{
@@ -89,8 +86,8 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 	}
 	verificationStarted := time.Now()
 	defer func() { observePreparationStage(parent, "verification", verificationStarted, resultErr) }()
-	if req.ExecutionControls != nil && req.ExecutionControls.DisableProgrammaticToolCalling {
-		if err := verifyProgrammaticToolsDisabled(cancelCtx, rpc); err != nil {
+	if req.ExecutionControls != nil && req.ExecutionControls.ProgrammaticToolCalling != nil {
+		if err := verifyProgrammaticTools(cancelCtx, rpc, *req.ExecutionControls.ProgrammaticToolCalling); err != nil {
 			return p.preparationFailed(err)
 		}
 	}
@@ -100,7 +97,7 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 		}
 	}
 	if s.observeSubagentIdentities {
-		if err := verifySubagentObservationProfile(cancelCtx, rpc, plan.Cwd); err != nil {
+		if err := verifySubagentObservationProfile(cancelCtx, rpc); err != nil {
 			return p.preparationFailed(err)
 		}
 	}
diff --git a/apps/daemon/internal/agent/codex/preparation_helpers_test.go b/apps/daemon/internal/agent/codex/preparation_helpers_test.go
index 1472c3a5d..780febc73 100644
--- a/apps/daemon/internal/agent/codex/preparation_helpers_test.go
+++ b/apps/daemon/internal/agent/codex/preparation_helpers_test.go
@@ -42,7 +42,7 @@ func preparationFixture(t *testing.T) (proto.PromptRequestPayload, sessionConfig
 	req := proto.PromptRequestPayload{
 		AgentKind: "codex", AgentStateKey: "prepared-session",
 		AgentOptions:                map[string]any{"model": "fixture-model"},
-		ExecutionControls:           &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"},
+		ExecutionControls:           &proto.ExecutionControls{TextVerbosity: "medium"},
 		DisableExecutionEnvironment: true,
 		FunctionTools:               []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{"type":"object","properties":{"value":{"type":"integer"}}}`)}},
 	}
diff --git a/apps/daemon/internal/agent/codex/preparation_router_test.go b/apps/daemon/internal/agent/codex/preparation_router_test.go
index 35f2b64f0..f1a3086d3 100644
--- a/apps/daemon/internal/agent/codex/preparation_router_test.go
+++ b/apps/daemon/internal/agent/codex/preparation_router_test.go
@@ -46,7 +46,6 @@ func TestPreparationRouterRetainsActualNativeChild(t *testing.T) {
 				"OAC_RUNTIME_ENVIRONMENT_ID": environment,
 				"OAC_RUNTIME_SESSION_ID":     session,
 				"OAC_RUNTIME_WORKSPACE":      workspace,
-				"OAC_RUNTIME_NETWORK_ACCESS": "enabled",
 			} {
 				t.Setenv(key, value)
 			}
@@ -54,9 +53,9 @@ func TestPreparationRouterRetainsActualNativeChild(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			req.AgentStateKey = "agents-api-" + session
+			req.AgentStateKey = session
 			req.DisableExecutionEnvironment = false
-			req.LocalEnvironment = &proto.LocalEnvironment{ID: environment, WorkspaceDirectory: "/workspace", NetworkAccess: "enabled", CapabilitySources: &agentcapabilities.Input{}}
+			req.LocalEnvironment = &proto.LocalEnvironment{ID: environment, WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}
 			registry := agent.NewRegistry()
 			registry.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{LocalEnvironment: proto.CapabilitySupported, FunctionTools: proto.CapabilitySupported})}, harnessconfig.Configuration{})
 			prepared := make(chan *Prepared, 1)
diff --git a/apps/daemon/internal/agent/codex/programmatic_tools.go b/apps/daemon/internal/agent/codex/programmatic_tools.go
index c2da9f9a1..52dac4668 100644
--- a/apps/daemon/internal/agent/codex/programmatic_tools.go
+++ b/apps/daemon/internal/agent/codex/programmatic_tools.go
@@ -11,8 +11,17 @@ import (
 
 var programmaticFeatures = []string{"code_mode", "code_mode_only", "code_mode_prewarm"}
 
-func disableProgrammaticTools(plan *SessionPlan, controls *proto.ExecutionControls) {
-	if controls == nil || !controls.DisableProgrammaticToolCalling {
+// applyProgrammaticTools maps the official programmatic_tool_calling.enabled
+// value to Codex code mode, whose model-written JavaScript calls the other
+// tools. Disabling also turns off its dependent features. Omission keeps the
+// native default.
+func applyProgrammaticTools(plan *SessionPlan, controls *proto.ExecutionControls) {
+	if controls == nil || controls.ProgrammaticToolCalling == nil {
+		return
+	}
+	if *controls.ProgrammaticToolCalling {
+		plan.EnableFeatures = append(plan.EnableFeatures, "code_mode")
+		plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"features.code_mode", "true"})
 		return
 	}
 	for _, feature := range programmaticFeatures {
@@ -25,7 +34,7 @@ func disableProgrammaticTools(plan *SessionPlan, controls *proto.ExecutionContro
 
 // Managed native requirements can override command-line feature settings.
 // Check before starting or resuming a native Session, not after model execution.
-func verifyProgrammaticToolsDisabled(ctx context.Context, rpc *JSONRPCClient) error {
+func verifyProgrammaticTools(ctx context.Context, rpc *JSONRPCClient, enabled bool) error {
 	raw, err := rpc.Request(ctx, "configRequirements/read", nil)
 	var response struct {
 		Requirements json.RawMessage `json:"requirements"`
@@ -40,6 +49,12 @@ func verifyProgrammaticToolsDisabled(ctx context.Context, rpc *JSONRPCClient) er
 		if json.Unmarshal(response.Requirements, &requirements) != nil {
 			return errors.New("codex: invalid programmatic tool requirements")
 		}
+		if enabled {
+			if required, pinned := requirements.Features["code_mode"]; pinned && !required {
+				return errors.New("codex: required programmatic tools conflict with explicit enabling")
+			}
+			return nil
+		}
 		for _, feature := range programmaticFeatures {
 			if requirements.Features[feature] {
 				return errors.New("codex: required programmatic tools conflict with explicit disabling")
diff --git a/apps/daemon/internal/agent/codex/programmatic_tools_test.go b/apps/daemon/internal/agent/codex/programmatic_tools_test.go
index fd0aeee8a..920d58720 100644
--- a/apps/daemon/internal/agent/codex/programmatic_tools_test.go
+++ b/apps/daemon/internal/agent/codex/programmatic_tools_test.go
@@ -3,6 +3,7 @@ package codex
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"slices"
 	"testing"
 	"time"
@@ -10,13 +11,19 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func TestProgrammaticToolsExplicitDisableOverridesNativeOptions(t *testing.T) {
+func TestProgrammaticToolsFollowTheOfficialValue(t *testing.T) {
+	enabled, disabled := true, false
 	plan := SessionPlan{ExtraConfig: [][2]string{{"features.code_mode", "true"}}}
-	disableProgrammaticTools(&plan, nil)
-	if len(plan.DisableFeatures) != 0 || len(plan.ExtraConfig) != 1 {
+	applyProgrammaticTools(&plan, nil)
+	applyProgrammaticTools(&plan, &proto.ExecutionControls{})
+	if len(plan.DisableFeatures) != 0 || len(plan.EnableFeatures) != 0 || len(plan.ExtraConfig) != 1 {
 		t.Fatal("omission changed native configuration")
 	}
-	disableProgrammaticTools(&plan, &proto.ExecutionControls{DisableProgrammaticToolCalling: true})
+	applyProgrammaticTools(&plan, &proto.ExecutionControls{ProgrammaticToolCalling: &enabled})
+	if !slices.Equal(plan.EnableFeatures, []string{"code_mode"}) || len(plan.DisableFeatures) != 0 || plan.ExtraConfig[len(plan.ExtraConfig)-1] != [2]string{"features.code_mode", "true"} {
+		t.Fatal("enabling did not select code mode", plan)
+	}
+	applyProgrammaticTools(&plan, &proto.ExecutionControls{ProgrammaticToolCalling: &disabled})
 	for _, feature := range programmaticFeatures {
 		if !slices.Contains(plan.DisableFeatures, feature) {
 			t.Fatal("missing disable", feature)
@@ -36,22 +43,26 @@ func TestProgrammaticToolsExplicitDisableOverridesNativeOptions(t *testing.T) {
 func TestProgrammaticToolsRejectManagedOverridesBeforeExecution(t *testing.T) {
 	for _, tc := range []struct {
 		response string
+		enabled  bool
 		accepted bool
 	}{
-		{`{"requirements":null}`, true},
-		{`{"requirements":{"featureRequirements":{"code_mode":false,"unrelated":true}}}`, true},
-		{`{"requirements":{"featureRequirements":{"code_mode":true}}}`, false},
-		{`{"requirements":{"featureRequirements":{"code_mode_only":true}}}`, false},
-		{`{"requirements":{"featureRequirements":{"code_mode_prewarm":true}}}`, false},
-		{`{}`, false}, {`null`, false}, {`{"requirements":[]}`, false},
+		{`{"requirements":null}`, false, true},
+		{`{"requirements":{"featureRequirements":{"code_mode":false,"unrelated":true}}}`, false, true},
+		{`{"requirements":{"featureRequirements":{"code_mode":true}}}`, false, false},
+		{`{"requirements":{"featureRequirements":{"code_mode_only":true}}}`, false, false},
+		{`{"requirements":{"featureRequirements":{"code_mode_prewarm":true}}}`, false, false},
+		{`{}`, false, false}, {`null`, false, false}, {`{"requirements":[]}`, false, false},
+		{`{"requirements":null}`, true, true},
+		{`{"requirements":{"featureRequirements":{"code_mode":true}}}`, true, true},
+		{`{"requirements":{"featureRequirements":{"code_mode":false}}}`, true, false},
 	} {
-		t.Run(tc.response, func(t *testing.T) {
+		t.Run(fmt.Sprint(tc.enabled, tc.response), func(t *testing.T) {
 			client, server, cleanup := NewTestClient()
 			defer cleanup()
 			ctx, cancel := context.WithTimeout(t.Context(), time.Second)
 			defer cancel()
 			done := make(chan error, 1)
-			go func() { done <- verifyProgrammaticToolsDisabled(ctx, client.JSONRPCClient) }()
+			go func() { done <- verifyProgrammaticTools(ctx, client.JSONRPCClient, tc.enabled) }()
 			var request struct{ ID, Method string }
 			if err := json.NewDecoder(server.FromClient).Decode(&request); err != nil {
 				t.Fatal(err)
diff --git a/apps/daemon/internal/agent/codex/protocol.go b/apps/daemon/internal/agent/codex/protocol.go
index 2daa4acb7..2e9bd8a89 100644
--- a/apps/daemon/internal/agent/codex/protocol.go
+++ b/apps/daemon/internal/agent/codex/protocol.go
@@ -164,24 +164,10 @@ type UserInput struct {
 }
 
 type TurnStartParams struct {
-	ThreadID          string             `json:"threadId"`
-	Input             []UserInput        `json:"input"`
-	CollaborationMode *CollaborationMode `json:"collaborationMode,omitempty"`
-}
-
-type CollaborationModeKind string
-
-const CollaborationModeDefault CollaborationModeKind = "default"
-
-type CollaborationMode struct {
-	Mode     CollaborationModeKind     `json:"mode"`
-	Settings CollaborationModeSettings `json:"settings"`
-}
-
-type CollaborationModeSettings struct {
-	ReasoningEffort       string  `json:"reasoning_effort,omitempty"`
-	Model                 string  `json:"model"`
-	DeveloperInstructions *string `json:"developer_instructions"`
+	ThreadID string      `json:"threadId"`
+	Input    []UserInput `json:"input"`
+	// OutputSchema constrains this Turn's final assistant message natively.
+	OutputSchema json.RawMessage `json:"outputSchema,omitempty"`
 }
 
 type TurnInterruptParams struct {
@@ -230,11 +216,10 @@ type ThreadItem struct {
 	ID   string `json:"id,omitempty"`
 
 	// agentMessage / reasoning
-	Phase       string   `json:"phase,omitempty"`
-	Text        string   `json:"text,omitempty"`
-	Summary     []string `json:"summary,omitempty"`
-	Content     []string `json:"content,omitempty"`
-	SummaryText string   `json:"summary_text,omitempty"`
+	Phase   string   `json:"phase,omitempty"`
+	Text    string   `json:"text,omitempty"`
+	Summary []string `json:"summary,omitempty"`
+	Content []string `json:"content,omitempty"`
 
 	// commandExecution
 	Command  string `json:"command,omitempty"`
@@ -297,7 +282,12 @@ type AgentMessageDeltaNotification struct {
 	Delta    string `json:"delta"`
 }
 
-type ReasoningDeltaNotification = AgentMessageDeltaNotification
+// ReasoningDeltaNotification is a summaryTextDelta (SummaryIndex) or a textDelta (ContentIndex).
+type ReasoningDeltaNotification struct {
+	AgentMessageDeltaNotification
+	SummaryIndex int `json:"summaryIndex"`
+	ContentIndex int `json:"contentIndex"`
+}
 
 type ThreadTokenUsageUpdatedNotification struct {
 	ThreadID   string     `json:"threadId"`
diff --git a/apps/daemon/internal/agent/codex/protocol_wire_test.go b/apps/daemon/internal/agent/codex/protocol_wire_test.go
index 895888bab..d22371f20 100644
--- a/apps/daemon/internal/agent/codex/protocol_wire_test.go
+++ b/apps/daemon/internal/agent/codex/protocol_wire_test.go
@@ -49,29 +49,3 @@ func TestThreadStartParams_ModelProviderIsCamelCaseField(t *testing.T) {
 		t.Fatalf("snake_case model_provider leaked: %s", body)
 	}
 }
-
-func TestTurnStartParams_CollaborationModeWireShape(t *testing.T) {
-	developerInstructions := "stay within the configured workspace"
-	params := TurnStartParams{
-		ThreadID: "thread-1",
-		Input:    []UserInput{{Type: UserInputText, Text: "ask me a question"}},
-		CollaborationMode: &CollaborationMode{
-			Mode: CollaborationModeDefault,
-			Settings: CollaborationModeSettings{
-				Model:                 "MiniMax-M3",
-				DeveloperInstructions: &developerInstructions,
-			},
-		},
-	}
-	raw, err := json.Marshal(params)
-	if err != nil {
-		t.Fatalf("marshal: %v", err)
-	}
-	body := string(raw)
-	if !strings.Contains(body, `"collaborationMode":{"mode":"default","settings":{"model":"MiniMax-M3","developer_instructions":"stay within the configured workspace"}}`) {
-		t.Fatalf("collaboration mode missing or malformed: %s", body)
-	}
-	if strings.Contains(body, `"collaboration_mode"`) {
-		t.Fatalf("snake_case collaboration_mode leaked: %s", body)
-	}
-}
diff --git a/apps/daemon/internal/agent/codex/provider_config.go b/apps/daemon/internal/agent/codex/provider_config.go
index 42ca09b38..8bd145254 100644
--- a/apps/daemon/internal/agent/codex/provider_config.go
+++ b/apps/daemon/internal/agent/codex/provider_config.go
@@ -41,6 +41,8 @@ type providerConfig struct {
 	// WireAPI is "responses" (codex Responses API) or "chat" (rejected
 	// upstream since codex-rs 0.140). Empty defaults to "responses".
 	WireAPI string
+	// ContextWindow is the native model_context_window when set.
+	ContextWindow int32
 }
 
 // writeCodexProviderConfig writes (or appends to) <codexHome>/config.toml
diff --git a/apps/daemon/internal/agent/codex/provider_config_test.go b/apps/daemon/internal/agent/codex/provider_config_test.go
index a68dbb7e9..6be2d4d83 100644
--- a/apps/daemon/internal/agent/codex/provider_config_test.go
+++ b/apps/daemon/internal/agent/codex/provider_config_test.go
@@ -304,9 +304,10 @@ func TestProviderHeadersRebuiltForEveryTurn(t *testing.T) {
 		if !slices.Contains(plan.Env, "OAC_CODEX_MODEL_HEADER_0=private-header-canary") {
 			t.Fatal("missing header environment")
 		}
+		excludeFromShellEnvironment(&plan, "OAC_CODEX_MCP_HEADER_*")
 		found := false
 		for _, option := range plan.ExtraConfig {
-			if option[0] == "shell_environment_policy.exclude" && strings.Contains(option[1], "OAC_CODEX_MODEL_HEADER_0") {
+			if option[0] == "shell_environment_policy.exclude" && strings.Contains(option[1], "OAC_CODEX_MODEL_HEADER_0") && strings.Contains(option[1], providerAPIKeyEnv) && strings.Contains(option[1], "OAC_CODEX_MCP_HEADER_*") {
 				found = true
 			}
 		}
diff --git a/apps/daemon/internal/agent/codex/recovery_test.go b/apps/daemon/internal/agent/codex/recovery_test.go
index c4ea41f01..f859c93e4 100644
--- a/apps/daemon/internal/agent/codex/recovery_test.go
+++ b/apps/daemon/internal/agent/codex/recovery_test.go
@@ -158,7 +158,7 @@ func TestPreparedRecoveryCannotStartWithoutExistingHistory(t *testing.T) {
 					t.Fatal(err)
 				}
 				req.DisableExecutionEnvironment = false
-				req.LocalEnvironment = &proto.LocalEnvironment{ID: uuid.NewString(), WorkspaceDirectory: "/workspace", NetworkAccess: "enabled", CapabilitySources: &agentcapabilities.Input{}, WorkspaceRoot: cwd}
+				req.LocalEnvironment = &proto.LocalEnvironment{ID: uuid.NewString(), WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}, WorkspaceRoot: cwd}
 			}
 			e, err := testExecutor(t, "complete", req, cfg)
 			if err != nil {
diff --git a/apps/daemon/internal/agent/codex/session.go b/apps/daemon/internal/agent/codex/session.go
index 44ae605bb..207514baa 100644
--- a/apps/daemon/internal/agent/codex/session.go
+++ b/apps/daemon/internal/agent/codex/session.go
@@ -63,7 +63,6 @@ type Session struct {
 	subagents                 *subagentObservations
 	observeSubagentIdentities bool
 	functions                 *functionCalls
-	observeMessages           bool
 
 	runID string
 	cfg   sessionConfig
@@ -88,8 +87,7 @@ type Session struct {
 	threadID   string
 	steering   steeringTurn
 
-	deltaSeq    atomic.Uint64
-	thinkingSeq atomic.Uint64
+	deltaSeq atomic.Uint64
 
 	bufs *ItemBuffers
 
@@ -101,6 +99,8 @@ type Session struct {
 	resumeUsageThreadID string
 	resumeUsageTotal    *TurnUsage
 	resolvedModel       string
+	// reasoningSummary reports that the Agent requested reasoning summaries.
+	reasoningSummary bool
 
 	finalTextMu sync.Mutex
 	finalText   string
@@ -127,8 +127,8 @@ func (s *Session) registerHandlers() {
 	rpc.OnNotification("item/completed", s.onItemCompleted)
 	rpc.OnNotification("item/agentMessage/delta", s.onAgentDelta)
 	rpc.OnNotification("item/commandExecution/outputDelta", s.onCommandOutput)
-	rpc.OnNotification("item/reasoning/textDelta", s.onReasoningDelta)
-	rpc.OnNotification("item/reasoning/summaryTextDelta", s.onReasoningDelta)
+	rpc.OnNotification("item/reasoning/textDelta", func(raw json.RawMessage) { s.onReasoningDelta("text", raw) })
+	rpc.OnNotification("item/reasoning/summaryTextDelta", func(raw json.RawMessage) { s.onReasoningDelta("summary", raw) })
 	rpc.OnNotification("thread/tokenUsage/updated", s.onUsageUpdated)
 	rpc.OnNotification("error", s.onErrorNotif)
 
@@ -145,21 +145,61 @@ func (s *Session) onTurnStarted(raw json.RawMessage) {
 	}
 }
 
-func (s *Session) onReasoningDelta(raw json.RawMessage) {
-	var p AgentMessageDeltaNotification
+// onReasoningDelta streams the first native channel a reasoning item delivers:
+// its summary, or the raw reasoning text of a model that has no summary. Each
+// native part is reported as its own part.
+func (s *Session) onReasoningDelta(channel string, raw json.RawMessage) {
+	var p ReasoningDeltaNotification
 	if err := json.Unmarshal(raw, &p); err != nil {
 		return
 	}
-	if !s.isRootTurn(p.ThreadID, p.TurnID) || p.Delta == "" || p.ItemID == "" {
+	if !s.reasoningSummary || !s.isRootTurn(p.ThreadID, p.TurnID) || p.Delta == "" || p.ItemID == "" {
 		return
 	}
-	_ = FoldDeltaIntoBuffer(s.bufs, "reasoning", p.ItemID, p.Delta)
-	seq := s.thinkingSeq.Add(1)
-	env, err := proto.NewEnvelope(proto.TypeThinking, s.runID, proto.ThinkingPayload{Text: p.Delta, Sequence: seq})
-	if err != nil {
+	native := p.ContentIndex
+	if channel == "summary" {
+		native = p.SummaryIndex
+	}
+	stream, started := s.bufs.Reasoning[p.ItemID]
+	if started && stream.channel != channel {
 		return
 	}
-	s.trySend(env)
+	if started && stream.native != native {
+		stream.part++
+	}
+	stream.channel, stream.native = channel, native
+	s.bufs.Reasoning[p.ItemID] = stream
+	s.sendReasoning(p.ItemID, "in_progress", stream.part, p.Delta)
+}
+
+// completeReasoning ends a reasoning item. An item that streamed nothing is
+// reported whole from its completed body; one with no text is not reported.
+func (s *Session) completeReasoning(item ThreadItem) {
+	if !s.reasoningSummary {
+		return
+	}
+	_, streamed := s.bufs.Reasoning[item.ID]
+	delete(s.bufs.Reasoning, item.ID)
+	if !streamed {
+		part := 0
+		for _, text := range nativeReasoningParts(item) {
+			if text != "" {
+				s.sendReasoning(item.ID, "in_progress", part, text)
+				part++
+			}
+		}
+		if part == 0 {
+			return
+		}
+	}
+	s.sendReasoning(item.ID, "completed", 0, "")
+}
+
+func (s *Session) sendReasoning(id, status string, part int, delta string) {
+	env, err := proto.NewEnvelope(proto.TypeReasoning, s.runID, proto.ReasoningPayload{ID: id, Status: status, Index: part, Delta: delta})
+	if err == nil {
+		s.trySend(env)
+	}
 }
 
 func (s *Session) onTurnCompleted(raw json.RawMessage) {
@@ -337,7 +377,7 @@ func (s *Session) emitDoneAt(content string, usage *TurnUsage, completedAt *int6
 		return
 	}
 	s.stopSteering()
-	s.stopFunctionCalls()
+	s.stopFunctionCalls(s.subagents != nil)
 	doneMeta := map[string]any{}
 	if tid := s.currentThreadID(); tid != "" {
 		doneMeta[proto.DoneMetaAgentSessionID] = tid
@@ -377,7 +417,7 @@ func (s *Session) emitTerminalFailure(message string, asError bool, failure prot
 		return
 	}
 	s.stopSteering()
-	s.stopFunctionCalls()
+	s.stopFunctionCalls(s.subagents != nil)
 	// Keep safe correlation at terminal settlement; native bodies stay private.
 	if asError {
 		s.cfg.logger.Warn("codex: emitting terminal error",
diff --git a/apps/daemon/internal/agent/codex/session_cancel.go b/apps/daemon/internal/agent/codex/session_cancel.go
index 091eae119..a8e30ae65 100644
--- a/apps/daemon/internal/agent/codex/session_cancel.go
+++ b/apps/daemon/internal/agent/codex/session_cancel.go
@@ -40,7 +40,7 @@ func (s *Session) Cancel(ctx context.Context) error {
 
 func (s *Session) cancelNativeWork() {
 	defer close(s.cancelReady)
-	s.stopFunctionCalls()
+	s.stopFunctionCalls(false)
 	turnID, active := s.stopSteering()
 	// Best effort: a known Turn must use its native identity. An explicit
 	// empty ID invokes native startup cancellation before turn/started.
diff --git a/apps/daemon/internal/agent/codex/session_items.go b/apps/daemon/internal/agent/codex/session_items.go
index 3cb3db01d..c1cd6a3cf 100644
--- a/apps/daemon/internal/agent/codex/session_items.go
+++ b/apps/daemon/internal/agent/codex/session_items.go
@@ -3,27 +3,30 @@ package codex
 import (
 	"encoding/json"
 	"fmt"
-	"strings"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-// ItemBuffers holds the per-itemId text accumulators used to fold
-// delta notifications back into a single chunk on item/completed.
-// Codex streams reasoning and agentMessage in two channels — the
-// {reasoning,agentMessage}/delta notifications, plus the final item
-// body on item/completed. We keep both: deltas drive incremental UI
-// (TypeDelta / TypeThinking), and completed-item bodies anchor the
-// final text for the done event.
+// ItemBuffers holds per-itemId state for streamed notifications.
+// agentMessage deltas drive incremental TypeDelta frames while the completed
+// item anchors the final text. A reasoning item streams one of its two native
+// channels, recorded here from its first delta.
 type ItemBuffers struct {
-	Reasoning map[string]string
+	Reasoning map[string]reasoningStream
 	AgentText map[string]string
 }
 
+// reasoningStream is the native channel a reasoning item streams, the last
+// native part index seen on it and the reported part it maps to.
+type reasoningStream struct {
+	channel      string
+	native, part int
+}
+
 // NewItemBuffers returns an empty buffer set.
 func NewItemBuffers() *ItemBuffers {
 	return &ItemBuffers{
-		Reasoning: map[string]string{},
+		Reasoning: map[string]reasoningStream{},
 		AgentText: map[string]string{},
 	}
 }
@@ -36,7 +39,7 @@ func NewItemBuffers() *ItemBuffers {
 // item types we silence by intent:
 //
 //   - reasoning / agentMessage / userMessage: text is streamed via deltas
-//     and re-stamped in item/completed
+//     and re-stamped in item/completed; reasoning is reported by the Session
 //   - error: surfaced by turn/completed.status="failed" instead
 func DispatchStartedItem(runID string, item ThreadItem) ([]proto.Envelope, error) {
 	switch item.Type {
@@ -69,34 +72,14 @@ func DispatchStartedItem(runID string, item ThreadItem) ([]proto.Envelope, error
 }
 
 // DispatchCompletedItem folds an item.completed payload into envelopes.
-// Reasoning and agentMessage produce a final TypeThinking / TypeDelta
-// (delta+sequence=0) so the buffer drained by upstream deltas can be
-// flushed; tool-call variants produce an "after" envelope so the UI
-// gets a stage transition.
-//
-// emitFinalDelta=true asks the dispatch to emit a synthetic full-text
-// TypeDelta whose Sequence will be set by the caller using a session-
-// level monotonic counter; this is only needed when no deltas were
-// observed (item.completed arrived without any item/agentMessage/delta).
+// An agentMessage returns its text so the session can stamp it into
+// DonePayload.Content; tool-call variants produce an "after" envelope so the
+// UI gets a stage transition.
 //
 // Returns the agent text body for agentMessage items so the session can
 // stamp it into DonePayload.Content. Empty string for everything else.
 func DispatchCompletedItem(runID string, item ThreadItem, bufs *ItemBuffers) (envelopes []proto.Envelope, agentText string, err error) {
 	switch item.Type {
-	case "reasoning":
-		body := bufs.Reasoning[item.ID]
-		delete(bufs.Reasoning, item.ID)
-		if body == "" {
-			body = fallbackReasoningText(item)
-		}
-		if body == "" {
-			return nil, "", nil
-		}
-		env, err := proto.NewEnvelope(proto.TypeThinking, runID, proto.ThinkingPayload{Text: body})
-		if err != nil {
-			return nil, "", fmt.Errorf("codex: thinking envelope: %w", err)
-		}
-		return []proto.Envelope{env}, "", nil
 	case "agentMessage":
 		body := bufs.AgentText[item.ID]
 		delete(bufs.AgentText, item.ID)
@@ -123,22 +106,14 @@ func DispatchCompletedItem(runID string, item ThreadItem, bufs *ItemBuffers) (en
 	return nil, "", nil
 }
 
-// FoldDeltaIntoBuffer accumulates a delta string under the matching
-// itemId. Returns the running prefix so the caller can emit a
-// progressive TypeDelta / TypeThinking envelope for streaming UI.
-func FoldDeltaIntoBuffer(bufs *ItemBuffers, kind, itemID, delta string) string {
+// FoldDeltaIntoBuffer accumulates an agentMessage delta under its itemId and
+// returns the running text.
+func FoldDeltaIntoBuffer(bufs *ItemBuffers, itemID, delta string) string {
 	if delta == "" || itemID == "" {
 		return ""
 	}
-	switch kind {
-	case "agent":
-		bufs.AgentText[itemID] += delta
-		return bufs.AgentText[itemID]
-	case "reasoning":
-		bufs.Reasoning[itemID] += delta
-		return bufs.Reasoning[itemID]
-	}
-	return ""
+	bufs.AgentText[itemID] += delta
+	return bufs.AgentText[itemID]
 }
 
 func toolNameForItem(item ThreadItem) string {
@@ -203,32 +178,11 @@ func argMap(v any) map[string]any {
 	return map[string]any{"value": json.RawMessage(raw)}
 }
 
-func fallbackReasoningText(item ThreadItem) string {
-	if item.Text != "" {
-		return item.Text
-	}
-	if item.SummaryText != "" {
-		return item.SummaryText
-	}
+// nativeReasoningParts is what Codex shows for a completed reasoning item: its
+// summary when it has one, otherwise its raw reasoning text.
+func nativeReasoningParts(item ThreadItem) []string {
 	if len(item.Summary) > 0 {
-		var b strings.Builder
-		for i, s := range item.Summary {
-			if i > 0 {
-				b.WriteString("\n\n")
-			}
-			b.WriteString(s)
-		}
-		return b.String()
-	}
-	if len(item.Content) > 0 {
-		var b strings.Builder
-		for i, s := range item.Content {
-			if i > 0 {
-				b.WriteString("\n\n")
-			}
-			b.WriteString(s)
-		}
-		return b.String()
+		return item.Summary
 	}
-	return ""
+	return item.Content
 }
diff --git a/apps/daemon/internal/agent/codex/session_items_test.go b/apps/daemon/internal/agent/codex/session_items_test.go
index 8ba3334b7..95ce60d56 100644
--- a/apps/daemon/internal/agent/codex/session_items_test.go
+++ b/apps/daemon/internal/agent/codex/session_items_test.go
@@ -1,7 +1,9 @@
 package codex
 
 import (
+	"context"
 	"encoding/json"
+	"reflect"
 	"strings"
 	"testing"
 
@@ -66,54 +68,46 @@ func TestDispatchStartedItem_UnknownSilent(t *testing.T) {
 	}
 }
 
-func TestDispatchCompletedItem_Reasoning_UsesBuffer(t *testing.T) {
-	bufs := NewItemBuffers()
-	FoldDeltaIntoBuffer(bufs, "reasoning", "r1", "Hello ")
-	FoldDeltaIntoBuffer(bufs, "reasoning", "r1", "world")
-
-	envs, text, err := DispatchCompletedItem("run-1", ThreadItem{
-		Type: "reasoning", ID: "r1",
-	}, bufs)
-	if err != nil {
-		t.Fatalf("dispatch: %v", err)
-	}
-	if text != "" {
-		t.Fatalf("reasoning must not produce agent text, got %q", text)
-	}
-	if len(envs) != 1 || envs[0].Type != proto.TypeThinking {
-		t.Fatalf("envs = %+v", envs)
-	}
-	var p proto.ThinkingPayload
-	_ = envs[0].DecodePayload(&p)
-	if p.Text != "Hello world" {
-		t.Fatalf("thinking text = %q", p.Text)
-	}
-	// Buffer must be drained so a re-completion doesn't double-emit.
-	if got := bufs.Reasoning["r1"]; got != "" {
-		t.Fatalf("buffer not drained: %q", got)
-	}
-}
-
-func TestDispatchCompletedItem_Reasoning_FallbackToItemBody(t *testing.T) {
-	// No deltas observed — must fall back to item.text / summary.
-	bufs := NewItemBuffers()
-	envs, _, err := DispatchCompletedItem("run-1", ThreadItem{
-		Type: "reasoning", ID: "r1", Text: "fallback body",
-	}, bufs)
-	if err != nil {
-		t.Fatalf("dispatch: %v", err)
-	}
-	var p proto.ThinkingPayload
-	_ = envs[0].DecodePayload(&p)
-	if p.Text != "fallback body" {
-		t.Fatalf("fallback path = %q", p.Text)
+func TestReasoningIsReportedOnlyWhenRequested(t *testing.T) {
+	for _, requested := range []bool{true, false} {
+		out := make(chan proto.Envelope, 16)
+		s := &Session{runID: "run", out: out, cancelCtx: context.Background(), cfg: defaultSessionConfig(testStateRoot(t)),
+			rpc: NewJSONRPCClient(JSONRPCConfig{}), bufs: NewItemBuffers(), reasoningSummary: requested}
+		s.registerHandlers()
+		s.setThreadID("root")
+		scopeNotification(t, s, "turn/started", `{"threadId":"root","turn":{"id":"turn"}}`)
+		scope := `{"threadId":"root","turnId":"turn",`
+		scopeNotification(t, s, "item/reasoning/summaryTextDelta", scope+`"itemId":"r1","delta":"plan ","summaryIndex":0}`)
+		scopeNotification(t, s, "item/reasoning/textDelta", scope+`"itemId":"r1","delta":"raw","contentIndex":0}`)
+		scopeNotification(t, s, "item/reasoning/summaryTextDelta", scope+`"itemId":"r1","delta":"next","summaryIndex":1}`)
+		scopeNotification(t, s, "item/completed", scope+`"item":{"type":"reasoning","id":"r1"}}`)
+		scopeNotification(t, s, "item/completed", scope+`"item":{"type":"reasoning","id":"r2","content":["whole"]}}`)
+		close(out)
+		var got []proto.ReasoningPayload
+		for env := range out {
+			if env.Type == proto.TypeReasoning {
+				var p proto.ReasoningPayload
+				_ = env.DecodePayload(&p)
+				got = append(got, p)
+			}
+		}
+		want := []proto.ReasoningPayload{
+			{ID: "r1", Status: "in_progress", Delta: "plan "}, {ID: "r1", Status: "in_progress", Index: 1, Delta: "next"}, {ID: "r1", Status: "completed"},
+			{ID: "r2", Status: "in_progress", Delta: "whole"}, {ID: "r2", Status: "completed"},
+		}
+		if !requested {
+			want = nil
+		}
+		if !reflect.DeepEqual(got, want) {
+			t.Fatalf("requested=%v: reasoning %+v, want %+v", requested, got, want)
+		}
 	}
 }
 
 func TestDispatchCompletedItem_AgentMessage_BufferIsFinalText(t *testing.T) {
 	bufs := NewItemBuffers()
-	FoldDeltaIntoBuffer(bufs, "agent", "a1", "Hello ")
-	FoldDeltaIntoBuffer(bufs, "agent", "a1", "world")
+	FoldDeltaIntoBuffer(bufs, "a1", "Hello ")
+	FoldDeltaIntoBuffer(bufs, "a1", "world")
 
 	envs, text, err := DispatchCompletedItem("run-1", ThreadItem{
 		Type: "agentMessage", ID: "a1", Text: "fallback",
@@ -168,14 +162,14 @@ func TestDispatchCompletedItem_ToolCallEmitsAfterStage(t *testing.T) {
 
 func TestFoldDeltaIntoBuffer_AccumulatesPerItem(t *testing.T) {
 	bufs := NewItemBuffers()
-	if got := FoldDeltaIntoBuffer(bufs, "agent", "a1", "hi"); got != "hi" {
+	if got := FoldDeltaIntoBuffer(bufs, "a1", "hi"); got != "hi" {
 		t.Fatalf("fold returned %q", got)
 	}
-	if got := FoldDeltaIntoBuffer(bufs, "agent", "a1", " there"); got != "hi there" {
+	if got := FoldDeltaIntoBuffer(bufs, "a1", " there"); got != "hi there" {
 		t.Fatalf("fold accumulation = %q", got)
 	}
 	// Different itemId is a different accumulator.
-	if got := FoldDeltaIntoBuffer(bufs, "agent", "a2", "other"); got != "other" {
+	if got := FoldDeltaIntoBuffer(bufs, "a2", "other"); got != "other" {
 		t.Fatalf("cross-item bleed: got %q", got)
 	}
 }
diff --git a/apps/daemon/internal/agent/codex/session_messages.go b/apps/daemon/internal/agent/codex/session_messages.go
index 840485d46..4d7642f36 100644
--- a/apps/daemon/internal/agent/codex/session_messages.go
+++ b/apps/daemon/internal/agent/codex/session_messages.go
@@ -17,13 +17,9 @@ func (s *Session) onAgentDelta(raw json.RawMessage) {
 		return
 	}
 	first := s.boundary.text(received, p.TurnID)
-	_ = FoldDeltaIntoBuffer(s.bufs, "agent", p.ItemID, p.Delta)
+	_ = FoldDeltaIntoBuffer(s.bufs, p.ItemID, p.Delta)
 	seq := s.deltaSeq.Add(1)
-	payload := proto.DeltaPayload{Delta: p.Delta, Sequence: seq}
-	if s.observeMessages {
-		payload.ItemID = p.ItemID
-	}
-	env, err := proto.NewEnvelope(proto.TypeDelta, s.runID, payload)
+	env, err := proto.NewEnvelope(proto.TypeDelta, s.runID, proto.DeltaPayload{ItemID: p.ItemID, Delta: p.Delta, Sequence: seq})
 	if err != nil {
 		return
 	}
@@ -57,11 +53,15 @@ func (s *Session) onItemCompleted(raw json.RawMessage) {
 	if err := json.Unmarshal(raw, &p); err != nil {
 		return
 	}
+	// Record native application before observation backpressure can delay publication.
+	s.confirmFunctionResult(raw)
 	if !s.isRootTurn(p.ThreadID, p.TurnID) || p.Item.ID == "" {
 		return
 	}
-	// Record native application before observation backpressure can delay publication.
-	s.confirmFunctionResult(raw)
+	if p.Item.Type == "reasoning" {
+		s.completeReasoning(p.Item)
+		return
+	}
 	envs, text, err := DispatchCompletedItem(s.runID, p.Item, s.bufs)
 	if err != nil {
 		s.cfg.logger.Warn("codex: dispatch completed item failed", "run_id", s.runID, "err", err)
@@ -77,7 +77,7 @@ func (s *Session) onItemCompleted(raw json.RawMessage) {
 		first = s.boundary.text(received, p.TurnID)
 	}
 	sent := s.observeMessage(p.Item, "completed", &messageText)
-	if first && s.observeMessages {
+	if first {
 		s.boundary.forward(received, sent)
 	}
 	if text != "" {
@@ -86,7 +86,7 @@ func (s *Session) onItemCompleted(raw json.RawMessage) {
 }
 
 func (s *Session) observeMessage(item ThreadItem, status string, text *string) bool {
-	if !s.observeMessages || item.Type != "agentMessage" {
+	if item.Type != "agentMessage" {
 		return false
 	}
 	env, err := proto.NewEnvelope(proto.TypeOutputMessage, s.runID, proto.OutputMessagePayload{ID: item.ID, Status: status, Phase: item.Phase, Text: text})
diff --git a/apps/daemon/internal/agent/codex/session_messages_test.go b/apps/daemon/internal/agent/codex/session_messages_test.go
index 1e09975fb..eacc37199 100644
--- a/apps/daemon/internal/agent/codex/session_messages_test.go
+++ b/apps/daemon/internal/agent/codex/session_messages_test.go
@@ -8,65 +8,55 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func TestMessageObservationIsOptInAndKeepsNativeBoundaries(t *testing.T) {
-	for _, enabled := range []bool{false, true} {
-		t.Run(map[bool]string{false: "legacy", true: "observed"}[enabled], func(t *testing.T) {
-			out := make(chan proto.Envelope, 16)
-			s := &Session{runID: "run", observeMessages: enabled, out: out, cancelCtx: context.Background(), bufs: NewItemBuffers(), cfg: defaultSessionConfig(testStateRoot(t))}
-			s.setThreadID("thread")
-			s.onTurnStarted(json.RawMessage(`{"threadId":"thread","turn":{"id":"turn"}}`))
-			s.onItemStarted(json.RawMessage(`{"threadId":"thread","turnId":"turn","item":{"type":"agentMessage","id":"a","phase":"commentary"}}`))
-			s.onAgentDelta(json.RawMessage(`{"threadId":"thread","turnId":"turn","itemId":"a","delta":"first"}`))
-			s.onItemStarted(json.RawMessage(`{"threadId":"thread","turnId":"turn","item":{"type":"agentMessage","id":"b","phase":"final_answer"}}`))
-			s.onAgentDelta(json.RawMessage(`{"threadId":"thread","turnId":"turn","itemId":"b","delta":"second"}`))
-			s.onItemCompleted(json.RawMessage(`{"threadId":"thread","turnId":"turn","item":{"type":"agentMessage","id":"a","phase":"commentary","text":"first complete"}}`))
-			// b stays unfinished, as when the native request is cancelled before item/completed.
-			s.onItemCompleted(json.RawMessage(`{"threadId":"thread","turnId":"turn","item":{"type":"agentMessage","id":"c","phase":"final_answer","text":"without deltas"}}`))
-			var deltas []proto.DeltaPayload
-			var messages []proto.OutputMessagePayload
-			for len(out) > 0 {
-				env := <-out
-				switch env.Type {
-				case proto.TypeDelta:
-					var p proto.DeltaPayload
-					if err := env.DecodePayload(&p); err != nil {
-						t.Fatal(err)
-					}
-					deltas = append(deltas, p)
-				case proto.TypeOutputMessage:
-					var p proto.OutputMessagePayload
-					if err := env.DecodePayload(&p); err != nil {
-						t.Fatal(err)
-					}
-					messages = append(messages, p)
-				default:
-					t.Fatalf("unexpected frame: %s", env.Type)
-				}
-			}
-			if len(deltas) != 2 || deltas[0].Delta != "first" || deltas[1].Delta != "second" || deltas[1].Sequence != 2 {
-				t.Fatalf("legacy text changed: %+v", deltas)
-			}
-			if !enabled {
-				if len(messages) != 0 || deltas[0].ItemID != "" || deltas[1].ItemID != "" {
-					t.Fatal("legacy request gained observations")
-				}
-				return
-			}
-			if deltas[0].ItemID != "a" || deltas[1].ItemID != "b" || len(messages) != 4 {
-				t.Fatalf("identity lost: %+v %+v", deltas, messages)
-			}
-			if messages[0].ID != "a" || messages[0].Phase != "commentary" || messages[0].Status != "in_progress" || messages[0].Text != nil {
-				t.Fatalf("start: %+v", messages[0])
-			}
-			if messages[1].ID != "b" || messages[1].Phase != "final_answer" || messages[1].Status != "in_progress" {
-				t.Fatalf("second start: %+v", messages[1])
-			}
-			if messages[2].ID != "a" || messages[2].Status != "completed" || messages[2].Text == nil || *messages[2].Text != "first complete" {
-				t.Fatalf("completion: %+v", messages[2])
-			}
-			if messages[3].ID != "c" || messages[3].Text == nil || *messages[3].Text != "without deltas" {
-				t.Fatalf("non-streamed message lost: %+v", messages[3])
-			}
-		})
+func TestMessageObservationKeepsNativeBoundaries(t *testing.T) {
+	out := make(chan proto.Envelope, 16)
+	s := &Session{runID: "run", out: out, cancelCtx: context.Background(), bufs: NewItemBuffers(), cfg: defaultSessionConfig(testStateRoot(t))}
+	s.setThreadID("thread")
+	s.onTurnStarted(json.RawMessage(`{"threadId":"thread","turn":{"id":"turn"}}`))
+	s.onItemStarted(json.RawMessage(`{"threadId":"thread","turnId":"turn","item":{"type":"agentMessage","id":"a","phase":"commentary"}}`))
+	s.onAgentDelta(json.RawMessage(`{"threadId":"thread","turnId":"turn","itemId":"a","delta":"first"}`))
+	s.onItemStarted(json.RawMessage(`{"threadId":"thread","turnId":"turn","item":{"type":"agentMessage","id":"b","phase":"final_answer"}}`))
+	s.onAgentDelta(json.RawMessage(`{"threadId":"thread","turnId":"turn","itemId":"b","delta":"second"}`))
+	s.onItemCompleted(json.RawMessage(`{"threadId":"thread","turnId":"turn","item":{"type":"agentMessage","id":"a","phase":"commentary","text":"first complete"}}`))
+	// b stays unfinished, as when the native request is cancelled before item/completed.
+	s.onItemCompleted(json.RawMessage(`{"threadId":"thread","turnId":"turn","item":{"type":"agentMessage","id":"c","phase":"final_answer","text":"without deltas"}}`))
+	var deltas []proto.DeltaPayload
+	var messages []proto.OutputMessagePayload
+	for len(out) > 0 {
+		env := <-out
+		switch env.Type {
+		case proto.TypeDelta:
+			var p proto.DeltaPayload
+			if err := env.DecodePayload(&p); err != nil {
+				t.Fatal(err)
+			}
+			deltas = append(deltas, p)
+		case proto.TypeOutputMessage:
+			var p proto.OutputMessagePayload
+			if err := env.DecodePayload(&p); err != nil {
+				t.Fatal(err)
+			}
+			messages = append(messages, p)
+		default:
+			t.Fatalf("unexpected frame: %s", env.Type)
+		}
+	}
+	if len(deltas) != 2 || deltas[0].Delta != "first" || deltas[1].Delta != "second" || deltas[1].Sequence != 2 {
+		t.Fatalf("text changed: %+v", deltas)
+	}
+	if deltas[0].ItemID != "a" || deltas[1].ItemID != "b" || len(messages) != 4 {
+		t.Fatalf("identity lost: %+v %+v", deltas, messages)
+	}
+	if messages[0].ID != "a" || messages[0].Phase != "commentary" || messages[0].Status != "in_progress" || messages[0].Text != nil {
+		t.Fatalf("start: %+v", messages[0])
+	}
+	if messages[1].ID != "b" || messages[1].Phase != "final_answer" || messages[1].Status != "in_progress" {
+		t.Fatalf("second start: %+v", messages[1])
+	}
+	if messages[2].ID != "a" || messages[2].Status != "completed" || messages[2].Text == nil || *messages[2].Text != "first complete" {
+		t.Fatalf("completion: %+v", messages[2])
+	}
+	if messages[3].ID != "c" || messages[3].Text == nil || *messages[3].Text != "without deltas" {
+		t.Fatalf("non-streamed message lost: %+v", messages[3])
 	}
 }
diff --git a/apps/daemon/internal/agent/codex/session_notifications_test.go b/apps/daemon/internal/agent/codex/session_notifications_test.go
index 2c1f1092b..3e33d7885 100644
--- a/apps/daemon/internal/agent/codex/session_notifications_test.go
+++ b/apps/daemon/internal/agent/codex/session_notifications_test.go
@@ -13,7 +13,7 @@ func TestRootNotificationIsolation(t *testing.T) {
 		t.Run(map[bool]string{false: "child without thread started", true: "child thread started"}[childStarted], func(t *testing.T) {
 			out := make(chan proto.Envelope, 64)
 			s := &Session{runID: "run", out: out, cancelCtx: context.Background(), cfg: defaultSessionConfig(testStateRoot(t)),
-				rpc: NewJSONRPCClient(JSONRPCConfig{}), bufs: NewItemBuffers(), observeMessages: true}
+				rpc: NewJSONRPCClient(JSONRPCConfig{}), bufs: NewItemBuffers(), reasoningSummary: true}
 			s.registerHandlers()
 			s.setThreadID("root")
 			notify := func(method, params string) { t.Helper(); scopeNotification(t, s, method, params) }
@@ -57,7 +57,7 @@ func TestRootNotificationIsolation(t *testing.T) {
 			if s.terminal.Load() || s.currentThreadID() != "root" || len(out) != rootEvents {
 				t.Fatalf("foreign notification changed Run ownership/output: terminal=%v thread=%q events=%d want=%d", s.terminal.Load(), s.currentThreadID(), len(out), rootEvents)
 			}
-			if s.bufs.AgentText["shared"] != "root " || s.bufs.Reasoning["thought"] != "root thought" || s.peekLastErrText() != "root retry" || s.takeFinalText() != "" {
+			if s.bufs.AgentText["shared"] != "root " || s.bufs.Reasoning["thought"].channel != "text" || s.peekLastErrText() != "root retry" || s.takeFinalText() != "" {
 				t.Fatal("foreign notification changed root buffers")
 			}
 			if s.latestUsage == nil || s.latestUsage.InputTokens != 20 || s.latestUsage.OutputTokens != 5 || s.usageTurnID != "root-turn" {
@@ -88,8 +88,8 @@ func TestRootNotificationIsolation(t *testing.T) {
 					}
 				}
 			}
-			if doneCount != 1 || s.deltaSeq.Load() != 2 || s.thinkingSeq.Load() != 1 {
-				t.Fatalf("root output duplicated or polluted: done=%d delta=%d thinking=%d", doneCount, s.deltaSeq.Load(), s.thinkingSeq.Load())
+			if doneCount != 1 || s.deltaSeq.Load() != 2 {
+				t.Fatalf("root output duplicated or polluted: done=%d delta=%d", doneCount, s.deltaSeq.Load())
 			}
 		})
 	}
diff --git a/apps/daemon/internal/agent/codex/session_plan.go b/apps/daemon/internal/agent/codex/session_plan.go
index b917805f4..fe240ec20 100644
--- a/apps/daemon/internal/agent/codex/session_plan.go
+++ b/apps/daemon/internal/agent/codex/session_plan.go
@@ -28,9 +28,13 @@ func prepareSessionPlan(ctx context.Context, req proto.PromptRequestPayload, cfg
 		plan.Cleanup()
 		return SessionPlan{}, nil, err
 	}
-	disableProgrammaticTools(&plan, req.ExecutionControls)
+	applyProgrammaticTools(&plan, req.ExecutionControls)
 	if req.LocalEnvironment != nil {
 		plan.Cwd = req.LocalEnvironment.WorkspaceRoot
+		if err := writeWorkspaceTrust(nativeHomeFromPlan(plan), plan.Cwd); err != nil {
+			plan.Cleanup()
+			return SessionPlan{}, nil, err
+		}
 	} else {
 		// environment:none has no workspace; the Session's private home is its cwd.
 		plan.Cwd = nativeHomeFromPlan(plan)
@@ -60,22 +64,11 @@ func prepareSessionPlan(ctx context.Context, req proto.PromptRequestPayload, cfg
 		}
 	}
 
-	if req.ExecutionControls != nil {
-		if err := prepareModelVerbosity(ctx, cfg.codexBinary, &plan); err != nil {
-			plan.Cleanup()
-			return SessionPlan{}, nil, err
-		}
-	}
-
 	if req.DisableExecutionEnvironment {
 		plan.Env = append(plan.Env, "CODEX_EXEC_SERVER_URL=none")
 	}
 	var skillRoots []string
 	if req.LocalEnvironment != nil && len(req.LocalEnvironment.Skills) > 0 {
-		if err := verifyHostedSkills(req.LocalEnvironment.Skills); err != nil {
-			plan.Cleanup()
-			return SessionPlan{}, nil, err
-		}
 		for _, skill := range req.LocalEnvironment.Skills {
 			skillRoots = append(skillRoots, localworkspace.SkillPath(skill))
 		}
diff --git a/apps/daemon/internal/agent/codex/session_run.go b/apps/daemon/internal/agent/codex/session_run.go
index a341d8ce8..48e3002ff 100644
--- a/apps/daemon/internal/agent/codex/session_run.go
+++ b/apps/daemon/internal/agent/codex/session_run.go
@@ -3,7 +3,6 @@ package codex
 import (
 	"context"
 	"fmt"
-	"strings"
 	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
@@ -29,24 +28,9 @@ func (s *Session) startNative(ctx context.Context, plan SessionPlan, req proto.P
 		return err
 	}
 	turnParams := TurnStartParams{
-		ThreadID: s.currentThreadID(),
-		Input:    input,
-	}
-	model := strings.TrimSpace(s.resolvedModel)
-	if model == "" {
-		return fmt.Errorf("codex: collaboration mode requires a resolved model")
-	}
-	var developerInstructions *string
-	if plan.SystemPrompt != "" {
-		developerInstructions = &plan.SystemPrompt
-	}
-	turnParams.CollaborationMode = &CollaborationMode{
-		Mode: CollaborationModeDefault,
-		Settings: CollaborationModeSettings{
-			ReasoningEffort:       plan.ModelReasoningEffort,
-			Model:                 model,
-			DeveloperInstructions: developerInstructions,
-		},
+		ThreadID:     s.currentThreadID(),
+		Input:        input,
+		OutputSchema: plan.OutputSchema,
 	}
 	turnCtx, turnCancel := context.WithTimeout(ctx, 10*time.Second)
 	_, ackErr := s.rpc.requestWithResult(withNativeBoundary(turnCtx, s.boundary), "turn/start", turnParams, s.bindTurnResult)
diff --git a/apps/daemon/internal/agent/codex/session_steering.go b/apps/daemon/internal/agent/codex/session_steering.go
index 53fabc084..c3f000389 100644
--- a/apps/daemon/internal/agent/codex/session_steering.go
+++ b/apps/daemon/internal/agent/codex/session_steering.go
@@ -25,19 +25,8 @@ type TurnSteerParams struct {
 	Input          []UserInput `json:"input"`
 }
 
-var _ agent.Steerer = (*Session)(nil)
-
-// Steer returns success only after Codex accepts input for this native turn.
-func (s *Session) Steer(ctx context.Context, input proto.PromptSteerPayload) error {
-	return s.steer(ctx, input, nil)
-}
-
 // SteerWithReceipt waits under the Run context after reporting the complete write.
 func (s *Session) SteerWithReceipt(ctx context.Context, input proto.PromptSteerPayload, written func()) error {
-	return s.steer(ctx, input, written)
-}
-
-func (s *Session) steer(ctx context.Context, input proto.PromptSteerPayload, written func()) error {
 	if !s.beginOperation() {
 		return agent.ErrSteeringInactive
 	}
@@ -67,19 +56,13 @@ func (s *Session) steer(ctx context.Context, input proto.PromptSteerPayload, wri
 		return agent.ErrSteeringRejected
 	}
 	params := TurnSteerParams{ThreadID: threadID, ExpectedTurnID: turnID, Input: content}
-	timeout := s.rpc.cfg.RequestTimeout
-	if written != nil {
-		timeout = 0
-	}
 	raw, err := s.rpc.requestWithTimeout(ctx, "turn/steer", params, func(frame any) error {
 		if err := s.rpc.writeFrameContext(ctx, frame); err != nil {
 			return err
 		}
-		if written != nil {
-			written()
-		}
+		written()
 		return nil
-	}, timeout, nil)
+	}, 0, nil)
 	if err != nil {
 		var rejected *JsonRpcError
 		if errors.As(err, &rejected) {
diff --git a/apps/daemon/internal/agent/codex/session_steering_lifecycle_test.go b/apps/daemon/internal/agent/codex/session_steering_lifecycle_test.go
index 6dc663ea0..8cbaa7863 100644
--- a/apps/daemon/internal/agent/codex/session_steering_lifecycle_test.go
+++ b/apps/daemon/internal/agent/codex/session_steering_lifecycle_test.go
@@ -25,9 +25,9 @@ func TestSteeringReceiptTimeoutAndCompletionKeepProcessAlive(t *testing.T) {
 			}
 			ctx, cancel := context.WithTimeout(context.Background(), timeout)
 			defer cancel()
-			done := make(chan error, 1)
+			done, written := make(chan error, 1), make(chan struct{})
 			go func() {
-				done <- s.Steer(ctx, proto.PromptSteerPayload{InputID: "input", Input: proto.TextInput("extra")})
+				done <- s.SteerWithReceipt(ctx, proto.PromptSteerPayload{InputID: "input", Input: proto.TextInput("extra")}, func() { close(written) })
 			}()
 			var request JsonRpcRequest
 			if err := json.NewDecoder(server.FromClient).Decode(&request); err != nil {
@@ -36,19 +36,10 @@ func TestSteeringReceiptTimeoutAndCompletionKeepProcessAlive(t *testing.T) {
 			// Withhold the response after reading the entire request frame.
 			if complete {
 				// Reading the pipe does not mean its writer has returned yet.
-				for {
-					client.pendingMu.Lock()
-					pending := client.pending[request.ID]
-					waiting := pending != nil && pending.timer != nil
-					client.pendingMu.Unlock()
-					if waiting {
-						break
-					}
-					select {
-					case <-ctx.Done():
-						t.Fatal("steering request did not reach response wait")
-					case <-time.After(time.Millisecond):
-					}
+				select {
+				case <-written:
+				case <-ctx.Done():
+					t.Fatal("steering request did not reach response wait")
 				}
 				s.onTurnCompleted(json.RawMessage(`{"threadId":"thread","turn":{"id":"turn","status":"completed"}}`))
 			}
@@ -127,7 +118,7 @@ func TestBlockedSteeringWriteEndsRunWithTerminalFrames(t *testing.T) {
 	}
 	callCtx, callCancel := context.WithTimeout(ctx, 50*time.Millisecond)
 	defer callCancel()
-	if err := s.Steer(callCtx, proto.PromptSteerPayload{InputID: "blocked", Input: proto.TextInput("extra")}); err == nil {
+	if err := s.SteerWithReceipt(callCtx, proto.PromptSteerPayload{InputID: "blocked", Input: proto.TextInput("extra")}, func() {}); err == nil {
 		t.Fatal("blocked write accepted")
 	}
 	if client.Alive() {
diff --git a/apps/daemon/internal/agent/codex/session_steering_receipt_test.go b/apps/daemon/internal/agent/codex/session_steering_receipt_test.go
index bb14579d9..7432577ce 100644
--- a/apps/daemon/internal/agent/codex/session_steering_receipt_test.go
+++ b/apps/daemon/internal/agent/codex/session_steering_receipt_test.go
@@ -10,66 +10,46 @@ import (
 )
 
 func TestDurableSteeringBypassesOnlyNativeResponseDeadline(t *testing.T) {
-	for _, durable := range []bool{false, true} {
-		t.Run(map[bool]string{false: "legacy", true: "durable"}[durable], func(t *testing.T) {
-			client, server, cleanup := NewTestClient()
-			defer cleanup()
-			client.cfg.RequestTimeout = 20 * time.Millisecond
-			s := &Session{rpc: client.JSONRPCClient, cancelCtx: context.Background()}
-			s.setThreadID("thread")
-			s.onTurnStarted(json.RawMessage(`{"threadId":"thread","turn":{"id":"turn"}}`))
-			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-			defer cancel()
-			written := make(chan struct{})
-			reply := make(chan error, 1)
-			go func() {
-				input := proto.PromptSteerPayload{InputID: "extra", Input: proto.TextInput("text")}
-				if durable {
-					reply <- s.SteerWithReceipt(ctx, input, func() { close(written) })
-				} else {
-					reply <- s.Steer(ctx, input)
-				}
-			}()
-			if durable {
-				select {
-				case <-written:
-					t.Fatal("written before frame was read")
-				default:
-				}
-			}
-			var request JsonRpcRequest
-			if err := json.NewDecoder(server.FromClient).Decode(&request); err != nil {
-				t.Fatal(err)
-			}
-			if durable {
-				select {
-				case <-written:
-				case <-ctx.Done():
-					t.Fatal("missing write phase")
-				}
-			}
-			select {
-			case err := <-reply:
-				if durable || err == nil {
-					t.Fatal("unexpected response deadline", err)
-				}
-			case <-time.After(60 * time.Millisecond):
-				if !durable {
-					t.Fatal("legacy timeout disappeared")
-				}
-			}
-			if durable {
-				if err := json.NewEncoder(server.ToClient).Encode(map[string]any{"id": request.ID, "result": map[string]string{"turnId": "turn"}}); err != nil {
-					t.Fatal(err)
-				}
-				if err := <-reply; err != nil {
-					t.Fatal(err)
-				}
-			}
-			if !client.Alive() {
-				t.Fatal("receipt wait killed process")
-			}
-		})
+	client, server, cleanup := NewTestClient()
+	defer cleanup()
+	client.cfg.RequestTimeout = 20 * time.Millisecond
+	s := &Session{rpc: client.JSONRPCClient, cancelCtx: context.Background()}
+	s.setThreadID("thread")
+	s.onTurnStarted(json.RawMessage(`{"threadId":"thread","turn":{"id":"turn"}}`))
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	written := make(chan struct{})
+	reply := make(chan error, 1)
+	go func() {
+		reply <- s.SteerWithReceipt(ctx, proto.PromptSteerPayload{InputID: "extra", Input: proto.TextInput("text")}, func() { close(written) })
+	}()
+	select {
+	case <-written:
+		t.Fatal("written before frame was read")
+	default:
+	}
+	var request JsonRpcRequest
+	if err := json.NewDecoder(server.FromClient).Decode(&request); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-written:
+	case <-ctx.Done():
+		t.Fatal("missing write phase")
+	}
+	select {
+	case err := <-reply:
+		t.Fatal("unexpected response deadline", err)
+	case <-time.After(60 * time.Millisecond):
+	}
+	if err := json.NewEncoder(server.ToClient).Encode(map[string]any{"id": request.ID, "result": map[string]string{"turnId": "turn"}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := <-reply; err != nil {
+		t.Fatal(err)
+	}
+	if !client.Alive() {
+		t.Fatal("receipt wait killed process")
 	}
 }
 
diff --git a/apps/daemon/internal/agent/codex/session_steering_test.go b/apps/daemon/internal/agent/codex/session_steering_test.go
index 1fe0fcc47..524398938 100644
--- a/apps/daemon/internal/agent/codex/session_steering_test.go
+++ b/apps/daemon/internal/agent/codex/session_steering_test.go
@@ -33,7 +33,7 @@ func TestSteeringUsesNativeActiveTurnAndReceipt(t *testing.T) {
 			s.onTurnStarted(json.RawMessage(`{"threadId":"native-thread","turn":{"id":"native-turn"}}`))
 			done := make(chan error, 1)
 			go func() {
-				done <- s.Steer(ctx, proto.PromptSteerPayload{InputID: "input-1", Input: proto.TextInput("追加输入")})
+				done <- s.SteerWithReceipt(ctx, proto.PromptSteerPayload{InputID: "input-1", Input: proto.TextInput("追加输入")}, func() {})
 			}()
 			var request struct {
 				ID     string          `json:"id"`
@@ -78,7 +78,7 @@ func TestSteeringDeadlineReleasesBlockedNativeWrite(t *testing.T) {
 	defer cancel()
 	done := make(chan error, 1)
 	go func() {
-		done <- s.Steer(ctx, proto.PromptSteerPayload{InputID: "blocked", Input: proto.TextInput("extra")})
+		done <- s.SteerWithReceipt(ctx, proto.PromptSteerPayload{InputID: "blocked", Input: proto.TextInput("extra")}, func() {})
 	}()
 	// No reader drains the pipe, so the request never reaches its response wait.
 	select {
@@ -103,18 +103,18 @@ func TestSteeringDoesNotStartOrReviveTurns(t *testing.T) {
 	// A nil RPC client proves these states do not issue a request.
 	for _, notification := range []json.RawMessage{nil, json.RawMessage(`{"threadId":"other-thread","turn":{"id":"other-turn"}}`)} {
 		s.onTurnStarted(notification)
-		if err := s.Steer(ctx, input); !errors.Is(err, agent.ErrSteeringNotReady) {
+		if err := s.SteerWithReceipt(ctx, input, func() {}); !errors.Is(err, agent.ErrSteeringNotReady) {
 			t.Fatalf("starting turn: %v", err)
 		}
 	}
 	s.stopSteering()
 	s.onTurnStarted(json.RawMessage(`{"threadId":"native-thread","turn":{"id":"late-turn"}}`))
-	if err := s.Steer(ctx, input); !errors.Is(err, agent.ErrSteeringInactive) {
+	if err := s.SteerWithReceipt(ctx, input, func() {}); !errors.Is(err, agent.ErrSteeringInactive) {
 		t.Fatalf("terminal turn revived: %v", err)
 	}
 	s = &Session{cancelCtx: ctx}
 	cancel()
-	if err := s.Steer(context.Background(), input); !errors.Is(err, agent.ErrSteeringInactive) {
+	if err := s.SteerWithReceipt(context.Background(), input, func() {}); !errors.Is(err, agent.ErrSteeringInactive) {
 		t.Fatalf("cancelled run: %v", err)
 	}
 }
diff --git a/apps/daemon/internal/agent/codex/session_thread.go b/apps/daemon/internal/agent/codex/session_thread.go
index 35699b8a8..65b59fce9 100644
--- a/apps/daemon/internal/agent/codex/session_thread.go
+++ b/apps/daemon/internal/agent/codex/session_thread.go
@@ -42,13 +42,9 @@ func (s *Session) startThread(plan SessionPlan) error {
 
 func (s *Session) resumeThread(threadID string, plan SessionPlan) error {
 	params := ThreadResumeParams{
-		ThreadID: threadID, ApprovalPolicy: approvalPolicyNever, Sandbox: sandboxDangerFullAccess,
+		ThreadID: threadID, Cwd: plan.Cwd, ApprovalPolicy: approvalPolicyNever, Sandbox: sandboxDangerFullAccess,
 		DeveloperInstructions: plan.SystemPrompt,
 	}
-	if plan.mcpServers != nil {
-		// Resolve the same project configuration checked before native startup.
-		params.Cwd = plan.Cwd
-	}
 	s.usageMu.Lock()
 	s.resumeUsageThreadID = threadID
 	s.usageMu.Unlock()
diff --git a/apps/daemon/internal/agent/codex/startup_observation_test.go b/apps/daemon/internal/agent/codex/startup_observation_test.go
index 15d758233..82daa0eb2 100644
--- a/apps/daemon/internal/agent/codex/startup_observation_test.go
+++ b/apps/daemon/internal/agent/codex/startup_observation_test.go
@@ -129,66 +129,6 @@ func TestFirstOutputIgnoresEmptyWrites(t *testing.T) {
 	}
 }
 
-func TestCatalogObservationsPreserveFailureBoundaries(t *testing.T) {
-	if !SupportsTextVerbosity {
-		t.Skip("catalog probe requires Unix")
-	}
-	for _, test := range []struct {
-		name, script, failedStage string
-	}{
-		{"success", `printf '%s' '{"models":[{"slug":"known","support_verbosity":true}]}'`, ""},
-		{"nonzero", `printf '%s' '{"models":[]}'; exit 7`, "model_catalog_command"},
-		{"invalid", `printf '%s' '{"models":'`, "model_catalog_validation"},
-		{"unsupported", `printf '%s' '{"models":[]}'`, "model_catalog_validation"},
-		{"snapshot_failure", `printf '%s' '{"models":[{"slug":"known","support_verbosity":true}]}'`, "model_catalog_snapshot"},
-		{"spawn_failure", "", "model_catalog_command"},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			output := captureStartupLogs(t)
-			home := t.TempDir()
-			if test.name == "snapshot_failure" {
-				home = filepath.Join(home, "missing")
-			}
-			plan := SessionPlan{Model: "known", Cwd: t.TempDir(), Env: []string{"CODEX_HOME=" + home}, ExtraConfig: [][2]string{{"model_verbosity", `"high"`}}, Cleanup: func() {}}
-			defer func() { plan.Cleanup() }()
-			binary := filepath.Join(t.TempDir(), "probe")
-			content := "#!/bin/sh\n" + test.script + "\n"
-			if test.name == "spawn_failure" {
-				content = "#!/missing-interpreter\n"
-			}
-			if err := os.WriteFile(binary, []byte(content), 0700); err != nil {
-				t.Fatal(err)
-			}
-			err := prepareModelVerbosity(t.Context(), binary, &plan)
-			if (err != nil) != (test.failedStage != "") {
-				t.Fatal(err)
-			}
-			stages := startupStages(t, output)
-			if stages["model_catalog"]["success"] != (err == nil) {
-				t.Fatal(stages)
-			}
-			if test.failedStage != "" && stages[test.failedStage]["success"] != false {
-				t.Fatal(stages)
-			}
-			if test.failedStage == "model_catalog_command" && stages["model_catalog_validation"] != nil {
-				t.Fatal("validated failed command")
-			}
-			if test.name == "spawn_failure" && stages["model_catalog_cleanup"] != nil {
-				t.Fatal("unstarted process reported cleanup")
-			}
-			if test.name == "success" && stages["model_catalog_cleanup"]["success"] != false {
-				t.Fatal("already-exited group signal did not report its error", stages)
-			}
-			if test.failedStage == "model_catalog_validation" && stages["model_catalog_snapshot"] != nil {
-				t.Fatal("persisted invalid catalog")
-			}
-			if strings.Contains(output.String(), "models") || strings.Contains(output.String(), home) {
-				t.Fatal("catalog or path leaked")
-			}
-		})
-	}
-}
-
 func TestInitializeObservationDoesNotBlockResponseDelivery(t *testing.T) {
 	reader, writer := io.Pipe()
 	defer reader.Close()
diff --git a/apps/daemon/internal/agent/codex/subagent_observations.go b/apps/daemon/internal/agent/codex/subagent_observations.go
index 29d1dcaf3..dda5bd36d 100644
--- a/apps/daemon/internal/agent/codex/subagent_observations.go
+++ b/apps/daemon/internal/agent/codex/subagent_observations.go
@@ -113,6 +113,7 @@ func (s *Session) collectSubagentFacts() {
 			return
 		}
 		firstFailure = time.Time{}
+		s.sendHeldFunctionCalls(o.ctx)
 		if terminal != nil && !busy {
 			s.publishSubagentTerminal(terminal, nil)
 			return
@@ -129,6 +130,7 @@ func (s *Session) publishSubagentTerminal(events []proto.Envelope, cause error)
 	for _, event := range events {
 		s.trySend(event)
 	}
+	s.stopFunctionCalls(false)
 	s.closeOut()
 }
 
diff --git a/apps/daemon/internal/agent/codex/subagent_profile.go b/apps/daemon/internal/agent/codex/subagent_profile.go
index 68afc9626..cf7093ab5 100644
--- a/apps/daemon/internal/agent/codex/subagent_profile.go
+++ b/apps/daemon/internal/agent/codex/subagent_profile.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"slices"
 	stdstrconv "strconv"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
@@ -14,14 +13,8 @@ func configureSubagentObservations(plan *SessionPlan, req proto.PromptRequestPay
 	if !req.ObserveSubagentIdentities || req.DisableSubagents {
 		return nil
 	}
-	for _, feature := range []string{"hooks", "plugins", "code_mode", "code_mode_only", "code_mode_prewarm", "multi_agent_v2"} {
-		if !slices.Contains(plan.DisableFeatures, feature) {
-			plan.DisableFeatures = append(plan.DisableFeatures, feature)
-		}
-		plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"features." + feature, "false"})
-	}
 	plan.EnableFeatures = append(plan.EnableFeatures, "multi_agent")
-	plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"features.multi_agent", "true"}, [2]string{"agents.max_depth", "64"})
+	plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"features.multi_agent", "true"})
 	if req.MaxConcurrentSubagents != nil {
 		if *req.MaxConcurrentSubagents < 1 {
 			return errors.New("codex: invalid subagent concurrency limit")
@@ -31,38 +24,24 @@ func configureSubagentObservations(plan *SessionPlan, req proto.PromptRequestPay
 	return nil
 }
 
-func verifySubagentObservationProfile(ctx context.Context, rpc *JSONRPCClient, cwd string) error {
-	hooks, err := readNativeToolHooks(ctx, rpc, cwd)
-	if err != nil {
-		return err
-	}
-	if len(hooks) != 0 {
-		return errors.New("codex: subagent observation requires hooks disabled")
-	}
-
+// Code-mode collaboration calls and multi_agent_v2 leave no persisted receipt, so
+// managed requirements that force them cannot be observed.
+func verifySubagentObservationProfile(ctx context.Context, rpc *JSONRPCClient) error {
 	raw, err := rpc.Request(ctx, "configRequirements/read", nil)
 	var response struct {
 		Requirements *struct {
-			AllowManagedHooksOnly bool            `json:"allowManagedHooksOnly"`
-			Features              map[string]bool `json:"featureRequirements"`
+			Features map[string]bool `json:"featureRequirements"`
 		} `json:"requirements"`
 	}
 	if err != nil || json.Unmarshal(raw, &response) != nil {
-		return errors.New("codex: subagent hook requirements unavailable")
+		return errors.New("codex: subagent feature requirements unavailable")
 	}
 	if response.Requirements == nil {
-		if len(hooks) != 0 {
-			return errors.New("codex: managed-only subagent hooks are not enforced")
-		}
 		return nil
 	}
-	requirements := response.Requirements
-	if (len(hooks) != 0 || requirements.Features["hooks"]) && !requirements.AllowManagedHooksOnly {
-		return errors.New("codex: managed-only subagent hooks are not enforced")
-	}
-	for _, feature := range []string{"plugins", "code_mode", "code_mode_only", "code_mode_prewarm", "multi_agent_v2"} {
-		if requirements.Features[feature] {
-			return errors.New("codex: required feature conflicts with subagent observation profile")
+	for _, feature := range []string{"code_mode", "code_mode_only", "code_mode_prewarm", "multi_agent_v2"} {
+		if response.Requirements.Features[feature] {
+			return errors.New("codex: required feature conflicts with subagent observation")
 		}
 	}
 	return nil
diff --git a/apps/daemon/internal/agent/codex/subagent_profile_test.go b/apps/daemon/internal/agent/codex/subagent_profile_test.go
index 14ee5aa5a..ae96346b0 100644
--- a/apps/daemon/internal/agent/codex/subagent_profile_test.go
+++ b/apps/daemon/internal/agent/codex/subagent_profile_test.go
@@ -8,19 +8,15 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func TestSubagentProfileOverridesUnsafeNativeFeatures(t *testing.T) {
+func TestSubagentProfileEnablesOnlyMultiAgent(t *testing.T) {
 	limit := 6
 	plan := SessionPlan{}
 	if err := configureSubagentObservations(&plan, proto.PromptRequestPayload{ObserveSubagentIdentities: true, MaxConcurrentSubagents: &limit}); err != nil {
 		t.Fatal(err)
 	}
-	for _, feature := range []string{"hooks", "plugins", "code_mode", "code_mode_only", "code_mode_prewarm", "multi_agent_v2"} {
-		if slices.Contains(plan.EnableFeatures, feature) || !slices.Contains(plan.DisableFeatures, feature) {
-			t.Fatal(feature, plan)
-		}
-	}
-	if !slices.Contains(plan.ExtraConfig, [2]string{"agents.max_threads", "6"}) || !slices.Contains(plan.ExtraConfig, [2]string{"agents.max_depth", "64"}) {
-		t.Fatal(plan.ExtraConfig)
+	want := [][2]string{{"features.multi_agent", "true"}, {"agents.max_threads", "6"}}
+	if !slices.Equal(plan.EnableFeatures, []string{"multi_agent"}) || len(plan.DisableFeatures) != 0 || !slices.Equal(plan.ExtraConfig, want) {
+		t.Fatal(plan)
 	}
 }
 
@@ -35,26 +31,26 @@ func TestSubagentProfileDoesNotDisableRequiredToolEnvironment(t *testing.T) {
 	}
 }
 
-func TestSubagentProfileRejectsRequirementsThatPermitResultRewrite(t *testing.T) {
+func TestSubagentProfileRejectsRequirementsThatForceUnobservableFeatures(t *testing.T) {
 	for _, test := range []struct {
 		name         string
 		requirements any
 		allowed      bool
 	}{
-		{"ordinary disabled hooks", nil, true},
-		{"managed-only hooks", map[string]any{"allowManagedHooksOnly": true, "featureRequirements": map[string]bool{"hooks": true}}, true},
-		{"unrestricted forced hooks", map[string]any{"allowManagedHooksOnly": false, "featureRequirements": map[string]bool{"hooks": true}}, false},
+		{"no requirements", nil, true},
+		{"forced hooks", map[string]any{"featureRequirements": map[string]bool{"hooks": true}}, true},
+		{"forced plugins", map[string]any{"featureRequirements": map[string]bool{"plugins": true}}, true},
 		{"forced code mode", map[string]any{"featureRequirements": map[string]bool{"code_mode": true}}, false},
-		{"forced plugins", map[string]any{"featureRequirements": map[string]bool{"plugins": true}}, false},
+		{"forced multi_agent_v2", map[string]any{"featureRequirements": map[string]bool{"multi_agent_v2": true}}, false},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			client, server, cleanup := NewTestClient()
 			defer cleanup()
 			done := make(chan error, 1)
-			go func() { done <- verifySubagentObservationProfile(t.Context(), client.JSONRPCClient, "/workspace") }()
+			go func() { done <- verifySubagentObservationProfile(t.Context(), client.JSONRPCClient) }()
 			decoder := json.NewDecoder(server.FromClient)
 			encoder := json.NewEncoder(server.ToClient)
-			for _, result := range []any{map[string]any{"data": []any{map[string]any{"cwd": "/workspace", "hooks": []any{}, "errors": []any{}}}}, map[string]any{"requirements": test.requirements}} {
+			for _, result := range []any{map[string]any{"requirements": test.requirements}} {
 				var request JsonRpcRequest
 				if err := decoder.Decode(&request); err != nil {
 					t.Fatal(err)
@@ -69,3 +65,29 @@ func TestSubagentProfileRejectsRequirementsThatPermitResultRewrite(t *testing.T)
 		})
 	}
 }
+
+func TestSubagentItemSnapshotSkipsUnmappedItemTypes(t *testing.T) {
+	for _, item := range []string{`{"type":"imageView","id":"i1","path":"/x.png"}`, `{"type":"contextCompaction","id":"c1"}`} {
+		kind, _, _, err := subagentItemSnapshot(json.RawMessage(item), "completed", true)
+		if err != nil || kind != "" {
+			t.Fatal(item, kind, err)
+		}
+	}
+}
+
+func TestSubagentReasoningIsReportedOnlyWhenRequestedWithText(t *testing.T) {
+	for _, test := range []struct {
+		item      string
+		requested bool
+		want      string
+	}{
+		{`{"type":"reasoning","id":"r1","summary":["plan","next"]}`, true, `{"status":"completed","summary":[{"text":"plan","type":"summary_text"},{"text":"next","type":"summary_text"}]}`},
+		{`{"type":"reasoning","id":"r1","summary":["plan"]}`, false, ""},
+		{`{"type":"reasoning","id":"r1"}`, true, ""},
+	} {
+		kind, body, _, err := subagentItemSnapshot(json.RawMessage(test.item), "completed", test.requested)
+		if err != nil || string(body) != test.want || (kind == "") != (test.want == "") {
+			t.Fatal(test.item, test.requested, kind, string(body), err)
+		}
+	}
+}
diff --git a/apps/daemon/internal/agent/codex/subagent_snapshots.go b/apps/daemon/internal/agent/codex/subagent_snapshots.go
index 9f3eda46c..2dcca64ad 100644
--- a/apps/daemon/internal/agent/codex/subagent_snapshots.go
+++ b/apps/daemon/internal/agent/codex/subagent_snapshots.go
@@ -185,7 +185,7 @@ func (s *Session) publishSubagentHistory(ctx context.Context, h subagentHistory,
 			if turn.CompletedItems[identity.ID] {
 				itemStatus = "completed"
 			}
-			kind, body, id, err := subagentItemSnapshot(raw, itemStatus)
+			kind, body, id, err := subagentItemSnapshot(raw, itemStatus, s.reasoningSummary)
 			if kind == proto.TypeSubagentCoordination {
 				value, decodeErr := subagentCoordination(raw, h.ID)
 				if decodeErr != nil {
@@ -218,6 +218,9 @@ func (s *Session) publishSubagentHistory(ctx context.Context, h subagentHistory,
 			if err := s.sendSubagentFact(ctx, proto.TypeSubagentTurn, key, payload); err != nil {
 				return false, err
 			}
+			if err := s.withdrawChildCalls(ctx, h.ID, turn.ID); err != nil {
+				return false, err
+			}
 		}
 	}
 	return busy || nativeStatus.Type == "active", nil
@@ -231,7 +234,7 @@ func nativeMilliseconds(seconds *int64) *int64 {
 	return &ms
 }
 
-func subagentItemSnapshot(raw json.RawMessage, turnStatus string) (string, json.RawMessage, string, error) {
+func subagentItemSnapshot(raw json.RawMessage, turnStatus string, reasoningSummary bool) (string, json.RawMessage, string, error) {
 	var item struct {
 		Type   string `json:"type"`
 		ID     string `json:"id"`
@@ -288,15 +291,22 @@ func subagentItemSnapshot(raw json.RawMessage, turnStatus string) (string, json.
 		body, err := json.Marshal(map[string]any{"input": []any{map[string]any{"type": "message", "role": "user", "content": content}}})
 		return "message", body, item.ID, err
 	case "reasoning":
-		var source struct {
-			Summary []string `json:"summary"`
+		if !reasoningSummary {
+			return "", nil, "", nil
 		}
+		var source ThreadItem
 		if json.Unmarshal(raw, &source) != nil {
 			return "", nil, "", errors.New("codex: invalid child reasoning")
 		}
-		summary := make([]map[string]string, 0, len(source.Summary))
-		for _, text := range source.Summary {
-			summary = append(summary, map[string]string{"type": "summary_text", "text": text})
+		var summary []map[string]string
+		for _, text := range nativeReasoningParts(source) {
+			if text != "" {
+				summary = append(summary, map[string]string{"type": "summary_text", "text": text})
+			}
+		}
+		if len(summary) == 0 {
+			// A reasoning item with no text is not reported, as in the root projection.
+			return "", nil, "", nil
 		}
 		status := "in_progress"
 		if turnStatus == "completed" {
@@ -307,6 +317,7 @@ func subagentItemSnapshot(raw json.RawMessage, turnStatus string) (string, json.
 		body, err := json.Marshal(map[string]any{"status": status, "summary": summary})
 		return "reasoning", body, item.ID, err
 	default:
-		return "", nil, "", errors.New("codex: unsupported child Item observation")
+		// Item types without a neutral vocabulary are skipped, as in the root projection.
+		return "", nil, "", nil
 	}
 }
diff --git a/apps/daemon/internal/agent/codex/subagent_tools_native_test.go b/apps/daemon/internal/agent/codex/subagent_tools_native_test.go
new file mode 100644
index 000000000..4d0840434
--- /dev/null
+++ b/apps/daemon/internal/agent/codex/subagent_tools_native_test.go
@@ -0,0 +1,131 @@
+package codex
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+)
+
+// This opt-in test runs the real pinned harness with a model that spawns a
+// Subagent, which calls a function or an MCP tool of the Agent.
+func TestSubagentToolsNative(t *testing.T) {
+	binary, options := nativeAcceptanceConfig(t)
+	mcpServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		var rpc struct {
+			ID     json.RawMessage `json:"id"`
+			Method string          `json:"method"`
+		}
+		_ = json.Unmarshal(body, &rpc)
+		var result string
+		switch rpc.Method {
+		case "initialize":
+			result = `{"protocolVersion":"2025-06-18","capabilities":{"tools":{}},"serverInfo":{"name":"proof","version":"0"}}`
+		case "tools/list":
+			result = `{"tools":[{"name":"echo","description":"Return the synthetic MCP value.","inputSchema":{"type":"object","properties":{}}}]}`
+		case "tools/call":
+			result = `{"content":[{"type":"text","text":"MCP-5521"}]}`
+		default:
+			w.WriteHeader(http.StatusAccepted)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"jsonrpc":"2.0","id":` + string(rpc.ID) + `,"result":` + result + `}`))
+	}))
+	defer mcpServer.Close()
+	for name, prompt := range map[string]string{
+		"function": "Call spawn_agent with fork_context true and the task: call the lookup function once and report the value it returns. Then wait for that Subagent and reply with its value. Do not call lookup yourself.",
+		"mcp":      "Call spawn_agent with a task: call the echo tool of the proof MCP server once and report the value it returns. Then wait for that Subagent and reply with its value. Do not call echo yourself.",
+	} {
+		t.Run(name, func(t *testing.T) {
+			cfg := defaultSessionConfig(testStateRoot(t))
+			cfg.codexBinary = binary
+			cfg.logger = slog.New(slog.DiscardHandler)
+			servers := []proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "proof", ServerURL: mcpServer.URL}}
+			req := proto.PromptRequestPayload{
+				AgentKind: "codex", AgentStateKey: "subagent-tools-" + name,
+				DisableExecutionEnvironment: true, ObserveSubagentIdentities: true,
+				AgentOptions:   options,
+				FunctionTools:  []proto.FunctionTool{{Name: "lookup", Description: "Return the synthetic verification value.", Parameters: json.RawMessage(`{"type":"object","properties":{},"additionalProperties":false}`)}},
+				MCPHTTPServers: &servers,
+			}
+			ctx, cancel := context.WithTimeout(t.Context(), 5*time.Minute)
+			defer cancel()
+			e, err := newExecutor(ctx, req, cfg)
+			if err != nil {
+				t.Fatalf("native prepare failed (%T)", err)
+			}
+			defer e.Close(context.Background())
+			output := make(chan proto.Envelope, 512)
+			turn, err := e.StartTurn(ctx, name, proto.TextInput(prompt), output)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var calls []proto.FunctionCallPayload
+			var childTools []string
+			var answer string
+			var answers sync.WaitGroup
+			for event := range output {
+				switch event.Type {
+				case proto.TypeFunctionCall:
+					var call proto.FunctionCallPayload
+					_ = event.DecodePayload(&call)
+					calls = append(calls, call)
+					text := "FN-4729"
+					answers.Add(1)
+					go func() {
+						defer answers.Done()
+						if err := turn.(agent.FunctionResultSubmitter).SubmitFunctionResult(ctx, proto.FunctionResultPayload{CallID: call.CallID, Success: true, Content: []proto.InputContent{{Type: "input_text", Text: &text}}}); err != nil {
+							t.Errorf("function answer: %v", err)
+						}
+					}()
+				case proto.TypeSubagentItem:
+					var item proto.SubagentItemPayload
+					_ = event.DecodePayload(&item)
+					var tool struct {
+						Stage       string `json:"stage"`
+						Observation struct {
+							Kind, Name, Server string
+						} `json:"observation"`
+					}
+					if item.Kind == proto.TypeToolCall && json.Unmarshal(item.Payload, &tool) == nil && tool.Stage == "after" {
+						childTools = append(childTools, tool.Observation.Kind+":"+tool.Observation.Server+tool.Observation.Name)
+					}
+				case proto.TypeDone:
+					var done proto.DonePayload
+					_ = event.DecodePayload(&done)
+					answer = done.Content
+				}
+			}
+			answers.Wait()
+			if _, err := turn.AwaitSettlement(ctx); err != nil {
+				t.Fatal(err)
+			}
+			t.Logf("function_calls=%+v child_tools=%v answer=%q", calls, childTools, answer)
+			want := map[string]string{"function": "function:lookup", "mcp": "mcp:proofecho"}[name]
+			seen := false
+			for _, tool := range childTools {
+				seen = seen || tool == want
+			}
+			if !seen {
+				t.Fatalf("the Subagent did not run %s", want)
+			}
+			if name == "function" && (len(calls) != 1 || calls[0].NativeID == "" || calls[0].TurnID == "" || !strings.Contains(answer, "FN-4729")) {
+				t.Fatal("the Subagent call did not reach the client with its child identity")
+			}
+			if name == "mcp" && (len(calls) != 0 || !strings.Contains(answer, "MCP-5521")) {
+				t.Fatal("the MCP value did not reach the root")
+			}
+		})
+	}
+}
diff --git a/apps/daemon/internal/agent/codex/trust.go b/apps/daemon/internal/agent/codex/trust.go
new file mode 100644
index 000000000..83fa1d697
--- /dev/null
+++ b/apps/daemon/internal/agent/codex/trust.go
@@ -0,0 +1,28 @@
+package codex
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// writeWorkspaceTrust marks the workspace as a trusted native project, the entry
+// thread/start would persist, so start and cold resume load the same workspace
+// configuration. The key is the nearest checkout root, else the workspace.
+func writeWorkspaceTrust(codexHome, workspace string) error {
+	root := workspace
+	for dir := workspace; ; dir = filepath.Dir(dir) {
+		if _, err := os.Lstat(filepath.Join(dir, ".git")); err == nil {
+			root = dir
+			break
+		}
+		if filepath.Dir(dir) == dir {
+			break
+		}
+	}
+	if resolved, err := filepath.EvalSymlinks(root); err == nil {
+		root = resolved
+	}
+	return appendConfigTOML(filepath.Join(codexHome, "config.toml"),
+		fmt.Sprintf("[projects.%s]\ntrust_level = \"trusted\"\n\n", tomlQuoteString(root)))
+}
diff --git a/apps/daemon/internal/agent/codex/workspace_trust_native_test.go b/apps/daemon/internal/agent/codex/workspace_trust_native_test.go
new file mode 100644
index 000000000..63ffeb1bb
--- /dev/null
+++ b/apps/daemon/internal/agent/codex/workspace_trust_native_test.go
@@ -0,0 +1,135 @@
+package codex
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+)
+
+// A trusted workspace loads its own native configuration on start and on cold
+// resume, but may not move a declared MCP server's credential binding. Opt-in:
+// it needs the pinned native binary and no model call.
+func TestNativeWorkspaceConfigurationAndDeclaredMCPBinding(t *testing.T) {
+	binary := os.Getenv("OAC_TEST_CODEX_BINARY")
+	if binary == "" {
+		t.Skip("requires the pinned native Codex binary")
+	}
+	if version, err := exec.Command(binary, "--version").Output(); err != nil || strings.TrimSpace(string(version)) != "codex-cli 0.153.4" {
+		t.Fatal("native artifact is not Codex 0.153.4")
+	}
+	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
+	cfg := defaultSessionConfig(testStateRoot(t))
+	cfg.codexBinary = binary
+	cfg.logger = slog.New(slog.DiscardHandler)
+	workspace := t.TempDir()
+	if err := exec.Command("git", "init", "-q", workspace).Run(); err != nil {
+		t.Fatal(err)
+	}
+	writeWorkspace := func(body string) {
+		t.Helper()
+		if err := os.MkdirAll(filepath.Join(workspace, ".codex"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(workspace, ".codex", "config.toml"), []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	token := "synthetic-private-token"
+	prepare := func(ctx context.Context, thread string) (*Executor, error) {
+		servers := []proto.MCPHTTPServer{{ConnectionOrigin: "environment", ServerLabel: "docs", ServerURL: "https://docs.invalid/mcp", BearerToken: &token}}
+		return newExecutor(ctx, proto.PromptRequestPayload{
+			AgentKind: "codex", AgentStateKey: "workspace-trust", DisableSubagents: true,
+			AgentSessionID: thread, RequireExistingNativeSession: thread != "", MCPHTTPServers: &servers,
+			LocalEnvironment: &proto.LocalEnvironment{WorkspaceRoot: workspace},
+			AgentOptions:     map[string]any{"model": "gpt-5.5", "model_provider": map[string]any{"base_url": "http://127.0.0.1:9/v1", "protocol": "responses", "api_key": "unused"}},
+		}, cfg)
+	}
+	closeExecutor := func(e *Executor) {
+		c, stop := context.WithTimeout(context.Background(), 20*time.Second)
+		defer stop()
+		_ = e.Close(c)
+	}
+	ctx, cancel := context.WithTimeout(t.Context(), 3*time.Minute)
+	defer cancel()
+	readConfig := func(e *Executor) (map[string]any, map[string]any) {
+		t.Helper()
+		raw, err := e.prepared.session.rpc.Request(ctx, "config/read", map[string]any{"cwd": workspace, "includeLayers": false})
+		if err != nil {
+			t.Fatal(err)
+		}
+		var response struct {
+			Config struct {
+				Servers  map[string]any `json:"mcp_servers"`
+				Features map[string]any `json:"features"`
+			} `json:"config"`
+		}
+		if err := json.Unmarshal(raw, &response); err != nil {
+			t.Fatal(err)
+		}
+		return response.Config.Servers, response.Config.Features
+	}
+
+	// Additional workspace servers are admitted and plugins and apps keep their native values.
+	writeWorkspace("[mcp_servers.extra]\ncommand = \"true\"\n\n[mcp_servers.docs]\ntool_timeout_sec = 7\n")
+	e, err := prepare(ctx, "")
+	if err != nil {
+		t.Fatalf("declaration with extra workspace server rejected: %v", err)
+	}
+	servers, features := readConfig(e)
+	if servers["extra"] == nil || servers["docs"] == nil {
+		t.Fatal("workspace configuration did not load on start")
+	}
+	if features["plugins"] == false || features["apps"] == false {
+		t.Fatal("plugins or apps were forced off")
+	}
+	output := make(chan proto.Envelope, 64)
+	turn, err := e.StartTurn(ctx, "first", proto.TextInput("Reply OK."), output)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for done := false; !done; {
+		select {
+		case event := <-output:
+			done = event.Type == proto.TypeDone
+		case <-ctx.Done():
+			t.Fatal("Turn did not settle")
+		}
+	}
+	_, _ = turn.AwaitSettlement(ctx)
+	thread := turn.(*Session).currentThreadID()
+	closeExecutor(e)
+	if thread == "" {
+		t.Fatal("no native thread to resume")
+	}
+
+	// A cold resume loads the same workspace configuration.
+	e, err = prepare(ctx, thread)
+	if err != nil {
+		t.Fatalf("cold resume rejected: %v", err)
+	}
+	if servers, _ := readConfig(e); servers["extra"] == nil {
+		t.Fatal("workspace configuration did not load on cold resume")
+	}
+	closeExecutor(e)
+
+	// Redirecting the declared server fails start and cold resume before any native Turn.
+	writeWorkspace("[mcp_servers.docs]\nurl = \"https://workspace.invalid/mcp\"\n")
+	for _, resume := range []string{"", thread} {
+		e, err := prepare(ctx, resume)
+		if !errors.Is(err, errMCPBindingChanged) {
+			t.Fatalf("redirected declared server admitted (resume=%q): %v", resume, err)
+		}
+		if e != nil {
+			closeExecutor(e)
+		}
+	}
+}
diff --git a/apps/daemon/internal/agent/contract_declarations_test.go b/apps/daemon/internal/agent/contract_declarations_test.go
index 7915f9df6..bae330dbc 100644
--- a/apps/daemon/internal/agent/contract_declarations_test.go
+++ b/apps/daemon/internal/agent/contract_declarations_test.go
@@ -1,11 +1,9 @@
 package agent_test
 
 import (
-	"encoding/json"
 	"go/ast"
 	"go/parser"
 	"go/token"
-	"os"
 	"path/filepath"
 	"reflect"
 	"strings"
@@ -20,7 +18,6 @@ func TestPublicHarnessContractDeclarations(t *testing.T) {
 		"Turn":                     {"session"},
 		"Session":                  {"session"},
 		"DurableSteerer":           {"session"},
-		"Steerer":                  {"session"},
 		"FunctionResultSubmitter":  {"session"},
 		"WorkspaceReader":          {"executor", "session"},
 		"WorkspaceDirectoryLister": {"executor", "session"},
@@ -58,17 +55,12 @@ func TestPublicHarnessContractDeclarations(t *testing.T) {
 			t.Fatalf("unclassified interface %s", name)
 		}
 	}
-	data, err := os.ReadFile("../../../../internal/harnessconfig/builtin/catalog.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var catalog []struct {
-		Configuration string `json:"configuration"`
-	}
-	if err := json.Unmarshal(data, &catalog); err != nil {
-		t.Fatal(err)
+	declarations, err := filepath.Glob("../../../../internal/harnessconfig/*/declaration.go")
+	if err != nil || len(declarations) == 0 {
+		t.Fatal("no Harness declarations", err)
 	}
-	for _, entry := range catalog {
+	for _, declaration := range declarations {
+		entry := struct{ Configuration string }{filepath.Base(filepath.Dir(declaration))}
 		t.Run(entry.Configuration, func(t *testing.T) {
 			f, err := parser.ParseFile(token.NewFileSet(), filepath.Join(entry.Configuration, "contracts.go"), nil, 0)
 			if err != nil {
diff --git a/apps/daemon/internal/agent/contracttest/text.go b/apps/daemon/internal/agent/contracttest/text.go
index c389163a7..bc7f336a7 100644
--- a/apps/daemon/internal/agent/contracttest/text.go
+++ b/apps/daemon/internal/agent/contracttest/text.go
@@ -71,7 +71,7 @@ func TextLifecycle(t *testing.T, fixture TextFixture) {
 		t.Fatal("public text Turn must implement DurableSteerer")
 	}
 	var written atomic.Int32
-	if err := steerer.SteerWithReceipt(ctx, proto.PromptSteerPayload{InputID: "contract-input", Input: fixture.SteeringInput, DurableReceipt: true}, func() { written.Add(1) }); err != nil {
+	if err := steerer.SteerWithReceipt(ctx, proto.PromptSteerPayload{InputID: "contract-input", Input: fixture.SteeringInput}, func() { written.Add(1) }); err != nil {
 		t.Fatalf("active input after stale cancellation: %v", err)
 	}
 	if written.Load() != 1 {
@@ -168,3 +168,12 @@ func settled(t *testing.T, ctx context.Context, turn agent.Turn, output *capture
 func sameTurn(a, b agent.Turn) bool {
 	return reflect.ValueOf(a).Comparable() && a == b
 }
+
+// RequireNarrowed fails when discovery grants a capability its declaration does
+// not make: discovery may only withdraw support the installed host cannot give.
+func RequireNarrowed(t *testing.T, declared, discovered proto.AgentKindCapabilities) {
+	t.Helper()
+	if widened := agent.Widened(declared, discovered); len(widened) > 0 {
+		t.Errorf("discovery widened %v", widened)
+	}
+}
diff --git a/apps/daemon/internal/agent/harness.go b/apps/daemon/internal/agent/harness.go
index 4804282de..19f2364df 100644
--- a/apps/daemon/internal/agent/harness.go
+++ b/apps/daemon/internal/agent/harness.go
@@ -9,38 +9,70 @@
 // return ErrUnsupportedOperation before any native effects. Interface presence
 // does not advertise support; the capability declaration controls admission. MCP,
 // images, structured output and Subagent observations use protocol messages
-// rather than additional Go interfaces; qualify and advertise them separately.
+// rather than additional Go interfaces; declare and advertise them separately.
 //
-// Registration: each adapter exports one Declaration. The Runtime discovers the
-// static declaration list and installs each resulting Runtime through Register.
-// Availability and factory selection belong to the adapter. RegisterKind resets
-// the factories, so Register installs it first. RegisterExecutor derives the
-// Preparation capability; the adapter declares WorkspaceReadPreparation.
+// Registration: each adapter exports one Declaration, which binds its shared
+// declaration (internal/harnessconfig/<package>/declaration.go) to Discover.
+// The Runtime discovers the generated declaration list and installs each
+// resulting Runtime through Register. Availability and factory selection belong
+// to the adapter. RegisterKind resets the factories, so Register installs it
+// first. RegisterExecutor derives the Preparation capability.
 //
-// Runtime registration and Core service qualification remain separate. A public
-// Harness also needs a profile in services/core/internal/engine; advertising
-// a capability cannot authorize it. Requests, events and capability descriptors
-// use the existing internal/agentdaemon/proto types. An Environment execution
-// request carries the Runtime's bound workspace directory in
-// LocalEnvironment.WorkspaceRoot; the native Harness runs there.
+// The shared declaration is the only authored statement of what a Harness
+// supports; Core admission reads the same value. Discovery may only narrow its
+// capabilities for the installed host, with Narrow. Requests, events and
+// capability descriptors use the existing internal/agentdaemon/proto types. An
+// Environment execution request carries the Runtime's bound workspace directory
+// in LocalEnvironment.WorkspaceRoot; the native Harness runs there.
 package agent
 
 import (
 	"context"
 	"io"
+	"reflect"
+	"strings"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
 )
 
-// Declaration is the complete startup contract for a Harness implementation.
+// Declaration binds a Harness's shared declaration to its native discovery.
 // Discover returns nil when the adapter is not configured. An unavailable
 // configured adapter returns a Runtime with Available=false and no factories.
-// Discovery owns runtime-specific configuration, readiness and feature gates.
+// Discovery owns runtime-specific configuration and readiness, and narrows the
+// declared capabilities to what the host provides; it never widens them.
 type Declaration struct {
-	Info          proto.SupportedAgentKind
-	Configuration harnessconfig.Configuration
-	Discover      func(context.Context, DiscoveryOptions, proto.SupportedAgentKind) *Runtime
+	harnessconfig.Declaration
+	Discover func(context.Context, DiscoveryOptions, proto.SupportedAgentKind) *Runtime
+}
+
+// Unavailable is the Runtime of a configured adapter the host cannot run. It
+// declares nothing supported and has no factories.
+func Unavailable(info proto.SupportedAgentKind) *Runtime {
+	info.Available, info.Version = false, ""
+	info.Capabilities = proto.UnsupportedCapabilities()
+	return &Runtime{Info: info}
+}
+
+// Widened names the capabilities discovery reports supported although the
+// declaration does not.
+func Widened(declared, discovered proto.AgentKindCapabilities) []string {
+	d, found := reflect.ValueOf(declared), reflect.ValueOf(discovered)
+	var widened []string
+	for i := 0; i < d.NumField(); i++ {
+		if found.Field(i).Interface() == proto.CapabilitySupported && d.Field(i).Interface() != proto.CapabilitySupported {
+			widened = append(widened, d.Type().Field(i).Name)
+		}
+	}
+	return widened
+}
+
+// Narrow withdraws a declared capability the host cannot provide. It never
+// grants one.
+func Narrow(capability *proto.CapabilitySupport, provided bool) {
+	if !provided {
+		*capability = proto.CapabilityUnsupported
+	}
 }
 
 // DiscoveryOptions provides process context without naming an implementation.
@@ -61,12 +93,17 @@ type Runtime struct {
 
 // Register installs a discovered Runtime with its declaration's configuration.
 func (r *Registry) Register(declaration Declaration, runtime Runtime) {
-	if runtime.Info.Kind != declaration.Info.Kind {
+	if runtime.Info.Kind != declaration.Kind {
 		panic("agent.Registry.Register: discovery kind differs from declaration")
 	}
 	if !runtime.Info.Available && runtime.Executor != nil {
 		panic("agent.Registry.Register: unavailable runtime has factories")
 	}
+	advertised := runtime.Info.Capabilities
+	advertised.Preparation = proto.CapabilityFromBool(runtime.Executor != nil)
+	if widened := Widened(declaration.Capabilities, advertised); len(widened) > 0 {
+		panic("agent.Registry.Register: discovery widened " + strings.Join(widened, ", "))
+	}
 	r.RegisterKind(runtime.Info, declaration.Configuration)
 	if runtime.Executor != nil {
 		r.RegisterExecutor(runtime.Info.Kind, runtime.Executor)
@@ -80,8 +117,8 @@ func (r *Registry) Register(declaration Declaration, runtime Runtime) {
 // The declaration belongs to the adapter and is also consumed by Core. Keep
 // adapter field rules and rendering private. That shared contract owns frozen
 // configuration and native application obligations. This file owns execution
-// lifecycle only. Native image/tool/operation support is qualified through proto
-// capabilities and the Core engine profile, not model configuration declarations.
+// lifecycle only. Native image/tool/operation support is declared through the
+// declaration's capabilities, not model configuration.
 //
 // Preparation failure retains unconfirmed native cleanup in a non-nil Executor
 // under the factory ownership contract below.
@@ -139,18 +176,12 @@ type Session interface {
 // unsupported operations return ErrUnsupportedOperation with a fixed safe reason.
 
 // DurableSteerer reports one complete write synchronously, then waits for the native receipt.
-// It is independent of Steerer and is mandatory on every public Turn.
+// It is mandatory on every public Turn.
 // Required input receipts cannot be implemented by returning Unsupported.
 type DurableSteerer interface {
 	SteerWithReceipt(context.Context, proto.PromptSteerPayload, func()) error
 }
 
-// Steerer delivers non-durable input when qualified; otherwise it explicitly
-// returns ErrUnsupportedOperation without submitting input.
-type Steerer interface {
-	Steer(context.Context, proto.PromptSteerPayload) error
-}
-
 // FunctionResultSubmitter delivers a result for an outstanding native call.
 // A successful return requires its native application receipt.
 type FunctionResultSubmitter interface {
diff --git a/apps/daemon/internal/agent/mcode/contracts.go b/apps/daemon/internal/agent/mcode/contracts.go
index 3f01ff20b..30e32fa6f 100644
--- a/apps/daemon/internal/agent/mcode/contracts.go
+++ b/apps/daemon/internal/agent/mcode/contracts.go
@@ -9,7 +9,6 @@ var (
 	_ agent.Turn                     = (*Session)(nil)
 	_ agent.Session                  = (*Session)(nil)
 	_ agent.DurableSteerer           = (*Session)(nil)
-	_ agent.Steerer                  = (*Session)(nil)
 	_ agent.FunctionResultSubmitter  = (*Session)(nil)
 	_ agent.WorkspaceReader          = (*Session)(nil)
 	_ agent.WorkspaceDirectoryLister = (*Session)(nil)
diff --git a/apps/daemon/internal/agent/mcode/declaration.go b/apps/daemon/internal/agent/mcode/declaration.go
index 03bbef288..4da7072f7 100644
--- a/apps/daemon/internal/agent/mcode/declaration.go
+++ b/apps/daemon/internal/agent/mcode/declaration.go
@@ -7,41 +7,11 @@ import (
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	configuration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/mcode"
+	declaration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/mcode"
 )
 
-// Declaration owns MiniMax Code discovery, configuration and execution factories.
-var Declaration = agent.Declaration{Info: proto.SupportedAgentKind{Kind: "mcode", Capabilities: proto.AgentKindCapabilities{
-	SubagentObservations:           proto.CapabilityUnsupported,
-	Streaming:                      proto.CapabilitySupported,
-	Usage:                          proto.CapabilityUnsupported,
-	Resume:                         proto.CapabilitySupported,
-	RetainedNativeHistory:          proto.CapabilityUnsupported,
-	NativeSessionRecovery:          proto.CapabilityUnsupported,
-	Steering:                       proto.CapabilityUnsupported,
-	MessageItems:                   proto.CapabilityUnsupported,
-	ToolObservations:               proto.CapabilityUnsupported,
-	EnvironmentNone:                proto.CapabilityUnsupported,
-	LocalEnvironment:               proto.CapabilityUnsupported,
-	Preparation:                    proto.CapabilityUnsupported,
-	WorkspaceReadPreparation:       proto.CapabilityUnsupported,
-	WorkspaceOutputExport:          proto.CapabilityUnsupported,
-	ProgrammaticToolCallingDisable: proto.CapabilityUnsupported,
-	WebSearchControl:               proto.CapabilityUnsupported,
-	ExecutionControls:              proto.CapabilityUnsupported,
-	TextVerbosity:                  proto.CapabilityUnsupported,
-	StructuredOutput:               proto.CapabilityUnsupported,
-	ToolSearch:                     proto.CapabilityUnsupported,
-	MessageImages:                  proto.CapabilityUnsupported,
-	FunctionResultImages:           proto.CapabilityUnsupported,
-	SubagentControl:                proto.CapabilityUnsupported,
-	DurableInputReceipts:           proto.CapabilityUnsupported,
-	DurableTurns:                   proto.CapabilityUnsupported,
-	FunctionTools:                  proto.CapabilityUnsupported,
-	MCPHTTPTools:                   proto.CapabilityUnsupported,
-	MCPHTTPRequired:                proto.CapabilityUnsupported,
-	MCPHTTPBearerAuth:              proto.CapabilityUnsupported,
-}}, Configuration: configuration.Configuration(), Discover: discover}
+// Declaration binds the shared MiniMax Code declaration to discovery and execution factories.
+var Declaration = agent.Declaration{Declaration: declaration.Declaration, Discover: discover}
 
 func discover(ctx context.Context, options agent.DiscoveryOptions, info proto.SupportedAgentKind) *agent.Runtime {
 	return discoverWithCheck(ctx, options, info, CheckCLIAvailable)
@@ -54,21 +24,9 @@ func discoverWithCheck(parent context.Context, options agent.DiscoveryOptions, r
 	version, err := check(ctx, "")
 	if err != nil {
 		fmt.Fprintf(options.Stderr, "oac-daemon: mcode unavailable: %v\n  Install: npm install -g @minimax-ai/code@0.4.12\n", err)
-		return runtime
+		return agent.Unavailable(result)
 	}
 	result.Available, result.Version = true, version
-	result.Capabilities.Steering = proto.CapabilitySupported
-	result.Capabilities.DurableTurns = proto.CapabilitySupported
-	result.Capabilities.DurableInputReceipts = proto.CapabilitySupported
-	result.Capabilities.ExecutionControls = proto.CapabilitySupported
-	result.Capabilities.ProgrammaticToolCallingDisable = proto.CapabilitySupported
-	result.Capabilities.ToolObservations = proto.CapabilitySupported
-	result.Capabilities.SubagentControl = proto.CapabilitySupported
-	// Native preparation verifies the applied admission/tool profile before input.
-	result.Capabilities.SubagentObservations = proto.CapabilitySupported
-	result.Capabilities.EnvironmentNone = proto.CapabilitySupported
-	result.Capabilities.MCPHTTPTools = proto.CapabilitySupported
-	result.Capabilities.MCPHTTPBearerAuth = proto.CapabilitySupported
 	runtime.Info = result
 	workspace := discoverWorkspace(parent, options, runtime)
 	if runtime.Info.Available {
diff --git a/apps/daemon/internal/agent/mcode/declaration_test.go b/apps/daemon/internal/agent/mcode/declaration_test.go
index 386c4df2d..44d6ffba5 100644
--- a/apps/daemon/internal/agent/mcode/declaration_test.go
+++ b/apps/daemon/internal/agent/mcode/declaration_test.go
@@ -4,11 +4,10 @@ import (
 	"context"
 	"errors"
 	"io"
-	"reflect"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/contracttest"
 )
 
 // An available runtime is execution-capable; a rejected native version is unavailable.
@@ -19,7 +18,7 @@ func TestMCodeExecutionFollowsAvailability(t *testing.T) {
 	}{{SupportedVersion, nil}, {"0.3.11", errors.New("mcode: unsupported version 0.3.11")}} {
 		t.Run(tc.version, func(t *testing.T) {
 			rc := agent.DiscoveryOptions{Stdout: io.Discard, Stderr: io.Discard}
-			runtime := discoverWithCheck(t.Context(), rc, Declaration.Info, func(context.Context, string) (string, error) { return tc.version, tc.check })
+			runtime := discoverWithCheck(t.Context(), rc, Declaration.Info(), func(context.Context, string) (string, error) { return tc.version, tc.check })
 			info, available := runtime.Info, tc.check == nil
 			if (runtime.Executor != nil) != available || info.Capabilities.WorkspaceReadPreparation.IsSupported() {
 				t.Fatalf("factories: %+v", runtime)
@@ -27,28 +26,15 @@ func TestMCodeExecutionFollowsAvailability(t *testing.T) {
 			if info.Available != available || info.Capabilities.EnvironmentNone.IsSupported() != available || info.Capabilities.DurableInputReceipts.IsSupported() != available || info.Capabilities.SubagentObservations.IsSupported() != available {
 				t.Fatalf("capabilities=%+v", info.Capabilities)
 			}
-			if info.Capabilities.NativeSessionRecovery.IsSupported() || info.Capabilities.LocalEnvironment.IsSupported() || info.Capabilities.FunctionTools.IsSupported() {
+			if info.Capabilities.NativeSessionRecovery.IsSupported() || info.Capabilities.LocalEnvironment.IsSupported() {
 				t.Fatal("unqualified capability advertised")
 			}
 		})
 	}
 }
 
-// The declaration must retain the complete baseline capability descriptor.
-func TestDeclaredCapabilityBaseline(t *testing.T) {
-	expected := map[string]bool{"Streaming": true, "Resume": true}
-	value := reflect.ValueOf(Declaration.Info.Capabilities)
-	for i := 0; i < value.NumField(); i++ {
-		name := value.Type().Field(i).Name
-		want := proto.CapabilityUnsupported
-		if expected[name] {
-			want = proto.CapabilitySupported
-		}
-		if got := value.Field(i).Interface(); got != want {
-			t.Errorf("%s = %v, want %v", name, got, want)
-		}
-	}
-	if err := Declaration.Info.ValidateDeclaration(); err != nil {
-		t.Fatal(err)
-	}
+// Discovery narrows the declaration for the installed host and never widens it.
+func TestDiscoveryOnlyNarrowsDeclaration(t *testing.T) {
+	runtime := discoverWithCheck(t.Context(), agent.DiscoveryOptions{Stdout: io.Discard, Stderr: io.Discard}, Declaration.Info(), func(context.Context, string) (string, error) { return SupportedVersion, nil })
+	contracttest.RequireNarrowed(t, Declaration.Capabilities, runtime.Info.Capabilities)
 }
diff --git a/apps/daemon/internal/agent/mcode/discovery_workspace.go b/apps/daemon/internal/agent/mcode/discovery_workspace.go
index aa3461192..d8f60f021 100644
--- a/apps/daemon/internal/agent/mcode/discovery_workspace.go
+++ b/apps/daemon/internal/agent/mcode/discovery_workspace.go
@@ -15,7 +15,7 @@ import (
 
 func discoverWorkspace(parent context.Context, options agent.DiscoveryOptions, runtime *agent.Runtime) *WorkspaceConfig {
 	fail := func(err error) {
-		runtime.Info.Available = false
+		*runtime = *agent.Unavailable(runtime.Info)
 		fmt.Fprintf(options.Stderr, "oac-daemon: mcode workspace unavailable: %v\n", err)
 	}
 	binding, err := localworkspace.Load()
@@ -24,6 +24,7 @@ func discoverWorkspace(parent context.Context, options agent.DiscoveryOptions, r
 		return nil
 	}
 	if binding == nil {
+		narrowWorkspace(&runtime.Info.Capabilities, false)
 		return nil
 	}
 	node := os.Getenv("OAC_RUNTIME_MCODE_NODE")
@@ -50,7 +51,7 @@ func discoverWorkspace(parent context.Context, options agent.DiscoveryOptions, r
 		fail(err)
 		return nil
 	}
-	c, err := ConfigureLocal(binary, node, os.Getenv("OAC_RUNTIME_MCODE_WORKSPACE_BRIDGE"), options.RuntimeRoot, os.Getenv("OAC_RUNTIME_WORKSPACE"), binding.NetworkPolicy())
+	c, err := ConfigureLocal(binary, node, os.Getenv("OAC_RUNTIME_MCODE_COMPANION"), os.Getenv("OAC_RUNTIME_WORKSPACE"))
 	if err == nil {
 		err = CheckWorkspace(parent, c)
 	}
@@ -59,8 +60,14 @@ func discoverWorkspace(parent context.Context, options agent.DiscoveryOptions, r
 		return nil
 	}
 
-	caps := &runtime.Info.Capabilities
-	caps.EnvironmentNone = proto.CapabilityUnsupported
-	caps.LocalEnvironment, caps.WorkspaceReadPreparation = proto.CapabilitySupported, proto.CapabilitySupported
+	narrowWorkspace(&runtime.Info.Capabilities, true)
 	return &c
 }
+
+// narrowWorkspace keeps either the local workspace capabilities or environment:none.
+func narrowWorkspace(caps *proto.AgentKindCapabilities, local bool) {
+	agent.Narrow(&caps.EnvironmentNone, !local)
+	agent.Narrow(&caps.LocalEnvironment, local)
+	agent.Narrow(&caps.WorkspaceReadPreparation, local)
+	agent.Narrow(&caps.WorkspaceOutputExport, local)
+}
diff --git a/apps/daemon/internal/agent/mcode/environment_mcp.go b/apps/daemon/internal/agent/mcode/environment_mcp.go
index c675465c8..310d0cfc7 100644
--- a/apps/daemon/internal/agent/mcode/environment_mcp.go
+++ b/apps/daemon/internal/agent/mcode/environment_mcp.go
@@ -15,37 +15,38 @@ func runtimeMCP(req proto.PromptRequestPayload) ([]map[string]any, error) {
 	if err != nil {
 		return nil, err
 	}
-	var servers []map[string]any
+	servers := []map[string]any{}
 	for _, binding := range bindings {
-		if binding.ServerLabel == "oac_workspace" || binding.ConnectionOrigin != "environment" || binding.AllowedTools != nil || binding.Required {
-			return nil, fmt.Errorf("mcode: unsupported MCP binding")
-		}
 		if binding.Transport == "http" {
-			server, err := environmentHTTPMCP(binding)
+			server, err := httpMCP(binding)
 			if err != nil {
 				return nil, err
 			}
 			servers = append(servers, server)
-		} else {
+		} else if binding.Stdio != nil {
 			command, args := localworkspace.MCPStdioCommand(*binding.Stdio)
 			servers = append(servers, map[string]any{"name": binding.ServerLabel, "command": command, "args": args, "env": []map[string]string{}})
+		} else {
+			return nil, fmt.Errorf("mcode: public MCP stdio servers are unsupported")
 		}
 	}
 	return servers, nil
 }
 
 // ACP session servers remain in native memory; credentials never enter argv or
-// persisted native configuration. Custom headers are not qualified because the
-// pinned native HTTP client can forward them across redirect origins.
-func environmentHTTPMCP(item agent.MCPBinding) (map[string]any, error) {
+// persisted native configuration.
+func httpMCP(item agent.MCPBinding) (map[string]any, error) {
 	endpoint, err := url.Parse(item.ServerURL)
-	if err != nil || (endpoint.Scheme != "http" && endpoint.Scheme != "https") || endpoint.Hostname() == "" || endpoint.User != nil || endpoint.Fragment != "" || endpoint.RawQuery != "" || endpoint.ForceQuery || endpoint.Opaque != "" || len(item.HTTPHeaders) != 0 {
-		return nil, fmt.Errorf("mcode: unsupported environment HTTP MCP declaration")
+	if err != nil || (endpoint.Scheme != "http" && endpoint.Scheme != "https") || endpoint.Hostname() == "" || endpoint.User != nil || endpoint.Fragment != "" || endpoint.Opaque != "" {
+		return nil, fmt.Errorf("mcode: unsupported HTTP MCP declaration")
 	}
 	headers := []map[string]string{}
+	for name, value := range item.HTTPHeaders {
+		headers = append(headers, map[string]string{"name": name, "value": value})
+	}
 	if item.BearerToken != nil {
 		if endpoint.Scheme != "https" || !agent.ValidMCPHTTPBearerToken(*item.BearerToken) {
-			return nil, fmt.Errorf("mcode: unsupported environment MCP bearer credential")
+			return nil, fmt.Errorf("mcode: unsupported MCP bearer credential")
 		}
 		headers = append(headers, map[string]string{"name": "Authorization", "value": "Bearer " + *item.BearerToken})
 	}
diff --git a/apps/daemon/internal/agent/mcode/environment_mcp_test.go b/apps/daemon/internal/agent/mcode/environment_mcp_test.go
index dae9ac41f..677d6ced2 100644
--- a/apps/daemon/internal/agent/mcode/environment_mcp_test.go
+++ b/apps/daemon/internal/agent/mcode/environment_mcp_test.go
@@ -25,7 +25,6 @@ func TestEnvironmentMCPUsesFixedLauncherForNewAndLoadedSessions(t *testing.T) {
 	for _, resume := range []bool{false, true} {
 		t.Run(map[bool]string{false: "new", true: "load"}[resume], func(t *testing.T) {
 			c, req, record := workspaceFixture(t)
-			c.Network, req.LocalEnvironment.NetworkAccess = "enabled", "enabled"
 			req.LocalEnvironment.MCP = []proto.EnvironmentMCP{environmentMCPFixture()}
 			if resume {
 				req.AgentSessionID = "native-1"
@@ -50,15 +49,15 @@ func TestEnvironmentMCPUsesFixedLauncherForNewAndLoadedSessions(t *testing.T) {
 					Env           []map[string]string
 				} `json:"mcpServers"`
 			}
-			if json.Unmarshal(raw, &params) != nil || len(params.MCP) != 2 || params.MCP[0].Name != "oac_workspace" {
-				t.Fatal("environment MCP displaced workspace tools")
+			if json.Unmarshal(raw, &params) != nil || len(params.MCP) != 1 {
+				t.Fatal("native Session did not receive exactly the declared MCP server")
 			}
 			cwd, err := os.ReadFile(record + ".cwd")
 			workspace, pathErr := filepath.EvalSymlinks(req.LocalEnvironment.WorkspaceRoot)
 			if err != nil || pathErr != nil || string(cwd) != workspace || params.Cwd != req.LocalEnvironment.WorkspaceRoot {
 				t.Fatalf("native process and ACP Session must use the declared workspace: process=%q ACP=%q", cwd, params.Cwd)
 			}
-			server := params.MCP[1]
+			server := params.MCP[0]
 			executable, _ := os.Executable()
 			if server.Name != "proof.server" || server.Command != executable || server.Env == nil || len(server.Env) != 0 ||
 				!reflect.DeepEqual(server.Args, []string{"runtime-mcp-exec", "/private/runtime/capabilities", "plugins/fixture", "proof.server"}) {
@@ -72,17 +71,13 @@ func TestEnvironmentMCPUsesFixedLauncherForNewAndLoadedSessions(t *testing.T) {
 }
 
 func TestEnvironmentMCPRejectsUnqualifiedAuthorityBeforePreparation(t *testing.T) {
-	for _, name := range []string{"http-headers", "http-bearer-insecure", "http-bearer-missing", "restricted", "disabled", "duplicate", "reserved"} {
+	for _, name := range []string{"http-bearer-insecure", "http-bearer-missing", "duplicate"} {
 		t.Run(name, func(t *testing.T) {
 			c, req, _ := workspaceFixture(t)
-			c.Network, req.LocalEnvironment.NetworkAccess = "enabled", "enabled"
 			req.LocalEnvironment.MCP = []proto.EnvironmentMCP{environmentMCPFixture()}
 			switch name {
-			case "http-headers", "http-bearer-insecure", "http-bearer-missing":
+			case "http-bearer-insecure", "http-bearer-missing":
 				req.LocalEnvironment.MCP[0].Server = agentplugin.MCPServer{Name: "remote", Type: "http", URL: "https://example.invalid/mcp"}
-				if name == "http-headers" {
-					req.LocalEnvironment.MCP[0].Server.HTTPHeaders = map[string]string{"X-Private": "secret"}
-				}
 				if name == "http-bearer-missing" {
 					req.LocalEnvironment.MCP[0].Server.BearerTokenEnvVar = "SELECTED_TOKEN"
 				}
@@ -91,23 +86,23 @@ func TestEnvironmentMCPRejectsUnqualifiedAuthorityBeforePreparation(t *testing.T
 					token := "confidential-http-token"
 					req.LocalEnvironment.MCP[0].BearerToken = &token
 				}
-			case "restricted", "disabled":
-				c.Network, req.LocalEnvironment.NetworkAccess = name, name
 			case "duplicate":
 				req.LocalEnvironment.MCP = append(req.LocalEnvironment.MCP, environmentMCPFixture())
-			case "reserved":
-				req.LocalEnvironment.MCP[0].Server.Name = "oac_workspace"
 			}
-			if _, err := prepareWorkspaceOptions(testStateRoot(t), c, req); err == nil || strings.Contains(err.Error(), "confidential-http-token") {
+			root := t.TempDir()
+			_, err := NewExecutorFactory(root, &c)(context.Background(), req)
+			if err == nil || strings.Contains(err.Error(), "confidential-http-token") {
 				t.Fatal("unqualified declaration accepted or credential exposed")
 			}
+			if entries, _ := os.ReadDir(root); len(entries) != 0 {
+				t.Fatalf("native files written before MCP was rejected: %v", entries)
+			}
 		})
 	}
 }
 
 func TestEnvironmentMCPCancelSettlesPendingObservationBeforeDone(t *testing.T) {
 	c, req, _ := workspaceFixture(t)
-	c.Network, req.LocalEnvironment.NetworkAccess = "enabled", "enabled"
 	req.LocalEnvironment.MCP = []proto.EnvironmentMCP{environmentMCPFixture()}
 	script, err := os.ReadFile(c.Binary)
 	if err != nil {
@@ -182,7 +177,6 @@ func mcpRegistryEntry(server, segment, tool, toolSegment string) map[string]any
 func TestEnvironmentHTTPMCPUsesEphemeralACPConfiguration(t *testing.T) {
 	for _, authenticated := range []bool{false, true} {
 		c, req, record := workspaceFixture(t)
-		c.Network, req.LocalEnvironment.NetworkAccess = "enabled", "enabled"
 		item := proto.EnvironmentMCP{Server: agentplugin.MCPServer{Name: "remote", Type: "http", URL: "https://example.invalid/mcp"}}
 		const token = "private-mcp-canary"
 		if authenticated {
@@ -205,10 +199,10 @@ func TestEnvironmentHTTPMCPUsesEphemeralACPConfiguration(t *testing.T) {
 				Headers         []map[string]string
 			} `json:"mcpServers"`
 		}
-		if json.Unmarshal(raw, &params) != nil || len(params.MCP) != 2 {
-			t.Fatal("HTTP MCP displaced workspace tools")
+		if json.Unmarshal(raw, &params) != nil || len(params.MCP) != 1 {
+			t.Fatal("native Session did not receive exactly the declared MCP server")
 		}
-		server := params.MCP[1]
+		server := params.MCP[0]
 		if server.Name != "remote" || server.Type != "http" || server.URL != item.Server.URL || server.Headers == nil {
 			t.Fatal("invalid native HTTP projection")
 		}
@@ -220,28 +214,29 @@ func TestEnvironmentHTTPMCPUsesEphemeralACPConfiguration(t *testing.T) {
 			t.Fatal("anonymous MCP inherited credentials")
 		}
 		dataDir := resource.(*executor).opts.DataDir
-		for _, name := range []string{"config.yaml", "mcp.json", "workspace-profile.json"} {
-			body, err := os.ReadFile(filepath.Join(dataDir, name))
-			if err != nil && !os.IsNotExist(err) {
-				t.Fatal(err)
-			}
-			if strings.Contains(string(body), token) {
-				t.Fatal("MCP credential persisted in native configuration")
-			}
+		body, err := os.ReadFile(filepath.Join(dataDir, "config.yaml"))
+		if err != nil || strings.Contains(string(body), token) {
+			t.Fatal("MCP credential persisted in native configuration", err)
+		}
+		if _, err := os.Stat(filepath.Join(dataDir, "mcp.json")); !os.IsNotExist(err) {
+			t.Fatal("adapter wrote a native MCP file")
 		}
 	}
 }
 
 func TestPublicEnvironmentHTTPMCPKeepsCredentialTransient(t *testing.T) {
 	c, req, _ := workspaceFixture(t)
-	c.Network, req.LocalEnvironment.NetworkAccess = "enabled", "enabled"
 	token := "selected-public-vault-canary"
 	req.MCPHTTPServers = &[]proto.MCPHTTPServer{{ConnectionOrigin: "environment", ServerLabel: "remote", ServerURL: "https://example.test/mcp", BearerToken: &token}}
 	opts, err := prepareWorkspaceOptions(testStateRoot(t), c, req)
 	if err != nil {
 		t.Fatal(err)
 	}
-	raw, err := json.Marshal(opts.MCP)
+	servers, err := runtimeMCP(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, err := json.Marshal(servers)
 	if err != nil || !strings.Contains(string(raw), "Bearer "+token) {
 		t.Fatal("selected token not supplied to native ACP")
 	}
@@ -264,14 +259,31 @@ func TestPublicEnvironmentHTTPMCPKeepsCredentialTransient(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	empty := []string{}
-	(*req.MCPHTTPServers)[0].AllowedTools = &empty
-	if _, err := prepareWorkspaceOptions(testStateRoot(t), c, req); err == nil {
-		t.Fatal("empty allowlist silently treated as all")
+}
+
+func TestMCPHeadersReachACPHeaders(t *testing.T) {
+	req := testRequest(t)
+	req.MCPHTTPServers = &[]proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "fixture", ServerURL: "https://mcp.example/mcp", Headers: map[string]string{"X-Tenant": "a"}}}
+	servers, err := runtimeMCP(req)
+	want := []map[string]string{{"name": "X-Tenant", "value": "a"}}
+	if err != nil || len(servers) != 1 || !reflect.DeepEqual(servers[0]["headers"], want) {
+		t.Fatalf("MCP = %v, %v", servers, err)
+	}
+}
+
+func TestServiceOriginMCPOnNonePlacement(t *testing.T) {
+	req := testRequest(t)
+	req.MCPHTTPServers = &[]proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "fixture", ServerURL: "https://mcp.example/mcp"}}
+	servers, err := runtimeMCP(req)
+	want := []map[string]any{{"name": "fixture", "type": "http", "url": "https://mcp.example/mcp", "headers": []map[string]string{}}}
+	if err != nil || !reflect.DeepEqual(servers, want) {
+		t.Fatalf("MCP = %v, %v", servers, err)
 	}
-	(*req.MCPHTTPServers)[0].AllowedTools = nil
-	(*req.MCPHTTPServers)[0].Required = true
-	if _, err := prepareWorkspaceOptions(testStateRoot(t), c, req); err == nil {
-		t.Fatal("required initialization silently ignored")
+}
+
+func TestPublicMCPStdioIsRejected(t *testing.T) {
+	servers := []proto.MCPHTTPServer{{ConnectionOrigin: "environment", ServerLabel: "local", Stdio: &proto.MCPStdio{Command: "run", Cwd: "/work"}}}
+	if _, err := runtimeMCP(proto.PromptRequestPayload{LocalEnvironment: &proto.LocalEnvironment{}, MCPHTTPServers: &servers}); err == nil {
+		t.Fatal("native starts session stdio servers outside the declared cwd")
 	}
 }
diff --git a/apps/daemon/internal/agent/mcode/events.go b/apps/daemon/internal/agent/mcode/events.go
index a41789fd1..f9c562e01 100644
--- a/apps/daemon/internal/agent/mcode/events.go
+++ b/apps/daemon/internal/agent/mcode/events.go
@@ -37,18 +37,22 @@ func (s *Session) handle(frame rpcFrame) error {
 	s.mu.Lock()
 	s.steeringReady = true
 	s.mu.Unlock()
+	var chunk struct {
+		Type string `json:"type"`
+		Text string `json:"text"`
+	}
+	if kind := event.Update.Kind; kind == "agent_message_chunk" && json.Unmarshal(event.Update.Content, &chunk) != nil {
+		return fmt.Errorf("mcode: invalid session update")
+	}
 	switch event.Update.Kind {
 	case "agent_message_chunk":
-		if event.Update.Content.Type != "text" {
+		if chunk.Type != "text" {
 			return fmt.Errorf("mcode: unsupported response content")
 		}
-		text := event.Update.Content.Text
+		text := chunk.Text
 		s.content.WriteString(text)
 		s.sequence++
 		s.emit(proto.TypeDelta, proto.DeltaPayload{Delta: text, Sequence: s.sequence})
-	case "agent_thought_chunk":
-		s.sequence++
-		s.emit(proto.TypeThinking, proto.ThinkingPayload{Text: event.Update.Content.Text, Sequence: s.sequence})
 	case "tool_call", "tool_call_update":
 		return s.emitTool(event.Update.toolUpdate)
 	}
@@ -75,12 +79,12 @@ func (s *Session) emitTool(update toolUpdate) error {
 	}
 	if update.mcp == nil {
 		var err error
-		update.mcp, err = s.environmentMCPIdentity(update.Name)
+		update.mcp, err = s.mcpIdentity(update.Name)
 		if err != nil {
 			return err
 		}
 	}
-	if previous.mcp == nil && workspaceToolObservation(previous, "before") == nil {
+	if previous.mcp == nil && s.nativeToolObservation(previous, "before") == nil {
 		if err := s.emitToolStage(update, "before"); err != nil {
 			return err
 		}
diff --git a/apps/daemon/internal/agent/mcode/execution.go b/apps/daemon/internal/agent/mcode/execution.go
index e35d927a2..729d0a3d8 100644
--- a/apps/daemon/internal/agent/mcode/execution.go
+++ b/apps/daemon/internal/agent/mcode/execution.go
@@ -3,17 +3,22 @@ package mcode
 import (
 	"fmt"
 	"os"
+	"strings"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	declaration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/mcode"
 )
 
 func validateExecutionRequest(req proto.PromptRequestPayload) error {
-	if !req.DisableExecutionEnvironment || req.AgentStateKey == "" || req.LocalEnvironment != nil || req.RequireExistingNativeSession || len(req.FunctionTools) != 0 || (req.MCPHTTPServers != nil && len(*req.MCPHTTPServers) != 0) {
+	if !req.DisableExecutionEnvironment || req.AgentStateKey == "" || req.LocalEnvironment != nil || req.RequireExistingNativeSession {
 		return fmt.Errorf("mcode: unsupported execution configuration")
 	}
-	if req.ExecutionControls == nil || req.ExecutionControls.OutputFormat != nil || req.ExecutionControls.WebSearch != "disabled" || (req.ExecutionControls.TextVerbosity != "" && req.ExecutionControls.TextVerbosity != "medium") {
+	if req.ExecutionControls == nil || req.ExecutionControls.OutputFormat != nil {
 		return fmt.Errorf("mcode: unsupported execution controls")
 	}
+	if err := declaration.Declaration.ValidateExecutionControls(req.ExecutionControls); err != nil {
+		return err
+	}
 	if !req.DisableSubagents {
 		if req.MaxConcurrentSubagents == nil || *req.MaxConcurrentSubagents < 1 {
 			return fmt.Errorf("mcode: Subagent concurrency limit is required")
@@ -25,20 +30,16 @@ func validateExecutionRequest(req proto.PromptRequestPayload) error {
 	return nil
 }
 
-func configureTextExecution(config map[string]any) {
-	config["agents"] = map[string]any{"default": map[string]any{
-		"tools": []string{}, "builtinTools": []string{}, "skills": []string{},
-		"features": map[string]bool{"mavis": false, "delegation": false, "webSearch": false},
-	}}
-	config["askUser"] = map[string]bool{"enabled": false}
-	config["beta"] = map[string]bool{"browserUseTooling": false, "mcodeTools": false, "threadGoal": false}
-}
-
 // Harness children use the daemon user's ordinary environment.
 func executionEnvironment() []string { return os.Environ() }
 
-// ACP commands are only recognized for a single text block. A second, empty
-// block keeps public input as user text.
+// ACP joins text blocks with "\n\n" and parses slash commands only from a
+// single block. A second, empty block keeps input that starts with "/" as user
+// text; any other input is sent as one block so the model sees it unchanged.
 func promptContent(text string) []map[string]string {
-	return []map[string]string{{"type": "text", "text": text}, {"type": "text", "text": ""}}
+	content := []map[string]string{{"type": "text", "text": text}}
+	if strings.HasPrefix(text, "/") {
+		content = append(content, map[string]string{"type": "text", "text": ""})
+	}
+	return content
 }
diff --git a/apps/daemon/internal/agent/mcode/execution_test.go b/apps/daemon/internal/agent/mcode/execution_test.go
index afa6b0ad1..df1b2841b 100644
--- a/apps/daemon/internal/agent/mcode/execution_test.go
+++ b/apps/daemon/internal/agent/mcode/execution_test.go
@@ -14,7 +14,7 @@ func TestExecutionOptionsInheritUserEnvironment(t *testing.T) {
 	r := testRequest(t)
 	t.Setenv("OAC_TEST_SECRET_CANARY", "secret")
 	t.Setenv("NODE_OPTIONS", "--import=untrusted")
-	opts, err := prepareOptions(testStateRoot(t), r)
+	opts, err := prepareOptions(testStateRoot(t), r, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -43,21 +43,22 @@ func TestExecutionRejectsUnqualifiedAuthority(t *testing.T) {
 		func(r *proto.PromptRequestPayload) { r.DisableExecutionEnvironment = false },
 		func(r *proto.PromptRequestPayload) { r.DisableSubagents = false },
 		func(r *proto.PromptRequestPayload) { r.RequireExistingNativeSession = true },
-		func(r *proto.PromptRequestPayload) { r.FunctionTools = []proto.FunctionTool{{Name: "f"}} },
-		func(r *proto.PromptRequestPayload) { r.ExecutionControls.WebSearch = "enabled" },
+		func(r *proto.PromptRequestPayload) {
+			r.ExecutionControls.WebSearch = &proto.WebSearchControl{Mode: "live", ContextSize: "medium"}
+		},
 	} {
 		r := testRequest(t)
 		change(&r)
-		if _, err := prepareOptions(testStateRoot(t), r); err == nil {
+		if _, err := prepareOptions(testStateRoot(t), r, nil); err == nil {
 			t.Fatal("unsupported execution accepted")
 		}
 	}
 }
 
 func TestPublicTextDoesNotInvokeACPCommands(t *testing.T) {
-	for _, text := range []string{"/model", "/compact", "hello"} {
+	for text, want := range map[string]int{"/model": 2, "/compact": 2, "hello": 1} {
 		blocks := promptContent(text)
-		if len(blocks) != 2 || blocks[0]["text"] != text || blocks[1]["text"] != "" {
+		if len(blocks) != want || blocks[0]["text"] != text || (want == 2 && blocks[1]["text"] != "") {
 			t.Fatal(blocks)
 		}
 	}
diff --git a/apps/daemon/internal/agent/mcode/executor.go b/apps/daemon/internal/agent/mcode/executor.go
index 0ea08bf3b..9853f9d5a 100644
--- a/apps/daemon/internal/agent/mcode/executor.go
+++ b/apps/daemon/internal/agent/mcode/executor.go
@@ -4,12 +4,14 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	declaration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/mcode"
 )
 
 var errTurnCancelled = errors.New("mcode: Turn cancelled before submission")
@@ -32,7 +34,6 @@ func NewExecutorFactory(runtimeRoot string, config *WorkspaceConfig) agent.Execu
 	var frozen *WorkspaceConfig
 	if config != nil {
 		value := *config
-		value.AllowedDomains = append([]string(nil), config.AllowedDomains...)
 		frozen = &value
 	}
 	return func(ctx context.Context, req proto.PromptRequestPayload) (agent.Executor, error) {
@@ -42,11 +43,15 @@ func NewExecutorFactory(runtimeRoot string, config *WorkspaceConfig) agent.Execu
 		if req.RunID != "" || len(req.Input) != 0 {
 			return nil, fmt.Errorf("mcode: Executor configuration cannot contain Turn input")
 		}
-		var err error
+		// MCP is checked before any native file is written.
+		mcp, err := runtimeMCP(req)
+		if err != nil {
+			return nil, err
+		}
 		var opts launchOptions
 		binary := defaultBinary()
 		if frozen == nil {
-			opts, err = prepareOptions(runtimeRoot, req)
+			opts, err = prepareOptions(runtimeRoot, req, nil)
 		} else {
 			binary = frozen.Binary
 			opts, err = prepareWorkspaceOptions(runtimeRoot, *frozen, req)
@@ -54,6 +59,16 @@ func NewExecutorFactory(runtimeRoot string, config *WorkspaceConfig) agent.Execu
 		if err != nil {
 			return nil, err
 		}
+		opts.MCP = mcp
+		if len(req.FunctionTools) > 0 && slices.ContainsFunc(mcp, func(server map[string]any) bool { return server["name"] == declaration.FunctionServerLabel }) {
+			return nil, fmt.Errorf("mcode: a Plugin MCP server uses the reserved label %s", declaration.FunctionServerLabel)
+		}
+		if opts.Functions, err = serveFunctions(req.FunctionTools); err != nil {
+			return nil, err
+		}
+		if opts.Functions != nil {
+			opts.MCP = append(opts.MCP, opts.Functions.mcpServer())
+		}
 		resource, err := newExecutor(ctx, req, opts, binary)
 		if resource == nil {
 			return nil, err
@@ -65,9 +80,13 @@ func NewExecutorFactory(runtimeRoot string, config *WorkspaceConfig) agent.Execu
 func newExecutor(ctx context.Context, req proto.PromptRequestPayload, opts launchOptions, binary string) (*executor, error) {
 	bootstrap, err := launch(ctx, req, opts, binary)
 	if err != nil {
+		opts.Functions.close()
 		return nil, err
 	}
 	e := &executor{connection: bootstrap.connection, req: req, opts: opts}
+	if opts.Functions != nil {
+		opts.Functions.owner.Store(e)
+	}
 	err = bootstrap.prepareNative()
 	e.connection.setCurrent(nil)
 	close(bootstrap.finished)
@@ -160,6 +179,7 @@ func (e *executor) Close(ctx context.Context) error {
 	}
 	e.connection.process.Cancel()
 	e.mu.Unlock()
+	e.opts.Functions.close()
 	select {
 	case <-e.connection.exited:
 	case <-ctx.Done():
diff --git a/apps/daemon/internal/agent/mcode/executor_backpressure_test.go b/apps/daemon/internal/agent/mcode/executor_backpressure_test.go
index 4651d46db..00bddf925 100644
--- a/apps/daemon/internal/agent/mcode/executor_backpressure_test.go
+++ b/apps/daemon/internal/agent/mcode/executor_backpressure_test.go
@@ -78,7 +78,7 @@ func TestExecutorUnknownSteeringOutcomeCannotBecomeAppliedCancellation(t *testin
 		t.Fatal("native prompt did not start")
 	}
 	session := turn.(*Session)
-	if err := session.Steer(ctx, proto.PromptSteerPayload{InputID: "input-unknown", Input: proto.TextInput("continue")}); err == nil {
+	if err := session.SteerWithReceipt(ctx, proto.PromptSteerPayload{InputID: "input-unknown", Input: proto.TextInput("continue")}, func() {}); err == nil {
 		t.Fatal("unknown native receipt was accepted")
 	}
 	if err := turn.Cancel(ctx); err == nil {
diff --git a/apps/daemon/internal/agent/mcode/executor_test.go b/apps/daemon/internal/agent/mcode/executor_test.go
index d9936a712..c304d5bf4 100644
--- a/apps/daemon/internal/agent/mcode/executor_test.go
+++ b/apps/daemon/internal/agent/mcode/executor_test.go
@@ -18,7 +18,7 @@ func workspaceFixture(t *testing.T) (WorkspaceConfig, proto.PromptRequestPayload
 	r := testRequest(t)
 	r.RunID, r.Input = "", nil
 	r.DisableExecutionEnvironment = false
-	r.LocalEnvironment = &proto.LocalEnvironment{ID: "environment", NetworkAccess: "enabled", WorkspaceRoot: t.TempDir()}
+	r.LocalEnvironment = &proto.LocalEnvironment{ID: "environment", WorkspaceRoot: t.TempDir()}
 	record := filepath.Join(t.TempDir(), "calls")
 	exe, err := os.Executable()
 	if err != nil {
@@ -30,7 +30,7 @@ func workspaceFixture(t *testing.T) (WorkspaceConfig, proto.PromptRequestPayload
 	if err := os.WriteFile(binary, []byte(script), 0700); err != nil {
 		t.Fatal(err)
 	}
-	return WorkspaceConfig{Binary: binary, Node: "/usr/bin/node", Bridge: "/opt/bridge.mjs", Directory: r.LocalEnvironment.WorkspaceRoot, Network: "enabled", Scratch: t.TempDir()}, r, record
+	return WorkspaceConfig{Binary: binary, Node: "/usr/bin/node", Companion: "/opt/mcode-harness", Directory: r.LocalEnvironment.WorkspaceRoot}, r, record
 }
 
 func executorFixture(t *testing.T, scenario string, workspace bool) (*executor, string) {
@@ -143,15 +143,15 @@ func TestExecutorCancellationRetiresOwnerAndLateCancelCannotRetarget(t *testing.
 			if !disabled {
 				// A terminal native history record still cannot prove Bash cleanup.
 				dir := t.TempDir()
-				node, bridge := filepath.Join(dir, "node"), filepath.Join(dir, "bridge.mjs")
+				node := filepath.Join(dir, "node")
 				body := "#!/bin/sh\nprintf '%s\\n' '{\"version\":1,\"complete\":true,\"rootSessionId\":\"native-1\",\"sessions\":[{\"id\":\"native-1\",\"turns\":[{\"id\":\"root-turn\",\"status\":\"aborted\"}]}]}'\n"
-				for name, data := range map[string]string{node: body, bridge: "", filepath.Join(dir, "subagent-snapshot.mjs"): ""} {
+				for name, data := range map[string]string{node: body, filepath.Join(dir, "subagent-snapshot.mjs"): ""} {
 					if err := os.WriteFile(name, []byte(data), 0700); err != nil {
 						t.Fatal(err)
 					}
 				}
 				t.Setenv("OAC_RUNTIME_MCODE_NODE", node)
-				t.Setenv("OAC_RUNTIME_MCODE_WORKSPACE_BRIDGE", bridge)
+				t.Setenv("OAC_RUNTIME_MCODE_COMPANION", dir)
 			}
 			out := make(chan proto.Envelope, 32)
 			second, err := e.StartTurn(t.Context(), "second", proto.TextInput("wait"), out)
diff --git a/apps/daemon/internal/agent/mcode/executor_turn.go b/apps/daemon/internal/agent/mcode/executor_turn.go
index dc24cd17a..a34e18d5a 100644
--- a/apps/daemon/internal/agent/mcode/executor_turn.go
+++ b/apps/daemon/internal/agent/mcode/executor_turn.go
@@ -34,6 +34,7 @@ func (s *Session) runExecutorTurn(prompt string) {
 	if len(s.tools) > 0 {
 		reusable = false
 	}
+	s.stopFunctions()
 	s.finishEnvironmentMCP()
 	s.mu.Lock()
 	// ACP and native history cancellation do not prove detached tool cleanup.
@@ -121,6 +122,7 @@ func (s *Session) Cancel(ctx context.Context) error {
 	// context. After native settlement, cancellation retires and drains the owner.
 	s.outputCancel()
 	e.mu.Unlock()
+	s.stopFunctions()
 	var err error
 	if first {
 		raw, _ := json.Marshal(map[string]string{"sessionId": s.sessionID})
diff --git a/apps/daemon/internal/agent/mcode/functions.go b/apps/daemon/internal/agent/mcode/functions.go
new file mode 100644
index 000000000..32e88391d
--- /dev/null
+++ b/apps/daemon/internal/agent/mcode/functions.go
@@ -0,0 +1,260 @@
+package mcode
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/json"
+	"errors"
+	"net"
+	"net/http"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	declaration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/mcode"
+)
+
+// functionServer serves the Session's public functions as native MCP tools. It
+// listens on loopback only and requires a per-Session bearer token, so only the
+// native process that received the ACP server entry can call it.
+type functionServer struct {
+	token string
+	url   string
+	http  *http.Server
+	done  chan struct{}
+	owner atomic.Pointer[executor]
+}
+
+func serveFunctions(tools []proto.FunctionTool) (*functionServer, error) {
+	if len(tools) == 0 {
+		return nil, nil
+	}
+	f := &functionServer{token: rand.Text(), done: make(chan struct{})}
+	server, err := f.newServer(tools)
+	if err != nil {
+		return nil, err
+	}
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return nil, err
+	}
+	f.url = "http://" + listener.Addr().String() + "/mcp"
+	handler := mcp.NewStreamableHTTPHandler(func(*http.Request) *mcp.Server { return server }, &mcp.StreamableHTTPOptions{Stateless: true, JSONResponse: true})
+	want := []byte("Bearer " + f.token)
+	f.http = &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if subtle.ConstantTimeCompare([]byte(r.Header.Get("Authorization")), want) != 1 {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		handler.ServeHTTP(w, r)
+	})}
+	go func() {
+		defer close(f.done)
+		_ = f.http.Serve(listener)
+	}()
+	return f, nil
+}
+
+// newServer registers the tools before any listener exists. AddTool panics on a
+// schema it rejects, which becomes an error here.
+func (f *functionServer) newServer(tools []proto.FunctionTool) (server *mcp.Server, err error) {
+	defer func() {
+		if recover() != nil {
+			server, err = nil, errors.New("mcode: the MCP server rejected a function schema")
+		}
+	}()
+	server = mcp.NewServer(&mcp.Implementation{Name: declaration.FunctionServerLabel, Version: "1"}, nil)
+	for _, tool := range tools {
+		server.AddTool(&mcp.Tool{Name: tool.Name, Description: tool.Description, InputSchema: tool.Parameters}, f.call)
+	}
+	return server, nil
+}
+
+// mcpServer is the ACP mcpServers entry; the token stays in transient ACP headers.
+func (f *functionServer) mcpServer() map[string]any {
+	return map[string]any{"name": declaration.FunctionServerLabel, "type": "http", "url": f.url,
+		"headers": []map[string]string{{"name": "Authorization", "value": "Bearer " + f.token}}}
+}
+
+// close stops the listener and every connection, then waits for the serving goroutine.
+func (f *functionServer) close() {
+	if f == nil {
+		return
+	}
+	_ = f.http.Close()
+	<-f.done
+}
+
+// call runs on the HTTP handler goroutine; the active Turn owns the call.
+func (f *functionServer) call(ctx context.Context, req *mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	e := f.owner.Load()
+	if e == nil {
+		return nil, agent.ErrUnknownFunctionCall
+	}
+	e.mu.Lock()
+	s := e.active
+	e.mu.Unlock()
+	if s == nil {
+		return nil, agent.ErrUnknownFunctionCall
+	}
+	return s.callFunction(ctx, req.Params.Name, req.Params.Arguments)
+}
+
+type pendingFunction struct {
+	call proto.FunctionCallPayload
+	// settled closes when the result is delivered or the call is released; a nil result means released.
+	settled chan struct{}
+	receipt chan error
+	result  *proto.FunctionResultPayload
+	content []mcp.Content
+}
+
+// functionCalls is one Turn's pending calls. emit holds the lock so a stopped
+// Turn never writes to its closed output.
+type functionCalls struct {
+	mu      sync.Mutex
+	pending map[string]*pendingFunction
+	stopped chan struct{}
+	closed  bool
+}
+
+// functionCallMeta is the CallToolResult _meta key that native echoes in its tool update.
+const functionCallMeta = "oac_call_id"
+
+func (s *Session) callFunction(ctx context.Context, name string, arguments json.RawMessage) (*mcp.CallToolResult, error) {
+	id := "call_" + rand.Text()
+	p := &pendingFunction{call: proto.FunctionCallPayload{CallID: id, Name: name, Arguments: arguments}, settled: make(chan struct{}), receipt: make(chan error, 1)}
+	s.functions.mu.Lock()
+	if s.functions.closed {
+		s.functions.mu.Unlock()
+		return nil, agent.ErrUnknownFunctionCall
+	}
+	s.functions.pending[id] = p
+	s.emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: name, Stage: "before", Observation: &proto.ToolObservation{Kind: "function", Status: "in_progress", Name: name, Arguments: arguments}})
+	s.emit(proto.TypeFunctionCall, p.call)
+	s.functions.mu.Unlock()
+	select {
+	case <-p.settled:
+		if p.result == nil {
+			return nil, agent.ErrUnknownFunctionCall
+		}
+		return &mcp.CallToolResult{Content: p.content, IsError: !p.result.Success, Meta: mcp.Meta{functionCallMeta: id}}, nil
+	case <-s.functions.stopped:
+		return nil, agent.ErrUnknownFunctionCall
+	case <-ctx.Done():
+		s.functions.mu.Lock()
+		s.release(p)
+		s.functions.mu.Unlock()
+		return nil, ctx.Err()
+	}
+}
+
+// release drops a call that native ended without confirming its result,
+// withdraws it from a live Turn and unblocks its waiter. The caller holds
+// s.functions.mu.
+func (s *Session) release(p *pendingFunction) {
+	if s.functions.pending[p.call.CallID] != p {
+		return
+	}
+	delete(s.functions.pending, p.call.CallID)
+	if !s.functions.closed {
+		s.emit(proto.TypeFunctionCallWithdrawn, proto.FunctionCallWithdrawnPayload{CallID: p.call.CallID})
+	}
+	if p.result == nil {
+		close(p.settled)
+	}
+	p.receipt <- agent.ErrUnknownFunctionCall
+}
+
+func (s *Session) SubmitFunctionResult(ctx context.Context, result proto.FunctionResultPayload) error {
+	if err := result.ValidateContent(); err != nil {
+		return err
+	}
+	content := make([]mcp.Content, 0, len(result.Content))
+	for _, part := range result.Content {
+		if part.Text == nil {
+			return errors.New("mcode: function result images are not supported")
+		}
+		content = append(content, &mcp.TextContent{Text: *part.Text})
+	}
+	s.functions.mu.Lock()
+	p := s.functions.pending[result.CallID]
+	if s.functions.closed || p == nil || p.result != nil {
+		s.functions.mu.Unlock()
+		return agent.ErrUnknownFunctionCall
+	}
+	p.result, p.content = &result, content
+	close(p.settled)
+	s.functions.mu.Unlock()
+	// The receive loop calls this inline, so the wait is bounded.
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	select {
+	case err := <-p.receipt:
+		return err
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+// confirmFunction applies a terminal native update for a function tool. Native
+// echoes the returned result, with the call ID in its _meta, only when it
+// received one; any other end means native gave up on the call, such as its
+// 120 s timeout.
+// Native runs MCP tools one at a time, so at most one call is in flight.
+func (s *Session) confirmFunction(update toolUpdate) {
+	s.functions.mu.Lock()
+	defer s.functions.mu.Unlock()
+	var echo struct {
+		Details struct {
+			MCP struct {
+				Meta map[string]any `json:"_meta"`
+			} `json:"mcp"`
+		} `json:"details"`
+	}
+	raw, _ := json.Marshal(update.RawOutput)
+	_ = json.Unmarshal(raw, &echo)
+	id, _ := echo.Details.MCP.Meta[functionCallMeta].(string)
+	p := s.functions.pending[id]
+	if p == nil {
+		for _, q := range s.functions.pending {
+			if q.call.Name == update.mcp.tool {
+				p = q
+			}
+		}
+	}
+	if p == nil {
+		return
+	}
+	if id != p.call.CallID || p.result == nil {
+		s.release(p)
+		return
+	}
+	delete(s.functions.pending, id)
+	status := "completed"
+	if update.Status != "completed" || !p.result.Success {
+		status = "failed"
+	}
+	s.emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: p.call.Name, Stage: "after", Observation: &proto.ToolObservation{Kind: "function", Status: status, Name: p.call.Name, Arguments: p.call.Arguments, Content: &p.result.Content}})
+	p.receipt <- nil
+}
+
+// stopFunctions ends the Turn's calls: native gets an error for each pending
+// call and each unconfirmed submission fails.
+func (s *Session) stopFunctions() {
+	s.functions.mu.Lock()
+	defer s.functions.mu.Unlock()
+	if s.functions.closed {
+		return
+	}
+	s.functions.closed = true
+	close(s.functions.stopped)
+	for _, p := range s.functions.pending {
+		s.release(p)
+	}
+}
diff --git a/apps/daemon/internal/agent/mcode/functions_native_test.go b/apps/daemon/internal/agent/mcode/functions_native_test.go
new file mode 100644
index 000000000..aa8cbaafb
--- /dev/null
+++ b/apps/daemon/internal/agent/mcode/functions_native_test.go
@@ -0,0 +1,78 @@
+package mcode
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+)
+
+// This opt-in test makes real model calls: the model calls a public function,
+// native receives the submitted result, and the Turn finishes with it.
+func TestNativeMCodePublicFunction(t *testing.T) {
+	binary, options := os.Getenv("OAC_RUNTIME_MCODE_BIN"), os.Getenv("OAC_TEST_MCODE_REAL_OPTIONS")
+	if binary == "" || options == "" {
+		t.Skip("native executable and private provider options required")
+	}
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Minute)
+	defer cancel()
+	raw, err := os.ReadFile(options)
+	if err != nil {
+		t.Fatal("private provider options unavailable")
+	}
+	req := testRequest(t)
+	req.RunID, req.Input = "", nil
+	if json.Unmarshal(raw, &req.AgentOptions) != nil {
+		t.Fatal("invalid private provider options")
+	}
+	req.FunctionTools = []proto.FunctionTool{{Name: "lookup_code", Description: "Returns the secret access code. Always call it when asked for the access code.", Parameters: json.RawMessage(`{"type":"object","properties":{}}`)}}
+	e, err := prepareExecutor(t, ctx, req)
+	if err != nil {
+		t.Fatal("native Executor preparation failed")
+	}
+	out := make(chan proto.Envelope, 256)
+	turn, err := e.StartTurn(ctx, "turn", proto.TextInput("Call the lookup_code function to get the access code, then reply with only the code."), out)
+	if err != nil {
+		t.Fatal("native Turn admission failed")
+	}
+	var content string
+	submitted, confirmed := make(chan error, 1), false
+	for event := range out {
+		switch event.Type {
+		case proto.TypeError:
+			t.Fatalf("native Turn reported an error: %s", event.Payload)
+		case proto.TypeFunctionCall:
+			var call proto.FunctionCallPayload
+			_ = json.Unmarshal(event.Payload, &call)
+			text := "ACCESS-CODE-4417"
+			go func() {
+				submitted <- turn.(*Session).SubmitFunctionResult(ctx, proto.FunctionResultPayload{DeliveryID: "delivery", CallID: call.CallID, Success: true, Content: []proto.InputContent{{Type: "input_text", Text: &text}}})
+			}()
+		case proto.TypeToolCall:
+			var call proto.ToolCallPayload
+			confirmed = confirmed || (json.Unmarshal(event.Payload, &call) == nil && call.Stage == "after" && call.Observation != nil && call.Observation.Kind == "function" && call.Observation.Status == "completed")
+		case proto.TypeDone:
+			var done proto.DonePayload
+			_ = json.Unmarshal(event.Payload, &done)
+			content = done.Content
+		}
+	}
+	if _, err := turn.AwaitSettlement(ctx); err != nil {
+		t.Fatal("native Turn did not settle")
+	}
+	select {
+	case err := <-submitted:
+		if err != nil {
+			t.Fatal("function result was not applied:", err)
+		}
+	default:
+		t.Fatal("the model never called the function")
+	}
+	if !confirmed || !strings.Contains(content, "ACCESS-CODE-4417") {
+		t.Fatalf("confirmed=%v content=%q", confirmed, content)
+	}
+}
diff --git a/apps/daemon/internal/agent/mcode/functions_test.go b/apps/daemon/internal/agent/mcode/functions_test.go
new file mode 100644
index 000000000..325455cc5
--- /dev/null
+++ b/apps/daemon/internal/agent/mcode/functions_test.go
@@ -0,0 +1,260 @@
+package mcode
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+)
+
+type bearerTransport struct{ header string }
+
+func (b bearerTransport) RoundTrip(r *http.Request) (*http.Response, error) {
+	r = r.Clone(r.Context())
+	r.Header.Set("Authorization", b.header)
+	return http.DefaultTransport.RoundTrip(r)
+}
+
+// fakeFunctionTurn is the native side of a public function call: it reads the
+// ACP Session's functions server, calls the tool and records what native got.
+func fakeFunctionTurn(params json.RawMessage, update func(string, map[string]any), send func(any), promptID json.RawMessage) {
+	var session struct {
+		MCP []struct {
+			Name    string `json:"name"`
+			URL     string `json:"url"`
+			Headers []struct{ Name, Value string }
+		} `json:"mcpServers"`
+	}
+	if json.Unmarshal(params, &session) != nil || len(session.MCP) != 1 || session.MCP[0].Name != "functions" || writeMCPRegistry(os.Getenv("MINIMAX_DATA_DIR"), mcpRegistryEntry("functions", "functions", "lookup", "lookup")) != nil {
+		os.Exit(20)
+	}
+	server := session.MCP[0]
+	update("tool_call", map[string]any{"toolCallId": "t1", "name": "mcp__functions__lookup", "status": "in_progress", "rawInput": map[string]any{"q": "x"}})
+	client := mcp.NewClient(&mcp.Implementation{Name: "fake", Version: "1"}, nil)
+	connection, err := client.Connect(context.Background(), &mcp.StreamableClientTransport{Endpoint: server.URL, HTTPClient: &http.Client{Transport: bearerTransport{server.Headers[0].Value}}}, nil)
+	if err != nil {
+		os.Exit(21)
+	}
+	result, err := connection.CallTool(context.Background(), &mcp.CallToolParams{Name: "lookup", Arguments: map[string]any{"q": "x"}})
+	text := "error"
+	if err == nil {
+		text = result.Content[0].(*mcp.TextContent).Text
+	}
+	if os.WriteFile(os.Getenv("OAC_TEST_FN_RESULT"), []byte(text), 0600) != nil {
+		return
+	}
+	update("tool_call_update", map[string]any{"toolCallId": "t1", "status": "completed", "rawOutput": map[string]any{"details": map[string]any{"mcp": result}}})
+	raw, _ := json.Marshal(map[string]string{"stopReason": "end_turn"})
+	send(rpcFrame{JSONRPC: "2.0", ID: promptID, Result: raw})
+}
+
+func functionTurn(t *testing.T, scenario string) (*Session, <-chan proto.Envelope, string) {
+	t.Helper()
+	req := helperRequest(t, scenario, false)
+	req.FunctionTools = []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{"type":"object"}`)}}
+	record := t.TempDir() + "/result"
+	t.Setenv("OAC_TEST_FN_RESULT", record)
+	out := make(chan proto.Envelope, 32)
+	session, err := startTurn(t, t.Context(), req, out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return session, out, record
+}
+func waitFunctionCall(t *testing.T, out <-chan proto.Envelope) proto.FunctionCallPayload {
+	t.Helper()
+	for event := range out {
+		if event.Type == proto.TypeFunctionCall {
+			var call proto.FunctionCallPayload
+			_ = json.Unmarshal(event.Payload, &call)
+			return call
+		}
+	}
+	t.Fatal("no function call")
+	return proto.FunctionCallPayload{}
+}
+
+// Native calls the served tool, blocks until the result arrives, receives it,
+// and the receipt is confirmed by the native tool result.
+func TestFunctionCallRoundTrip(t *testing.T) {
+	session, out, record := functionTurn(t, "functions")
+	call := waitFunctionCall(t, out)
+	if call.Name != "lookup" || string(call.Arguments) != `{"q":"x"}` {
+		t.Fatalf("call = %+v", call)
+	}
+	functions := session.executor.opts.Functions
+	if response, err := http.Post(functions.url, "application/json", strings.NewReader("{}")); err != nil || response.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("unauthenticated request: %v", err)
+	}
+	text := "answer"
+	if err := session.SubmitFunctionResult(t.Context(), proto.FunctionResultPayload{DeliveryID: "d", CallID: call.CallID, Success: true, Content: []proto.InputContent{{Type: "input_text", Text: &text}}}); err != nil {
+		t.Fatal(err)
+	}
+	if got, _ := os.ReadFile(record); string(got) != "answer" {
+		t.Fatalf("native received %q", got)
+	}
+	confirmed := false
+	for event := range out {
+		var payload proto.ToolCallPayload
+		if event.Type == proto.TypeError {
+			t.Fatalf("error: %s", event.Payload)
+		}
+		if event.Type == proto.TypeToolCall && json.Unmarshal(event.Payload, &payload) == nil && payload.Stage == "after" && payload.Observation.Kind == "function" && payload.Observation.Status == "completed" {
+			confirmed = true
+		}
+	}
+	if !confirmed {
+		t.Fatal("function receipt was not observed")
+	}
+}
+
+// A pending call fails when the Turn is cancelled, and closing the Session
+// leaves no listener behind.
+func TestFunctionCallCancellationReleasesPendingCall(t *testing.T) {
+	session, out, _ := functionTurn(t, "cancel-wait")
+	functions := session.executor.opts.Functions
+	client := mcp.NewClient(&mcp.Implementation{Name: "probe", Version: "1"}, nil)
+	connection, err := client.Connect(t.Context(), &mcp.StreamableClientTransport{Endpoint: functions.url, HTTPClient: &http.Client{Transport: bearerTransport{"Bearer " + functions.token}}}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	released := make(chan error, 1)
+	go func() {
+		_, err := connection.CallTool(t.Context(), &mcp.CallToolParams{Name: "lookup", Arguments: map[string]any{}})
+		released <- err
+	}()
+	call := waitFunctionCall(t, out)
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+	defer cancel()
+	if err := session.Cancel(ctx); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case err := <-released:
+		if err == nil {
+			t.Fatal("pending native call succeeded")
+		}
+	case <-ctx.Done():
+		t.Fatal("pending native call was not released")
+	}
+	if err := session.SubmitFunctionResult(ctx, proto.FunctionResultPayload{DeliveryID: "d", CallID: call.CallID, Content: []proto.InputContent{}}); err == nil {
+		t.Fatal("result accepted after cancellation")
+	}
+	if err := session.executor.Close(ctx); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-functions.done:
+	default:
+		t.Fatal("function listener outlived the Session")
+	}
+}
+
+// probeFunction is the native side of one call: it calls the tool over MCP and
+// returns what native received.
+func probeFunction(t *testing.T, functions *functionServer) <-chan *mcp.CallToolResult {
+	t.Helper()
+	client := mcp.NewClient(&mcp.Implementation{Name: "probe", Version: "1"}, nil)
+	connection, err := client.Connect(t.Context(), &mcp.StreamableClientTransport{Endpoint: functions.url, HTTPClient: &http.Client{Transport: bearerTransport{"Bearer " + functions.token}}}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	received := make(chan *mcp.CallToolResult, 1)
+	go func() {
+		result, _ := connection.CallTool(t.Context(), &mcp.CallToolParams{Name: "lookup", Arguments: map[string]any{}})
+		received <- result
+	}()
+	return received
+}
+
+func submitText(session *Session, callID, text string) error {
+	return session.SubmitFunctionResult(context.Background(), proto.FunctionResultPayload{DeliveryID: "d", CallID: callID, Success: true, Content: []proto.InputContent{{Type: "input_text", Text: &text}}})
+}
+
+func nativeEnd(session *Session, status string, callID string) {
+	output := map[string]any{}
+	if callID != "" {
+		output["details"] = map[string]any{"mcp": map[string]any{"_meta": map[string]any{functionCallMeta: callID}}}
+	}
+	session.confirmFunction(toolUpdate{mcp: &mcpToolIdentity{server: "functions", tool: "lookup"}, Status: status, RawOutput: output})
+}
+
+// Calls of the same function run one after another; each gets its own result
+// and its own receipt.
+func TestFunctionCallsInSequence(t *testing.T) {
+	session, out, _ := functionTurn(t, "cancel-wait")
+	functions := session.executor.opts.Functions
+	for _, answer := range []string{"first", "second"} {
+		received := probeFunction(t, functions)
+		call := waitFunctionCall(t, out)
+		submitted := make(chan error, 1)
+		go func() { submitted <- submitText(session, call.CallID, answer) }()
+		result := <-received
+		if got := result.Content[0].(*mcp.TextContent).Text; got != answer {
+			t.Fatalf("native received %q, want %q", got, answer)
+		}
+		nativeEnd(session, "completed", call.CallID)
+		if err := <-submitted; err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+// A call that native fails, such as at its call timeout, is withdrawn: a late
+// result is refused at once and the next call still works.
+func TestFunctionCallFailedByNativeIsWithdrawn(t *testing.T) {
+	session, out, _ := functionTurn(t, "cancel-wait")
+	functions := session.executor.opts.Functions
+	received := probeFunction(t, functions)
+	late := waitFunctionCall(t, out)
+	nativeEnd(session, "failed", "")
+	for event := range out {
+		if event.Type == proto.TypeFunctionCallWithdrawn {
+			var withdrawn proto.FunctionCallWithdrawnPayload
+			if json.Unmarshal(event.Payload, &withdrawn) != nil || withdrawn.CallID != late.CallID {
+				t.Fatalf("withdrawn = %s", event.Payload)
+			}
+			break
+		}
+	}
+	if result := <-received; result != nil {
+		t.Fatal("released call returned a result")
+	}
+	if err := submitText(session, late.CallID, "late"); !errors.Is(err, agent.ErrUnknownFunctionCall) {
+		t.Fatalf("late result: %v", err)
+	}
+	received = probeFunction(t, functions)
+	next := waitFunctionCall(t, out)
+	submitted := make(chan error, 1)
+	go func() { submitted <- submitText(session, next.CallID, "next") }()
+	if result := <-received; result.Content[0].(*mcp.TextContent).Text != "next" {
+		t.Fatal("next call did not get its result")
+	}
+	nativeEnd(session, "completed", next.CallID)
+	if err := <-submitted; err != nil {
+		t.Fatal(err)
+	}
+}
+
+// A call still pending when the Turn ends is reported to native and refuses a result.
+func TestFunctionCallPendingAtTurnEnd(t *testing.T) {
+	session, out, _ := functionTurn(t, "cancel-wait")
+	received := probeFunction(t, session.executor.opts.Functions)
+	call := waitFunctionCall(t, out)
+	session.stopFunctions()
+	if result := <-received; result != nil {
+		t.Fatal("pending call returned a result")
+	}
+	if err := submitText(session, call.CallID, "late"); !errors.Is(err, agent.ErrUnknownFunctionCall) {
+		t.Fatalf("result after Turn end: %v", err)
+	}
+}
diff --git a/apps/daemon/internal/agent/mcode/harness_config_test.go b/apps/daemon/internal/agent/mcode/harness_config_test.go
index 1de262c5d..0cc11b16d 100644
--- a/apps/daemon/internal/agent/mcode/harness_config_test.go
+++ b/apps/daemon/internal/agent/mcode/harness_config_test.go
@@ -8,11 +8,11 @@ import (
 func TestNativeConfigDoesNotPretendToSupportParameters(t *testing.T) {
 	req := testRequest(t)
 	req.AgentOptions["harness_config"] = map[string]any{}
-	if _, err := prepareOptions(testStateRoot(t), req); err != nil {
+	if _, err := prepareOptions(testStateRoot(t), req, nil); err != nil {
 		t.Fatal(err)
 	}
 	req.AgentOptions["harness_config"] = map[string]any{"temperature": 0.5}
-	if _, err := prepareOptions(testStateRoot(t), req); err != harnessconfig.ErrHarnessConfig {
+	if _, err := prepareOptions(testStateRoot(t), req, nil); err != harnessconfig.ErrHarnessConfig {
 		t.Fatalf("unsupported parameter accepted: %v", err)
 	}
 }
diff --git a/apps/daemon/internal/agent/mcode/installation.go b/apps/daemon/internal/agent/mcode/installation.go
index 5f6937fc1..ce35f0f42 100644
--- a/apps/daemon/internal/agent/mcode/installation.go
+++ b/apps/daemon/internal/agent/mcode/installation.go
@@ -12,7 +12,7 @@ import (
 func Installation() agent.Installation {
 	return agent.Installation{AgentKind: "mcode", Version: SupportedVersion, Supported: func() bool { return runtime.GOOS == "linux" || runtime.GOOS == "darwin" },
 		Environment: func(dir, node string) map[string]string {
-			return map[string]string{"OAC_RUNTIME_MCODE_BIN": filepath.Join(dir, "native", "cli.js"), "OAC_RUNTIME_MCODE_NODE": node, "OAC_RUNTIME_MCODE_WORKSPACE_BRIDGE": filepath.Join(dir, "bridge.mjs")}
+			return map[string]string{"OAC_RUNTIME_MCODE_BIN": filepath.Join(dir, "native", "cli.js"), "OAC_RUNTIME_MCODE_NODE": node, "OAC_RUNTIME_MCODE_COMPANION": dir}
 		},
 		Check: func(ctx context.Context, dir, node string, env []string) error {
 			got, err := installroot.Probe(ctx, node, []string{filepath.Join(dir, "native", "cli.js"), "--version"}, env, dir)
diff --git a/apps/daemon/internal/agent/mcode/mcp_observations.go b/apps/daemon/internal/agent/mcode/mcp_observations.go
index 364d8995b..a026881bd 100644
--- a/apps/daemon/internal/agent/mcode/mcp_observations.go
+++ b/apps/daemon/internal/agent/mcode/mcp_observations.go
@@ -10,22 +10,22 @@ import (
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	declaration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/mcode"
 )
 
 type mcpToolIdentity struct{ server, tool string }
 
 // MiniMax 0.4.12 atomically writes these assignments before exposing tools.
 // Read its exact mapping instead of reversing lossy native name normalization.
-func (s *Session) environmentMCPIdentity(name string) (*mcpToolIdentity, error) {
-	if s.req.LocalEnvironment == nil ||
-		!strings.HasPrefix(name, "mcp__") || strings.HasPrefix(name, "mcp__oac_workspace__") {
+func (s *Session) mcpIdentity(name string) (*mcpToolIdentity, error) {
+	if !strings.HasPrefix(name, "mcp__") {
 		return nil, nil
 	}
 	bindings, err := agent.ResolveMCPBindings(s.req)
 	if err != nil {
 		return nil, err
 	}
-	if len(bindings) == 0 {
+	if len(bindings) == 0 && len(s.req.FunctionTools) == 0 {
 		return nil, nil
 	}
 	raw, err := os.ReadFile(filepath.Join(s.opts.DataDir, "mcp-runtime-names.json"))
@@ -50,12 +50,15 @@ func (s *Session) environmentMCPIdentity(name string) (*mcpToolIdentity, error)
 			}
 			var key []string
 			declared := 0
+			if server.Raw == declaration.FunctionServerLabel && len(s.req.FunctionTools) > 0 {
+				declared = 1
+			}
 			for _, item := range bindings {
 				if item.ServerLabel == server.Raw {
 					declared++
 				}
 			}
-			if found != nil || declared != 1 || server.Raw == "oac_workspace" || tool.Raw == "" ||
+			if found != nil || declared != 1 || tool.Raw == "" ||
 				json.Unmarshal([]byte(server.Key), &key) != nil || len(key) != 2 || key[0] != "configured" || key[1] != server.Raw {
 				return nil, fmt.Errorf("mcode: ambiguous or undeclared native MCP identity")
 			}
@@ -68,7 +71,7 @@ func (s *Session) environmentMCPIdentity(name string) (*mcpToolIdentity, error)
 	return found, nil
 }
 
-func environmentMCPObservation(update toolUpdate, stage string) (*proto.ToolObservation, error) {
+func mcpObservation(update toolUpdate, stage string) (*proto.ToolObservation, error) {
 	if update.mcp == nil {
 		return nil, nil
 	}
diff --git a/apps/daemon/internal/agent/mcode/mcp_observations_test.go b/apps/daemon/internal/agent/mcode/mcp_observations_test.go
index 9f613f1a9..96084853f 100644
--- a/apps/daemon/internal/agent/mcode/mcp_observations_test.go
+++ b/apps/daemon/internal/agent/mcode/mcp_observations_test.go
@@ -16,7 +16,7 @@ func mcpObservationSession(t *testing.T) (*Session, chan proto.Envelope) {
 	out := make(chan proto.Envelope, 16)
 	s := &Session{ctx: context.Background(), outputContext: context.Background(), opts: launchOptions{DataDir: t.TempDir()},
 		req: proto.PromptRequestPayload{RunID: "run",
-			LocalEnvironment: &proto.LocalEnvironment{NetworkAccess: "enabled", MCP: []proto.EnvironmentMCP{environmentMCPFixture()}}},
+			LocalEnvironment: &proto.LocalEnvironment{MCP: []proto.EnvironmentMCP{environmentMCPFixture()}}},
 		out: out, tools: map[string]toolUpdate{}, completedTools: map[string]bool{}, active: true, sessionID: "native-session"}
 	if err := writeMCPRegistry(s.opts.DataDir, mcpRegistryEntry("proof.server", "proof_server_2", "read.status", "read_status_2")); err != nil {
 		t.Fatal(err)
@@ -164,18 +164,6 @@ func TestEnvironmentMCPResultMustMatchStartAndUnsettledCallsCloseOnce(t *testing
 	}
 }
 
-func TestEnvironmentMCPDoesNotPublishInternalWorkspaceUtilities(t *testing.T) {
-	s, out := mcpObservationSession(t)
-	for _, name := range []string{"workspace_read", "workspace_write", "workspace_edit", "workspace_glob", "workspace_grep"} {
-		if err := s.emitTool(toolUpdate{ID: name, Name: "mcp__oac_workspace__" + name, Status: "completed"}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if len(out) != 0 {
-		t.Fatal("internal workspace utility became a public MCP call")
-	}
-}
-
 func TestEnvironmentMCPNativeJSONRetainsIntegerPrecision(t *testing.T) {
 	s, out := mcpObservationSession(t)
 	frames := []string{
diff --git a/apps/daemon/internal/agent/mcode/model_provider.go b/apps/daemon/internal/agent/mcode/model_provider.go
index 231198586..a3cab3554 100644
--- a/apps/daemon/internal/agent/mcode/model_provider.go
+++ b/apps/daemon/internal/agent/mcode/model_provider.go
@@ -8,8 +8,8 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/modelprovider"
 )
 
-func modelProviderConfig(raw any, model string) (map[string]any, error) {
-	provider, err := harnessconfiguration.Configuration().ParseProvider(raw)
+func modelProviderConfig(raw any, model, effort string) (map[string]any, error) {
+	provider, err := harnessconfiguration.Declaration.Configuration.ParseProvider(raw)
 	if err != nil {
 		return nil, fmt.Errorf("mcode: %w", err)
 	}
@@ -26,12 +26,25 @@ func modelProviderConfig(raw any, model string) (map[string]any, error) {
 	if len(provider.Headers) > 0 {
 		options["headers"] = maps.Clone(provider.Headers)
 	}
+	native := map[string]any{"name": model}
+	// Absent limits are omitted so the native defaults apply.
+	limit := map[string]any{}
+	if provider.ContextWindow > 0 {
+		limit["context"] = provider.ContextWindow
+	}
+	if provider.MaxOutputTokens > 0 {
+		limit["output"] = provider.MaxOutputTokens
+	}
+	if len(limit) > 0 {
+		native["limit"] = limit
+	}
+	if effort != "" {
+		// The Session selects this effort through ACP thinkingEffort.
+		native["thinking"] = map[string]any{"effortOptions": []string{effort}}
+	}
 	return map[string]any{
 		"name": "Configured provider", "kind": "custom", "enabled": true, "api": api,
 		"options": options,
-		"models": map[string]any{model: map[string]any{
-			"name": model, "tool_call": true,
-			"limit": map[string]any{"context": provider.ContextWindow, "output": provider.MaxOutputTokens},
-		}},
+		"models":  map[string]any{model: native},
 	}, nil
 }
diff --git a/apps/daemon/internal/agent/mcode/model_provider_test.go b/apps/daemon/internal/agent/mcode/model_provider_test.go
index ada80d770..c6dfb0cf4 100644
--- a/apps/daemon/internal/agent/mcode/model_provider_test.go
+++ b/apps/daemon/internal/agent/mcode/model_provider_test.go
@@ -17,7 +17,7 @@ func TestOptionsModelProviderProtocols(t *testing.T) {
 			req.AgentOptions["model_provider"].(map[string]any)["protocol"] = tc.protocol
 			req.AgentOptions["model_provider"].(map[string]any)["headers"] = map[string]string{"X-Activity": "private-header"}
 			req.AgentOptions["model"] = "chosen-model"
-			opts, err := prepareOptions(testStateRoot(t), req)
+			opts, err := prepareOptions(testStateRoot(t), req, nil)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -33,7 +33,7 @@ func TestOptionsModelProviderProtocols(t *testing.T) {
 				"name": "Configured provider", "kind": "custom", "enabled": true, "api": tc.api,
 				"options": map[string]any{"baseURL": "https://provider.example/v1", "apiKey": "fixture-key", "headers": map[string]any{"X-Activity": "private-header"}},
 				"models": map[string]any{"chosen-model": map[string]any{
-					"name": "chosen-model", "tool_call": true,
+					"name":  "chosen-model",
 					"limit": map[string]any{"context": float64(64000), "output": float64(4096)},
 				}},
 			}}
@@ -44,6 +44,43 @@ func TestOptionsModelProviderProtocols(t *testing.T) {
 	}
 }
 
+func TestOptionsOmitAbsentTokenLimits(t *testing.T) {
+	for _, tc := range []struct {
+		name  string
+		unset []string
+		want  any
+	}{
+		{"none", []string{"context_window", "max_output_tokens"}, nil},
+		{"context only", []string{"max_output_tokens"}, map[string]any{"context": float64(64000)}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			req := testRequest(t)
+			for _, field := range tc.unset {
+				delete(req.AgentOptions["model_provider"].(map[string]any), field)
+			}
+			opts, err := prepareOptions(testStateRoot(t), req, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			body, err := os.ReadFile(filepath.Join(opts.DataDir, "config.yaml"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var config struct {
+				CustomProvider map[string]struct {
+					Models map[string]map[string]any `json:"models"`
+				} `json:"custom_provider"`
+			}
+			if err := json.Unmarshal(body, &config); err != nil {
+				t.Fatal(err)
+			}
+			if got := config.CustomProvider["oac"].Models[opts.Model]["limit"]; !reflect.DeepEqual(got, tc.want) {
+				t.Fatalf("limit = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
 func TestOptionsRejectInvalidProvider(t *testing.T) {
 	for _, tc := range []struct {
 		name, field string
@@ -53,15 +90,13 @@ func TestOptionsRejectInvalidProvider(t *testing.T) {
 		{"protocol alias", "protocol", "chat-completions"},
 		{"remote HTTP", "base_url", "http://provider.example/v1"},
 		{"empty key", "api_key", ""},
-		{"missing context", "context_window", 0},
-		{"missing output", "max_output_tokens", 0},
 		{"excess output", "max_output_tokens", 64001},
 		{"native options", "options", map[string]any{"apiKey": "fixture-key"}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			req := testRequest(t)
 			req.AgentOptions["model_provider"].(map[string]any)[tc.field] = tc.value
-			if _, err := prepareOptions(testStateRoot(t), req); err == nil {
+			if _, err := prepareOptions(testStateRoot(t), req, nil); err == nil {
 				t.Fatal("invalid model provider accepted")
 			}
 		})
@@ -70,7 +105,7 @@ func TestOptionsRejectInvalidProvider(t *testing.T) {
 		req := testRequest(t)
 		req.AgentOptions["mcode_provider"] = req.AgentOptions["model_provider"]
 		delete(req.AgentOptions, "model_provider")
-		if _, err := prepareOptions(testStateRoot(t), req); err == nil {
+		if _, err := prepareOptions(testStateRoot(t), req, nil); err == nil {
 			t.Fatal("retired native provider option accepted")
 		}
 	})
@@ -79,7 +114,34 @@ func TestOptionsRejectInvalidProvider(t *testing.T) {
 func TestOptionsAllowLoopbackProviderFixture(t *testing.T) {
 	req := testRequest(t)
 	req.AgentOptions["model_provider"].(map[string]any)["base_url"] = "http://127.0.0.1:4321/v1"
-	if _, err := prepareOptions(testStateRoot(t), req); err != nil {
+	if _, err := prepareOptions(testStateRoot(t), req, nil); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestOptionsWriteNativeThinkingEffort(t *testing.T) {
+	req := testRequest(t)
+	req.ExecutionControls.ReasoningEffort = "high"
+	opts, err := prepareOptions(testStateRoot(t), req, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, err := os.ReadFile(filepath.Join(opts.DataDir, "config.yaml"))
+	if err != nil {
 		t.Fatal(err)
 	}
+	var config struct {
+		CustomProvider map[string]struct {
+			Models map[string]struct {
+				Thinking map[string]any `json:"thinking"`
+			} `json:"models"`
+		} `json:"custom_provider"`
+	}
+	if err := json.Unmarshal(body, &config); err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]any{"effortOptions": []any{"high"}}
+	if got := config.CustomProvider["oac"].Models["fixture"].Thinking; !reflect.DeepEqual(got, want) {
+		t.Fatalf("thinking = %v", got)
+	}
 }
diff --git a/apps/daemon/internal/agent/mcode/native_effort_mcp_test.go b/apps/daemon/internal/agent/mcode/native_effort_mcp_test.go
new file mode 100644
index 000000000..60cfa4c94
--- /dev/null
+++ b/apps/daemon/internal/agent/mcode/native_effort_mcp_test.go
@@ -0,0 +1,168 @@
+package mcode
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+)
+
+// This opt-in test makes real model calls. It sends the native model traffic
+// through a local recording proxy and a text-placement HTTP MCP fixture, then
+// checks the effort and the final user text at the model and the MCP call.
+func TestNativeMCodeEffortMCPAndPlainText(t *testing.T) {
+	binary, options := os.Getenv("OAC_RUNTIME_MCODE_BIN"), os.Getenv("OAC_TEST_MCODE_REAL_OPTIONS")
+	if binary == "" || options == "" {
+		t.Skip("native executable and private provider options required")
+	}
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Minute)
+	defer cancel()
+	raw, err := os.ReadFile(options)
+	if err != nil {
+		t.Fatal("private provider options unavailable")
+	}
+	req := testRequest(t)
+	req.RunID, req.Input = "", nil
+	if json.Unmarshal(raw, &req.AgentOptions) != nil {
+		t.Fatal("invalid private provider options")
+	}
+	provider := req.AgentOptions["model_provider"].(map[string]any)
+	upstream, err := url.Parse(provider["base_url"].(string))
+	if err != nil {
+		t.Fatal("invalid provider base URL")
+	}
+	var mu sync.Mutex
+	var bodies [][]byte
+	proxy := httptest.NewServer(&httputil.ReverseProxy{
+		Rewrite: func(r *httputil.ProxyRequest) {
+			r.SetURL(upstream)
+			if body, err := io.ReadAll(r.In.Body); err == nil {
+				mu.Lock()
+				bodies = append(bodies, body)
+				mu.Unlock()
+				r.Out.Body = io.NopCloser(bytes.NewReader(body))
+			}
+		},
+	})
+	defer proxy.Close()
+	provider["base_url"] = proxy.URL
+
+	var called sync.Map
+	mcp := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			w.WriteHeader(http.StatusMethodNotAllowed)
+			return
+		}
+		var rpc struct {
+			ID     json.RawMessage `json:"id"`
+			Method string          `json:"method"`
+			Params struct {
+				Name      string         `json:"name"`
+				Arguments map[string]any `json:"arguments"`
+			} `json:"params"`
+		}
+		_ = json.NewDecoder(r.Body).Decode(&rpc)
+		if len(rpc.ID) == 0 {
+			w.WriteHeader(http.StatusAccepted)
+			return
+		}
+		var result any
+		switch rpc.Method {
+		case "initialize":
+			result = map[string]any{"protocolVersion": "2025-03-26", "capabilities": map[string]any{"tools": map[string]any{}}, "serverInfo": map[string]any{"name": "fixture", "version": "1"}}
+		case "tools/list":
+			result = map[string]any{"tools": []any{map[string]any{"name": "lookup_code", "description": "Returns the secret access code. Always call it when asked for the access code.", "inputSchema": map[string]any{"type": "object", "properties": map[string]any{}}}}}
+		case "tools/call":
+			called.Store(rpc.Params.Name, true)
+			result = map[string]any{"content": []any{map[string]any{"type": "text", "text": "ACCESS-CODE-4417"}}}
+		default:
+			result = map[string]any{}
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{"jsonrpc": "2.0", "id": rpc.ID, "result": result})
+	}))
+	defer mcp.Close()
+
+	req.ExecutionControls.ReasoningEffort = "high"
+	req.MCPHTTPServers = &[]proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "fixture", ServerURL: mcp.URL + "/mcp"}}
+	value, err := NewExecutorFactory(testStateRoot(t), nil)(ctx, req)
+	if err != nil {
+		t.Fatal("native Executor preparation failed")
+	}
+	e := value.(*executor)
+	defer func() {
+		cleanup, stop := context.WithTimeout(context.Background(), 15*time.Second)
+		defer stop()
+		_ = e.Close(cleanup)
+	}()
+	out := make(chan proto.Envelope, 256)
+	turn, err := e.StartTurn(ctx, "turn", proto.TextInput("Use the MCP tool to get the access code, then reply with only the code."), out)
+	if err != nil {
+		t.Fatal("native Turn admission failed")
+	}
+	var content string
+	observed := false
+	for event := range out {
+		switch event.Type {
+		case proto.TypeError:
+			t.Fatal("native Turn reported an error")
+		case proto.TypeToolCall:
+			var call proto.ToolCallPayload
+			if json.Unmarshal(event.Payload, &call) == nil && call.Observation != nil && call.Observation.Kind == "mcp" && call.Observation.Server == "fixture" && call.Observation.Name == "lookup_code" {
+				observed = true
+			}
+		case proto.TypeDone:
+			var done proto.DonePayload
+			_ = json.Unmarshal(event.Payload, &done)
+			content = done.Content
+		}
+	}
+	if _, err := turn.AwaitSettlement(ctx); err != nil {
+		t.Fatal("native Turn did not settle")
+	}
+	if _, ok := called.Load("lookup_code"); !ok || !observed || !strings.Contains(content, "ACCESS-CODE-4417") {
+		t.Fatalf("MCP tool was not listed, called and observed: called=%v observed=%v", ok, observed)
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	effort, plain := false, false
+	for _, body := range bodies {
+		var request struct {
+			OutputConfig map[string]any `json:"output_config"`
+			Messages     []struct {
+				Role    string `json:"role"`
+				Content any    `json:"content"`
+			} `json:"messages"`
+		}
+		if json.Unmarshal(body, &request) != nil {
+			continue
+		}
+		effort = effort || request.OutputConfig["effort"] == "high"
+		if len(request.Messages) > 0 && request.Messages[0].Role == "user" {
+			if blocks, ok := request.Messages[0].Content.([]any); ok {
+				for _, block := range blocks {
+					if text, _ := block.(map[string]any)["text"].(string); strings.HasSuffix(text, "reply with only the code.") {
+						plain = true
+					}
+				}
+			} else if text, _ := request.Messages[0].Content.(string); strings.HasSuffix(text, "reply with only the code.") {
+				plain = true
+			}
+		}
+	}
+	t.Logf("model requests=%d effort high on wire=%v user text ends without newlines=%v", len(bodies), effort, plain)
+	if !effort || !plain {
+		t.Fatal("model request did not carry the effort and the unmodified user text")
+	}
+}
diff --git a/apps/daemon/internal/agent/mcode/native_test.go b/apps/daemon/internal/agent/mcode/native_test.go
index ba3c33247..48b01ff6f 100644
--- a/apps/daemon/internal/agent/mcode/native_test.go
+++ b/apps/daemon/internal/agent/mcode/native_test.go
@@ -62,6 +62,7 @@ func testNativeMCodeHeaders(t *testing.T, protocol string, workspace bool) {
 		mu.Unlock()
 		if protocol == "chat_completions" {
 			tool := ""
+			arguments := ""
 			if !toolSent.Load() {
 				for _, raw := range body["tools"].([]any) {
 					function, ok := raw.(map[string]any)["function"].(map[string]any)
@@ -69,14 +70,26 @@ func testNativeMCodeHeaders(t *testing.T, protocol string, workspace bool) {
 						function = raw.(map[string]any)
 					}
 					name, _ := function["name"].(string)
-					if strings.HasSuffix(name, "workspace_read") && toolSent.CompareAndSwap(false, true) {
+					if name == "read" && toolSent.CompareAndSwap(false, true) {
 						tool = name
+						parameters, _ := function["parameters"].(map[string]any)
+						properties, _ := parameters["properties"].(map[string]any)
+						for _, key := range []string{"file_path", "filePath", "path"} {
+							if _, ok := properties[key]; ok {
+								raw, _ := json.Marshal(map[string]string{key: "fixture.txt"})
+								arguments = string(raw)
+								break
+							}
+						}
+						if arguments == "" {
+							t.Error("native read tool has no supported file path parameter")
+						}
 						break
 					}
 				}
 
 			}
-			writeNativeChatResponse(w, tool)
+			writeNativeChatResponse(w, tool, arguments)
 		} else {
 			writeNativeResponse(w)
 		}
@@ -92,6 +105,9 @@ func testNativeMCodeHeaders(t *testing.T, protocol string, workspace bool) {
 	defer cancel()
 	var config *WorkspaceConfig
 	if workspace {
+		if os.Getenv("OAC_RUNTIME_MCODE_COMPANION") == "" {
+			t.Skip("set OAC_RUNTIME_MCODE_COMPANION for native workspace test")
+		}
 		root := t.TempDir()
 		if err := os.WriteFile(filepath.Join(root, "fixture.txt"), []byte("HEADER-TOOL-CONTINUATION"), 0600); err != nil {
 			t.Fatal(err)
@@ -100,9 +116,9 @@ func testNativeMCodeHeaders(t *testing.T, protocol string, workspace bool) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		config = &WorkspaceConfig{Binary: binary, Node: node, Bridge: filepath.Join(filepath.Dir(filepath.Dir(binary)), "bridge.mjs"), Directory: root, Network: "enabled", Scratch: t.TempDir()}
+		config = &WorkspaceConfig{Binary: binary, Node: node, Companion: os.Getenv("OAC_RUNTIME_MCODE_COMPANION"), Directory: root}
 		req.DisableExecutionEnvironment = false
-		req.LocalEnvironment = &proto.LocalEnvironment{ID: "headers-workspace", WorkspaceRoot: root, NetworkAccess: "enabled"}
+		req.LocalEnvironment = &proto.LocalEnvironment{ID: "headers-workspace", WorkspaceRoot: root}
 	}
 	factory := NewExecutorFactory(stateRoot, config)
 	owner, err := factory(ctx, req)
@@ -197,12 +213,12 @@ func writeNativeResponse(w http.ResponseWriter) {
 	send("message_stop", map[string]string{"type": "message_stop"})
 }
 
-func writeNativeChatResponse(w http.ResponseWriter, tool string) {
+func writeNativeChatResponse(w http.ResponseWriter, tool, arguments string) {
 	w.Header().Set("Content-Type", "text/event-stream")
 	delta := map[string]any{"role": "assistant", "content": "OAC-MCODE-OK"}
 	finish := "stop"
 	if tool != "" {
-		delta = map[string]any{"role": "assistant", "tool_calls": []any{map[string]any{"index": 0, "id": "call_fixture", "type": "function", "function": map[string]any{"name": tool, "arguments": `{"path":"fixture.txt"}`}}}}
+		delta = map[string]any{"role": "assistant", "tool_calls": []any{map[string]any{"index": 0, "id": "call_fixture", "type": "function", "function": map[string]any{"name": tool, "arguments": arguments}}}}
 		finish = "tool_calls"
 	}
 	for _, choice := range []map[string]any{{"index": 0, "delta": delta, "finish_reason": nil}, {"index": 0, "delta": map[string]any{}, "finish_reason": finish}} {
diff --git a/apps/daemon/internal/agent/mcode/options.go b/apps/daemon/internal/agent/mcode/options.go
index f34f57b53..703fdf0d7 100644
--- a/apps/daemon/internal/agent/mcode/options.go
+++ b/apps/daemon/internal/agent/mcode/options.go
@@ -16,11 +16,22 @@ type launchOptions struct {
 	Dir, DataDir, Model string
 	Env                 []string
 	MCP                 []map[string]any
+	Functions           *functionServer
 }
 
-func prepareOptions(runtimeRoot string, req proto.PromptRequestPayload) (launchOptions, error) {
+// workspaceProfile selects the native tools of a Session that has an Environment.
+type workspaceProfile struct {
+	// ToolEnv is the Runtime's frozen tool environment as KEY=value entries.
+	ToolEnv []string
+	// WebFetch keeps the native web_fetch tool.
+	WebFetch bool
+}
+
+// prepareOptions writes the native configuration. A nil workspace is the none
+// placement: the native process has no builtin file, process or fetch tools.
+func prepareOptions(runtimeRoot string, req proto.PromptRequestPayload, workspace *workspaceProfile) (launchOptions, error) {
 	var result launchOptions
-	if _, err := harnessconfiguration.Configuration().PrepareHarnessConfig(req.AgentOptions); err != nil {
+	if _, err := harnessconfiguration.Declaration.Configuration.PrepareHarnessConfig(req.AgentOptions); err != nil {
 		return result, err
 	}
 	if err := validateExecutionRequest(req); err != nil {
@@ -46,25 +57,27 @@ func prepareOptions(runtimeRoot string, req proto.PromptRequestPayload) (launchO
 	if err := os.WriteFile(filepath.Join(result.DataDir, "AGENTS.md"), []byte(prompt), 0o600); err != nil {
 		return result, err
 	}
-	config := map[string]any{"logLevel": "error", "skills": map[string]any{"external": map[string]any{"enabled": false}}}
+	config := map[string]any{}
+	effort := ""
+	if req.ExecutionControls != nil {
+		effort = req.ExecutionControls.ReasoningEffort
+	}
 	result.Model = optionString(opts, "model")
 	if result.Model == "" {
 		return result, fmt.Errorf("mcode: model is required")
 	}
-	provider, err := modelProviderConfig(opts["model_provider"], result.Model)
+	provider, err := modelProviderConfig(opts["model_provider"], result.Model, effort)
 	if err != nil {
 		return result, err
 	}
 	config["custom_provider"] = map[string]any{"oac": provider}
-	configureTextExecution(config)
-	if !req.DisableSubagents {
-		config["agents"] = map[string]any{"default": map[string]any{
-			"tools":        []string{"task", "task_append", "task_query", "task_output", "task_stop"},
-			"builtinTools": []string{"task", "task_append", "task_query", "task_output", "task_stop"}, "skills": []string{},
-			"features": map[string]bool{"mavis": false, "delegation": true, "webSearch": false},
-		}}
-	}
-	config["permissionMode"] = "auto"
+	config["agents"] = map[string]any{"default": agentCapabilities(req, workspace)}
+	// Unattended: no ask-user. Native mcode-tools needs a MiniMax account sign-in that Core does not hold.
+	// Thread goals schedule continuation Turns after the Turn ends.
+	config["askUser"] = map[string]bool{"enabled": false}
+	config["beta"] = map[string]bool{"mcodeTools": false, "threadGoal": false}
+	// Unattended: tools, including MCP tools on environment none, run without approval prompts.
+	config["permissionMode"] = "bypassPermissions"
 	data, err := json.Marshal(config)
 	if err != nil {
 		return result, err
@@ -72,10 +85,12 @@ func prepareOptions(runtimeRoot string, req proto.PromptRequestPayload) (launchO
 	if err := os.WriteFile(filepath.Join(result.DataDir, "config.yaml"), data, 0o600); err != nil {
 		return result, err
 	}
-	result.Env = append(executionEnvironment(), "OAC_RUNTIME_MCODE_TOOL_POLICY=protected-mcp-v1")
-	if err := os.WriteFile(filepath.Join(result.DataDir, "mcp.json"), []byte(`{"mcpServers":{}}`), 0o600); err != nil {
-		return result, err
+	result.Env = executionEnvironment()
+	if workspace != nil {
+		result.Env = append(result.Env, workspace.ToolEnv...)
 	}
+	// Background bash outlives the Turn and escapes the process group; Subagent task output stays.
+	result.Env = append(result.Env, "OAC_RUNTIME_MCODE_BACKGROUND_BASH=off")
 	if !req.DisableSubagents {
 		result.Env = append(result.Env, "OAC_RUNTIME_MCODE_MAX_SUBAGENTS="+strconv.Itoa(*req.MaxConcurrentSubagents))
 	} else {
@@ -83,10 +98,32 @@ func prepareOptions(runtimeRoot string, req proto.PromptRequestPayload) (launchO
 	}
 	// The adapter owns the native state location, including after cold resume.
 	result.Env = append(result.Env, "MINIMAX_DATA_DIR="+result.DataDir, "HOME="+result.DataDir, "USERPROFILE="+result.DataDir)
-	result.MCP = []map[string]any{}
 	return result, nil
 }
 
+// agentCapabilities is the native agents.default ceiling. A native ID list is
+// all-or-nothing: one unknown ID drops the whole list and enables every tool.
+func agentCapabilities(req proto.PromptRequestPayload, workspace *workspaceProfile) map[string]any {
+	tools := []string{}
+	if workspace != nil {
+		// website_deploy needs a MiniMax account and stays out of the list.
+		tools = append(tools, "read", "write", "edit", "bash", "grep", "glob", "todowrite")
+		if workspace.WebFetch {
+			tools = append(tools, "web_fetch")
+		}
+	}
+	return map[string]any{
+		"tools": tools,
+		"features": map[string]bool{
+			// The mavis tool carries cron scheduling that runs beyond a Turn, plus session send, agent create and MCP create.
+			"mavis":      false,
+			"delegation": !req.DisableSubagents,
+			// Native web search calls MiniMax's cloud with a MiniMax account credential that Core does not hold.
+			"webSearch": false,
+		},
+	}
+}
+
 func optionString(options map[string]any, key string) string {
 	value, _ := options[key].(string)
 	return value
diff --git a/apps/daemon/internal/agent/mcode/options_test.go b/apps/daemon/internal/agent/mcode/options_test.go
index 5018a743f..989475c9b 100644
--- a/apps/daemon/internal/agent/mcode/options_test.go
+++ b/apps/daemon/internal/agent/mcode/options_test.go
@@ -13,7 +13,7 @@ import (
 func TestOptionsRefreshManagedState(t *testing.T) {
 	t.Setenv("MINIMAX_DATA_DIR", "/wrong")
 	req := testRequest(t)
-	opts, err := prepareOptions(testStateRoot(t), req)
+	opts, err := prepareOptions(testStateRoot(t), req, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -31,7 +31,7 @@ func TestOptionsRefreshManagedState(t *testing.T) {
 	}
 	req.AgentOptions["system_prompt"] = ""
 	req.AgentSessionID = "native-1"
-	refreshed, err := prepareOptions(testStateRoot(t), req)
+	refreshed, err := prepareOptions(testStateRoot(t), req, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -50,11 +50,11 @@ func TestOptionsRefreshManagedState(t *testing.T) {
 	if json.Unmarshal(data, &cfg) != nil {
 		t.Fatal("invalid config")
 	}
-	if cfg["permissionMode"] != "auto" {
-		t.Fatal("native permission mode changed")
+	if cfg["permissionMode"] != "bypassPermissions" {
+		t.Fatal("MCP tools on environment none can wait for approval")
 	}
-	if cfg["skills"].(map[string]any)["external"].(map[string]any)["enabled"] != false {
-		t.Fatal("external discovery enabled")
+	if _, set := cfg["skills"]; set {
+		t.Fatal("native Skill discovery was overridden")
 	}
 	info, _ := os.Stat(filepath.Join(opts.DataDir, "config.yaml"))
 	if info.Mode().Perm() != 0600 {
@@ -75,7 +75,7 @@ func TestOptionsRejectDroppedContext(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			req := testRequest(t)
 			tt.edit(&req)
-			if _, err := prepareOptions(testStateRoot(t), req); err == nil {
+			if _, err := prepareOptions(testStateRoot(t), req, nil); err == nil {
 				t.Fatal("expected validation failure")
 			}
 		})
diff --git a/apps/daemon/internal/agent/mcode/protocol.go b/apps/daemon/internal/agent/mcode/protocol.go
index 116d8c024..516ca2183 100644
--- a/apps/daemon/internal/agent/mcode/protocol.go
+++ b/apps/daemon/internal/agent/mcode/protocol.go
@@ -42,11 +42,9 @@ type toolUpdate struct {
 type sessionUpdate struct {
 	SessionID string `json:"sessionId"`
 	Update    struct {
-		Kind    string `json:"sessionUpdate"`
-		Content struct {
-			Type string `json:"type"`
-			Text string `json:"text"`
-		} `json:"content"`
+		Kind string `json:"sessionUpdate"`
+		// Message chunks carry one content block; native tool updates carry a list, which is not read.
+		Content json.RawMessage `json:"content"`
 		toolUpdate
 	} `json:"update"`
 }
diff --git a/apps/daemon/internal/agent/mcode/session.go b/apps/daemon/internal/agent/mcode/session.go
index 528d0338b..826214f7d 100644
--- a/apps/daemon/internal/agent/mcode/session.go
+++ b/apps/daemon/internal/agent/mcode/session.go
@@ -48,6 +48,7 @@ type Session struct {
 	previousNativeTurns  map[string]bool
 	rootCompletedAtMS    *int64
 	subagentHistoryReady bool
+	functions            *functionCalls
 }
 
 var _ agent.Session = (*Session)(nil)
@@ -65,7 +66,7 @@ func launch(ctx context.Context, req proto.PromptRequestPayload, opts launchOpti
 }
 
 func newTurnSession(ctx context.Context, req proto.PromptRequestPayload, opts launchOptions, c *connection, out chan<- proto.Envelope) *Session {
-	return &Session{ctx: ctx, req: req, opts: opts, connection: c, out: out, frames: make(chan rpcFrame, 32), finished: make(chan struct{}), tools: map[string]toolUpdate{}, completedTools: map[string]bool{}}
+	return &Session{ctx: ctx, req: req, opts: opts, connection: c, out: out, frames: make(chan rpcFrame, 32), finished: make(chan struct{}), functions: &functionCalls{pending: map[string]*pendingFunction{}, stopped: make(chan struct{})}, tools: map[string]toolUpdate{}, completedTools: map[string]bool{}}
 }
 
 func (s *Session) prepareNative() error {
@@ -74,7 +75,7 @@ func (s *Session) prepareNative() error {
 		Meta            struct {
 			Subagents struct {
 				Version, MaxConcurrent int
-				WorkspaceTools         string
+				BackgroundBash         *bool
 			} `json:"oac/subagents"`
 		} `json:"_meta"`
 	}
@@ -84,8 +85,11 @@ func (s *Session) prepareNative() error {
 	if initialized.ProtocolVersion != 1 {
 		return fmt.Errorf("mcode: unsupported ACP protocol version %d", initialized.ProtocolVersion)
 	}
-	if !s.req.DisableSubagents && (initialized.Meta.Subagents.Version != 1 || initialized.Meta.Subagents.WorkspaceTools != "protected-mcp-v1" || s.req.MaxConcurrentSubagents == nil || initialized.Meta.Subagents.MaxConcurrent != *s.req.MaxConcurrentSubagents) {
-		return fmt.Errorf("mcode: native Subagent admission is unavailable")
+	// Only the patched CLI reports that background bash is off; an unpatched one would leave work after a Turn.
+	meta := initialized.Meta.Subagents
+	if meta.Version != 2 || meta.BackgroundBash == nil || *meta.BackgroundBash ||
+		(!s.req.DisableSubagents && (s.req.MaxConcurrentSubagents == nil || meta.MaxConcurrent != *s.req.MaxConcurrentSubagents)) {
+		return fmt.Errorf("mcode: patched native CLI is unavailable")
 	}
 	params := map[string]any{"cwd": s.opts.Dir, "mcpServers": s.opts.MCP}
 	method := "session/new"
@@ -106,10 +110,15 @@ func (s *Session) prepareNative() error {
 	s.mu.Lock()
 	s.sessionID = session.SessionID
 	s.mu.Unlock()
-	model, err := advertisedModel(session.ConfigOptions, s.opts.Model)
+	// A model with effort options is advertised only with its "thinking" variant.
+	variant := ""
+	if s.req.ExecutionControls != nil && s.req.ExecutionControls.ReasoningEffort != "" {
+		variant = "thinking"
+	}
+	model, err := advertisedModel(session.ConfigOptions, s.opts.Model, variant)
 	if err != nil && s.req.AgentSessionID != "" && !slices.ContainsFunc(session.ConfigOptions, func(option configOption) bool { return option.ID == "model" }) {
 		// Native load omits the selector when its persisted model was removed; selection still validates against the current catalog.
-		model = "m:custom_provider%3Aoac:" + strings.ReplaceAll(url.QueryEscape(s.opts.Model), "+", "%20") + ":v:"
+		model = "m:custom_provider%3Aoac:" + strings.ReplaceAll(url.QueryEscape(s.opts.Model), "+", "%20") + ":v:" + variant
 		err = nil
 	}
 	if err != nil {
@@ -119,6 +128,10 @@ func (s *Session) prepareNative() error {
 	if err := s.call("session/set_config_option", map[string]any{"sessionId": session.SessionID, "configId": "model", "value": model}, nil, false); err != nil {
 		return err
 	}
+	if variant != "" {
+		// A selected variant takes no model default, so the Session's effort is set explicitly.
+		return s.call("session/set_config_option", map[string]any{"sessionId": session.SessionID, "configId": "thinkingEffort", "value": s.req.ExecutionControls.ReasoningEffort}, nil, false)
+	}
 	return nil
 }
 
@@ -148,7 +161,7 @@ func (s *Session) executePrompt(prompt string) error {
 }
 
 // Select the advertised custom model, rather than using mcode's native default.
-func advertisedModel(options []configOption, model string) (string, error) {
+func advertisedModel(options []configOption, model, variant string) (string, error) {
 	for _, option := range options {
 		if option.ID != "model" {
 			continue
@@ -166,7 +179,7 @@ func advertisedModel(options []configOption, model string) (string, error) {
 			if err != nil {
 				continue
 			}
-			if provider == "custom_provider:oac" && id == model && (parts[3] == "u" || (len(parts) == 5 && parts[3] == "v" && parts[4] == "")) {
+			if provider == "custom_provider:oac" && id == model && (parts[3] == "u" || (len(parts) == 5 && parts[3] == "v" && parts[4] == variant)) {
 				return candidate.Value, nil
 			}
 		}
diff --git a/apps/daemon/internal/agent/mcode/session_test.go b/apps/daemon/internal/agent/mcode/session_test.go
index 044a1bb35..6aadc85e9 100644
--- a/apps/daemon/internal/agent/mcode/session_test.go
+++ b/apps/daemon/internal/agent/mcode/session_test.go
@@ -6,7 +6,9 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -18,7 +20,7 @@ func testRequest(t *testing.T) proto.PromptRequestPayload {
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
 	return proto.PromptRequestPayload{RunID: "run-1", AgentStateKey: "conversation-1/agent-1/mcode", Input: proto.TextInput("Hello"), AgentOptions: map[string]any{
 		"model": "fixture", "model_provider": map[string]any{"protocol": "anthropic", "base_url": "https://provider.example/v1", "api_key": "fixture-key", "context_window": 64000, "max_output_tokens": 4096}, "system_prompt": "Current instructions",
-	}, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
+	}, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{TextVerbosity: "medium"}}
 }
 
 // helperRequest selects a protocol fixture scenario as the native CLI.
@@ -161,7 +163,7 @@ func TestResumeSelectsModelWhenNativeSelectorIsMissing(t *testing.T) {
 }
 
 func TestSessionFailuresAreReported(t *testing.T) {
-	for _, scenario := range []string{"malformed", "exit", "unknown-model"} {
+	for _, scenario := range []string{"malformed", "exit", "unknown-model", "background-bash"} {
 		t.Run(scenario, func(t *testing.T) {
 			ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
 			defer cancel()
@@ -204,7 +206,10 @@ func TestMCodeProcess(t *testing.T) {
 		return
 	}
 	encoder := json.NewEncoder(os.Stdout)
+	var sendMu sync.Mutex
 	send := func(value any) {
+		sendMu.Lock()
+		defer sendMu.Unlock()
 		if err := encoder.Encode(value); err != nil {
 			os.Exit(2)
 		}
@@ -214,7 +219,7 @@ func TestMCodeProcess(t *testing.T) {
 		send(map[string]any{"jsonrpc": "2.0", "method": "session/update", "params": map[string]any{"sessionId": "native-1", "update": fields}})
 	}
 	scanner := bufio.NewScanner(os.Stdin)
-	var promptID json.RawMessage
+	var promptID, sessionParams json.RawMessage
 	prompts, configurations := 0, 0
 	for scanner.Scan() {
 		var frame rpcFrame
@@ -254,8 +259,12 @@ func TestMCodeProcess(t *testing.T) {
 			if scenario == "unattended" && strings.Contains(string(frame.Params), "elicitation") {
 				os.Exit(7)
 			}
-			result = map[string]int{"protocolVersion": 1}
+			// The patched CLI reports its Subagent limit and whether bash may outlive a Turn.
+			limit, _ := strconv.Atoi(os.Getenv("OAC_RUNTIME_MCODE_MAX_SUBAGENTS"))
+			result = map[string]any{"protocolVersion": 1, "_meta": map[string]any{"oac/subagents": map[string]any{
+				"version": 2, "maxConcurrent": limit, "backgroundBash": scenario == "background-bash" || os.Getenv("OAC_RUNTIME_MCODE_BACKGROUND_BASH") != "off"}}}
 		case "session/new", "session/load":
+			sessionParams = frame.Params
 			if scenario == "prepared-mcp-cancel" {
 				if writeMCPRegistry(os.Getenv("MINIMAX_DATA_DIR"), mcpRegistryEntry("proof.server", "proof_server", "read.status", "read_status")) != nil {
 					os.Exit(12)
@@ -292,7 +301,7 @@ func TestMCodeProcess(t *testing.T) {
 				Prompt []map[string]string `json:"prompt"`
 			}
 			_ = json.Unmarshal(frame.Params, &input)
-			if len(input.Prompt) != 2 {
+			if len(input.Prompt) != 1 {
 				os.Exit(9)
 			}
 			if strings.HasPrefix(scenario, "executor") {
@@ -306,7 +315,7 @@ func TestMCodeProcess(t *testing.T) {
 					continue
 				}
 				update("agent_message_chunk", map[string]any{"content": map[string]string{"type": "text", "text": input.Prompt[0]["text"]}})
-				update("tool_call", map[string]any{"toolCallId": "repeated-call", "name": "mcp__oac_workspace__workspace_bash", "status": "in_progress", "rawInput": map[string]any{"command": "true"}})
+				update("tool_call", map[string]any{"toolCallId": "repeated-call", "name": "bash", "status": "in_progress", "rawInput": map[string]any{"command": "true"}})
 				update("tool_call_update", map[string]any{"toolCallId": "repeated-call", "status": "completed"})
 				raw, _ := json.Marshal(map[string]string{"stopReason": "end_turn"})
 				send(rpcFrame{JSONRPC: "2.0", ID: frame.ID, Result: raw})
@@ -317,6 +326,11 @@ func TestMCodeProcess(t *testing.T) {
 				}
 				continue
 			}
+			if scenario == "functions" {
+				promptID = frame.ID
+				go fakeFunctionTurn(sessionParams, update, send, promptID)
+				continue
+			}
 			if scenario == "prepared-mcp-cancel" {
 				promptID = frame.ID
 				update("tool_call", map[string]any{"toolCallId": "native-call", "name": "mcp__proof_server__read_status", "status": "in_progress", "rawInput": map[string]any{}})
@@ -345,7 +359,7 @@ func TestMCodeProcess(t *testing.T) {
 			}
 			update("agent_message_chunk", map[string]any{"content": map[string]string{"type": "text", "text": "Hello "}})
 			update("agent_message_chunk", map[string]any{"content": map[string]string{"type": "text", "text": "world"}})
-			update("tool_call", map[string]any{"toolCallId": "tool-1", "name": "mcp__oac_workspace__workspace_bash", "status": "in_progress", "rawInput": map[string]any{"command": "cat fixture.txt"}})
+			update("tool_call", map[string]any{"toolCallId": "tool-1", "name": "bash", "status": "in_progress", "rawInput": map[string]any{"command": "cat fixture.txt"}})
 			for range 2 {
 				update("tool_call_update", map[string]any{"toolCallId": "tool-1", "status": "completed", "rawOutput": "fixture"})
 			}
diff --git a/apps/daemon/internal/agent/mcode/steering.go b/apps/daemon/internal/agent/mcode/steering.go
index 005f5c859..21ae074e0 100644
--- a/apps/daemon/internal/agent/mcode/steering.go
+++ b/apps/daemon/internal/agent/mcode/steering.go
@@ -12,10 +12,6 @@ import (
 
 var _ agent.DurableSteerer = (*Session)(nil)
 
-func (s *Session) Steer(ctx context.Context, input proto.PromptSteerPayload) error {
-	return s.SteerWithReceipt(ctx, input, nil)
-}
-
 // Native acceptance belongs to the active ACP Turn; it does not promise model consumption.
 func (s *Session) SteerWithReceipt(ctx context.Context, input proto.PromptSteerPayload, written func()) error {
 	s.mu.Lock()
@@ -53,9 +49,7 @@ func (s *Session) SteerWithReceipt(ctx context.Context, input proto.PromptSteerP
 		s.markInputUncertain()
 		return fmt.Errorf("mcode: input transport failed")
 	}
-	if written != nil {
-		written()
-	}
+	written()
 	var frame rpcFrame
 	var stopped error
 	select {
diff --git a/apps/daemon/internal/agent/mcode/subagent_messages.go b/apps/daemon/internal/agent/mcode/subagent_messages.go
index 00f20d105..a4c9cbabb 100644
--- a/apps/daemon/internal/agent/mcode/subagent_messages.go
+++ b/apps/daemon/internal/agent/mcode/subagent_messages.go
@@ -34,11 +34,6 @@ func (s *Session) projectSubagentMessages(session nativeSubagentSession, turn na
 		if message.Role != "assistant" {
 			continue
 		}
-		if message.Data.Thinking != "" {
-			if err := emit(message.ID+":reasoning", "reasoning", map[string]any{"status": "completed", "summary": []map[string]string{{"type": "summary_text", "text": message.Data.Thinking}}}); err != nil {
-				return err
-			}
-		}
 		if message.Data.Text != "" {
 			text := message.Data.Text
 			if err := emit(message.ID, proto.TypeOutputMessage, proto.OutputMessagePayload{ID: message.ID, Status: "completed", Text: &text}); err != nil {
@@ -72,14 +67,14 @@ func (s *Session) projectSubagentMessages(session nativeSubagentSession, turn na
 				status = "failed"
 			}
 			update := toolUpdate{ID: tool.ID, Name: tool.Name, Status: status, RawInput: args, RawOutput: result}
-			observation := workspaceToolObservation(update, "after")
+			observation := s.nativeToolObservation(update, "after")
 			if observation == nil {
 				var err error
-				update.mcp, err = s.environmentMCPIdentity(update.Name)
+				update.mcp, err = s.mcpIdentity(update.Name)
 				if err != nil {
 					return err
 				}
-				observation, err = environmentMCPObservation(update, "after")
+				observation, err = mcpObservation(update, "after")
 				if err != nil {
 					return err
 				}
diff --git a/apps/daemon/internal/agent/mcode/subagents.go b/apps/daemon/internal/agent/mcode/subagents.go
index 65c05a7b2..57c5a5749 100644
--- a/apps/daemon/internal/agent/mcode/subagents.go
+++ b/apps/daemon/internal/agent/mcode/subagents.go
@@ -35,9 +35,8 @@ type nativeSubagentMessage struct {
 	ID, TurnID, Role string
 	CreatedAt        int64
 	Data             struct {
-		Text     string               `json:"msg_content"`
-		Thinking string               `json:"thinking_content"`
-		Tools    []nativeSubagentTool `json:"tool_calls"`
+		Text  string               `json:"msg_content"`
+		Tools []nativeSubagentTool `json:"tool_calls"`
 	}
 }
 type nativeSubagentTool struct {
@@ -53,9 +52,9 @@ type nativeSubagentTask struct {
 }
 
 func subagentReader() (string, string, error) {
-	node, bridge := os.Getenv("OAC_RUNTIME_MCODE_NODE"), os.Getenv("OAC_RUNTIME_MCODE_WORKSPACE_BRIDGE")
-	reader := filepath.Join(filepath.Dir(bridge), "subagent-snapshot.mjs")
-	for _, path := range []string{node, bridge, reader} {
+	node := os.Getenv("OAC_RUNTIME_MCODE_NODE")
+	reader := filepath.Join(os.Getenv("OAC_RUNTIME_MCODE_COMPANION"), "subagent-snapshot.mjs")
+	for _, path := range []string{node, reader} {
 		resolved, err := filepath.EvalSymlinks(path)
 		if err != nil || !filepath.IsAbs(path) || resolved != path {
 			return "", "", fmt.Errorf("mcode: protected Subagent reader is unavailable")
diff --git a/apps/daemon/internal/agent/mcode/subagents_test.go b/apps/daemon/internal/agent/mcode/subagents_test.go
index 25a1773af..e82e4f3b9 100644
--- a/apps/daemon/internal/agent/mcode/subagents_test.go
+++ b/apps/daemon/internal/agent/mcode/subagents_test.go
@@ -40,7 +40,8 @@ func TestSubagentSnapshotsKeepOwnHistoryAndStableNativeIdentity(t *testing.T) {
 	}
 	first := project(childSnapshot(t))
 	second := project(childSnapshot(t))
-	if len(first) != 6 {
+	// Native thinking is not reported: MiniMax Code admits no reasoning summary.
+	if len(first) != 5 {
 		t.Fatalf("got %d events", len(first))
 	}
 	for i, event := range first {
@@ -48,7 +49,7 @@ func TestSubagentSnapshotsKeepOwnHistoryAndStableNativeIdentity(t *testing.T) {
 			t.Fatal("cold snapshot identities changed")
 		}
 	}
-	if first[0].Type != proto.TypeSubagentIdentity || first[1].Type != proto.TypeSubagentTurn || first[5].Type != proto.TypeSubagentTurn {
+	if first[0].Type != proto.TypeSubagentIdentity || first[1].Type != proto.TypeSubagentTurn || first[4].Type != proto.TypeSubagentTurn {
 		t.Fatal("identity/turn/item ordering changed")
 	}
 	var input proto.SubagentItemPayload
@@ -72,10 +73,9 @@ func TestSubagentSnapshotRejectsMissingParentProvenance(t *testing.T) {
 // The ACP cancelled response may precede the root native Turn becoming terminal.
 func TestSubagentSettlementIncludesActiveRootTurn(t *testing.T) {
 	dir := t.TempDir()
-	node, bridge := filepath.Join(dir, "node"), filepath.Join(dir, "bridge.mjs")
+	node := filepath.Join(dir, "node")
 	for name, data := range map[string]string{
-		node:   "#!/bin/sh\ncat \"$3/snapshot.json\"\n",
-		bridge: "",
+		node: "#!/bin/sh\ncat \"$3/snapshot.json\"\n",
 		filepath.Join(dir, "subagent-snapshot.mjs"): "",
 	} {
 		if err := os.WriteFile(name, []byte(data), 0700); err != nil {
@@ -83,7 +83,7 @@ func TestSubagentSettlementIncludesActiveRootTurn(t *testing.T) {
 		}
 	}
 	t.Setenv("OAC_RUNTIME_MCODE_NODE", node)
-	t.Setenv("OAC_RUNTIME_MCODE_WORKSPACE_BRIDGE", bridge)
+	t.Setenv("OAC_RUNTIME_MCODE_COMPANION", dir)
 	for _, status := range []string{"accepted", "aborted"} {
 		t.Run(status, func(t *testing.T) {
 			raw := []byte(`{"version":1,"complete":true,"rootSessionId":"root","sessions":[{"id":"root","turns":[{"id":"current","status":"` + status + `"}]}]}`)
diff --git a/apps/daemon/internal/agent/mcode/tool_environment_test.go b/apps/daemon/internal/agent/mcode/tool_environment_test.go
index fd047583a..66ffa720e 100644
--- a/apps/daemon/internal/agent/mcode/tool_environment_test.go
+++ b/apps/daemon/internal/agent/mcode/tool_environment_test.go
@@ -2,10 +2,10 @@ package mcode
 
 import (
 	"bytes"
-	"encoding/json"
 	"io/fs"
 	"os"
 	"path/filepath"
+	"slices"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/localworkspace"
@@ -37,9 +37,7 @@ func TestWorkspaceCredentialsRemainInRuntimeSnapshotAcrossReconnect(t *testing.T
 	t.Setenv("OAC_RUNTIME_SESSION_ID", session)
 	t.Setenv("OAC_RUNTIME_WORKSPACE", config.Directory)
 	t.Setenv("OAC_RUNTIME_CAPABILITY_DIRECTORY", t.TempDir())
-	t.Setenv("OAC_RUNTIME_NETWORK_ACCESS", "enabled")
-	t.Setenv("OAC_RUNTIME_ALLOWED_DOMAINS", "")
-	req.AgentStateKey = "agents-api-" + session
+	req.AgentStateKey = session
 	req.LocalEnvironment.ID, req.LocalEnvironment.WorkspaceDirectory = environment, config.Directory
 	req.LocalEnvironment.Capabilities = true
 	req.LocalEnvironment.CapabilitySources = &agentcapabilities.Input{Directories: []string{plugin}}
@@ -64,21 +62,18 @@ func TestWorkspaceCredentialsRemainInRuntimeSnapshotAcrossReconnect(t *testing.T
 		if err != nil {
 			t.Fatal(err)
 		}
-		raw, err := os.ReadFile(filepath.Join(opts.DataDir, "workspace-profile.json"))
-		if err != nil {
-			t.Fatal(err)
-		}
-		var profile struct {
-			ToolEnvFile string `json:"toolEnvFile"`
+		// The native process, and so its tools, sees the Runtime snapshot, not a later change to the source.
+		for _, want := range []string{"MCP_TEST_TOKEN=fixture-bearer-canary", "TOOL_SECRET=fixture-tool-canary"} {
+			if !slices.Contains(opts.Env, want) {
+				t.Fatal("native environment lacks the frozen tool environment", want)
+			}
 		}
-		if err := json.Unmarshal(raw, &profile); err != nil {
+		// Assert the actual env-selected HTTP credential, not a manually injected token.
+		servers, err := runtimeMCP(prepared)
+		if err != nil {
 			t.Fatal(err)
 		}
-		if profile.ToolEnvFile != filepath.Join(initialization, "tool-env.json") {
-			t.Fatal("native profile did not retain the Runtime snapshot reference")
-		}
-		// Assert the actual env-selected HTTP credential, not a manually injected token.
-		headers, ok := opts.MCP[1]["headers"].([]map[string]string)
+		headers, ok := servers[0]["headers"].([]map[string]string)
 		if !ok || len(headers) != 1 || headers[0]["name"] != "Authorization" || headers[0]["value"] != "Bearer fixture-bearer-canary" {
 			t.Fatal("frozen MCP credential was lost or replaced")
 		}
diff --git a/apps/daemon/internal/agent/mcode/tool_observations.go b/apps/daemon/internal/agent/mcode/tool_observations.go
index 1dbd6d643..9267669d2 100644
--- a/apps/daemon/internal/agent/mcode/tool_observations.go
+++ b/apps/daemon/internal/agent/mcode/tool_observations.go
@@ -2,24 +2,34 @@ package mcode
 
 import (
 	"encoding/json"
+	"math"
+	"strings"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	declaration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/mcode"
 )
 
 func (s *Session) emitToolStage(update toolUpdate, stage string) error {
+	// Public functions report through the function call, not as MCP observations.
+	if update.mcp != nil && update.mcp.server == declaration.FunctionServerLabel {
+		if stage == "after" && update.Status != "incomplete" {
+			s.confirmFunction(update)
+		}
+		return nil
+	}
 	payload := proto.ToolCallPayload{ID: update.ID, Name: update.Name, Stage: stage, Args: update.RawInput}
 	if stage == "after" {
 		payload.Result = map[string]any{"output": update.RawOutput, "status": update.Status}
 	}
-	payload.Observation = workspaceToolObservation(update, stage)
+	payload.Observation = s.nativeToolObservation(update, stage)
 	if payload.Observation == nil {
 		var err error
-		payload.Observation, err = environmentMCPObservation(update, stage)
+		payload.Observation, err = mcpObservation(update, stage)
 		if err != nil {
 			return err
 		}
 	}
-	// Native task/skill bookkeeping has no qualified public item mapping.
+	// Native task/Skill/file bookkeeping has no qualified public item mapping.
 	if payload.Observation == nil {
 		return nil
 	}
@@ -27,35 +37,68 @@ func (s *Session) emitToolStage(update toolUpdate, stage string) error {
 	return nil
 }
 
-func workspaceToolObservation(update toolUpdate, stage string) *proto.ToolObservation {
-	if update.Name != "mcp__oac_workspace__workspace_bash" {
-		return nil
-	}
-	command, _ := update.RawInput["command"].(string)
-	if command == "" {
-		return nil
-	}
-	cwd := "/workspace"
-	result := &proto.ToolObservation{Kind: "command", Command: command, Cwd: &cwd, Status: "in_progress"}
-	if stage == "after" {
-		result.Status = update.Status
-		// ACP reports MCP content but no structured exit code or duration.
-		raw, _ := json.Marshal(update.RawOutput)
-		var output struct {
-			Content []struct {
-				Type string `json:"type"`
-				Text string `json:"text"`
-			} `json:"content"`
+// nativeToolObservation projects the native bash and web_fetch tools. A tool
+// without its arguments yet has no observation.
+func (s *Session) nativeToolObservation(update toolUpdate, stage string) *proto.ToolObservation {
+	switch update.Name {
+	case "bash":
+		command, _ := update.RawInput["command"].(string)
+		if command == "" {
+			return nil
 		}
-		if json.Unmarshal(raw, &output) == nil && output.Content != nil {
-			text := ""
-			for _, part := range output.Content {
-				if part.Type == "text" {
-					text += part.Text
-				}
+		cwd := s.opts.Dir
+		result := &proto.ToolObservation{Kind: "command", Command: command, Cwd: &cwd, Status: "in_progress"}
+		if stage == "after" {
+			result.Status = update.Status
+			result.Output, _ = json.Marshal(toolResultText(update.RawOutput))
+			// Only a finished command reports its exit code; a failed one carries prose, which is not parsed.
+			if code, ok := nativeExitCode(update.RawOutput); ok {
+				result.ExitCode = &code
 			}
-			result.Output, _ = json.Marshal(text)
 		}
+		return result
+	case "web_fetch":
+		url, _ := update.RawInput["url"].(string)
+		if url == "" {
+			return nil
+		}
+		result := &proto.ToolObservation{Kind: "web_search", Status: "in_progress", Action: &proto.ToolWebSearchAction{Type: "open_page", URL: &url}}
+		if stage == "after" {
+			result.Status = update.Status
+		}
+		return result
+	}
+	return nil
+}
+
+// toolResultText joins the text parts of a native tool result; a Subagent history keeps plain text results.
+func toolResultText(output any) string {
+	if text, ok := output.(string); ok {
+		return text
+	}
+	result, _ := output.(map[string]any)
+	parts, _ := result["content"].([]any)
+	var text strings.Builder
+	for _, part := range parts {
+		if item, _ := part.(map[string]any); item["type"] == "text" {
+			value, _ := item["text"].(string)
+			text.WriteString(value)
+		}
+	}
+	return text.String()
+}
+
+// nativeExitCode reads the structured exit code of a finished bash command.
+func nativeExitCode(output any) (int64, bool) {
+	result, _ := output.(map[string]any)
+	details, _ := result["details"].(map[string]any)
+	process, _ := details["processOutput"].(map[string]any)
+	switch code := process["exitCode"].(type) {
+	case json.Number:
+		value, err := code.Int64()
+		return value, err == nil
+	case float64:
+		return int64(code), code == math.Trunc(code)
 	}
-	return result
+	return 0, false
 }
diff --git a/apps/daemon/internal/agent/mcode/tool_observations_test.go b/apps/daemon/internal/agent/mcode/tool_observations_test.go
index 703e3cb90..12817a217 100644
--- a/apps/daemon/internal/agent/mcode/tool_observations_test.go
+++ b/apps/daemon/internal/agent/mcode/tool_observations_test.go
@@ -8,18 +8,32 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func TestWorkspaceCommandObservationsWaitForArgumentsAndRetainOutcome(t *testing.T) {
-	for _, status := range []string{"completed", "failed"} {
-		t.Run(status, func(t *testing.T) {
-			out := make(chan proto.Envelope, 8)
-			s := &Session{ctx: context.Background(), outputContext: context.Background(), req: proto.PromptRequestPayload{RunID: "run"}, out: out, tools: map[string]toolUpdate{}, completedTools: map[string]bool{}}
-			s.emitTool(toolUpdate{ID: "call", Name: "mcp__oac_workspace__workspace_bash"})
+func observationSession() (*Session, chan proto.Envelope) {
+	out := make(chan proto.Envelope, 8)
+	return &Session{ctx: context.Background(), outputContext: context.Background(), req: proto.PromptRequestPayload{RunID: "run"}, opts: launchOptions{Dir: "/environment/workspace"},
+		out: out, tools: map[string]toolUpdate{}, completedTools: map[string]bool{}}, out
+}
+
+func TestNativeBashBecomesCommandObservation(t *testing.T) {
+	for _, test := range []struct {
+		status string
+		output map[string]any
+		exit   *int64
+		text   string
+	}{
+		{"completed", map[string]any{"content": []any{map[string]any{"type": "text", "text": "/environment/workspace"}},
+			"details": map[string]any{"processOutput": map[string]any{"exitCode": json.Number("0")}}}, ptr(0), "/environment/workspace"},
+		// A failed command reports only prose, which is not parsed for an exit code.
+		{"failed", map[string]any{"content": []any{map[string]any{"type": "text", "text": "Command exited with code 3"}}}, nil, "Command exited with code 3"},
+	} {
+		t.Run(test.status, func(t *testing.T) {
+			s, out := observationSession()
+			_ = s.emitTool(toolUpdate{ID: "call", Name: "bash"})
 			if len(out) != 0 {
 				t.Fatal("command item emitted before native arguments")
 			}
-			s.emitTool(toolUpdate{ID: "call", RawInput: map[string]any{"command": "pwd"}})
-			s.emitTool(toolUpdate{ID: "call", Status: status, RawOutput: map[string]any{"content": []any{map[string]string{"type": "text", "text": "/workspace"}}}})
-			s.emitTool(toolUpdate{ID: "call", Status: status})
+			_ = s.emitTool(toolUpdate{ID: "call", RawInput: map[string]any{"command": "pwd"}})
+			_ = s.emitTool(toolUpdate{ID: "call", Status: test.status, RawOutput: test.output})
 			if len(out) != 2 {
 				t.Fatalf("events=%d", len(out))
 			}
@@ -30,20 +44,40 @@ func TestWorkspaceCommandObservationsWaitForArgumentsAndRetainOutcome(t *testing
 				t.Fatal(before)
 			}
 			n := after.Observation
-			if n == nil || n.Command != "pwd" || n.Cwd == nil || *n.Cwd != "/workspace" || n.Status != status {
+			output, _ := json.Marshal(test.text)
+			if n == nil || n.Command != "pwd" || n.Cwd == nil || *n.Cwd != "/environment/workspace" || n.Status != test.status || string(n.Output) != string(output) {
 				t.Fatal(after)
 			}
-			if string(n.Output) != `"/workspace"` || n.ExitCode != nil || n.DurationMS != nil {
-				t.Fatal(n)
+			if (n.ExitCode == nil) != (test.exit == nil) || (n.ExitCode != nil && *n.ExitCode != *test.exit) || n.DurationMS != nil {
+				t.Fatal("exit code", n.ExitCode)
 			}
 		})
 	}
 }
 
-func TestPrivateUtilitiesAreNotInventedPublicFunctionCalls(t *testing.T) {
-	for _, name := range []string{"mcp__oac_workspace__workspace_read", "skill", "task_query", "task_output", "task_stop", "mcp__unregistered__workspace_bash"} {
-		if workspaceToolObservation(toolUpdate{Name: name}, "before") != nil {
+func TestNativeWebFetchBecomesOpenPageObservation(t *testing.T) {
+	s, out := observationSession()
+	_ = s.emitTool(toolUpdate{ID: "call", Name: "web_fetch", RawInput: map[string]any{"url": "https://example.test/doc"}})
+	_ = s.emitTool(toolUpdate{ID: "call", Status: "failed", RawOutput: map[string]any{}})
+	var calls [2]proto.ToolCallPayload
+	for i := range calls {
+		_ = json.Unmarshal((<-out).Payload, &calls[i])
+	}
+	for i, status := range []string{"in_progress", "failed"} {
+		n := calls[i].Observation
+		if n == nil || n.Kind != "web_search" || n.Status != status || n.Action == nil || n.Action.Type != "open_page" || n.Action.URL == nil || *n.Action.URL != "https://example.test/doc" {
+			t.Fatal(calls[i])
+		}
+	}
+}
+
+func TestOtherNativeToolsAreNotInventedPublicItems(t *testing.T) {
+	s, _ := observationSession()
+	for _, name := range []string{"read", "write", "edit", "grep", "glob", "todowrite", "skill", "task_query", "task_output", "task_stop"} {
+		if s.nativeToolObservation(toolUpdate{Name: name, RawInput: map[string]any{"command": "x", "url": "x"}}, "before") != nil {
 			t.Fatal(name)
 		}
 	}
 }
+
+func ptr(value int64) *int64 { return &value }
diff --git a/apps/daemon/internal/agent/mcode/unsupported.go b/apps/daemon/internal/agent/mcode/unsupported.go
index e221bd595..ac35c4efa 100644
--- a/apps/daemon/internal/agent/mcode/unsupported.go
+++ b/apps/daemon/internal/agent/mcode/unsupported.go
@@ -2,15 +2,9 @@ package mcode
 
 import (
 	"context"
-	"fmt"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func (s *Session) SubmitFunctionResult(context.Context, proto.FunctionResultPayload) error {
-	return fmt.Errorf("%w: native public function tools are not qualified", agent.ErrUnsupportedOperation)
-}
-
 func (s *executor) ReadWorkspaceFile(context.Context, string, int) (agent.WorkspaceReadResult, error) {
 	return agent.WorkspaceReadResult{}, agent.ErrWorkspaceReadUnsupported
 }
diff --git a/apps/daemon/internal/agent/mcode/unsupported_test.go b/apps/daemon/internal/agent/mcode/unsupported_test.go
index eb0609bb6..05a2afb0d 100644
--- a/apps/daemon/internal/agent/mcode/unsupported_test.go
+++ b/apps/daemon/internal/agent/mcode/unsupported_test.go
@@ -7,7 +7,6 @@ import (
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
 // Nil concrete receivers prove Unsupported needs no native owner, transport,
@@ -25,8 +24,6 @@ func TestUnsupportedExtensionsHaveNoNativeEffects(t *testing.T) {
 			t.Fatal("unsupported error disclosed input")
 		}
 	}
-	var turn *Session
-	check(turn.SubmitFunctionResult(ctx, proto.FunctionResultPayload{CallID: secret, DeliveryID: secret}))
 	for _, owner := range []agent.WorkspaceReader{(*executor)(nil), (*Session)(nil)} {
 		result, err := owner.ReadWorkspaceFile(ctx, secret, 1)
 		check(err)
diff --git a/apps/daemon/internal/agent/mcode/workspace.go b/apps/daemon/internal/agent/mcode/workspace.go
index b5bbd2899..334d6c782 100644
--- a/apps/daemon/internal/agent/mcode/workspace.go
+++ b/apps/daemon/internal/agent/mcode/workspace.go
@@ -1,38 +1,33 @@
 package mcode
 
 import (
-	"encoding/json"
 	"fmt"
+	"maps"
 	"os"
 	"path/filepath"
 	"runtime"
+	"slices"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/localworkspace"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
 )
 
 // WorkspaceConfig is frozen deployment input, separate from public Agent options.
 type WorkspaceConfig struct {
-	Binary, Node, Bridge, Directory, Network, Scratch string
-	AllowedDomains                                    []string
+	Binary, Node, Companion, Directory string
 }
 
-func ConfigureLocal(binary, node, bridge, root, workspace string, network agentnetwork.Policy) (WorkspaceConfig, error) {
-	c := WorkspaceConfig{Binary: binary, Node: node, Bridge: bridge, Directory: workspace, Network: network.Access, AllowedDomains: network.Hosts(),
-		Scratch: filepath.Join(root, "runtime", "mcode-tools", "scratch")}
-	if runtime.GOOS == "windows" || network.Access != "enabled" || len(network.AllowedDomains) != 0 {
-		return c, fmt.Errorf("mcode: native execution requires Linux or macOS and unrestricted host access")
+func ConfigureLocal(binary, node, companion, workspace string) (WorkspaceConfig, error) {
+	c := WorkspaceConfig{Binary: binary, Node: node, Companion: companion, Directory: workspace}
+	if runtime.GOOS == "windows" {
+		return c, fmt.Errorf("mcode: native execution requires Linux or macOS")
 	}
-	if network.Validate() != nil {
-		return c, fmt.Errorf("mcode: explicit workspace network policy is required")
-	}
-	for _, path := range []string{binary, node, bridge, root, workspace} {
+	for _, path := range []string{binary, node, companion, workspace} {
 		if !filepath.IsAbs(path) || filepath.Clean(path) != path || path == "/" {
 			return c, fmt.Errorf("mcode: canonical absolute deployment paths are required")
 		}
 	}
-	for _, path := range []string{binary, node, bridge} {
+	for _, path := range []string{binary, node} {
 		info, err := os.Stat(path)
 		if err != nil || !info.Mode().IsRegular() {
 			return c, fmt.Errorf("mcode: runtime program unavailable")
@@ -42,31 +37,28 @@ func ConfigureLocal(binary, node, bridge, root, workspace string, network agentn
 	if err != nil || !bound.IsDir() {
 		return c, fmt.Errorf("mcode: workspace directory unavailable")
 	}
-
-	if err := os.MkdirAll(c.Scratch, 0700); err != nil {
-		return c, err
-	}
 	return c, nil
 }
 
 func prepareWorkspaceOptions(runtimeRoot string, c WorkspaceConfig, req proto.PromptRequestPayload) (launchOptions, error) {
-	if c.Network != "enabled" || len(c.AllowedDomains) != 0 {
-		return launchOptions{}, fmt.Errorf("mcode: Runtime does not implement network isolation")
-	}
-	if req.LocalEnvironment == nil || req.LocalEnvironment.WorkspaceRoot != c.Directory || req.DisableExecutionEnvironment || !(agentnetwork.Policy{Access: c.Network, AllowedDomains: c.AllowedDomains}).Equal(agentnetwork.Policy{Access: req.LocalEnvironment.NetworkAccess, AllowedDomains: req.LocalEnvironment.AllowedDomains}) || req.WorkspaceReadOnly {
+	if req.LocalEnvironment == nil || req.LocalEnvironment.WorkspaceRoot != c.Directory || req.DisableExecutionEnvironment || req.WorkspaceReadOnly {
 		return launchOptions{}, fmt.Errorf("mcode: execution does not match the dedicated workspace")
 	}
-	servers, err := runtimeMCP(req)
+	values, err := localworkspace.ReadOptionalToolEnvironment()
 	if err != nil {
 		return launchOptions{}, err
 	}
+	// A disabled web_search control removes web_fetch as well; without the control the native default applies.
+	searchDisabled := req.ExecutionControls != nil && req.ExecutionControls.WebSearch != nil && req.ExecutionControls.WebSearch.Mode == "disabled"
+	profile := &workspaceProfile{WebFetch: !searchDisabled}
+	for _, key := range slices.Sorted(maps.Keys(values)) {
+		profile.ToolEnv = append(profile.ToolEnv, key+"="+values[key])
+	}
 	// Reuse public option validation and private Session state provisioning.
-	// The native process, ACP Session and workspace tools share the declared cwd.
+	// The native process runs in the declared workspace.
 	private := req
 	private.LocalEnvironment, private.DisableExecutionEnvironment = nil, true
-	// Public declarations have already been resolved into the transient ACP map.
-	private.MCPHTTPServers = nil
-	opts, err := prepareOptions(runtimeRoot, private)
+	opts, err := prepareOptions(runtimeRoot, private, profile)
 	if err != nil {
 		return opts, err
 	}
@@ -90,73 +82,5 @@ func prepareWorkspaceOptions(runtimeRoot string, c WorkspaceConfig, req proto.Pr
 			}
 		}
 	}
-
-	raw, err := os.ReadFile(filepath.Join(opts.DataDir, "config.yaml"))
-	if err != nil {
-		return opts, err
-	}
-	var config map[string]any
-	if err = json.Unmarshal(raw, &config); err != nil {
-		return opts, err
-	}
-	config["permissionMode"] = "bypassPermissions"
-	config["sandbox"] = map[string]bool{"enabled": false}
-	if len(req.LocalEnvironment.Skills) > 0 {
-		selected := config["agents"].(map[string]any)["default"].(map[string]any)
-		names := make([]string, 0, len(req.LocalEnvironment.Skills))
-		for _, skill := range req.LocalEnvironment.Skills {
-			names = append(names, skill.Metadata.Name)
-		}
-		selected["skills"] = names
-		for _, key := range []string{"tools", "builtinTools"} {
-			selected[key] = append(selected[key].([]any), "skill")
-		}
-	}
-	raw, err = json.Marshal(config)
-	if err != nil {
-		return opts, err
-	}
-	if err = os.WriteFile(filepath.Join(opts.DataDir, "config.yaml"), raw, 0600); err != nil {
-		return opts, err
-	}
-	profile := map[string]any{"capabilityRoot": req.LocalEnvironment.CapabilityRoot, "workspace": "/workspace", "scratch": c.Scratch, "network": c.Network, "allowedDomains": (agentnetwork.Policy{Access: c.Network, AllowedDomains: c.AllowedDomains}).Hosts(), "skills": len(req.LocalEnvironment.Skills) > 0}
-
-	profile["workspace"] = c.Directory
-	{
-		file, err := localworkspace.ToolEnvironmentFile()
-		if err != nil {
-			return opts, err
-		}
-		if file != "" {
-			profile["toolEnvFile"] = file
-		}
-	}
-
-	raw, err = json.Marshal(profile)
-	if err != nil {
-		return opts, err
-	}
-	path := filepath.Join(opts.DataDir, "workspace-profile.json")
-	if err = os.WriteFile(path, raw, 0600); err != nil {
-		return opts, err
-	}
-	opts.MCP = []map[string]any{{"name": "oac_workspace", "command": c.Node, "args": []string{c.Bridge, path}, "env": []map[string]string{}}}
-	opts.MCP = append(opts.MCP, servers...)
-	if !req.DisableSubagents {
-		// This native data directory belongs to one public Session and its
-		// descendants. ACP's ephemeral server map otherwise covers only root.
-		configured := map[string]any{}
-		for _, server := range opts.MCP[:1] {
-			name, _ := server["name"].(string)
-			configured[name] = map[string]any{"type": "stdio", "command": server["command"], "args": server["args"], "env": map[string]string{}, "enabled": true}
-		}
-		raw, err := json.Marshal(map[string]any{"mcpServers": configured})
-		if err != nil {
-			return opts, err
-		}
-		if err := os.WriteFile(filepath.Join(opts.DataDir, "mcp.json"), raw, 0o600); err != nil {
-			return opts, err
-		}
-	}
 	return opts, nil
 }
diff --git a/apps/daemon/internal/agent/mcode/workspace_config_test.go b/apps/daemon/internal/agent/mcode/workspace_config_test.go
new file mode 100644
index 000000000..3e1c6b1f5
--- /dev/null
+++ b/apps/daemon/internal/agent/mcode/workspace_config_test.go
@@ -0,0 +1,73 @@
+package mcode
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"reflect"
+	"slices"
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+)
+
+func readNativeCapabilities(t *testing.T, dataDir string) (map[string]any, map[string]any) {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join(dataDir, "config.yaml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var config map[string]any
+	if err := json.Unmarshal(raw, &config); err != nil {
+		t.Fatal(err)
+	}
+	return config, config["agents"].(map[string]any)["default"].(map[string]any)
+}
+
+func TestWorkspaceRunsNativeToolsWithoutExtraServers(t *testing.T) {
+	native := []any{"read", "write", "edit", "bash", "grep", "glob", "todowrite"}
+	for _, test := range []struct {
+		name                string
+		subagents, disabled bool
+		tools               []any
+	}{
+		{"single agent", false, false, append(slices.Clone(native), "web_fetch")},
+		{"subagents", true, false, append(slices.Clone(native), "web_fetch")},
+		{"search disabled", true, true, native},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			c, req, _ := workspaceFixture(t)
+			if test.subagents {
+				dir := t.TempDir()
+				for _, name := range []string{"node", "subagent-snapshot.mjs"} {
+					if err := os.WriteFile(filepath.Join(dir, name), nil, 0700); err != nil {
+						t.Fatal(err)
+					}
+				}
+				t.Setenv("OAC_RUNTIME_MCODE_NODE", filepath.Join(dir, "node"))
+				t.Setenv("OAC_RUNTIME_MCODE_COMPANION", dir)
+				limit := 2
+				req.DisableSubagents, req.MaxConcurrentSubagents = false, &limit
+			}
+			if test.disabled {
+				req.ExecutionControls = &proto.ExecutionControls{WebSearch: &proto.WebSearchControl{Mode: "disabled", ContextSize: "medium"}}
+			}
+			opts, err := prepareWorkspaceOptions(testStateRoot(t), c, req)
+			if err != nil {
+				t.Fatal(err)
+			}
+			config, capabilities := readNativeCapabilities(t, opts.DataDir)
+			features := capabilities["features"].(map[string]any)
+			if _, ok := capabilities["skills"]; ok || !reflect.DeepEqual(capabilities["tools"], test.tools) || features["delegation"] != test.subagents ||
+				config["permissionMode"] != "bypassPermissions" || len(opts.MCP) != 0 || opts.Dir != c.Directory {
+				t.Fatalf("unexpected native configuration: %v %v", config, opts.MCP)
+			}
+			if !slices.Contains(opts.Env, "OAC_RUNTIME_MCODE_BACKGROUND_BASH=off") {
+				t.Fatal("background bash is not disabled")
+			}
+			if _, err := os.Stat(filepath.Join(opts.DataDir, "mcp.json")); !os.IsNotExist(err) {
+				t.Fatalf("adapter wrote a native MCP file: %v", err)
+			}
+		})
+	}
+}
diff --git a/apps/daemon/internal/agent/mcode/workspace_native_test.go b/apps/daemon/internal/agent/mcode/workspace_native_test.go
new file mode 100644
index 000000000..d9639eed1
--- /dev/null
+++ b/apps/daemon/internal/agent/mcode/workspace_native_test.go
@@ -0,0 +1,186 @@
+package mcode
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+)
+
+// This opt-in test makes real model calls with the native tools in a workspace.
+// It needs the built companion (OAC_RUNTIME_MCODE_COMPANION, OAC_RUNTIME_MCODE_NODE), the native CLI
+// (OAC_RUNTIME_MCODE_BIN) and private provider options (OAC_TEST_MCODE_REAL_OPTIONS).
+func TestNativeMCodeWorkspaceTools(t *testing.T) {
+	binary, node, companion, options := os.Getenv("OAC_RUNTIME_MCODE_BIN"), os.Getenv("OAC_RUNTIME_MCODE_NODE"), os.Getenv("OAC_RUNTIME_MCODE_COMPANION"), os.Getenv("OAC_TEST_MCODE_REAL_OPTIONS")
+	if binary == "" || node == "" || companion == "" || options == "" {
+		t.Skip("native executable, companion and private provider options required")
+	}
+	raw, err := os.ReadFile(options)
+	if err != nil {
+		t.Fatal("private provider options unavailable")
+	}
+	type result struct {
+		workspace, content string
+		calls              map[string][]proto.ToolCallPayload
+		events             map[string]int
+	}
+	// run executes one Turn; a nil config selects the none placement.
+	run := func(t *testing.T, c *WorkspaceConfig, search *proto.WebSearchControl, prompt string) result {
+		t.Helper()
+		ctx, cancel := context.WithTimeout(t.Context(), 6*time.Minute)
+		defer cancel()
+		workspace := t.TempDir()
+		if c != nil {
+			c.Directory = workspace
+		}
+		req := testRequest(t)
+		req.RunID, req.Input = "", nil
+		if json.Unmarshal(raw, &req.AgentOptions) != nil {
+			t.Fatal("invalid private provider options")
+		}
+		limit := 2
+		req.DisableSubagents, req.MaxConcurrentSubagents = false, &limit
+		if c != nil {
+			req.DisableExecutionEnvironment = false
+			req.LocalEnvironment = &proto.LocalEnvironment{ID: "environment", WorkspaceRoot: workspace}
+		}
+		if search != nil {
+			req.ExecutionControls = &proto.ExecutionControls{WebSearch: search}
+		}
+		if err := os.WriteFile(filepath.Join(workspace, "notes.txt"), []byte("alpha\n"), 0600); err != nil {
+			t.Fatal(err)
+		}
+		skill := filepath.Join(workspace, ".claude", "skills", "probe-phrase")
+		if err := os.MkdirAll(skill, 0700); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(skill, "SKILL.md"), []byte("---\nname: probe-phrase\ndescription: Gives the probe phrase.\n---\nThe probe phrase is violet-anchor-58.\n"), 0600); err != nil {
+			t.Fatal(err)
+		}
+		value, err := NewExecutorFactory(testStateRoot(t), c)(ctx, req)
+		if err != nil {
+			t.Fatal("native Executor preparation failed:", err)
+		}
+		e := value.(*executor)
+		defer func() {
+			cleanup, stop := context.WithTimeout(context.Background(), 15*time.Second)
+			defer stop()
+			if e.Close(cleanup) != nil {
+				t.Error("native owner cleanup failed")
+			}
+		}()
+		out := make(chan proto.Envelope, 1024)
+		turn, err := e.StartTurn(ctx, "turn", proto.TextInput(prompt), out)
+		if err != nil {
+			t.Fatal(err)
+		}
+		r := result{workspace: workspace, calls: map[string][]proto.ToolCallPayload{}, events: map[string]int{}}
+		for event := range out {
+			r.events[event.Type]++
+			switch event.Type {
+			case proto.TypeError:
+				t.Fatalf("native Turn reported an error: %s", event.Payload)
+			case proto.TypeToolCall:
+				var call proto.ToolCallPayload
+				if json.Unmarshal(event.Payload, &call) != nil {
+					t.Fatal("invalid tool call")
+				}
+				r.calls[call.ID] = append(r.calls[call.ID], call)
+			case proto.TypeDone:
+				var done proto.DonePayload
+				_ = json.Unmarshal(event.Payload, &done)
+				r.content = done.Content
+			}
+		}
+		if _, err := turn.AwaitSettlement(ctx); err != nil {
+			t.Fatal(err)
+		}
+		return r
+	}
+	workspace := &WorkspaceConfig{Binary: binary, Node: node, Companion: companion}
+	// finished returns the final observation of each command call, keyed by command text.
+	finished := func(calls map[string][]proto.ToolCallPayload) map[string]*proto.ToolObservation {
+		result := map[string]*proto.ToolObservation{}
+		for _, stages := range calls {
+			if last := stages[len(stages)-1]; last.Stage == "after" && last.Observation != nil && last.Observation.Kind == "command" {
+				result[last.Observation.Command] = last.Observation
+			}
+		}
+		return result
+	}
+	t.Run("files and commands", func(t *testing.T) {
+		r := run(t, workspace, nil, "Use your tools. 1) Read notes.txt. 2) Edit notes.txt, replacing alpha with beta. 3) Run exactly this bash command: echo bash-ok > out.txt. 4) Run exactly this bash command: sh -c 'exit 3'. Then reply DONE.")
+		notes, _ := os.ReadFile(filepath.Join(r.workspace, "notes.txt"))
+		out, _ := os.ReadFile(filepath.Join(r.workspace, "out.txt"))
+		if strings.TrimSpace(string(notes)) != "beta" || strings.TrimSpace(string(out)) != "bash-ok" {
+			t.Fatalf("workspace not changed by native tools: %q %q", notes, out)
+		}
+		commands := finished(r.calls)
+		write, failed := commands["echo bash-ok > out.txt"], commands["sh -c 'exit 3'"]
+		if write == nil || write.Status != "completed" || write.ExitCode == nil || *write.ExitCode != 0 || write.Cwd == nil || *write.Cwd != r.workspace {
+			t.Fatalf("command observation: %+v", write)
+		}
+		if failed == nil || failed.Status != "failed" || failed.ExitCode != nil || failed.Output == nil {
+			t.Fatalf("failed command observation: %+v", failed)
+		}
+	})
+	t.Run("bash stays in the foreground", func(t *testing.T) {
+		r := run(t, workspace, nil, "Use bash. 1) Run exactly this command and wait for it: sleep 20; echo slow-done. 2) Call bash with run_in_background set to true and the command: touch bg-ran. Report both tool replies.")
+		slow := finished(r.calls)["sleep 20; echo slow-done"]
+		if slow == nil || slow.Status != "completed" || !strings.Contains(string(slow.Output), "slow-done") {
+			t.Fatalf("slow command was not completed in the foreground: %+v", slow)
+		}
+		background := false
+		for _, stages := range r.calls {
+			if stages[0].Args["run_in_background"] == true {
+				background = true
+				if last := stages[len(stages)-1]; last.Observation == nil || last.Observation.Status != "failed" {
+					t.Fatalf("background bash was not refused: %+v", last.Observation)
+				}
+			}
+		}
+		time.Sleep(3 * time.Second)
+		if _, err := os.Stat(filepath.Join(r.workspace, "bg-ran")); err == nil || !background {
+			t.Fatal("background bash ran or was never requested")
+		}
+	})
+	t.Run("Subagents use the native tools", func(t *testing.T) {
+		r := run(t, workspace, nil, "Use the task tool to start one worker Subagent with this instruction: run the bash command `echo child-ok > child.txt`, then reply done. Wait for its result, then reply DONE.")
+		child, _ := os.ReadFile(filepath.Join(r.workspace, "child.txt"))
+		if strings.TrimSpace(string(child)) != "child-ok" || r.events[proto.TypeSubagentIdentity] == 0 || r.events[proto.TypeSubagentItem] == 0 {
+			t.Fatalf("Subagent did not run in the workspace: %q %v", child, r.events)
+		}
+	})
+	t.Run("workspace Skills load natively", func(t *testing.T) {
+		r := run(t, workspace, nil, "Use the probe-phrase Skill, then reply with the probe phrase only.")
+		if !strings.Contains(r.content, "violet-anchor-58") {
+			t.Fatalf("workspace Skill was not loaded: %q", r.content)
+		}
+	})
+	t.Run("web search control", func(t *testing.T) {
+		const prompt = "Without calling any tool, list the exact names of every tool you can call, comma separated."
+		tools := run(t, workspace, nil, prompt).content
+		disabled := run(t, workspace, &proto.WebSearchControl{Mode: "disabled", ContextSize: "medium"}, prompt).content
+		if !strings.Contains(tools, "web_fetch") || !strings.Contains(tools, "bash") || strings.Contains(disabled, "web_fetch") || !strings.Contains(disabled, "bash") {
+			t.Fatalf("tool inventories: %q / %q", tools, disabled)
+		}
+		for _, name := range []string{"website_deploy", "ask_user", "mavis", "web_search"} {
+			if strings.Contains(tools, name) {
+				t.Fatalf("%s is available: %q", name, tools)
+			}
+		}
+	})
+	t.Run("no Environment has no builtin tools", func(t *testing.T) {
+		tools := run(t, nil, nil, "Without calling any tool, list the exact names of every tool you can call, comma separated.").content
+		for _, name := range []string{"bash", "read", "write", "edit", "web_fetch"} {
+			if strings.Contains(tools, name) {
+				t.Fatalf("%s is available: %q", name, tools)
+			}
+		}
+	})
+}
diff --git a/apps/daemon/internal/agent/mcode/workspace_network_test.go b/apps/daemon/internal/agent/mcode/workspace_network_test.go
deleted file mode 100644
index 57aed9044..000000000
--- a/apps/daemon/internal/agent/mcode/workspace_network_test.go
+++ /dev/null
@@ -1,14 +0,0 @@
-package mcode
-
-import "testing"
-
-func TestWorkspaceRejectsInnerNetworkIsolation(t *testing.T) {
-	for _, access := range []string{"disabled", "restricted"} {
-		c, req, _ := workspaceFixture(t)
-		c.Network = access
-		req.LocalEnvironment.NetworkAccess = access
-		if _, err := prepareWorkspaceOptions(testStateRoot(t), c, req); err == nil {
-			t.Fatal("unsupported network isolation accepted")
-		}
-	}
-}
diff --git a/apps/daemon/internal/agent/mcode/workspace_readiness.go b/apps/daemon/internal/agent/mcode/workspace_readiness.go
index 7f44d672a..5621f588a 100644
--- a/apps/daemon/internal/agent/mcode/workspace_readiness.go
+++ b/apps/daemon/internal/agent/mcode/workspace_readiness.go
@@ -16,7 +16,7 @@ import (
 func CheckWorkspace(ctx context.Context, c WorkspaceConfig) error {
 	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
 	defer cancel()
-	p, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: c.Node, Args: []string{filepath.Join(filepath.Dir(c.Bridge), "check.mjs")}, Env: executionEnvironment()})
+	p, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: c.Node, Args: []string{filepath.Join(c.Companion, "check.mjs")}, Env: executionEnvironment()})
 	if err != nil {
 		return err
 	}
@@ -40,7 +40,7 @@ func ValidateWorkspaceReadiness(raw []byte) error {
 		Protocol       int `json:"protocol"`
 		Native, Source string
 	}
-	if len(raw) > 4096 || json.Unmarshal(raw, &info) != nil || info.Protocol != 2 || info.Native != SupportedVersion || info.Source != "33b259bbbeb1c16433390869938191d09bdb0680" {
+	if len(raw) > 4096 || json.Unmarshal(raw, &info) != nil || info.Protocol != 3 || info.Native != SupportedVersion || info.Source != "33b259bbbeb1c16433390869938191d09bdb0680" {
 		return fmt.Errorf("mcode: workspace companion check failed")
 	}
 	return nil
diff --git a/apps/daemon/internal/agent/mcode/workspace_readiness_test.go b/apps/daemon/internal/agent/mcode/workspace_readiness_test.go
index 6fca32fe8..910a4d78d 100644
--- a/apps/daemon/internal/agent/mcode/workspace_readiness_test.go
+++ b/apps/daemon/internal/agent/mcode/workspace_readiness_test.go
@@ -14,7 +14,7 @@ func TestWorkspaceReadinessRejectsOldCleanupContract(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("MiniMax adapter supports Linux and macOS")
 	}
-	for _, protocol := range []int{1, 2} {
+	for _, protocol := range []int{2, 3} {
 		t.Run(fmt.Sprint(protocol), func(t *testing.T) {
 			dir := t.TempDir()
 			node := filepath.Join(dir, "node")
@@ -22,8 +22,8 @@ func TestWorkspaceReadinessRejectsOldCleanupContract(t *testing.T) {
 			if err := os.WriteFile(node, []byte(body), 0700); err != nil {
 				t.Fatal(err)
 			}
-			err := CheckWorkspace(context.Background(), WorkspaceConfig{Node: node, Bridge: filepath.Join(dir, "bridge.mjs")})
-			if (err == nil) != (protocol == 2) {
+			err := CheckWorkspace(context.Background(), WorkspaceConfig{Node: node, Companion: dir})
+			if (err == nil) != (protocol == 3) {
 				t.Fatalf("protocol %d readiness: %v", protocol, err)
 			}
 		})
@@ -32,9 +32,9 @@ func TestWorkspaceReadinessRejectsOldCleanupContract(t *testing.T) {
 
 func TestValidateWorkspaceReadinessRejectsInvalidDescriptors(t *testing.T) {
 	for _, raw := range []string{"", "null", "{", strings.Repeat(" ", 4097),
-		`{"protocol":1,"native":"0.4.12","source":"33b259bbbeb1c16433390869938191d09bdb0680"}`,
-		`{"protocol":2,"native":"0.4.11","source":"33b259bbbeb1c16433390869938191d09bdb0680"}`,
-		`{"protocol":2,"native":"0.4.12","source":"other"}`} {
+		`{"protocol":2,"native":"0.4.12","source":"33b259bbbeb1c16433390869938191d09bdb0680"}`,
+		`{"protocol":3,"native":"0.4.11","source":"33b259bbbeb1c16433390869938191d09bdb0680"}`,
+		`{"protocol":3,"native":"0.4.12","source":"other"}`} {
 		if err := ValidateWorkspaceReadiness([]byte(raw)); err == nil || err.Error() != "mcode: workspace companion check failed" {
 			t.Fatal("invalid descriptor accepted or exposed", err)
 		}
diff --git a/apps/daemon/internal/agent/mcode/workspace_skills_test.go b/apps/daemon/internal/agent/mcode/workspace_skills_test.go
index 1126eaac9..c063c6553 100644
--- a/apps/daemon/internal/agent/mcode/workspace_skills_test.go
+++ b/apps/daemon/internal/agent/mcode/workspace_skills_test.go
@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
-	"reflect"
+	"slices"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentcapabilities"
@@ -42,17 +42,16 @@ func TestWorkspaceSkillsUseSelectedSnapshotAndNativeLoader(t *testing.T) {
 		}
 		var config struct {
 			Agents map[string]struct {
-				Skills, Tools, BuiltinTools []string
+				Skills, Tools []string
 			}
 		}
 		if err := json.Unmarshal(raw, &config); err != nil {
 			t.Fatal(err)
 		}
 		selected := config.Agents["default"]
-		if !reflect.DeepEqual(selected.Skills, []string{"proof"}) ||
-			!reflect.DeepEqual(selected.Tools, []string{"skill"}) ||
-			!reflect.DeepEqual(selected.BuiltinTools, []string{"skill"}) {
-			t.Fatalf("native selection lost the installed Skill: %+v", selected)
+		// Skill names are not native IDs, so the selection stays open and no tool list carries "skill".
+		if selected.Skills != nil || slices.Contains(selected.Tools, "skill") || !slices.Contains(selected.Tools, "bash") {
+			t.Fatalf("native selection does not leave the installed Skill available: %+v", selected)
 		}
 	}
 }
diff --git a/apps/daemon/internal/agent/mcp_binding.go b/apps/daemon/internal/agent/mcp_binding.go
index a59eb8091..a1f5413f3 100644
--- a/apps/daemon/internal/agent/mcp_binding.go
+++ b/apps/daemon/internal/agent/mcp_binding.go
@@ -12,7 +12,7 @@ import (
 
 // MCPBinding is the Runtime's transient effective declaration. Adapters project
 // it into their native configuration without resolving credentials or packages.
-// Never serialize or log bindings: headers and bearer values may be confidential.
+// Never serialize or log bindings: bearer values are confidential.
 type MCPBinding struct {
 	ServerLabel         string
 	ConnectionOrigin    string
@@ -25,6 +25,8 @@ type MCPBinding struct {
 	HTTPHeaders         map[string]string
 	// Stdio retains the installed package identity for the fixed Runtime launcher.
 	Stdio *proto.EnvironmentMCP
+	// Process is a public stdio declaration, started natively by the Harness.
+	Process *proto.MCPStdio
 }
 
 // ResolveMCPBindings combines public declarations with the frozen installation.
@@ -38,7 +40,16 @@ func ResolveMCPBindings(req proto.PromptRequestPayload) ([]MCPBinding, error) {
 			if err := server.ValidateConnectionOrigin(req); err != nil {
 				return nil, err
 			}
-			item := MCPBinding{ServerLabel: server.ServerLabel, ConnectionOrigin: server.ConnectionOrigin, CredentialAuthority: "none", Transport: "http", ServerURL: server.ServerURL, Required: server.Required, BearerToken: server.BearerToken}
+			transport := "http"
+			if server.Stdio != nil {
+				transport = "stdio"
+			}
+			item := MCPBinding{ServerLabel: server.ServerLabel, ConnectionOrigin: server.ConnectionOrigin, CredentialAuthority: "none", Transport: transport, ServerURL: server.ServerURL, Required: server.Required, BearerToken: server.BearerToken, HTTPHeaders: maps.Clone(server.Headers)}
+			if server.Stdio != nil {
+				process := *server.Stdio
+				process.Args, process.EnvVars = slices.Clone(process.Args), slices.Clone(process.EnvVars)
+				item.Process = &process
+			}
 			if server.AllowedTools != nil {
 				names := append([]string{}, (*server.AllowedTools)...)
 				item.AllowedTools = &names
@@ -50,9 +61,6 @@ func ResolveMCPBindings(req proto.PromptRequestPayload) ([]MCPBinding, error) {
 		}
 	}
 	if local := req.LocalEnvironment; local != nil && len(local.MCP) > 0 {
-		if req.DisableExecutionEnvironment || local.NetworkAccess != "enabled" {
-			return nil, errors.New("environment MCP requires an enabled workspace network")
-		}
 		for _, installed := range local.MCP {
 			declaration := installed.Server
 			item := MCPBinding{ServerLabel: declaration.Name, ConnectionOrigin: "environment", CredentialAuthority: "none", Transport: declaration.Type, ServerURL: declaration.URL, BearerToken: installed.BearerToken, HTTPHeaders: maps.Clone(declaration.HTTPHeaders)}
@@ -82,26 +90,29 @@ func ResolveMCPBindings(req proto.PromptRequestPayload) ([]MCPBinding, error) {
 			value := *item.BearerToken
 			item.BearerToken = &value
 		}
+		if item.AllowedTools != nil {
+			for _, name := range *item.AllowedTools {
+				if name == "" || strings.TrimSpace(name) != name {
+					return nil, errors.New("invalid MCP tool allowlist")
+				}
+			}
+		}
 		switch item.Transport {
 		case "stdio":
-			if item.Stdio == nil || item.BearerToken != nil || len(item.HTTPHeaders) > 0 || item.ServerURL != "" {
-				return nil, errors.New("invalid installed MCP transport")
+			if (item.Stdio == nil) == (item.Process == nil) || item.BearerToken != nil || len(item.HTTPHeaders) > 0 || item.ServerURL != "" {
+				return nil, errors.New("invalid MCP stdio transport")
+			}
+			if process := item.Process; process != nil && !process.Valid() {
+				return nil, errors.New("invalid MCP stdio declaration")
 			}
 		case "http":
 			endpoint, err := url.Parse(item.ServerURL)
-			if err != nil || endpoint.Hostname() == "" || (endpoint.Scheme != "https" && endpoint.Scheme != "http") || endpoint.User != nil || endpoint.Fragment != "" || endpoint.Opaque != "" || (item.ConnectionOrigin == "service" && (endpoint.RawQuery != "" || endpoint.ForceQuery)) {
+			if err != nil || endpoint.Hostname() == "" || (endpoint.Scheme != "https" && endpoint.Scheme != "http") || endpoint.User != nil || endpoint.Fragment != "" || endpoint.Opaque != "" {
 				return nil, errors.New("invalid MCP endpoint")
 			}
 			if item.BearerToken != nil && (endpoint.Scheme != "https" || !ValidMCPHTTPBearerToken(*item.BearerToken)) {
 				return nil, errors.New("invalid HTTPS MCP bearer credential")
 			}
-			if item.AllowedTools != nil {
-				for _, name := range *item.AllowedTools {
-					if name == "" || strings.TrimSpace(name) != name {
-						return nil, errors.New("invalid MCP tool allowlist")
-					}
-				}
-			}
 		default:
 			return nil, errors.New("unsupported MCP transport")
 		}
diff --git a/apps/daemon/internal/agent/mcp_binding_test.go b/apps/daemon/internal/agent/mcp_binding_test.go
index e1a020ede..c205380ed 100644
--- a/apps/daemon/internal/agent/mcp_binding_test.go
+++ b/apps/daemon/internal/agent/mcp_binding_test.go
@@ -1,6 +1,7 @@
 package agent
 
 import (
+	"reflect"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
@@ -25,7 +26,7 @@ func TestMCPBindingsPreserveOriginAuthorityAndPolicy(t *testing.T) {
 			t.Fatal("binding retained mutable credential pointer")
 		}
 	}
-	local := &proto.LocalEnvironment{NetworkAccess: "enabled", MCP: []proto.EnvironmentMCP{
+	local := &proto.LocalEnvironment{MCP: []proto.EnvironmentMCP{
 		{Server: agentplugin.MCPServer{Name: "stdio", Type: "stdio", Command: "node", Args: []string{"tool.js"}}, PackageRoot: "plugins/proof", InstallationRoot: "/private/installed"},
 		{Server: agentplugin.MCPServer{Name: "remote", Type: "http", URL: "https://example.test/mcp", HTTPHeaders: map[string]string{"X-Selected": "literal"}}, BearerToken: &token},
 	}}
@@ -57,13 +58,11 @@ func TestMCPBindingsDistinguishAbsentAndEmptyProfile(t *testing.T) {
 
 func TestMCPBindingsRejectRelocationAndAmbiguousInstallation(t *testing.T) {
 	public := []proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "remote", ServerURL: "https://example.test/mcp"}}
-	local := &proto.LocalEnvironment{NetworkAccess: "enabled", MCP: []proto.EnvironmentMCP{{Server: agentplugin.MCPServer{Name: "remote", Type: "http", URL: "https://example.test/mcp"}}}}
+	local := &proto.LocalEnvironment{MCP: []proto.EnvironmentMCP{{Server: agentplugin.MCPServer{Name: "remote", Type: "http", URL: "https://example.test/mcp"}}}}
 	for _, req := range []proto.PromptRequestPayload{
 		{MCPHTTPServers: &public, LocalEnvironment: local},
-		{DisableExecutionEnvironment: true, LocalEnvironment: local},
-		{LocalEnvironment: &proto.LocalEnvironment{NetworkAccess: "enabled", MCP: append(local.MCP, local.MCP[0])}},
-		{LocalEnvironment: &proto.LocalEnvironment{NetworkAccess: "disabled", MCP: local.MCP}},
-		{LocalEnvironment: &proto.LocalEnvironment{NetworkAccess: "enabled", MCP: []proto.EnvironmentMCP{{Server: agentplugin.MCPServer{Name: "remote", Type: "http", URL: "https://example.test/mcp", BearerTokenEnvVar: "MISSING"}}}}},
+		{LocalEnvironment: &proto.LocalEnvironment{MCP: append(local.MCP, local.MCP[0])}},
+		{LocalEnvironment: &proto.LocalEnvironment{MCP: []proto.EnvironmentMCP{{Server: agentplugin.MCPServer{Name: "remote", Type: "http", URL: "https://example.test/mcp", BearerTokenEnvVar: "MISSING"}}}}},
 	} {
 		if _, err := ResolveMCPBindings(req); err == nil {
 			t.Fatal("unsupported authority accepted")
@@ -75,7 +74,7 @@ func TestPublicEnvironmentMCPRetainsVaultAuthority(t *testing.T) {
 	token := "selected-vault-canary"
 	names := []string{"prove"}
 	public := []proto.MCPHTTPServer{{ConnectionOrigin: "environment", ServerLabel: "remote", ServerURL: "https://example.test/mcp", BearerToken: &token, AllowedTools: &names, Required: true}}
-	req := proto.PromptRequestPayload{MCPHTTPServers: &public, LocalEnvironment: &proto.LocalEnvironment{NetworkAccess: "enabled"}}
+	req := proto.PromptRequestPayload{MCPHTTPServers: &public, LocalEnvironment: &proto.LocalEnvironment{}}
 	got, err := ResolveMCPBindings(req)
 	if err != nil || len(got) != 1 {
 		t.Fatal("environment binding unavailable", err)
@@ -104,3 +103,27 @@ func TestPublicEnvironmentMCPRetainsVaultAuthority(t *testing.T) {
 		t.Fatal("unprepared environment accepted")
 	}
 }
+
+func TestMCPBindingsPublicStdio(t *testing.T) {
+	stdio := proto.MCPStdio{Command: "run", Args: []string{"-x"}, Cwd: "/work", EnvVars: []string{"TOKEN"}}
+	resolve := func(origin string, stdio proto.MCPStdio) ([]MCPBinding, error) {
+		servers := []proto.MCPHTTPServer{{ConnectionOrigin: origin, ServerLabel: "local", Stdio: &stdio}}
+		return ResolveMCPBindings(proto.PromptRequestPayload{LocalEnvironment: &proto.LocalEnvironment{}, MCPHTTPServers: &servers})
+	}
+	got, err := resolve("environment", stdio)
+	if err != nil || len(got) != 1 || got[0].Transport != "stdio" || got[0].Stdio != nil || !reflect.DeepEqual(*got[0].Process, stdio) {
+		t.Fatal("public stdio binding unavailable", got, err)
+	}
+	got[0].Process.Args[0] = "mutated"
+	if stdio.Args[0] != "-x" {
+		t.Fatal("binding shares the declaration")
+	}
+	for name, invalid := range map[string]proto.MCPStdio{"command": {Command: " "}, "variable": {Command: "run", EnvVars: []string{"1=2"}}} {
+		if _, err := resolve("environment", invalid); err == nil {
+			t.Fatal("invalid stdio declaration accepted: " + name)
+		}
+	}
+	if _, err := resolve("service", stdio); err == nil {
+		t.Fatal("service-origin stdio accepted")
+	}
+}
diff --git a/apps/daemon/internal/agent/registry_test.go b/apps/daemon/internal/agent/registry_test.go
index 3d484d6dc..04ffc9420 100644
--- a/apps/daemon/internal/agent/registry_test.go
+++ b/apps/daemon/internal/agent/registry_test.go
@@ -45,7 +45,25 @@ func TestRegistryRegisterRejectsFactoriesForUnavailableRuntime(t *testing.T) {
 			t.Fatal("rejected runtime changed registry")
 		}
 	}()
-	registry.Register(agent.Declaration{Info: info}, agent.Runtime{Info: info, Executor: executor})
+	registry.Register(agent.Declaration{Declaration: harnessconfig.Declaration{Kind: "k"}}, agent.Runtime{Info: info, Executor: executor})
+}
+
+func TestRegistryRegisterRejectsWidenedDiscovery(t *testing.T) {
+	declared := prototest.Capabilities(proto.AgentKindCapabilities{})
+	executor := func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) { return nil, nil }
+	for name, runtime := range map[string]agent.Runtime{
+		"capability": {Info: proto.SupportedAgentKind{Kind: "k", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported})}},
+		"executor":   {Info: proto.SupportedAgentKind{Kind: "k", Available: true, Capabilities: declared}, Executor: executor},
+	} {
+		t.Run(name, func(t *testing.T) {
+			defer func() {
+				if recover() == nil {
+					t.Fatal("discovery widened the declaration")
+				}
+			}()
+			agent.NewRegistry().Register(agent.Declaration{Declaration: harnessconfig.Declaration{Kind: "k", Capabilities: declared}}, runtime)
+		})
+	}
 }
 
 func TestRegistrySupportedAgentKindsReportsDescriptors(t *testing.T) {
diff --git a/apps/daemon/internal/cli/agent_discovery.go b/apps/daemon/internal/cli/agent_discovery.go
index b61818544..06c88d697 100644
--- a/apps/daemon/internal/cli/agent_discovery.go
+++ b/apps/daemon/internal/cli/agent_discovery.go
@@ -1,20 +1,17 @@
 package cli
 
 import (
+	"bytes"
 	"context"
 	"fmt"
+	"sync"
 	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/claudesdk"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/codex"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/mcode"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
 	obslog "github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
 )
 
-var harnessDeclarations = []agent.Declaration{codex.Declaration, mcode.Declaration, claudesdk.Declaration}
-
 type discoveredHarness struct {
 	declaration agent.Declaration
 	runtime     agent.Runtime
@@ -33,22 +30,37 @@ func discoverAgentCLIs(parent context.Context, rc *runContext, profile string, d
 	if err != nil {
 		return nil, err
 	}
-	var out agentCLIDiscovery
-	available := false
-	for _, declaration := range declarations {
-		if rc.installedKinds != nil && !rc.installedKinds[declaration.Info.Kind] {
+	// Preflights are independent and sit on every cold start, so they run
+	// concurrently; their output is replayed in declaration order.
+	type probe struct {
+		runtime        *agent.Runtime
+		stdout, stderr bytes.Buffer
+	}
+	probes := make([]probe, len(declarations))
+	var running sync.WaitGroup
+	for i, declaration := range declarations {
+		if rc.installedKinds != nil && !rc.installedKinds[declaration.Kind] {
 			continue
 		}
-		started := time.Now()
-		runtime := declaration.Discover(parent, agent.DiscoveryOptions{Profile: profile, StateRoot: stateRoot, RuntimeRoot: runtimeRoot, Stdout: rc.stdout, Stderr: rc.stderr}, declaration.Info)
-		obslog.Ctx(parent).Info("runtime startup stage", "stage", "harness_discovery",
-			"harness_kind", declaration.Info.Kind, "duration_ms", float64(time.Since(started))/float64(time.Millisecond),
-			"available", runtime != nil && runtime.Info.Available)
-		if runtime == nil {
+		running.Go(func() {
+			p := &probes[i]
+			started := time.Now()
+			p.runtime = declaration.Discover(parent, agent.DiscoveryOptions{Profile: profile, StateRoot: stateRoot, RuntimeRoot: runtimeRoot, Stdout: &p.stdout, Stderr: &p.stderr}, declaration.Info())
+			obslog.Ctx(parent).Info("runtime startup stage", "stage", "harness_discovery", "harness_kind", declaration.Kind, "duration_ms", float64(time.Since(started))/float64(time.Millisecond), "available", p.runtime != nil && p.runtime.Info.Available)
+		})
+	}
+	running.Wait()
+	var out agentCLIDiscovery
+	available := false
+	for i := range probes {
+		p := &probes[i]
+		_, _ = rc.stdout.Write(p.stdout.Bytes())
+		_, _ = rc.stderr.Write(p.stderr.Bytes())
+		if p.runtime == nil {
 			continue
 		}
-		out = append(out, discoveredHarness{declaration, *runtime})
-		available = available || runtime.Info.Available
+		out = append(out, discoveredHarness{declarations[i], *p.runtime})
+		available = available || p.runtime.Info.Available
 	}
 	if err := parent.Err(); err != nil {
 		return out, err
diff --git a/apps/daemon/internal/cli/claude_sdk_live_linux_test.go b/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
index 283a34291..080ae43a3 100644
--- a/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
+++ b/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
@@ -87,7 +87,7 @@ func TestLiveRegisteredClaudeSDK(t *testing.T) {
 		ctx, cancel := context.WithTimeout(t.Context(), 120*time.Second)
 		defer cancel()
 		id, prepare := uuid.NewString(), uuid.NewString()
-		request := proto.PromptRequestPayload{AgentKind: "claude_sdk", AgentStateKey: "agents-api-registered-acceptance", AgentSessionID: resume, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": nil}}
+		request := proto.PromptRequestPayload{AgentKind: "claude_sdk", AgentStateKey: "registered-acceptance", AgentSessionID: resume, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": nil}}
 		if callFunction {
 			request.FunctionTools = []proto.FunctionTool{{Name: "lookup", Description: "Return a verification value.", Parameters: json.RawMessage(`{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}`)}}
 		}
diff --git a/apps/daemon/internal/cli/connect.go b/apps/daemon/internal/cli/connect.go
index 3b26fc80d..ab9419878 100644
--- a/apps/daemon/internal/cli/connect.go
+++ b/apps/daemon/internal/cli/connect.go
@@ -316,6 +316,16 @@ func mainLoopRemoteWithDiscovery(parent context.Context, rc *runContext, profile
 // conn.Recv(), heartbeats every boot.HeartbeatInterval(), and a
 // confirmed router.Shutdown before returning ownership to the reconnect loop.
 // Failed cleanup keeps this exact Router alive, including after a shutdown signal.
+// advertisedKinds withdraws workspace export when this host cannot provide it now.
+func advertisedKinds(registry *agent.Registry, canExport bool) []proto.SupportedAgentKind {
+	kinds := registry.SupportedAgentKinds()
+	for i := range kinds {
+		caps := &kinds[i].Capabilities
+		agent.Narrow(&caps.WorkspaceOutputExport, canExport && caps.LocalEnvironment.IsSupported() && caps.WorkspaceReadPreparation.IsSupported())
+	}
+	return kinds
+}
+
 func pumpConn(parentCtx context.Context, conn *transport.Conn, registry *agent.Registry, boot *transport.BootstrapResponse, agentCLIs agentCLIDiscovery) error {
 	local, err := localworkspace.Load()
 	if err != nil {
@@ -336,11 +346,7 @@ func pumpConn(parentCtx context.Context, conn *transport.Conn, registry *agent.R
 	}()
 
 	conn.StartHeartbeats(parentCtx, boot.HeartbeatInterval(), func() proto.HeartbeatPayload {
-		kinds := registry.SupportedAgentKinds()
-		for i := range kinds {
-			caps := &kinds[i].Capabilities
-			caps.WorkspaceOutputExport = proto.CapabilityFromBool(local.CanExport() && caps.LocalEnvironment.IsSupported() && caps.WorkspaceReadPreparation.IsSupported())
-		}
+		kinds := advertisedKinds(registry, local.CanExport())
 		return proto.HeartbeatPayload{
 			Timestamp:           time.Now().Unix(),
 			ActiveRequests:      router.ActiveRuns(),
diff --git a/apps/daemon/internal/cli/connect_cleanup_test.go b/apps/daemon/internal/cli/connect_cleanup_test.go
index ba6192874..e84fd7dd2 100644
--- a/apps/daemon/internal/cli/connect_cleanup_test.go
+++ b/apps/daemon/internal/cli/connect_cleanup_test.go
@@ -145,7 +145,7 @@ func testDisconnectedPumpCleanup(t *testing.T, suspend bool) {
 	}
 	defer peer.Close()
 	env, err := proto.NewEnvelope(proto.TypeExecutionPrepare, "prepare", proto.ExecutionPreparePayload{SessionID: "cleanup",
-		Configuration: proto.PromptRequestPayload{AgentKind: "cleanup", AgentStateKey: "agents-api-cleanup", DisableExecutionEnvironment: true}})
+		Configuration: proto.PromptRequestPayload{AgentKind: "cleanup", AgentStateKey: "cleanup", DisableExecutionEnvironment: true}})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/cli/connect_environment_binding.go b/apps/daemon/internal/cli/connect_environment_binding.go
index b661092e0..9cf2f0ca0 100644
--- a/apps/daemon/internal/cli/connect_environment_binding.go
+++ b/apps/daemon/internal/cli/connect_environment_binding.go
@@ -60,18 +60,12 @@ func bindEnvironmentRuntime(remote string, bound environmentEnrollment, credenti
 	if bound.WorkspaceDirectory != "/workspace" && bound.WorkspaceDirectory != workspace {
 		return errors.New("connect: enrollment does not match the Runtime workspace")
 	}
-	for key, value := range map[string]string{
-		"OAC_RUNTIME_ENVIRONMENT_ID": bound.EnvironmentID,
-		"OAC_RUNTIME_SESSION_ID":     bound.SessionID,
-		"OAC_RUNTIME_NETWORK_ACCESS": "enabled",
-	} {
+	identity := map[string]string{"OAC_RUNTIME_ENVIRONMENT_ID": bound.EnvironmentID, "OAC_RUNTIME_SESSION_ID": bound.SessionID}
+	for key, value := range identity {
 		if previous := os.Getenv(key); previous != "" && previous != value {
-			return errors.New("connect: conflicting Runtime identity or policy")
+			return errors.New("connect: conflicting Runtime identity")
 		}
 	}
-	if domains := os.Getenv("OAC_RUNTIME_ALLOWED_DOMAINS"); domains != "" && domains != "[]" {
-		return errors.New("connect: conflicting Runtime network domains")
-	}
 	capabilityDirectory := os.Getenv("OAC_RUNTIME_CAPABILITY_DIRECTORY")
 	if capabilityDirectory == "" {
 		capabilityDirectory = localworkspace.CapabilityDirectory
@@ -83,7 +77,7 @@ func bindEnvironmentRuntime(remote string, bound environmentEnrollment, credenti
 	if err = saveEnvironmentBinding(root, want); err != nil {
 		return err
 	}
-	for key, value := range map[string]string{"OAC_RUNTIME_ENVIRONMENT_ID": bound.EnvironmentID, "OAC_RUNTIME_SESSION_ID": bound.SessionID, "OAC_RUNTIME_NETWORK_ACCESS": "enabled"} {
+	for key, value := range identity {
 		if err = os.Setenv(key, value); err != nil {
 			return errors.New("connect: Runtime identity configuration failed")
 		}
diff --git a/apps/daemon/internal/cli/connect_environment_binding_test.go b/apps/daemon/internal/cli/connect_environment_binding_test.go
index 0f2b3ac68..bf9e91728 100644
--- a/apps/daemon/internal/cli/connect_environment_binding_test.go
+++ b/apps/daemon/internal/cli/connect_environment_binding_test.go
@@ -23,7 +23,7 @@ func environmentRuntimeFixture(t *testing.T) (root, workspace, credential string
 	}
 	t.Setenv("OAC_RUNTIME_HOME", root)
 	t.Setenv("OAC_RUNTIME_WORKSPACE", workspace)
-	for _, name := range []string{"OAC_RUNTIME_ENVIRONMENT_ID", "OAC_RUNTIME_SESSION_ID", "OAC_RUNTIME_NETWORK_ACCESS", "OAC_RUNTIME_ALLOWED_DOMAINS"} {
+	for _, name := range []string{"OAC_RUNTIME_ENVIRONMENT_ID", "OAC_RUNTIME_SESSION_ID"} {
 		t.Setenv(name, "")
 	}
 	return root, workspace, credential, environmentEnrollment{uuid.NewString(), uuid.NewString(), uuid.NewString(), "/workspace"}
diff --git a/apps/daemon/internal/cli/connect_heartbeat_test.go b/apps/daemon/internal/cli/connect_heartbeat_test.go
new file mode 100644
index 000000000..cc29ac3d4
--- /dev/null
+++ b/apps/daemon/internal/cli/connect_heartbeat_test.go
@@ -0,0 +1,26 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+)
+
+func TestHeartbeatNeverAdvertisesUndeclaredExport(t *testing.T) {
+	local := proto.AgentKindCapabilities{LocalEnvironment: proto.CapabilitySupported, WorkspaceReadPreparation: proto.CapabilitySupported}
+	exporting := local
+	exporting.WorkspaceOutputExport = proto.CapabilitySupported
+	registry := agent.NewRegistry()
+	registry.RegisterKind(proto.SupportedAgentKind{Kind: "declared", Available: true, Capabilities: prototest.Capabilities(exporting)}, harnessconfig.Configuration{})
+	registry.RegisterKind(proto.SupportedAgentKind{Kind: "undeclared", Available: true, Capabilities: prototest.Capabilities(local)}, harnessconfig.Configuration{})
+	for _, canExport := range []bool{false, true} {
+		for _, kind := range advertisedKinds(registry, canExport) {
+			if got, want := kind.Capabilities.WorkspaceOutputExport.IsSupported(), canExport && kind.Kind == "declared"; got != want {
+				t.Fatalf("%s with host export %v advertised export %v", kind.Kind, canExport, got)
+			}
+		}
+	}
+}
diff --git a/apps/daemon/internal/cli/connect_suspend.go b/apps/daemon/internal/cli/connect_suspend.go
index 40e918092..5fb40fb31 100644
--- a/apps/daemon/internal/cli/connect_suspend.go
+++ b/apps/daemon/internal/cli/connect_suspend.go
@@ -152,11 +152,7 @@ func (s *suspendedRouter) reconnectSuspension(ctx context.Context, dial transpor
 
 func (s *suspendedRouter) heartbeats(ctx context.Context, conn *transport.Conn, boot *transport.BootstrapResponse, discovery agentCLIDiscovery) {
 	conn.StartHeartbeats(ctx, boot.HeartbeatInterval(), func() proto.HeartbeatPayload {
-		kinds := s.registry.SupportedAgentKinds()
-		for i := range kinds {
-			caps := &kinds[i].Capabilities
-			caps.WorkspaceOutputExport = proto.CapabilityFromBool(s.local.CanExport() && caps.LocalEnvironment.IsSupported() && caps.WorkspaceReadPreparation.IsSupported())
-		}
+		kinds := advertisedKinds(s.registry, s.local.CanExport())
 		return proto.HeartbeatPayload{Timestamp: time.Now().Unix(), ActiveRequests: s.router.ActiveRuns(), DaemonVersion: Version, SupportedAgentKinds: kinds}
 	}, obslog.Bg())
 }
diff --git a/apps/daemon/internal/cli/connect_suspend_test.go b/apps/daemon/internal/cli/connect_suspend_test.go
index 6d92648e2..34cf456c8 100644
--- a/apps/daemon/internal/cli/connect_suspend_test.go
+++ b/apps/daemon/internal/cli/connect_suspend_test.go
@@ -347,8 +347,6 @@ func TestQuiesceRetainsExecutorAcrossReconnectAndShutdownConfirmsCleanup(t *test
 	t.Setenv("OAC_RUNTIME_CAPABILITY_DIRECTORY", t.TempDir())
 	t.Setenv("OAC_RUNTIME_ENVIRONMENT_ID", environment)
 	t.Setenv("OAC_RUNTIME_SESSION_ID", session)
-	t.Setenv("OAC_RUNTIME_NETWORK_ACCESS", "disabled")
-	t.Setenv("OAC_RUNTIME_ALLOWED_DOMAINS", "")
 	peers := make(chan *websocket.Conn, 2)
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		peer, err := (&websocket.Upgrader{}).Upgrade(w, r, nil)
@@ -385,7 +383,7 @@ func TestQuiesceRetainsExecutorAcrossReconnectAndShutdownConfirmsCleanup(t *test
 		t.Fatal("no connection")
 	}
 	defer peer.Close()
-	preparation, err := proto.NewEnvelope(proto.TypeExecutionPrepare, "prepare", proto.ExecutionPreparePayload{SessionID: session, Configuration: proto.PromptRequestPayload{AgentKind: "cleanup", AgentStateKey: "agents-api-" + session, LocalEnvironment: &proto.LocalEnvironment{ID: environment, NetworkAccess: "disabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}}})
+	preparation, err := proto.NewEnvelope(proto.TypeExecutionPrepare, "prepare", proto.ExecutionPreparePayload{SessionID: session, Configuration: proto.PromptRequestPayload{AgentKind: "cleanup", AgentStateKey: session, LocalEnvironment: &proto.LocalEnvironment{ID: environment, WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}}})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/cli/harness_declarations.go b/apps/daemon/internal/cli/harness_declarations.go
new file mode 100644
index 000000000..4710bc764
--- /dev/null
+++ b/apps/daemon/internal/cli/harness_declarations.go
@@ -0,0 +1,12 @@
+// Code generated by scripts/generate-harness-catalog.py; DO NOT EDIT.
+package cli
+
+import (
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/claudesdk"
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/codex"
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/mcode"
+)
+
+// harnessDeclarations binds every built-in Harness declaration to its Runtime adapter.
+var harnessDeclarations = []agent.Declaration{claudesdk.Declaration, codex.Declaration, mcode.Declaration}
diff --git a/apps/daemon/internal/cli/native_bundle.go b/apps/daemon/internal/cli/native_bundle.go
index 3f2126ce4..ff5a7fad1 100644
--- a/apps/daemon/internal/cli/native_bundle.go
+++ b/apps/daemon/internal/cli/native_bundle.go
@@ -84,8 +84,6 @@ func validBundlePath(name string) bool {
 	return name != "." && path.Clean(name) == name && !strings.ContainsAny(name, "\\\x00\r\n:") && filepath.IsLocal(filepath.FromSlash(name)) && name != ".oac-install.json"
 }
 
-func nativeComponentRoot(root, name string) string { return filepath.Join(root, "components", name) }
-
 func componentReceipt(root string) (nativeComponent, error) {
 	var c nativeComponent
 	err := readNativeJSON(filepath.Join(root, ".oac-install.json"), &c)
@@ -130,35 +128,90 @@ func checkComponentFiles(ctx context.Context, directory string, c nativeComponen
 	return nil
 }
 
-// A complete component is published once. An interruption cannot turn a partial
-// copy into an installation; a subsequent run can reuse an already-published one.
-func installNativeComponent(ctx context.Context, source, root, name string, expected nativeComponent) error {
-	dest := nativeComponentRoot(root, name)
+// verifyNativeComponent checks a stored component against its receipt and, when the distribution
+// is at hand, against the distribution's manifest.
+func verifyNativeComponent(ctx context.Context, dir, name string, expected *nativeComponent) error {
+	info, err := os.Lstat(dir)
+	if errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("shared component %s is missing from %s; run install again", name, filepath.Dir(dir))
+	}
+	remedy := "stop the installations that use it, delete " + dir + " (" + nativeDeleteCommand(dir) + ") and run install again"
+	if err != nil || !info.IsDir() || !ownedByCurrentUser(info) {
+		return fmt.Errorf("shared component %s is not a directory of this account; %s", name, remedy)
+	}
+	c, err := componentReceipt(dir)
+	if err != nil || c.Version != nativePins[name] || len(c.Files) == 0 {
+		return fmt.Errorf("shared component %s is missing files or modified; %s", name, remedy)
+	}
+	if expected != nil && !reflect.DeepEqual(c, *expected) {
+		return fmt.Errorf("shared component %s differs from this distribution's bundle.json; %s", name, remedy)
+	}
+	if err = checkComponentFiles(ctx, dir, c); errors.Is(err, errNativeComponentMismatch) || errors.Is(err, os.ErrNotExist) || errors.Is(err, os.ErrPermission) {
+		return fmt.Errorf("shared component %s is missing files, modified or unreadable; %s", name, remedy)
+	} else if err != nil {
+		return fmt.Errorf("install: cannot verify shared component %s: %w", name, err)
+	}
+	return nil
+}
+
+// ensureNativeComponent makes the store hold name: a stored component is verified, a missing one is
+// copied from the distribution directory or, with a Core address, downloaded. It is published
+// once, complete and read-only, so an interruption leaves nothing partial in place.
+func ensureNativeComponent(ctx context.Context, out io.Writer, o *nativeInstallOptions, name string, expected nativeComponent) error {
+	dest := filepath.Join(o.ComponentDirectory, name)
 	if _, err := os.Lstat(dest); err == nil {
-		got, e := componentReceipt(dest)
-		if e != nil || !reflect.DeepEqual(got, expected) {
-			return fmt.Errorf("install: existing %s is incompatible; preserve it and use a separate installation directory", name)
-		}
-		if err := checkComponentFiles(ctx, dest, got); err != nil {
-			if errors.Is(err, errNativeComponentMismatch) || errors.Is(err, os.ErrNotExist) {
-				return fmt.Errorf("install: existing %s is incomplete or modified; reinstall separately", name)
-			}
-			return fmt.Errorf("install: cannot verify existing %s: %w", name, err)
+		err = nativeInstallPhase(out, "Using installed "+name, func() error { return verifyNativeComponent(ctx, dest, name, &expected) })
+		if err != nil {
+			return err
 		}
-		return nil
+		// An interruption between the rename and the seal leaves the top directory writable.
+		return sealNativeComponent(dest)
 	} else if !errors.Is(err, os.ErrNotExist) {
 		return err
 	}
-	parent := filepath.Dir(dest)
-	if err := os.MkdirAll(parent, 0700); err != nil {
+	source := filepath.Join(o.Bundle, "components", name)
+	_, missing := os.Lstat(source)
+	if missing != nil && o.OnboardURL == "" {
+		return fmt.Errorf("install: component %s is missing from %s; extract %s-%s-%s.tar.gz into it and retry", name, o.Bundle, runtime.GOOS, runtime.GOARCH, name)
+	}
+	stage, err := os.MkdirTemp(o.ComponentDirectory, ".install-"+name+"-")
+	if err != nil {
 		return err
 	}
-	tmp, err := os.MkdirTemp(parent, ".install-"+name+"-")
+	defer removeNativeTree(stage)
+	var archive string
+	if missing == nil {
+		err = nativeInstallPhase(out, "Installing "+name, func() error { return copyNativeComponent(ctx, source, stage, expected) })
+	} else {
+		// A download prints its own progress, which a redrawn phase line would interleave with.
+		fmt.Fprintln(out, "Installing "+name+"...")
+		archive, err = downloadNativeComponent(ctx, out, o.OnboardURL, name, stage, expected)
+	}
 	if err != nil {
 		return err
 	}
-	defer os.RemoveAll(tmp)
-	src, err := os.OpenRoot(filepath.Join(source, "components", name))
+	raw, _ := json.Marshal(expected)
+	if err = os.WriteFile(filepath.Join(stage, ".oac-install.json"), raw, 0600); err != nil {
+		return err
+	}
+	if err = ctx.Err(); err != nil {
+		return err
+	}
+	if err = setNativeReadOnly(stage); err != nil {
+		return err
+	}
+	if err = os.Rename(stage, dest); err != nil {
+		return err
+	}
+	if archive != "" {
+		_ = os.Remove(archive)
+	}
+	return sealNativeComponent(dest)
+}
+
+// copyNativeComponent copies the manifest's files from the distribution into stage, verifying each.
+func copyNativeComponent(ctx context.Context, source, stage string, expected nativeComponent) error {
+	src, err := os.OpenRoot(source)
 	if err != nil {
 		return err
 	}
@@ -177,16 +230,13 @@ func installNativeComponent(ctx context.Context, source, root, name string, expe
 		}
 		required += uint64(info.Size())
 	}
-	if err = requireNativeSpace(parent, required); err != nil {
+	if err = requireNativeSpace(filepath.Dir(stage), required); err != nil {
 		return err
 	}
 	for name, expectedFile := range expected.Files {
 		if err := ctx.Err(); err != nil {
 			return err
 		}
-		if !validBundlePath(name) {
-			return errors.New("install: invalid component path")
-		}
 		in, err := src.Open(filepath.FromSlash(name))
 		if err != nil {
 			return errors.New("install: component file unavailable")
@@ -196,7 +246,7 @@ func installNativeComponent(ctx context.Context, source, root, name string, expe
 			in.Close()
 			return errors.New("install: component must contain regular files")
 		}
-		destination := filepath.Join(tmp, filepath.FromSlash(name))
+		destination := filepath.Join(stage, filepath.FromSlash(name))
 		if err = os.MkdirAll(filepath.Dir(destination), 0700); err != nil {
 			in.Close()
 			return err
@@ -227,14 +277,7 @@ func installNativeComponent(ctx context.Context, source, root, name string, expe
 			return errors.New("install: component checksum failed")
 		}
 	}
-	raw, _ := json.Marshal(expected)
-	if err = os.WriteFile(filepath.Join(tmp, ".oac-install.json"), raw, 0600); err != nil {
-		return err
-	}
-	if err := ctx.Err(); err != nil {
-		return err
-	}
-	return os.Rename(tmp, dest)
+	return nil
 }
 
 func selectedNativeHarnesses(value string) ([]string, error) {
diff --git a/apps/daemon/internal/cli/native_discovery_test.go b/apps/daemon/internal/cli/native_discovery_test.go
index e1dd6f225..1a71f932c 100644
--- a/apps/daemon/internal/cli/native_discovery_test.go
+++ b/apps/daemon/internal/cli/native_discovery_test.go
@@ -3,9 +3,13 @@ package cli
 import (
 	"context"
 	"errors"
+	"fmt"
 	"io"
 	"reflect"
+	"strings"
+	"sync"
 	"testing"
+	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
@@ -17,31 +21,44 @@ func TestDiscoveryAndRegistration(t *testing.T) {
 			runtimeRoot, stateRoot := t.TempDir(), t.TempDir()
 			t.Setenv("OAC_RUNTIME_HOME", runtimeRoot)
 			t.Setenv("OAC_RUNTIME_STATE_DIRECTORY", stateRoot)
-			called := []string{}
+			rc := &runContext{stdout: io.Discard, stderr: io.Discard}
+			expected := []string{"claude_sdk", "codex", "mcode"}
+			if selected != "" {
+				rc.installedKinds = map[string]bool{selected: true}
+				expected = []string{selected}
+			}
+			// Each probe waits for all selected probes to start, so a sequential
+			// discovery fails here instead of passing slowly.
+			var started sync.WaitGroup
+			started.Add(len(expected))
+			all := make(chan struct{})
+			go func() { started.Wait(); close(all) }()
 			declarations := append([]agent.Declaration(nil), harnessDeclarations...)
 			for i := range declarations {
 				declarations[i].Discover = func(_ context.Context, options agent.DiscoveryOptions, info proto.SupportedAgentKind) *agent.Runtime {
 					if options.RuntimeRoot != runtimeRoot || options.StateRoot != stateRoot {
-						t.Fatal("discovery lost explicit directory context")
+						t.Error("discovery lost explicit directory context")
+					}
+					started.Done()
+					select {
+					case <-all:
+					case <-time.After(5 * time.Second):
+						t.Error("preflights did not run concurrently")
 					}
-					called = append(called, info.Kind)
+					fmt.Fprintln(options.Stdout, info.Kind)
 					info.Available = true
 					info.Version = "test"
 					return &agent.Runtime{Info: info}
 				}
 			}
-			rc := &runContext{stdout: io.Discard, stderr: io.Discard}
-			expected := []string{"codex", "mcode", "claude_sdk"}
-			if selected != "" {
-				rc.installedKinds = map[string]bool{selected: true}
-				expected = []string{selected}
-			}
+			var stdout strings.Builder
+			rc.stdout = &stdout
 			discovery, err := discoverAgentCLIs(t.Context(), rc, "default", declarations)
 			if err != nil {
 				t.Fatal(err)
 			}
-			if !reflect.DeepEqual(called, expected) {
-				t.Fatalf("probes %v, want %v", called, expected)
+			if got := strings.Fields(stdout.String()); !reflect.DeepEqual(got, expected) {
+				t.Fatalf("preflight output %v, want %v", got, expected)
 			}
 			registry := agent.NewRegistry()
 			registerAgentKinds(registry, discovery)
diff --git a/apps/daemon/internal/cli/native_download.go b/apps/daemon/internal/cli/native_download.go
new file mode 100644
index 000000000..e79317190
--- /dev/null
+++ b/apps/daemon/internal/cli/native_download.go
@@ -0,0 +1,387 @@
+package cli
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimefs"
+)
+
+const nativeAttempts = 5
+
+var (
+	nativeStall        = 60 * time.Second
+	nativeRetryDelay   = time.Second
+	nativeDigest       = regexp.MustCompile(`^[0-9a-f]{64}$`)
+	errNativeRedirect  = errors.New("install: a download redirect must use HTTPS without credentials")
+	errNativeStall     = errors.New("install: download stalled (no data for 60 seconds)")
+	errNativeNoArchive = errors.New("install: this Core has no qualified archive for this component and platform")
+)
+
+// nativeClient follows redirects only to HTTPS, as the release host requires.
+var nativeClient = &http.Client{CheckRedirect: func(req *http.Request, via []*http.Request) error {
+	if len(via) > 5 || req.URL.Scheme != "https" || req.URL.User != nil {
+		return errNativeRedirect
+	}
+	return nil
+}}
+
+// nativeInstallerBase is where Core serves this release's installer archives.
+func nativeInstallerBase(onboardURL string) string {
+	return strings.TrimSuffix(onboardURL, "installation") + "install/" + Version
+}
+
+// nativeDownloadDirectory holds only transient files: the installer's bundle.* directories and the
+// partial archive that a retry or a later run resumes.
+func nativeDownloadDirectory() (string, error) {
+	home, err := paths.Root()
+	if err != nil {
+		return "", err
+	}
+	cache := filepath.Join(home, "native-download")
+	if err = runtimefs.EnsurePrivateDir(cache); err != nil {
+		return "", err
+	}
+	pruneNativeDownloads(cache)
+	dir := filepath.Join(cache, Version)
+	return dir, os.MkdirAll(dir, 0700)
+}
+
+// downloadNativeComponent fetches the archive of one component, verifies it against Core's
+// checksum and extracts it into stage. It returns the archive, which the caller deletes once the
+// component is published.
+func downloadNativeComponent(ctx context.Context, out io.Writer, onboardURL, name, stage string, expected nativeComponent) (string, error) {
+	dir, err := nativeDownloadDirectory()
+	if err != nil {
+		return "", err
+	}
+	file := runtime.GOOS + "-" + runtime.GOARCH + "-" + name
+	archive, err := fetchNativeArchive(ctx, out, nativeInstallerBase(onboardURL)+"/"+file, dir, file)
+	if err != nil {
+		return "", err
+	}
+	return archive, extractNativeComponent(ctx, out, archive, stage, name, expected)
+}
+
+// pruneNativeDownloads keeps the current version and recent distribution directories of running
+// installers. Failing to remove an old entry is harmless.
+func pruneNativeDownloads(cache string) {
+	entries, _ := os.ReadDir(cache)
+	for _, entry := range entries {
+		info, err := entry.Info()
+		recent := err == nil && strings.HasPrefix(entry.Name(), "bundle.") && time.Since(info.ModTime()) < 24*time.Hour
+		if entry.Name() != Version && !recent {
+			_ = os.RemoveAll(filepath.Join(cache, entry.Name()))
+		}
+	}
+}
+
+// fetchNativeArchive returns the verified archive, downloading or resuming it as needed.
+func fetchNativeArchive(ctx context.Context, out io.Writer, url, dir, file string) (string, error) {
+	want, err := fetchNativeChecksum(ctx, out, url+".sha256")
+	if err != nil {
+		return "", err
+	}
+	part := filepath.Join(dir, file+".tar.gz.part")
+	for pass := 0; ; pass++ {
+		resumed := false
+		if info, err := os.Stat(part); err == nil && info.Size() > 0 {
+			resumed = true
+			fmt.Fprintf(out, "Resuming the earlier %s download...\n", file)
+		}
+		if err = retryNativeDownload(ctx, out, func() (bool, error) { return downloadNativeFile(ctx, out, url+".tar.gz", part, file) }); err != nil {
+			return "", err
+		}
+		got, err := nativeFileDigest(ctx, part)
+		if err != nil {
+			return "", err
+		}
+		if got == want {
+			return part, nil
+		}
+		_ = os.Remove(part)
+		// A resumed file may have been damaged earlier; one clean download decides.
+		if !resumed || pass > 0 {
+			return "", errors.New("install: archive checksum mismatch; the download was discarded, rerun the command to download it again")
+		}
+	}
+}
+
+func fetchNativeChecksum(ctx context.Context, out io.Writer, url string) (string, error) {
+	var digest string
+	err := retryNativeDownload(ctx, out, func() (bool, error) {
+		ctx, cancel := context.WithTimeoutCause(ctx, nativeStall, errNativeStall)
+		defer cancel()
+		response, retry, err := getNative(ctx, url, 0)
+		if err != nil {
+			return retry, stalled(ctx, err)
+		}
+		defer response.Body.Close()
+		raw, err := io.ReadAll(io.LimitReader(response.Body, 1025))
+		digest = strings.TrimSpace(string(raw))
+		if err != nil {
+			return true, stalled(ctx, err)
+		}
+		if !nativeDigest.MatchString(digest) {
+			return false, errors.New("install: Core returned an invalid archive checksum")
+		}
+		return false, nil
+	})
+	return digest, err
+}
+
+// getNative returns a 200 or 206 response, or whether its failure is worth another attempt.
+func getNative(ctx context.Context, url string, offset int64) (*http.Response, bool, error) {
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, false, errors.New("install: invalid Core installer address")
+	}
+	if offset > 0 {
+		request.Header.Set("Range", fmt.Sprintf("bytes=%d-", offset))
+	}
+	response, err := nativeClient.Do(request)
+	if err != nil {
+		return nil, !errors.Is(err, errNativeRedirect), err
+	}
+	code := response.StatusCode
+	switch {
+	case code == http.StatusOK || code == http.StatusPartialContent || code == http.StatusRequestedRangeNotSatisfiable:
+		return response, false, nil
+	case code == http.StatusNotFound:
+		err = errNativeNoArchive
+	default:
+		err = fmt.Errorf("install: download failed (HTTP %d); check Core and the download host", code)
+	}
+	response.Body.Close()
+	return nil, code == 408 || code == 429 || code >= 500, err
+}
+
+func retryNativeDownload(ctx context.Context, out io.Writer, attempt func() (bool, error)) error {
+	for n := 1; ; n++ {
+		retry, err := attempt()
+		if err == nil {
+			return nil
+		}
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+		if !retry || nativeDiskFull(err) {
+			return err
+		}
+		if n == nativeAttempts {
+			return fmt.Errorf("%w (downloaded data is kept; check the network to Core and GitHub, set HTTPS_PROXY if a proxy is required, and rerun the command)", err)
+		}
+		fmt.Fprintf(out, "Download interrupted; retrying (%d/%d)...\n", n, nativeAttempts-1)
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(time.Duration(n) * nativeRetryDelay):
+		}
+	}
+}
+
+// downloadNativeFile appends to dest from where an earlier attempt stopped and fails when no data
+// arrives for nativeStall. There is no total time limit.
+func downloadNativeFile(ctx context.Context, out io.Writer, url, dest, label string) (bool, error) {
+	var offset int64
+	if info, err := os.Stat(dest); err == nil {
+		offset = info.Size()
+	}
+	ctx, cancel := context.WithCancelCause(ctx)
+	defer cancel(nil)
+	stall := time.AfterFunc(nativeStall, func() { cancel(errNativeStall) })
+	defer stall.Stop()
+	response, retry, err := getNative(ctx, url, offset)
+	if err != nil {
+		return retry, stalled(ctx, err)
+	}
+	defer response.Body.Close()
+	flags := os.O_WRONLY | os.O_CREATE | os.O_APPEND
+	switch response.StatusCode {
+	case http.StatusRequestedRangeNotSatisfiable:
+		return false, nil // The partial file already holds everything; the checksum decides.
+	case http.StatusOK:
+		flags, offset = os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0
+	}
+	if response.ContentLength > 0 {
+		if err = requireNativeSpace(filepath.Dir(dest), uint64(response.ContentLength)); err != nil {
+			return false, err
+		}
+	}
+	file, err := os.OpenFile(dest, flags, 0600)
+	if err != nil {
+		return false, err
+	}
+	progress := &nativeProgress{out: out, label: label, done: offset}
+	if response.ContentLength > 0 {
+		progress.total = offset + response.ContentLength
+	}
+	_, err = io.Copy(file, &nativeBody{Reader: response.Body, stall: stall, progress: progress})
+	if closeErr := file.Close(); err == nil {
+		err = closeErr
+	}
+	return err != nil, stalled(ctx, err)
+}
+
+// stalled reports a stall instead of the cancellation it caused.
+func stalled(ctx context.Context, err error) error {
+	if err != nil && errors.Is(context.Cause(ctx), errNativeStall) {
+		return errNativeStall
+	}
+	return err
+}
+
+type nativeBody struct {
+	io.Reader
+	stall    *time.Timer
+	progress *nativeProgress
+}
+
+func (b *nativeBody) Read(p []byte) (int, error) {
+	n, err := b.Reader.Read(p)
+	if n > 0 {
+		b.stall.Reset(nativeStall)
+		b.progress.add(int64(n))
+	}
+	return n, err
+}
+
+// nativeProgress prints one short line for each tenth of a download.
+type nativeProgress struct {
+	out         io.Writer
+	label       string
+	done, total int64
+	step        int64
+}
+
+func (p *nativeProgress) add(n int64) {
+	p.done += n
+	if p.total == 0 {
+		return
+	}
+	if step := p.done * 10 / p.total; step > p.step {
+		p.step = step
+		fmt.Fprintf(p.out, "Downloading %s: %d%% (%d of %d MiB)\n", p.label, step*10, p.done>>20, p.total>>20)
+	}
+}
+
+func nativeFileDigest(ctx context.Context, path string) (string, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+	hash := sha256.New()
+	if _, err = nativeCopy(ctx, hash, file); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+// extractNativeComponent unpacks components/<name>/ from a verified archive into stage. Only regular
+// files and directories under that path are accepted, and only files that bundle.json lists; every
+// file is then checked against its digest.
+func extractNativeComponent(ctx context.Context, out io.Writer, archive, stage, name string, expected nativeComponent) error {
+	var size uint64
+	if err := eachNativeEntry(ctx, archive, name, func(h *tar.Header, _ string, _ io.Reader) error {
+		size += uint64(h.Size)
+		return nil
+	}); err != nil {
+		return err
+	}
+	if err := requireNativeSpace(filepath.Dir(stage), size); err != nil {
+		return err
+	}
+	fmt.Fprintf(out, "Extracting %s...\n", name)
+	if err := eachNativeEntry(ctx, archive, name, func(h *tar.Header, rel string, r io.Reader) error {
+		target := filepath.Join(stage, filepath.FromSlash(rel))
+		if h.Typeflag == tar.TypeDir {
+			return os.MkdirAll(target, 0700)
+		}
+		listed, ok := expected.Files[rel]
+		if !ok {
+			return errors.New("install: component archive holds a file that bundle.json does not list")
+		}
+		if err := os.MkdirAll(filepath.Dir(target), 0700); err != nil {
+			return err
+		}
+		mode := os.FileMode(0600)
+		if listed.Executable {
+			mode = 0700
+		}
+		file, err := os.OpenFile(target, os.O_CREATE|os.O_EXCL|os.O_WRONLY, mode)
+		if err != nil {
+			return err
+		}
+		_, err = nativeCopy(ctx, file, r)
+		if closeErr := file.Close(); err == nil {
+			err = closeErr
+		}
+		return err
+	}); err != nil {
+		return err
+	}
+	if err := checkComponentFiles(ctx, stage, expected); err != nil {
+		if errors.Is(err, errNativeComponentMismatch) || errors.Is(err, os.ErrNotExist) {
+			return errors.New("install: component archive does not match bundle.json; Core serves inconsistent installer files")
+		}
+		return err
+	}
+	return nil
+}
+
+// eachNativeEntry visits the files and directories of a component archive; the root directory itself is skipped.
+func eachNativeEntry(ctx context.Context, archive, name string, visit func(*tar.Header, string, io.Reader) error) error {
+	file, err := os.Open(archive)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	zipped, err := gzip.NewReader(nativeCopyReader{ctx: ctx, Reader: file})
+	if err != nil {
+		return errors.New("install: component archive is invalid; remove it and retry")
+	}
+	reader := tar.NewReader(zipped)
+	prefix := "components/" + name + "/"
+	for {
+		header, err := reader.Next()
+		if errors.Is(err, io.EOF) {
+			return nil
+		}
+		if err != nil {
+			return fmt.Errorf("install: component archive is invalid or incomplete: %w", err)
+		}
+		if header.Typeflag != tar.TypeDir && header.Typeflag != tar.TypeReg {
+			return errors.New("install: component archive may contain only files and directories")
+		}
+		path := header.Name
+		if header.Typeflag == tar.TypeDir {
+			path = strings.TrimSuffix(path, "/") + "/"
+		}
+		rel, ok := strings.CutPrefix(path, prefix)
+		rel = strings.TrimSuffix(rel, "/")
+		if !ok || (rel == "" && header.Typeflag != tar.TypeDir) || (rel != "" && !validBundlePath(rel)) {
+			return errors.New("install: component archive contains an unexpected path")
+		}
+		if rel == "" {
+			continue
+		}
+		if err = visit(header, rel, reader); err != nil {
+			return err
+		}
+	}
+}
diff --git a/apps/daemon/internal/cli/native_download_test.go b/apps/daemon/internal/cli/native_download_test.go
new file mode 100644
index 000000000..86b9f7c91
--- /dev/null
+++ b/apps/daemon/internal/cli/native_download_test.go
@@ -0,0 +1,227 @@
+package cli
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/google/uuid"
+)
+
+// fakeCore serves the installation endpoints and one archive per component.
+type fakeCore struct {
+	*httptest.Server
+	mu       sync.Mutex
+	archives map[string][]byte
+	bodies   map[string]int // archive downloads by component
+	breakOn  string         // component whose first download is cut off halfway
+	status   int            // answer for /installation
+	redirect string         // when set, archives redirect here
+}
+
+func newFakeCore(t *testing.T, workspace string) (*fakeCore, string) {
+	t.Helper()
+	environment := uuid.NewString()
+	core := &fakeCore{archives: map[string][]byte{}, bodies: map[string]int{}, status: 200}
+	core.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		core.mu.Lock()
+		defer core.mu.Unlock()
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/installation/claim"):
+			w.WriteHeader(http.StatusNoContent)
+		case strings.HasSuffix(r.URL.Path, "/installation"):
+			if core.status != 200 {
+				w.WriteHeader(core.status)
+				return
+			}
+			_ = json.NewEncoder(w).Encode(v1.NativeInstallationContext{Version: Version, ProtocolVersion: proto.Version, EnvironmentID: environment,
+				RemoteURL: strings.Replace(core.URL, "http://", "ws://", 1) + "/api/v1/agent-daemon/ws", Workspace: workspace, Harness: nativeHarnesses["codex"].AgentKind})
+		default:
+			name, ext, _ := strings.Cut(strings.TrimPrefix(r.URL.Path, "/api/v1/agent-daemon/install/"+Version+"/"+runtime.GOOS+"-"+runtime.GOARCH+"-"), ".")
+			data, ok := core.archives[name]
+			switch {
+			case !ok:
+				w.WriteHeader(http.StatusNotFound)
+			case ext == "sha256":
+				fmt.Fprintf(w, "%x\n", sha256.Sum256(data))
+			case core.redirect != "":
+				http.Redirect(w, r, core.redirect, http.StatusTemporaryRedirect)
+			case name == core.breakOn && r.Header.Get("Range") == "":
+				core.bodies[name]++
+				w.Header().Set("Content-Length", fmt.Sprint(len(data)))
+				_, _ = w.Write(data[:len(data)/2])
+				w.(http.Flusher).Flush()
+				panic(http.ErrAbortHandler)
+			default:
+				if r.Header.Get("Range") == "" {
+					core.bodies[name]++
+				}
+				http.ServeContent(w, r, "", time.Time{}, bytes.NewReader(data))
+			}
+		}
+	}))
+	t.Cleanup(core.Close)
+	return core, environment
+}
+
+// add publishes a component archive and returns its bundle.json entry.
+func (c *fakeCore) add(t *testing.T, name string) nativeComponent {
+	t.Helper()
+	data := []byte("fixture " + name + strings.Repeat(" padding", 4096))
+	sum := sha256.Sum256(data)
+	var archive bytes.Buffer
+	zipped := gzip.NewWriter(&archive)
+	writer := tar.NewWriter(zipped)
+	for _, header := range []*tar.Header{{Name: "components/" + name + "/", Typeflag: tar.TypeDir, Mode: 0755}, {Name: "components/" + name + "/program", Typeflag: tar.TypeReg, Mode: 0755, Size: int64(len(data))}} {
+		if err := writer.WriteHeader(header); err != nil {
+			t.Fatal(err)
+		}
+	}
+	_, _ = writer.Write(data)
+	if writer.Close() != nil || zipped.Close() != nil {
+		t.Fatal("cannot build archive")
+	}
+	c.archives[name] = archive.Bytes()
+	return nativeComponent{Version: nativePins[name], Files: map[string]nativeFile{"program": {SHA256: hex.EncodeToString(sum[:]), Executable: true}}}
+}
+
+func nativeDownloadInstall(t *testing.T, core *fakeCore, bundle string, extra ...string) error {
+	t.Helper()
+	t.Setenv(v1.NativeInstallGrantEnv, "grant")
+	out := new(bytes.Buffer)
+	rc := &runContext{stdin: strings.NewReader(""), stdout: out, stderr: out}
+	o, err := parseNativeInstall(rc, append([]string{"--non-interactive", "--onboard-url", core.URL + "/api/v1/agent-daemon/installation", "--bundle-dir", bundle, "--harness", "codex"}, extra...))
+	if err != nil {
+		return err
+	}
+	return installNativeOptions(context.Background(), rc, &o)
+}
+
+func writeBundle(t *testing.T, bundle string, components map[string]nativeComponent) {
+	t.Helper()
+	raw, _ := json.Marshal(nativeBundle{Schema: 1, DaemonVersion: Version, OS: runtime.GOOS, Arch: runtime.GOARCH, Components: components})
+	if err := os.WriteFile(filepath.Join(bundle, "bundle.json"), raw, 0600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestNativeInstallDownloadsOnlySelectedComponentsOnceAndResumes(t *testing.T) {
+	home := nativeTestHome(t)
+	oldDelay, oldProbe := nativeRetryDelay, probeNativeInstallation
+	nativeRetryDelay = time.Millisecond
+	probeNativeInstallation = func(context.Context, string, []string) error { return nil }
+	t.Cleanup(func() { nativeRetryDelay, probeNativeInstallation = oldDelay, oldProbe })
+	core, _ := newFakeCore(t, t.TempDir())
+	components := map[string]nativeComponent{}
+	for _, name := range []string{"node", "codex", "claude"} {
+		components[name] = core.add(t, name)
+	}
+	core.breakOn = "codex"
+	cache := filepath.Join(home, "native-download")
+	if err := os.MkdirAll(filepath.Join(cache, "older-version"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	// Two Sessions of one release on one machine download each component once, into one store.
+	var installations []string
+	for i := 0; i < 2; i++ {
+		bundle, installation := t.TempDir(), t.TempDir()
+		installations = append(installations, installation)
+		writeBundle(t, bundle, components)
+		if err := nativeDownloadInstall(t, core, bundle, "--install-dir", installation); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := os.Stat(filepath.Join(bundle, "components")); err == nil {
+			t.Fatal("extracted into the distribution directory")
+		}
+		if _, err := os.Stat(filepath.Join(installation, "components")); err == nil {
+			t.Fatal("copied components into the installation")
+		}
+	}
+	if core.bodies["node"] != 1 || core.bodies["claude"] != 0 {
+		t.Fatalf("unexpected downloads: %v", core.bodies)
+	}
+	if core.bodies["codex"] != 1 {
+		t.Fatalf("codex was fetched %d times, want its interrupted download resumed", core.bodies["codex"])
+	}
+	store := nativeTestStore(t)
+	for _, name := range []string{"node", "codex"} {
+		if err := verifyNativeComponent(context.Background(), filepath.Join(store, name), name, nil); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := os.Stat(filepath.Join(store, "claude")); err == nil {
+		t.Fatal("downloaded a Harness the Sessions do not use")
+	}
+	if left, _ := filepath.Glob(filepath.Join(cache, Version, "*")); len(left) != 0 {
+		t.Fatalf("archives remain after extraction: %v", left)
+	}
+	if _, err := os.Stat(filepath.Join(cache, "older-version")); err == nil {
+		t.Fatal("downloads of another version were kept")
+	}
+}
+
+func TestNativeInstallRejectsGrantBeforeDownloading(t *testing.T) {
+	nativeTestHome(t)
+	core, _ := newFakeCore(t, t.TempDir())
+	core.status = http.StatusUnauthorized
+	if err := nativeDownloadInstall(t, core, t.TempDir()); err == nil || !strings.Contains(err.Error(), "authorization rejected") {
+		t.Fatalf("expected a rejected grant, got %v", err)
+	}
+	if len(core.bodies) != 0 {
+		t.Fatal("downloaded after a rejected grant")
+	}
+}
+
+func TestNativeInstallRefusesRedirectToHTTP(t *testing.T) {
+	nativeTestHome(t)
+	core, _ := newFakeCore(t, t.TempDir())
+	components := map[string]nativeComponent{"node": core.add(t, "node"), "codex": core.add(t, "codex")}
+	core.redirect = "http://127.0.0.1:1/archive.tar.gz"
+	bundle := t.TempDir()
+	writeBundle(t, bundle, components)
+	if err := nativeDownloadInstall(t, core, bundle, "--install-dir", t.TempDir()); err == nil || !strings.Contains(err.Error(), "HTTPS") {
+		t.Fatalf("expected an HTTPS-only redirect error, got %v", err)
+	}
+}
+
+func TestNativeInstallFromDistributionNamesMissingArchive(t *testing.T) {
+	rc, args, _, bundle := nativeInstallFixture(t)
+	if err := os.RemoveAll(bundleComponent(bundle, "codex")); err != nil {
+		t.Fatal(err)
+	}
+	err := runInstall(rc, args)
+	want := fmt.Sprintf("extract %s-%s-codex.tar.gz", runtime.GOOS, runtime.GOARCH)
+	if err == nil || !strings.Contains(err.Error(), want) {
+		t.Fatalf("expected an error naming %s, got %v", want, err)
+	}
+}
+
+func TestNativeDownloadFailsClearlyWhenCoreStopsAnswering(t *testing.T) {
+	oldStall, oldDelay := nativeStall, nativeRetryDelay
+	nativeStall, nativeRetryDelay = 50*time.Millisecond, time.Millisecond
+	t.Cleanup(func() { nativeStall, nativeRetryDelay = oldStall, oldDelay })
+	release := make(chan struct{})
+	server := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { <-release }))
+	t.Cleanup(func() { close(release); server.Close() })
+	if _, err := fetchNativeChecksum(context.Background(), io.Discard, server.URL+"/linux-amd64-codex.sha256"); !errors.Is(err, errNativeStall) {
+		t.Fatal(err)
+	}
+}
diff --git a/apps/daemon/internal/cli/native_harness.go b/apps/daemon/internal/cli/native_harness.go
index 69aa94b91..34bc1f300 100644
--- a/apps/daemon/internal/cli/native_harness.go
+++ b/apps/daemon/internal/cli/native_harness.go
@@ -23,19 +23,19 @@ func nativeExe(name string) string {
 	}
 	return name
 }
-func nativeNode(root string) string {
-	base := nativeComponentRoot(root, "node")
+func nativeNode(components string) string {
+	base := filepath.Join(components, "node")
 	if runtime.GOOS != "windows" {
 		base = filepath.Join(base, "bin")
 	}
 	return filepath.Join(base, nativeExe("node"))
 }
 
-func nativeHarnessEnvironment(root string, selected []string) map[string]string {
-	node := nativeNode(root)
+func nativeHarnessEnvironment(components string, selected []string) map[string]string {
+	node := nativeNode(components)
 	values := map[string]string{"PATH": filepath.Dir(node) + string(os.PathListSeparator) + os.Getenv("PATH")}
 	for _, name := range selected {
-		dir := nativeComponentRoot(root, name)
+		dir := filepath.Join(components, name)
 		values["PATH"] = filepath.Join(dir, "bin") + string(os.PathListSeparator) + values["PATH"]
 		for key, value := range nativeHarnesses[name].Environment(dir, node) {
 			values[key] = value
@@ -73,10 +73,10 @@ var nativeHarnesses = map[string]agent.Installation{
 }
 var probeNativeInstallation = checkNativeInstallation
 
-func checkNativeInstallation(ctx context.Context, root string, selected []string) error {
-	env := withNativeEnv(nativeHarnessEnvironment(root, selected))
-	node := nativeNode(root)
-	version, err := installroot.Probe(ctx, node, []string{"--version"}, env, root)
+func checkNativeInstallation(ctx context.Context, components string, selected []string) error {
+	env := withNativeEnv(nativeHarnessEnvironment(components, selected))
+	node := nativeNode(components)
+	version, err := installroot.Probe(ctx, node, []string{"--version"}, env, components)
 	if err != nil || version != "v"+nativePins["node"] {
 		return errors.New("install: bundled Node is unavailable or incompatible; use the matching native distribution")
 	}
@@ -85,7 +85,7 @@ func checkNativeInstallation(ctx context.Context, root string, selected []string
 		if !ok || !spec.Supported() {
 			return fmt.Errorf("install: %s is unsupported on this platform", name)
 		}
-		if err = spec.Check(ctx, nativeComponentRoot(root, name), node, env); err != nil {
+		if err = spec.Check(ctx, filepath.Join(components, name), node, env); err != nil {
 			return fmt.Errorf("install: %s; no installed files were replaced", err)
 		}
 	}
diff --git a/apps/daemon/internal/cli/native_install.go b/apps/daemon/internal/cli/native_install.go
index a59fc9d5c..dbec5a2f2 100644
--- a/apps/daemon/internal/cli/native_install.go
+++ b/apps/daemon/internal/cli/native_install.go
@@ -3,12 +3,11 @@ package cli
 import (
 	"bytes"
 	"context"
-	"crypto/sha256"
-	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"slices"
@@ -27,6 +26,7 @@ type nativeInstallation struct {
 	Workspace           string   `json:"workspace_directory"`
 	Credential          string   `json:"credential_file"`
 	CapabilityDirectory string   `json:"capability_directory"`
+	ComponentDirectory  string   `json:"component_directory"`
 	ToolEnvironmentFile string   `json:"tool_environment_file,omitempty"`
 	Harnesses           []string `json:"harnesses"`
 }
@@ -56,6 +56,14 @@ func lockNativeInstallation(root string) (*os.Root, func(), error) {
 	return held, func() { unlock(); held.Close() }, nil
 }
 
+// validateNativeComponentDirectory accepts only a version directory of a components store.
+func validateNativeComponentDirectory(dir string) error {
+	if runtimefs.ValidateLocalPath(dir) != nil || filepath.Base(dir) != Version || filepath.Base(filepath.Dir(dir)) != "components" {
+		return errors.New("invalid component directory")
+	}
+	return nil
+}
+
 func validateNativeInstallation(c nativeInstallation) error {
 	if c.Version != Version {
 		return errors.New("installation version is unsupported; preserve this installation and reinstall in a separate directory")
@@ -71,6 +79,9 @@ func validateNativeInstallation(c nativeInstallation) error {
 			return errors.New("install: --workspace, --credential-file and capability destination must be clean absolute paths")
 		}
 	}
+	if validateNativeComponentDirectory(c.ComponentDirectory) != nil {
+		return errors.New("installation component directory is invalid; reinstall in a separate directory")
+	}
 	info, err := os.Stat(c.Workspace)
 	if err != nil || !info.IsDir() {
 		return errors.New("install: --workspace requires an existing directory")
@@ -145,6 +156,35 @@ func installNativeOptions(ctx context.Context, rc *runContext, o *nativeInstallO
 	if err = cleanNativeTemporaryFiles(o.Directory); err != nil {
 		return err
 	}
+	// A rerun keeps the shared components its installation already uses.
+	var previous nativeInstallation
+	raw, err := runtimefs.ReadPrivate(held, "installation.json", 1<<20)
+	if err == nil {
+		if decodeEnvironmentJSON(raw, &previous) != nil || previous.Version != Version || len(previous.Harnesses) == 0 {
+			return errors.New("install: existing installation is unsupported; preserve it and reinstall separately")
+		}
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return errors.New("install: cannot read existing installation")
+	}
+	if len(previous.Harnesses) > 0 {
+		if validateNativeComponentDirectory(previous.ComponentDirectory) != nil {
+			return errors.New("install: existing installation is unsupported; preserve it and reinstall separately")
+		}
+		o.ComponentDirectory = previous.ComponentDirectory
+	} else if o.ComponentDirectory, err = nativeStoreDirectory(); err != nil {
+		return err
+	}
+	// An installation that did not publish its record must not pin the shared components. Removing
+	// the entry only lowers the count, so it needs no store lock; a later install or uninstall collects.
+	defer func() {
+		if _, err := os.Stat(filepath.Join(o.Directory, "daemon", "installation.json")); errors.Is(err, os.ErrNotExist) {
+			_ = os.Remove(nativeUserEntry(o.ComponentDirectory, o.Directory))
+		}
+	}()
+	// Fetch before claiming the credential, so a failed download leaves the Session's credential unclaimed.
+	if err = ensureNativeComponents(ctx, rc.stdout, o, bundle, selected); err != nil {
+		return err
+	}
 	if o.OnboardURL != "" {
 		if runtimefs.ValidateLocalPath(o.Workspace) != nil {
 			return errors.New("install: Session workspace is invalid on this platform")
@@ -159,12 +199,7 @@ func installNativeOptions(ctx context.Context, rc *runContext, o *nativeInstallO
 	if err = validateNativeInstallation(o.nativeInstallation); err != nil {
 		return err
 	}
-	var previous nativeInstallation
-	raw, err := runtimefs.ReadPrivate(held, "installation.json", 1<<20)
-	if err == nil {
-		if decodeEnvironmentJSON(raw, &previous) != nil || previous.Version != Version || len(previous.Harnesses) == 0 {
-			return errors.New("install: existing installation is unsupported; preserve it and reinstall separately")
-		}
+	if len(previous.Harnesses) > 0 {
 		wanted := o.nativeInstallation
 		wanted.Harnesses = nil
 		comparison := previous
@@ -174,8 +209,6 @@ func installNativeOptions(ctx context.Context, rc *runContext, o *nativeInstallO
 		if !bytes.Equal(before, after) {
 			return errors.New("install: existing connection settings differ; additive installation cannot replace them")
 		}
-	} else if !errors.Is(err, os.ErrNotExist) {
-		return errors.New("install: cannot read existing installation")
 	}
 	all := append([]string{}, previous.Harnesses...)
 	for _, name := range selected {
@@ -184,22 +217,16 @@ func installNativeOptions(ctx context.Context, rc *runContext, o *nativeInstallO
 		}
 	}
 	slices.Sort(all)
-	// Verify existing components before adding any new one; never repair or
-	// upgrade an installed dependency as a side effect of adding a Harness.
-	if len(previous.Harnesses) > 0 {
-		if err = nativeInstallPhase(rc.stdout, "Verifying installed components", func() error { return verifyNativeComponents(ctx, o.Directory, previous.Harnesses) }); err != nil {
+	// Harnesses installed earlier but not selected now were not touched above; they are verified, never repaired.
+	if untouched := slices.DeleteFunc(slices.Clone(previous.Harnesses), func(name string) bool { return slices.Contains(selected, name) }); len(untouched) > 0 {
+		if err = nativeInstallPhase(rc.stdout, "Verifying installed components", func() error { return verifyNativeComponents(ctx, o.ComponentDirectory, untouched) }); err != nil {
 			return err
 		}
 	}
 	if err = nativeInstallPhase(rc.stdout, "Installing Runtime", func() error { return installNativeBinary(ctx, o.Directory, len(previous.Harnesses) > 0) }); err != nil {
 		return err
 	}
-	for _, name := range append([]string{"node"}, selected...) {
-		if err = nativeInstallPhase(rc.stdout, "Installing "+name, func() error { return installNativeComponent(ctx, o.Bundle, o.Directory, name, bundle.Components[name]) }); err != nil {
-			return err
-		}
-	}
-	if err = nativeInstallPhase(rc.stdout, "Checking installed programs", func() error { return probeNativeInstallation(ctx, o.Directory, all) }); err != nil {
+	if err = nativeInstallPhase(rc.stdout, "Checking installed programs", func() error { return probeNativeInstallation(ctx, o.ComponentDirectory, all) }); err != nil {
 		return err
 	}
 	if err = ctx.Err(); err != nil {
@@ -218,20 +245,40 @@ func installNativeOptions(ctx context.Context, rc *runContext, o *nativeInstallO
 	return nil
 }
 
-func verifyNativeComponents(ctx context.Context, root string, selected []string) error {
+// ensureNativeComponents registers the installation as a user of this version's shared components,
+// collects what no installation uses, and installs the missing components. It holds the store lock.
+func ensureNativeComponents(ctx context.Context, out io.Writer, o *nativeInstallOptions, bundle nativeBundle, selected []string) error {
+	unlock, err := lockNativeStore(ctx, out, filepath.Dir(o.ComponentDirectory))
+	if err != nil {
+		return fmt.Errorf("install: %w", err)
+	}
+	defer unlock()
+	if err = requireNativeDirectory(o.ComponentDirectory); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("install: %w", err)
+	}
+	if err = addNativeUser(o.ComponentDirectory, o.Directory); err != nil {
+		return err
+	}
+	_ = collectNativeStore(filepath.Dir(o.ComponentDirectory))
+	if err = cleanNativeStaging(o.ComponentDirectory); err != nil {
+		return err
+	}
 	for _, name := range append([]string{"node"}, selected...) {
+		if err = ensureNativeComponent(ctx, out, o, name, bundle.Components[name]); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// verifyNativeComponents checks node and the named Harnesses in the shared components directory.
+func verifyNativeComponents(ctx context.Context, components string, harnesses []string) error {
+	for _, name := range append([]string{"node"}, harnesses...) {
 		if _, ok := nativePins[name]; !ok {
 			return errors.New("installation contains an unsupported Harness")
 		}
-		c, err := componentReceipt(nativeComponentRoot(root, name))
-		if err != nil || c.Version != nativePins[name] || len(c.Files) == 0 {
-			return fmt.Errorf("installed %s is missing, modified or incompatible; reinstall separately (no automatic repair or upgrade)", name)
-		}
-		if err = checkComponentFiles(ctx, nativeComponentRoot(root, name), c); err != nil {
-			if errors.Is(err, errNativeComponentMismatch) || errors.Is(err, os.ErrNotExist) {
-				return fmt.Errorf("installed %s is missing or modified; reinstall separately", name)
-			}
-			return fmt.Errorf("install: cannot verify installed %s: %w", name, err)
+		if err := verifyNativeComponent(ctx, filepath.Join(components, name), name, nil); err != nil {
+			return err
 		}
 	}
 	return nil
@@ -247,21 +294,11 @@ func installNativeBinary(ctx context.Context, root string, existing bool) error
 		return err
 	}
 	dest := filepath.Join(dir, nativeExe("oac-daemon"))
-	digest := func(name string) (string, error) {
-		f, e := os.Open(name)
-		if e != nil {
-			return "", e
-		}
-		defer f.Close()
-		h := sha256.New()
-		_, e = nativeCopy(ctx, h, f)
-		return hex.EncodeToString(h.Sum(nil)), e
-	}
-	want, err := digest(exe)
+	want, err := nativeFileDigest(ctx, exe)
 	if err != nil {
 		return err
 	}
-	if got, e := digest(dest); e == nil {
+	if got, e := nativeFileDigest(ctx, dest); e == nil {
 		if got != want {
 			return errors.New("install: existing daemon binary differs; in-place upgrades are unsupported")
 		}
@@ -337,10 +374,10 @@ func runStart(rc *runContext, args []string) error {
 		err = errors.New("start: no installed Harnesses; rerun install with --harness")
 	}
 	if err == nil {
-		err = verifyNativeComponents(ctx, root, config.Harnesses)
+		err = verifyNativeComponents(ctx, config.ComponentDirectory, config.Harnesses)
 	}
 	if err == nil {
-		err = probeNativeInstallation(ctx, root, config.Harnesses)
+		err = probeNativeInstallation(ctx, config.ComponentDirectory, config.Harnesses)
 	}
 	unlock()
 	if err != nil {
@@ -349,7 +386,7 @@ func runStart(rc *runContext, args []string) error {
 	previousKinds := rc.installedKinds
 	rc.installedKinds = nativeInstallationKinds(config.Harnesses)
 	defer func() { rc.installedKinds = previousKinds }()
-	values := nativeHarnessEnvironment(root, config.Harnesses)
+	values := nativeHarnessEnvironment(config.ComponentDirectory, config.Harnesses)
 	values["OAC_RUNTIME_WORKSPACE"] = config.Workspace
 	values["OAC_RUNTIME_CAPABILITY_DIRECTORY"] = config.CapabilityDirectory
 	values["OAC_RUNTIME_TOOL_ENV_FILE"] = config.ToolEnvironmentFile
diff --git a/apps/daemon/internal/cli/native_install_interrupt_unix_test.go b/apps/daemon/internal/cli/native_install_interrupt_unix_test.go
index d8a7e84da..049c12eee 100644
--- a/apps/daemon/internal/cli/native_install_interrupt_unix_test.go
+++ b/apps/daemon/internal/cli/native_install_interrupt_unix_test.go
@@ -44,7 +44,7 @@ func TestNativeInstallationInterruptReapsProbe(t *testing.T) {
 	script := []byte("#!/bin/sh\nsleep 300 &\nprintf '%s %s' \"$$\" \"$!\" > \"$OAC_TEST_PROBE_PIDS\"\nwait\n")
 	sum := sha256.Sum256(script)
 	b.Components["node"] = nativeComponent{Version: nativePins["node"], Files: map[string]nativeFile{"bin/node": {SHA256: hex.EncodeToString(sum[:]), Executable: true}}}
-	dir := filepath.Join(nativeComponentRoot(bundle, "node"), "bin")
+	dir := filepath.Join(bundleComponent(bundle, "node"), "bin")
 	if err := os.MkdirAll(dir, 0700); err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/cli/native_install_io.go b/apps/daemon/internal/cli/native_install_io.go
index 999e71a4b..788d284c7 100644
--- a/apps/daemon/internal/cli/native_install_io.go
+++ b/apps/daemon/internal/cli/native_install_io.go
@@ -13,11 +13,11 @@ import (
 )
 
 // nativeInstallationEntries are the top-level entries an installation directory
-// owns: the installer writes bin, daemon, components and the default
+// owns: the installer writes bin, daemon and the default
 // capabilities, and Windows keeps the lock file of daemon beside it; the daemon
 // running from it adds runtime, initialization and packages. Install refuses a directory with anything else, and uninstall
 // deletes nothing else.
-var nativeInstallationEntries = []string{"bin", "daemon", "components", "capabilities", ".daemon.runtime.lock", "runtime", "initialization", "packages"}
+var nativeInstallationEntries = []string{"bin", "daemon", "capabilities", ".daemon.runtime.lock", "runtime", "initialization", "packages"}
 
 // foreignEntries names what dir holds that no installation owns.
 func foreignEntries(dir string) ([]string, error) {
@@ -39,9 +39,8 @@ func foreignEntries(dir string) ([]string, error) {
 
 // These exact temporary names are reserved by the installer, never workspace data.
 var nativeTemporaryNames = map[string]*regexp.Regexp{
-	"components": regexp.MustCompile(`^\.install-(node|codex|claude|minimax)-[0-9]+$`),
-	"bin":        regexp.MustCompile(`^\.oac-daemon-[0-9]+$`),
-	"daemon":     regexp.MustCompile(`^\.(installation\.json|executor-credential\.json)-[0-9a-f]{24}\.tmp$`),
+	"bin":    regexp.MustCompile(`^\.oac-daemon-[0-9]+$`),
+	"daemon": regexp.MustCompile(`^\.(installation\.json|executor-credential\.json)-[0-9a-f]{24}\.tmp$`),
 }
 
 // The caller holds the installation lock, including while recovering a failed copy.
diff --git a/apps/daemon/internal/cli/native_install_recovery_test.go b/apps/daemon/internal/cli/native_install_recovery_test.go
index 12dabf52f..32c3c8962 100644
--- a/apps/daemon/internal/cli/native_install_recovery_test.go
+++ b/apps/daemon/internal/cli/native_install_recovery_test.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"errors"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -12,7 +13,7 @@ import (
 
 func TestNativeInstallationCleansOnlyReservedPartialFiles(t *testing.T) {
 	rc, args, root, _ := nativeInstallFixture(t)
-	names := []string{"components/.install-codex-12345/partial", "bin/.oac-daemon-9876", "daemon/.installation.json-0123456789abcdef01234567.tmp"}
+	names := []string{"bin/.oac-daemon-9876", "daemon/.installation.json-0123456789abcdef01234567.tmp"}
 	for _, name := range names {
 		path := filepath.Join(root, filepath.FromSlash(name))
 		if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
@@ -22,7 +23,7 @@ func TestNativeInstallationCleansOnlyReservedPartialFiles(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
-	keep := filepath.Join(root, "components", ".install-codex-user-notes")
+	keep := filepath.Join(root, "bin", ".oac-daemon-user-notes")
 	if err := os.WriteFile(keep, []byte("keep"), 0600); err != nil {
 		t.Fatal(err)
 	}
@@ -85,11 +86,11 @@ func TestNativeStagingCleanupDoesNotFollowLinks(t *testing.T) {
 	if err := os.WriteFile(keep, []byte("keep"), 0600); err != nil {
 		t.Fatal(err)
 	}
-	parent := filepath.Join(root, "components")
+	parent := filepath.Join(root, "bin")
 	if err := os.Mkdir(parent, 0700); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.Symlink(outside, filepath.Join(parent, ".install-codex-123")); err != nil {
+	if err := os.Symlink(outside, filepath.Join(parent, ".oac-daemon-123")); err != nil {
 		t.Skip("symlink permission unavailable")
 	}
 	if err := cleanNativeTemporaryFiles(root); err != nil {
@@ -105,6 +106,7 @@ func TestNativeVerificationCancellationPreservesInstallation(t *testing.T) {
 	if err := runInstall(rc, args); err != nil {
 		t.Fatal(err)
 	}
+	store := nativeTestStore(t)
 	config := filepath.Join(root, "daemon", "installation.json")
 	before, err := os.ReadFile(config)
 	if err != nil {
@@ -112,21 +114,21 @@ func TestNativeVerificationCancellationPreservesInstallation(t *testing.T) {
 	}
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
-	if err = verifyNativeComponents(ctx, root, []string{"codex"}); !errors.Is(err, context.Canceled) {
+	if err = verifyNativeComponents(ctx, store, []string{"codex"}); !errors.Is(err, context.Canceled) {
 		t.Fatalf("cancelled verification reported damage: %v", err)
 	}
 	b, err := readNativeBundle(bundle, []string{"codex"})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err = installNativeComponent(ctx, bundle, root, "codex", b.Components["codex"]); !errors.Is(err, context.Canceled) {
+	if err = ensureNativeComponent(ctx, io.Discard, &nativeInstallOptions{nativeInstallation: nativeInstallation{ComponentDirectory: store}, Bundle: bundle}, "codex", b.Components["codex"]); !errors.Is(err, context.Canceled) {
 		t.Fatalf("cancelled reuse reported damage: %v", err)
 	}
 	after, err := os.ReadFile(config)
 	if err != nil || !bytes.Equal(before, after) {
 		t.Fatal("cancellation changed installation")
 	}
-	if err = verifyNativeComponents(context.Background(), root, []string{"codex"}); err != nil {
+	if err = verifyNativeComponents(context.Background(), store, []string{"codex"}); err != nil {
 		t.Fatal(err)
 	}
 }
diff --git a/apps/daemon/internal/cli/native_install_test.go b/apps/daemon/internal/cli/native_install_test.go
index d423c8c4f..bae3f95b7 100644
--- a/apps/daemon/internal/cli/native_install_test.go
+++ b/apps/daemon/internal/cli/native_install_test.go
@@ -10,6 +10,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"strings"
 	"testing"
 
@@ -17,12 +18,64 @@ import (
 	"github.com/google/uuid"
 )
 
+// nativeTestHome points the Runtime home at a fresh directory. The shared components are read-only,
+// so cleanup makes them writable first.
+func nativeTestHome(t *testing.T) string {
+	t.Helper()
+	home := t.TempDir()
+	t.Setenv("OAC_RUNTIME_HOME", home)
+	t.Cleanup(func() { _ = removeNativeTree(home) })
+	return home
+}
+
+func bundleComponent(bundle, name string) string {
+	return filepath.Join(filepath.Join(bundle, "components"), name)
+}
+
+func nativeTestStore(t *testing.T) string {
+	t.Helper()
+	store, err := nativeStoreDirectory()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return store
+}
+
+// otherNativeInstallation returns arguments for a second Session on the same machine and distribution.
+func otherNativeInstallation(t *testing.T, args []string) []string {
+	t.Helper()
+	other := append([]string{}, args...)
+	environment := uuid.NewString()
+	key := filepath.Join(t.TempDir(), "credential.json")
+	body, _ := json.Marshal(map[string]string{"key_id": uuid.NewString(), "executor_token": "private-test-credential", "environment_id": environment})
+	if err := os.WriteFile(key, body, 0600); err != nil {
+		t.Fatal(err)
+	}
+	for flag, value := range map[string]string{"--environment-id": environment, "--credential-file": key, "--workspace": t.TempDir(), "--install-dir": t.TempDir()} {
+		other[slices.Index(other, flag)+1] = value
+	}
+	return other
+}
+
+// uninstallNative runs the installed executable's uninstall for one installation directory.
+func uninstallNative(t *testing.T, root string) string {
+	t.Helper()
+	old := os.Getenv("OAC_RUNTIME_HOME")
+	t.Setenv("OAC_RUNTIME_HOME", root)
+	defer os.Setenv("OAC_RUNTIME_HOME", old)
+	output := new(bytes.Buffer)
+	if err := runUninstall(&runContext{stdin: strings.NewReader("y\n"), stdout: output, stderr: output}, nil); err != nil {
+		t.Fatal(err)
+	}
+	return output.String()
+}
+
 func nativeInstallFixture(t *testing.T) (*runContext, []string, string, string) {
 	t.Helper()
 	root := t.TempDir()
 	bundle := t.TempDir()
 	workspace := t.TempDir()
-	t.Setenv("OAC_RUNTIME_HOME", root)
+	nativeTestHome(t)
 	key := filepath.Join(t.TempDir(), "credential.json")
 	environment := uuid.NewString()
 	body, _ := json.Marshal(map[string]string{"key_id": uuid.NewString(), "executor_token": "private-test-credential", "environment_id": environment})
@@ -34,7 +87,7 @@ func nativeInstallFixture(t *testing.T) (*runContext, []string, string, string)
 		data := []byte("fixture " + name)
 		sum := sha256.Sum256(data)
 		b.Components[name] = nativeComponent{Version: nativePins[name], Files: map[string]nativeFile{"program": {SHA256: hex.EncodeToString(sum[:]), Executable: true}}}
-		dir := nativeComponentRoot(bundle, name)
+		dir := bundleComponent(bundle, name)
 		if err := os.MkdirAll(dir, 0700); err != nil {
 			t.Fatal(err)
 		}
@@ -117,13 +170,17 @@ func TestNativeInstallationFailureAndRecoveryPreserveExisting(t *testing.T) {
 	if err := runInstall(rc, append(args, "--harness", "claude")); err != nil {
 		t.Fatalf("could not reuse complete unpublished component: %v", err)
 	}
-	// Source corruption cannot affect an existing component, and cannot be used
-	// to repair a modified installed one silently.
-	_ = os.WriteFile(filepath.Join(nativeComponentRoot(root, "codex"), "program"), []byte("changed"), 0700)
-	if err := runInstall(rc, args); err == nil {
-		t.Fatal("silently repaired modified executable")
+	// A modified shared component fails with the directory to delete and is never repaired silently.
+	component := filepath.Join(nativeTestStore(t), "codex")
+	program := filepath.Join(component, "program")
+	if err := os.Chmod(program, 0700); err != nil {
+		t.Fatal(err)
+	}
+	_ = os.WriteFile(program, []byte("changed"), 0700)
+	if err := runInstall(rc, args); err == nil || !strings.Contains(err.Error(), component) || !strings.Contains(err.Error(), nativeDeleteCommand(component)) {
+		t.Fatalf("modified component: %v", err)
 	}
-	if got, _ := os.ReadFile(filepath.Join(nativeComponentRoot(root, "codex"), "program")); string(got) != "changed" {
+	if got, _ := os.ReadFile(program); string(got) != "changed" {
 		t.Fatal("overwrote installed data")
 	}
 	_ = bundle
@@ -201,7 +258,7 @@ func TestNativeInstallationLockAndManifestContainment(t *testing.T) {
 	if err = runInstall(rc, args); err == nil {
 		t.Fatal("accepted manifest traversal")
 	}
-	if _, err = os.Stat(filepath.Join(root, "components")); !errors.Is(err, os.ErrNotExist) {
+	if _, err = os.Stat(filepath.Join(os.Getenv("OAC_RUNTIME_HOME"), "components")); !errors.Is(err, os.ErrNotExist) {
 		t.Fatal("manifest validation happened after mutation")
 	}
 }
@@ -248,10 +305,12 @@ func TestNativeInstallationConnectCannotBypassValidation(t *testing.T) {
 	if err := runInstall(rc, args); err != nil {
 		t.Fatal(err)
 	}
+	store := nativeTestStore(t)
+	t.Setenv("OAC_RUNTIME_HOME", root) // The installed executable acts on its own installation.
 	for _, mode := range []string{"installed", "missing-component"} {
 		t.Run(mode, func(t *testing.T) {
 			if mode == "missing-component" {
-				if err := os.Remove(filepath.Join(nativeComponentRoot(root, "codex"), "program")); err != nil {
+				if err := removeNativeTree(filepath.Join(store, "codex")); err != nil {
 					t.Fatal(err)
 				}
 			}
diff --git a/apps/daemon/internal/cli/native_start_interrupt_unix_test.go b/apps/daemon/internal/cli/native_start_interrupt_unix_test.go
index 316498fda..5f639f826 100644
--- a/apps/daemon/internal/cli/native_start_interrupt_unix_test.go
+++ b/apps/daemon/internal/cli/native_start_interrupt_unix_test.go
@@ -57,7 +57,7 @@ func TestNativeStartInterruptCancelsEnrollment(t *testing.T) {
 		t.Fatal(err)
 	}
 	cmd := exec.Command(os.Args[0], "-test.run=^TestNativeStartInterruptHelper$")
-	cmd.Env = append(os.Environ(), "OAC_TEST_START_INTERRUPT=1")
+	cmd.Env = append(os.Environ(), "OAC_TEST_START_INTERRUPT=1", "OAC_RUNTIME_HOME="+root)
 	output := new(bytes.Buffer)
 	cmd.Stdout, cmd.Stderr = output, output
 	if err := cmd.Start(); err != nil {
diff --git a/apps/daemon/internal/cli/native_store.go b/apps/daemon/internal/cli/native_store.go
new file mode 100644
index 000000000..ccd03d257
--- /dev/null
+++ b/apps/daemon/internal/cli/native_store.go
@@ -0,0 +1,281 @@
+package cli
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimefs"
+)
+
+// The Runtime home keeps one installed copy of each component per daemon version, in
+// components/<version>/<name>. Every installation of that version on this machine uses it.
+// The lock on components/ covers user entries, collection and installing missing components.
+var (
+	nativeStoreWait  = 10 * time.Minute
+	nativeStoreRetry = time.Second
+)
+
+func nativeStoreDirectory() (string, error) {
+	home, err := paths.Root()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(home, "components", Version), nil
+}
+
+// requireNativeDirectory accepts a real directory owned by the current user, never a link.
+func requireNativeDirectory(dir string) error {
+	info, err := os.Lstat(dir)
+	if err != nil {
+		return err
+	}
+	if !info.IsDir() || !ownedByCurrentUser(info) {
+		return fmt.Errorf("%s must be a directory owned by the current user, not a link", dir)
+	}
+	return nil
+}
+
+// lockNativeStore waits for another process holding the store; any other lock failure is final.
+func lockNativeStore(ctx context.Context, out io.Writer, root string) (func(), error) {
+	if _, err := os.Lstat(root); err == nil {
+		if err = requireNativeDirectory(root); err != nil {
+			return nil, err
+		}
+	}
+	if err := runtimefs.EnsurePrivateDir(root); err != nil {
+		return nil, err
+	}
+	held, err := os.OpenRoot(root)
+	if err != nil {
+		return nil, err
+	}
+	deadline := time.Now().Add(nativeStoreWait)
+	for waiting := false; ; waiting = true {
+		unlock, err := runtimefs.LockDirectory(held)
+		if err == nil {
+			return func() { unlock(); held.Close() }, nil
+		}
+		if !errors.Is(err, runtimefs.ErrLocked) {
+			held.Close()
+			return nil, err
+		}
+		if time.Now().After(deadline) {
+			held.Close()
+			return nil, errors.New("another installation on this machine has held the shared components for 10 minutes; wait for it to finish or stop it, then rerun the command")
+		}
+		if !waiting {
+			fmt.Fprintln(out, "Waiting for another installation on this machine...")
+		}
+		select {
+		case <-ctx.Done():
+			held.Close()
+			return nil, ctx.Err()
+		case <-time.After(nativeStoreRetry):
+		}
+	}
+}
+
+// resolvedNativeDirectory is the spelling that user entries record and hash.
+func resolvedNativeDirectory(dir string) string {
+	if resolved, err := filepath.EvalSymlinks(dir); err == nil {
+		return resolved
+	}
+	return dir
+}
+
+// nativeUserEntry names the file that records an installation as a user of a version directory.
+func nativeUserEntry(version, installation string) string {
+	sum := sha256.Sum256([]byte(resolvedNativeDirectory(installation)))
+	return filepath.Join(version, "users", hex.EncodeToString(sum[:]))
+}
+
+// addNativeUser records the installation; an unchanged entry is left alone, a new one is written atomically.
+func addNativeUser(version, installation string) error {
+	entry := nativeUserEntry(version, installation)
+	want := []byte(resolvedNativeDirectory(installation))
+	if got, err := os.ReadFile(entry); err == nil && string(got) == string(want) {
+		return nil
+	}
+	dir := filepath.Dir(entry)
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		return err
+	}
+	held, err := os.OpenRoot(dir)
+	if err != nil {
+		return err
+	}
+	defer held.Close()
+	return runtimefs.WritePrivateAtomic(held, filepath.Base(entry), want)
+}
+
+// countNativeUsers drops the entries of installations whose directory is gone and counts the rest.
+// Whatever it cannot read or parse counts as a user. managed is false for a directory without a
+// real users directory, which this store did not create.
+func countNativeUsers(version string) (users int, managed bool) {
+	dir := filepath.Join(version, "users")
+	if info, err := os.Lstat(dir); err != nil || !info.IsDir() {
+		return 0, false
+	}
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return 1, true
+	}
+	for _, entry := range entries {
+		if strings.HasPrefix(entry.Name(), ".") {
+			continue // an interrupted atomic write
+		}
+		file := filepath.Join(dir, entry.Name())
+		// An entry is dropped only when its installation directory is gone.
+		if raw, err := os.ReadFile(file); err == nil && filepath.IsAbs(string(raw)) {
+			if _, err = os.Stat(string(raw)); errors.Is(err, os.ErrNotExist) && os.Remove(file) == nil {
+				continue
+			}
+		}
+		users++
+	}
+	return users, true
+}
+
+// collectNativeStore removes every version directory that no installation uses. A directory is
+// renamed away before it is deleted, so a version is either whole or gone; a rename that fails,
+// as on Windows while a file is in use, keeps the version. Leftovers of an interrupted deletion are swept.
+func collectNativeStore(root string) error {
+	var failure error
+	entries, _ := os.ReadDir(root)
+	for _, entry := range entries {
+		dir := filepath.Join(root, entry.Name())
+		if strings.HasPrefix(entry.Name(), ".remove-") {
+			_ = removeNativeTree(dir)
+			continue
+		}
+		if !entry.IsDir() {
+			continue // never follow a link out of the store
+		}
+		if users, managed := countNativeUsers(dir); managed && users == 0 {
+			if err := removeNativeVersion(dir); err != nil && failure == nil {
+				failure = err
+			}
+		}
+	}
+	return failure
+}
+
+func removeNativeVersion(dir string) error {
+	gone := filepath.Join(filepath.Dir(dir), fmt.Sprintf(".remove-%d-%d", os.Getpid(), time.Now().UnixNano()))
+	if err := os.Rename(dir, gone); err != nil {
+		return fmt.Errorf("cannot remove %s: %w", dir, err)
+	}
+	return removeNativeTree(gone)
+}
+
+// releaseNativeStore drops one installation's entry and collects the store. It returns how many
+// other installations still use the version.
+func releaseNativeStore(ctx context.Context, out io.Writer, version, entry string) (int, error) {
+	root := filepath.Dir(version)
+	if _, err := os.Lstat(root); errors.Is(err, os.ErrNotExist) {
+		return 0, nil
+	}
+	unlock, err := lockNativeStore(ctx, out, root)
+	if err != nil {
+		return 0, err
+	}
+	defer unlock()
+	if err = os.Remove(entry); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return 0, err
+	}
+	if err = collectNativeStore(root); err != nil {
+		return 0, err
+	}
+	if _, err = os.Lstat(version); errors.Is(err, os.ErrNotExist) {
+		return 0, nil
+	}
+	users, _ := countNativeUsers(version)
+	if users == 0 {
+		return 0, fmt.Errorf("%s was not removed", version)
+	}
+	return users, nil
+}
+
+// setNativeReadOnly makes the contents of a component unchangeable: files 0400 or, when
+// executable, 0500, directories 0500. The top directory stays as it is, because macOS refuses to
+// rename a directory that is not writable; sealNativeComponent closes it after the rename.
+func setNativeReadOnly(path string) error {
+	var directories []string
+	err := filepath.WalkDir(path, func(name string, entry fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if entry.IsDir() {
+			if name != path {
+				directories = append(directories, name)
+			}
+			return nil
+		}
+		info, err := entry.Info()
+		if err != nil {
+			return err
+		}
+		mode := os.FileMode(0400)
+		if info.Mode().Perm()&0100 != 0 {
+			mode = 0500
+		}
+		return os.Chmod(name, mode)
+	})
+	for i := len(directories) - 1; err == nil && i >= 0; i-- {
+		err = os.Chmod(directories[i], 0500)
+	}
+	return err
+}
+
+func sealNativeComponent(dir string) error { return os.Chmod(dir, 0500) }
+
+// removeNativeTree deletes a tree that setNativeReadOnly protected. Go's RemoveAll
+// cannot delete read-only entries on Windows and cannot enter read-only directories elsewhere.
+func removeNativeTree(path string) error {
+	_ = filepath.WalkDir(path, func(name string, entry fs.DirEntry, err error) error {
+		if err != nil || entry.Type()&fs.ModeSymlink != 0 {
+			return nil
+		}
+		if entry.IsDir() {
+			return os.Chmod(name, 0700)
+		}
+		return os.Chmod(name, 0600)
+	})
+	return os.RemoveAll(path)
+}
+
+// nativeDeleteCommand is the command that deletes a read-only component directory by hand.
+func nativeDeleteCommand(dir string) string {
+	if runtime.GOOS == "windows" {
+		return "Remove-Item -Recurse -Force '" + strings.ReplaceAll(dir, "'", "''") + "'"
+	}
+	quoted := "'" + strings.ReplaceAll(dir, "'", `'\''`) + "'"
+	return "chmod -R u+w " + quoted + " && rm -rf " + quoted
+}
+
+// cleanNativeStaging removes the unpublished copies an interrupted installation left. The caller holds the store lock.
+func cleanNativeStaging(version string) error {
+	entries, err := os.ReadDir(version)
+	if err != nil {
+		return err
+	}
+	for _, entry := range entries {
+		if strings.HasPrefix(entry.Name(), ".install-") {
+			if err = removeNativeTree(filepath.Join(version, entry.Name())); err != nil {
+				return fmt.Errorf("install: cannot remove interrupted staging: %w", err)
+			}
+		}
+	}
+	return nil
+}
diff --git a/apps/daemon/internal/cli/native_store_test.go b/apps/daemon/internal/cli/native_store_test.go
new file mode 100644
index 000000000..a6debfd3d
--- /dev/null
+++ b/apps/daemon/internal/cli/native_store_test.go
@@ -0,0 +1,195 @@
+package cli
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestNativeInstallationsShareOneReadOnlyCopy(t *testing.T) {
+	rc, args, first, bundle := nativeInstallFixture(t)
+	if err := runInstall(rc, args); err != nil {
+		t.Fatal(err)
+	}
+	store := nativeTestStore(t)
+	// The second installation needs no distribution: it finds every component in the store.
+	if err := os.RemoveAll(filepath.Join(bundle, "components")); err != nil {
+		t.Fatal(err)
+	}
+	args = otherNativeInstallation(t, args)
+	if err := runInstall(rc, args); err != nil {
+		t.Fatal(err)
+	}
+	second := args[slices.Index(args, "--install-dir")+1]
+	for _, dir := range []string{first, second} {
+		if _, err := os.Stat(filepath.Join(dir, "components")); err == nil {
+			t.Fatal("installation holds its own component copy")
+		}
+		var installed nativeInstallation
+		if err := readNativeJSON(filepath.Join(dir, "daemon", "installation.json"), &installed); err != nil || installed.ComponentDirectory != store {
+			t.Fatalf("installation does not reference the store: %v %q", err, installed.ComponentDirectory)
+		}
+	}
+	if info, err := os.Stat(filepath.Join(store, "codex", ".oac-install.json")); err != nil || info.Mode().Perm()&0200 != 0 {
+		t.Fatalf("component file is writable: %v", err)
+	}
+	if users, _ := countNativeUsers(store); users != 2 {
+		t.Fatalf("store has %d users, want 2", users)
+	}
+	if output := uninstallNative(t, first); !strings.Contains(output, "Shared components kept: 1 other") {
+		t.Fatalf("first uninstall:\n%s", output)
+	}
+	if _, err := os.Stat(filepath.Join(store, "codex")); err != nil {
+		t.Fatal("uninstalling one installation removed components another uses")
+	}
+	if output := uninstallNative(t, second); !strings.Contains(output, "Shared components removed") {
+		t.Fatalf("last uninstall:\n%s", output)
+	}
+	if _, err := os.Stat(store); !os.IsNotExist(err) {
+		t.Fatal("the last uninstall left the version directory")
+	}
+}
+
+func TestNativeStoreDropsGoneInstallationsAndUnusedVersions(t *testing.T) {
+	rc, args, first, _ := nativeInstallFixture(t)
+	if err := runInstall(rc, args); err != nil {
+		t.Fatal(err)
+	}
+	store := nativeTestStore(t)
+	// A version whose only installation is gone, with read-only content like a published component.
+	old := filepath.Join(filepath.Dir(store), "old-version")
+	gone := filepath.Join(t.TempDir(), "deleted")
+	if err := addNativeUser(old, gone); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(old, "node"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(old, "node", "program"), nil, 0400); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(filepath.Join(old, "node"), 0500); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.RemoveAll(first); err != nil {
+		t.Fatal(err)
+	}
+	if err := runInstall(rc, otherNativeInstallation(t, args)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(old); !os.IsNotExist(err) {
+		t.Fatal("unused version directory remains")
+	}
+	if users, _ := countNativeUsers(store); users != 1 {
+		t.Fatalf("store has %d users, want only the new installation", users)
+	}
+}
+
+// safeBuffer lets the test read the output while the installation still writes it.
+type safeBuffer struct {
+	mu  sync.Mutex
+	buf bytes.Buffer
+}
+
+func (b *safeBuffer) Write(p []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.Write(p)
+}
+
+func (b *safeBuffer) String() string {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.String()
+}
+
+func TestNativeStoreWaitsForAnotherInstallation(t *testing.T) {
+	rc, args, _, _ := nativeInstallFixture(t)
+	output := &safeBuffer{}
+	rc.stdout = output
+	oldRetry, oldWait := nativeStoreRetry, nativeStoreWait
+	nativeStoreRetry = 5 * time.Millisecond
+	t.Cleanup(func() { nativeStoreRetry, nativeStoreWait = oldRetry, oldWait })
+	root := filepath.Dir(nativeTestStore(t))
+	unlock, err := lockNativeStore(context.Background(), io.Discard, root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	done := make(chan error, 1)
+	go func() { done <- runInstall(rc, args) }()
+	for deadline := time.Now().Add(10 * time.Second); !strings.Contains(output.String(), "Waiting for another installation"); {
+		select {
+		case err = <-done:
+			t.Fatalf("installation did not wait: %v", err)
+		case <-time.After(5 * time.Millisecond):
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("the wait was not announced")
+		}
+	}
+	unlock()
+	if err = <-done; err != nil {
+		t.Fatal(err)
+	}
+	unlock, err = lockNativeStore(context.Background(), io.Discard, root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer unlock()
+	nativeStoreWait = 20 * time.Millisecond
+	if _, err = lockNativeStore(context.Background(), io.Discard, root); err == nil || !strings.Contains(err.Error(), "held the shared components") {
+		t.Fatalf("expected a timeout, got %v", err)
+	}
+}
+
+func TestNativeStoreKeepsWhatItDidNotCreateOrCannotParse(t *testing.T) {
+	rc, args, _, _ := nativeInstallFixture(t)
+	store := nativeTestStore(t)
+	// Another program's directory in components/ is not a version directory.
+	unrelated := filepath.Join(filepath.Dir(store), "unrelated")
+	if err := os.MkdirAll(unrelated, 0700); err != nil {
+		t.Fatal(err)
+	}
+	// A failed first installation leaves no entry; the version is collected by a later install.
+	probeNativeInstallation = func(context.Context, string, []string) error { return errors.New("synthetic unavailable") }
+	if err := runInstall(rc, args); err == nil {
+		t.Fatal("published a failed installation")
+	}
+	if users, _ := countNativeUsers(store); users != 0 {
+		t.Fatal("a failed first installation pinned the shared components")
+	}
+	probeNativeInstallation = func(context.Context, string, []string) error { return nil }
+	if err := runInstall(rc, args); err != nil {
+		t.Fatal(err)
+	}
+	// An entry that cannot be read as a path counts as a user; a writable top directory is sealed again.
+	if err := os.WriteFile(filepath.Join(store, "users", "damaged"), nil, 0600); err != nil {
+		t.Fatal(err)
+	}
+	if runtime.GOOS != "windows" {
+		if err := os.Chmod(filepath.Join(store, "codex"), 0700); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := runInstall(rc, otherNativeInstallation(t, args)); err != nil {
+		t.Fatal(err)
+	}
+	if users, _ := countNativeUsers(store); users != 3 {
+		t.Fatalf("store has %d users, want 3", users)
+	}
+	if info, err := os.Stat(filepath.Join(store, "codex")); err != nil || (runtime.GOOS != "windows" && info.Mode().Perm() != 0500) {
+		t.Fatalf("component directory not sealed: %v", err)
+	}
+	if _, err := os.Stat(unrelated); err != nil {
+		t.Fatal("collection removed a directory it did not create")
+	}
+}
diff --git a/apps/daemon/internal/cli/native_store_unix.go b/apps/daemon/internal/cli/native_store_unix.go
new file mode 100644
index 000000000..13b1d54f0
--- /dev/null
+++ b/apps/daemon/internal/cli/native_store_unix.go
@@ -0,0 +1,13 @@
+//go:build !windows
+
+package cli
+
+import (
+	"os"
+	"syscall"
+)
+
+func ownedByCurrentUser(info os.FileInfo) bool {
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	return ok && int(stat.Uid) == os.Getuid()
+}
diff --git a/apps/daemon/internal/cli/native_store_windows.go b/apps/daemon/internal/cli/native_store_windows.go
new file mode 100644
index 000000000..5cc6b43f0
--- /dev/null
+++ b/apps/daemon/internal/cli/native_store_windows.go
@@ -0,0 +1,6 @@
+package cli
+
+import "os"
+
+// Windows directory ACLs, not owners, decide access; the account's profile already scopes the store.
+func ownedByCurrentUser(os.FileInfo) bool { return true }
diff --git a/apps/daemon/internal/cli/native_uninstall.go b/apps/daemon/internal/cli/native_uninstall.go
index 5ee504578..4e875d730 100644
--- a/apps/daemon/internal/cli/native_uninstall.go
+++ b/apps/daemon/internal/cli/native_uninstall.go
@@ -2,6 +2,7 @@ package cli
 
 import (
 	"bufio"
+	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -39,6 +40,11 @@ func runUninstall(rc *runContext, args []string) error {
 	if config.Workspace != "" && within(root, config.Workspace) {
 		return fmt.Errorf("uninstall: the workspace %s is inside the installation directory; move it out first", config.Workspace)
 	}
+	// The entry is named while the installation directory still exists.
+	var entry string
+	if validateNativeComponentDirectory(config.ComponentDirectory) == nil {
+		entry = nativeUserEntry(config.ComponentDirectory, root)
+	}
 	var owned []string
 	for _, name := range nativeInstallationEntries {
 		if _, err = os.Lstat(filepath.Join(root, name)); err == nil {
@@ -53,7 +59,10 @@ func runUninstall(rc *runContext, args []string) error {
 	for _, target := range owned {
 		fmt.Fprintln(rc.stdout, "  "+target)
 	}
-	fmt.Fprintln(rc.stdout, "These hold the executor credential, native history and Harnesses. The workspace stays, and so does anything else in "+root+" and any credential or capability directory outside the installation.")
+	if entry != "" {
+		fmt.Fprintln(rc.stdout, "The shared components of this version are deleted too when no other installation uses them: "+config.ComponentDirectory)
+	}
+	fmt.Fprintln(rc.stdout, "These hold the executor credential and native history. The workspace stays, and so does anything else in "+root+" and any credential or capability directory outside the installation.")
 	fmt.Fprint(rc.stdout, "Continue? [y/N] ")
 	answer, _ := bufio.NewReader(rc.stdin).ReadString('\n')
 	if !strings.EqualFold(strings.TrimSpace(answer), "y") {
@@ -87,6 +96,7 @@ func runUninstall(rc *runContext, args []string) error {
 	bin := filepath.Join(root, "bin")
 	order = append(order, bin, record)
 	var kept bool
+	var releaseErr error
 	for _, target := range order {
 		held, e := removeTree(target, running)
 		if e != nil {
@@ -103,6 +113,17 @@ func runUninstall(rc *runContext, args []string) error {
 		_ = os.Remove(root)
 	}
 	fmt.Fprintln(rc.stdout, "oac-daemon: uninstalled")
+	if entry != "" {
+		users, err := releaseNativeStore(context.Background(), rc.stdout, config.ComponentDirectory, entry)
+		if err != nil {
+			releaseErr = fmt.Errorf("uninstall: the installation was removed but its shared components could not be released (%w); the next install or uninstall on this machine collects them", err)
+			fmt.Fprintln(rc.stdout, "Warning: "+releaseErr.Error())
+		} else if users == 0 {
+			fmt.Fprintln(rc.stdout, "Shared components removed: "+config.ComponentDirectory)
+		} else {
+			fmt.Fprintf(rc.stdout, "Shared components kept: %d other installation(s) still use %s\n", users, config.ComponentDirectory)
+		}
+	}
 	if config.Workspace != "" {
 		fmt.Fprintln(rc.stdout, "Workspace kept: "+config.Workspace)
 	}
@@ -115,7 +136,7 @@ func runUninstall(rc *runContext, args []string) error {
 		}
 	}
 	fmt.Fprintf(rc.stdout, "Core still accepts this machine's credential. In Web, open the Session (Environment %s) and choose Revoke in Executor credentials, or Delete the Session. This Session's install command cannot be used again; to reconnect it, choose Rotate and install from an extracted distribution, or create a new Session.\n", config.Environment)
-	return nil
+	return releaseErr
 }
 
 // removeTree deletes path. keep is the running executable, which Windows
diff --git a/apps/daemon/internal/cli/native_uninstall_test.go b/apps/daemon/internal/cli/native_uninstall_test.go
index c5c789e0b..604d37e72 100644
--- a/apps/daemon/internal/cli/native_uninstall_test.go
+++ b/apps/daemon/internal/cli/native_uninstall_test.go
@@ -50,6 +50,7 @@ func TestUninstallDeletesInstallationAndKeepsWorkspace(t *testing.T) {
 	if err := os.WriteFile(foreignFile, []byte("keep"), 0600); err != nil {
 		t.Fatal(err)
 	}
+	t.Setenv("OAC_RUNTIME_HOME", root)
 	output := new(bytes.Buffer)
 	rc = &runContext{stdin: strings.NewReader("n\n"), stdout: output, stderr: output}
 	if err := runUninstall(rc, nil); err == nil || !strings.Contains(output.String(), filepath.Join(root, "bin")) {
@@ -63,7 +64,7 @@ func TestUninstallDeletesInstallationAndKeepsWorkspace(t *testing.T) {
 	if err := runUninstall(rc, nil); err != nil {
 		t.Fatal(err)
 	}
-	for _, text := range []string{"Revoke", "Executor credentials", "Delete the Session", "Kept: " + foreignFile, "Kept: " + foreignDir, "Kept: " + credential, "Rotate"} {
+	for _, text := range []string{"Revoke", "Executor credentials", "Delete the Session", "Kept: " + foreignFile, "Kept: " + foreignDir, "Kept: " + credential, "Rotate", "Shared components removed"} {
 		if !strings.Contains(output.String(), text) {
 			t.Fatalf("missing %q in\n%s", text, output)
 		}
@@ -90,10 +91,7 @@ func TestUninstallRemovesEmptiedInstallationDirectory(t *testing.T) {
 	if err := runInstall(rc, args); err != nil {
 		t.Fatal(err)
 	}
-	rc = &runContext{stdin: strings.NewReader("y\n"), stdout: new(bytes.Buffer), stderr: new(bytes.Buffer)}
-	if err := runUninstall(rc, nil); err != nil {
-		t.Fatal(err)
-	}
+	uninstallNative(t, root)
 	if _, err := os.Stat(root); !os.IsNotExist(err) {
 		t.Fatal("installation directory remains")
 	}
@@ -109,7 +107,8 @@ func TestUninstallFailureCanBeRerun(t *testing.T) {
 	if err := runInstall(rc, args); err != nil {
 		t.Fatal(err)
 	}
-	locked := filepath.Join(root, "components", "locked")
+	t.Setenv("OAC_RUNTIME_HOME", root)
+	locked := filepath.Join(root, "capabilities", "locked")
 	if err := os.MkdirAll(locked, 0700); err != nil {
 		t.Fatal(err)
 	}
@@ -157,13 +156,13 @@ func TestInstallRefusesDirectoryHoldingOtherFiles(t *testing.T) {
 
 // Without --install-dir an installation gets its own directory in the Runtime home.
 func TestInstallDefaultsToEnvironmentDirectory(t *testing.T) {
-	rc, args, root, _ := nativeInstallFixture(t)
+	rc, args, _, _ := nativeInstallFixture(t)
 	args = slices.Delete(args, slices.Index(args, "--install-dir"), slices.Index(args, "--install-dir")+2)
 	if err := runInstall(rc, args); err != nil {
 		t.Fatal(err)
 	}
 	environment := args[slices.Index(args, "--environment-id")+1]
-	if _, err := os.Stat(filepath.Join(root, "environments", environment, "daemon", "installation.json")); err != nil {
+	if _, err := os.Stat(filepath.Join(os.Getenv("OAC_RUNTIME_HOME"), "environments", environment, "daemon", "installation.json")); err != nil {
 		t.Fatalf("installation is not in the default directory: %v", err)
 	}
 }
diff --git a/apps/daemon/internal/cli/placement.go b/apps/daemon/internal/cli/placement.go
deleted file mode 100644
index af2b661c4..000000000
--- a/apps/daemon/internal/cli/placement.go
+++ /dev/null
@@ -1,69 +0,0 @@
-package cli
-
-import (
-	"context"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"time"
-
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/placement"
-)
-
-func runPlacement(ctx *runContext, args []string) error {
-	if len(args) == 0 || args[0] == "--help" || args[0] == "-h" {
-		fmt.Fprintln(ctx.stdout, "Usage: oac-daemon placement enroll --container <full-id> --owner <label-value> --workspace <absolute-path> [--environment <uuid>]")
-		fmt.Fprintln(ctx.stdout, "       oac-daemon placement retire --container <full-id> [--environment <uuid>]")
-		fmt.Fprintln(ctx.stdout, "Explicit operator-managed local Linux/Docker only; normal harness release is unaffected.")
-		fmt.Fprintln(ctx.stdout, "Enrollment requires label io.oac.placement=<owner> and the qualified private profile.")
-		fmt.Fprintln(ctx.stdout, "Scoped enrollment requires the same --environment on retirement; this is operator consent, not Core authentication.")
-		return nil
-	}
-	action := args[0]
-	if action != "enroll" && action != "retire" {
-		return fmt.Errorf("unknown placement action %q", action)
-	}
-	fs := newFlagSet("placement " + action)
-	id := fs.String("container", "", "full immutable container ID")
-	environment := fs.String("environment", "", "operator-confirmed Environment UUID")
-	var owner, workspace string
-	if action == "enroll" {
-		fs.StringVar(&owner, "owner", "", "operator-created placement label value")
-		fs.StringVar(&workspace, "workspace", "", "retained absolute host workspace path")
-	}
-	if err := fs.Parse(args[1:]); err != nil {
-		if err == flag.ErrHelp {
-			return runPlacement(ctx, []string{"--help"})
-		}
-		return err
-	}
-	if fs.NArg() != 0 || *id == "" {
-		return fmt.Errorf("placement %s requires --container and no positional arguments", action)
-	}
-	scoped := false
-	fs.Visit(func(f *flag.Flag) {
-		if f.Name == "environment" {
-			scoped = true
-		}
-	})
-	controller, err := placement.New()
-	if err != nil {
-		return err
-	}
-	operation, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
-	defer cancel()
-	var receipt *placement.Receipt
-	if action == "enroll" && scoped {
-		receipt, err = controller.EnrollEnvironment(operation, *id, owner, workspace, *environment)
-	} else if action == "enroll" {
-		receipt, err = controller.Enroll(operation, *id, owner, workspace)
-	} else if scoped {
-		receipt, err = controller.RetireEnvironment(operation, *id, *environment)
-	} else {
-		receipt, err = controller.Retire(operation, *id)
-	}
-	if err != nil {
-		return err
-	}
-	return json.NewEncoder(ctx.stdout).Encode(receipt)
-}
diff --git a/apps/daemon/internal/cli/root.go b/apps/daemon/internal/cli/root.go
index 092c62946..a2bcdad44 100644
--- a/apps/daemon/internal/cli/root.go
+++ b/apps/daemon/internal/cli/root.go
@@ -40,7 +40,6 @@ var commands = []command{
 	{name: "uninstall", summary: "Stop the daemon and delete this installation", run: runUninstall},
 	{name: "resume", summary: "Wake one planned hosted suspension", run: runResume},
 	{name: "runtime-mcp-exec", summary: "Execute an installed MCP server", run: runRuntimeMCP},
-	{name: "placement", summary: "Enroll or retire an explicitly managed local execution placement", run: runPlacement},
 	{name: "connect", summary: "Open the reverse WebSocket and start serving prompts", run: runConnect},
 	{name: "status", summary: "Print the credential profile and daemon state", run: runStatus},
 	{name: "stop", summary: "Stop a background `connect -b` daemon", run: runStop},
diff --git a/apps/daemon/internal/cli/root_test.go b/apps/daemon/internal/cli/root_test.go
index 2d930fc40..68a8cca4e 100644
--- a/apps/daemon/internal/cli/root_test.go
+++ b/apps/daemon/internal/cli/root_test.go
@@ -65,7 +65,6 @@ func TestSubcommandsAreRegistered(t *testing.T) {
 		"uninstall":        false,
 		"resume":           false,
 		"runtime-mcp-exec": false,
-		"placement":        false,
 		"connect":          false,
 		"status":           false,
 		"stop":             false,
diff --git a/apps/daemon/internal/daemonize/fork_unix.go b/apps/daemon/internal/daemonize/fork_unix.go
index 142ba56c7..d729a25be 100644
--- a/apps/daemon/internal/daemonize/fork_unix.go
+++ b/apps/daemon/internal/daemonize/fork_unix.go
@@ -3,38 +3,11 @@
 package daemonize
 
 import (
-	"fmt"
-	"os"
 	"os/exec"
-	"strconv"
 	"syscall"
 )
 
 func configureBackground(cmd *exec.Cmd) (func(), func() error, error) {
-	if err := closeInheritedOnExec(); err != nil {
-		return nil, nil, err
-	}
 	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
 	return func() {}, func() error { return nil }, nil
 }
-
-// closeInheritedOnExec keeps descriptors this process inherited, such as the
-// native bootstrap's download lock, out of the detached daemon, which outlives
-// its caller. Go opens its own descriptors close-on-exec already.
-func closeInheritedOnExec() error {
-	dir, err := os.Open("/dev/fd")
-	if err != nil {
-		return fmt.Errorf("daemonize: list open descriptors: %w", err)
-	}
-	names, err := dir.Readdirnames(-1)
-	dir.Close()
-	if err != nil {
-		return fmt.Errorf("daemonize: list open descriptors: %w", err)
-	}
-	for _, name := range names {
-		if fd, err := strconv.Atoi(name); err == nil && fd > 2 {
-			syscall.CloseOnExec(fd)
-		}
-	}
-	return nil
-}
diff --git a/apps/daemon/internal/daemonize/fork_unix_test.go b/apps/daemon/internal/daemonize/fork_unix_test.go
deleted file mode 100644
index a3caf9f55..000000000
--- a/apps/daemon/internal/daemonize/fork_unix_test.go
+++ /dev/null
@@ -1,44 +0,0 @@
-//go:build unix
-
-package daemonize
-
-import (
-	"path/filepath"
-	"syscall"
-	"testing"
-	"time"
-
-	"golang.org/x/sys/unix"
-)
-
-// The native bootstrap holds its download lock on an inheritable descriptor.
-// The detached daemon must not keep that lock after its caller exits.
-func TestSpawnLeavesInheritedLockBehind(t *testing.T) {
-	dir := privateTempDir(t)
-	lockPath := filepath.Join(dir, "download.lock")
-	inherited, err := syscall.Open(lockPath, syscall.O_RDWR|syscall.O_CREAT, 0o600)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := unix.Flock(inherited, unix.LOCK_EX|unix.LOCK_NB); err != nil {
-		t.Fatal(err)
-	}
-	t.Setenv(spawnTestChildEnv, "1")
-	pidPath := filepath.Join(dir, "child.pid")
-	if _, err := Spawn([]string{"oac-daemon", "child-mode"}, ReExecOptions{LogPath: filepath.Join(dir, "child.log"), PIDPath: pidPath}); err != nil {
-		t.Fatalf("Spawn: %v", err)
-	}
-	t.Cleanup(func() { _ = StopPIDFile(pidPath, 2*time.Second) })
-	if err := syscall.Close(inherited); err != nil {
-		t.Fatal(err)
-	}
-
-	next, err := syscall.Open(lockPath, syscall.O_RDWR|syscall.O_CLOEXEC, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer syscall.Close(next)
-	if err := unix.Flock(next, unix.LOCK_EX|unix.LOCK_NB); err != nil {
-		t.Fatalf("the background child kept the caller's lock: %v", err)
-	}
-}
diff --git a/apps/daemon/internal/dispatch/capability_admission_test.go b/apps/daemon/internal/dispatch/capability_admission_test.go
index 7aaf78466..b12cd0b4b 100644
--- a/apps/daemon/internal/dispatch/capability_admission_test.go
+++ b/apps/daemon/internal/dispatch/capability_admission_test.go
@@ -23,11 +23,11 @@ func TestSteeringUsesAdmittedDeclarationAndDoesNotReplayUnsupportedImplementatio
 					return fmt.Errorf("%w: fixture has no active input", agent.ErrUnsupportedOperation)
 				}}, nil
 			})
-			info := proto.SupportedAgentKind{Kind: "fixture", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilityFromBool(supported)})}
+			info := proto.SupportedAgentKind{Kind: "fixture", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilityFromBool(supported)})}
 			registerExecutorKind(h.reg, info, factory)
 			startRun(t, h.router, h.sender, "run", proto.PromptRequestPayload{AgentKind: "fixture"})
 			// A new registration cannot rewrite the already admitted owner's contract.
-			info.Capabilities.Steering = proto.CapabilityFromBool(!supported)
+			info.Capabilities.DurableInputReceipts = proto.CapabilityFromBool(!supported)
 			registerExecutorKind(h.reg, info, factory)
 			for range 2 {
 				if err := handleSteeringAndWait(t, h, mustEnv(t, proto.TypePromptSteer, "run", proto.PromptSteerPayload{InputID: "input", Input: proto.TextInput("hello")})); err != nil {
diff --git a/apps/daemon/internal/dispatch/durable_only_test.go b/apps/daemon/internal/dispatch/durable_only_test.go
deleted file mode 100644
index 1c6fa14ac..000000000
--- a/apps/daemon/internal/dispatch/durable_only_test.go
+++ /dev/null
@@ -1,65 +0,0 @@
-package dispatch_test
-
-import (
-	"context"
-	"sync/atomic"
-	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-type durableOnlyExecutor struct {
-	*reusableExecutor
-	applied atomic.Int32
-}
-
-func (e *durableOnlyExecutor) StartTurn(ctx context.Context, id string, input proto.MessageInput, out chan<- proto.Envelope) (agent.Turn, error) {
-	turn, err := e.reusableExecutor.StartTurn(ctx, id, input, out)
-	return &durableOnlyTurn{Turn: turn, applied: &e.applied}, err
-}
-
-type durableOnlyTurn struct {
-	agent.Turn
-	applied *atomic.Int32
-}
-
-func (t *durableOnlyTurn) SteerWithReceipt(_ context.Context, _ proto.PromptSteerPayload, written func()) error {
-	written()
-	t.applied.Add(1)
-	return nil
-}
-
-func TestPublicTextSteeringDoesNotRequireOptionalSteerer(t *testing.T) {
-	owner := &durableOnlyExecutor{reusableExecutor: &reusableExecutor{starts: make(chan *reusableTurn, 1)}}
-	router, sender := poolRouter(t, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) { return owner, nil })
-	admission := executorAdmission(t, router, sender, "prepare", executorRequest())
-	startExecutorTurn(t, router, sender, "prepare", "run", admission)
-	turn := <-owner.starts
-	defer turn.finish()
-	input := proto.PromptSteerPayload{InputID: "extra", Input: proto.TextInput("follow-up"), DurableReceipt: true}
-	if err := router.Handle(t.Context(), mustEnv(t, proto.TypePromptSteer, "run", input)); err != nil {
-		t.Fatal(err)
-	}
-	waitFor(t, func() bool {
-		for _, event := range sender.snapshot() {
-			var ack proto.PromptSteerAckPayload
-			if event.Type == proto.TypePromptSteerAck && event.DecodePayload(&ack) == nil && ack.InputID == input.InputID && ack.Accepted {
-				return true
-			}
-		}
-		return false
-	}, "durable input applied without optional Steerer")
-	if owner.applied.Load() != 1 {
-		t.Fatal("input was not applied exactly once")
-	}
-	input.DurableReceipt = false
-	input.InputID = "ordinary"
-	if err := router.Handle(t.Context(), mustEnv(t, proto.TypePromptSteer, "run", input)); err != nil {
-		t.Fatal(err)
-	}
-	if ack := lastSteeringAck(t, sender, "run", "ordinary"); ack.ErrorCode != "unsupported" {
-		t.Fatal("unimplemented optional Steerer was not rejected")
-	}
-
-}
diff --git a/apps/daemon/internal/dispatch/environment.go b/apps/daemon/internal/dispatch/environment.go
index 74de20411..5c120ca87 100644
--- a/apps/daemon/internal/dispatch/environment.go
+++ b/apps/daemon/internal/dispatch/environment.go
@@ -13,9 +13,6 @@ func validateExecutionEnvironment(req proto.PromptRequestPayload, caps proto.Age
 	if err := req.ValidateAgentOptions(); err != nil {
 		return err
 	}
-	if err := req.ValidateProgrammaticToolCallingDisable(caps.ProgrammaticToolCallingDisable.IsSupported()); err != nil {
-		return err
-	}
 	if err := req.ValidateToolSearch(caps.ToolSearch.IsSupported()); err != nil {
 		return err
 	}
diff --git a/apps/daemon/internal/dispatch/executor.go b/apps/daemon/internal/dispatch/executor.go
index 5b2e94305..113458736 100644
--- a/apps/daemon/internal/dispatch/executor.go
+++ b/apps/daemon/internal/dispatch/executor.go
@@ -44,7 +44,7 @@ func executorFingerprint(req proto.PromptRequestPayload) ([32]byte, error) {
 
 func (r *Router) handleExecutorPrepare(ctx context.Context, env proto.Envelope, input proto.ExecutionPreparePayload) error {
 	req := input.Configuration
-	if strings.TrimSpace(input.SessionID) == "" || req.RunID != "" || len(req.Input) != 0 || req.AgentStateKey != "agents-api-"+input.SessionID {
+	if strings.TrimSpace(input.SessionID) == "" || req.RunID != "" || len(req.Input) != 0 || req.AgentStateKey != input.SessionID {
 		return r.rejectPreparation(env, "invalid_configuration")
 	}
 	caps, available := r.availableCapabilities(req.AgentKind)
diff --git a/apps/daemon/internal/dispatch/executor_cancel_receipt_test.go b/apps/daemon/internal/dispatch/executor_cancel_receipt_test.go
index d9cf60fac..ecfdde7a0 100644
--- a/apps/daemon/internal/dispatch/executor_cancel_receipt_test.go
+++ b/apps/daemon/internal/dispatch/executor_cancel_receipt_test.go
@@ -103,9 +103,6 @@ func (t *receiptCancelTurn) AwaitSettlement(ctx context.Context) (agent.TurnSett
 func (t *receiptCancelTurn) CancellationOutcome() proto.DonePayload {
 	return proto.DonePayload{Content: "observed", Metadata: map[string]any{proto.DoneMetaAgentSessionID: "native-session"}}
 }
-func (t *receiptCancelTurn) Steer(ctx context.Context, input proto.PromptSteerPayload) error {
-	return t.SteerWithReceipt(ctx, input, nil)
-}
 func (t *receiptCancelTurn) SteerWithReceipt(ctx context.Context, _ proto.PromptSteerPayload, written func()) error {
 	written()
 	close(t.written)
@@ -156,7 +153,7 @@ func TestExecutorCancellationReachesNativeBeforeDurableReceiptJoin(t *testing.T)
 			p := executorAdmission(t, r, sender.recSender, "first", executorRequest())
 			startExecutorTurn(t, r, sender.recSender, "first", "run", p)
 			turn := <-owner.turn
-			input := proto.PromptSteerPayload{InputID: "pending", Input: proto.TextInput("second input"), DurableReceipt: true}
+			input := proto.PromptSteerPayload{InputID: "pending", Input: proto.TextInput("second input")}
 			if err := r.Handle(t.Context(), mustEnv(t, proto.TypePromptSteer, "run", input)); err != nil {
 				t.Fatal(err)
 			}
diff --git a/apps/daemon/internal/dispatch/executor_handoff_test.go b/apps/daemon/internal/dispatch/executor_handoff_test.go
index 0b679aa7f..31f0b9ed3 100644
--- a/apps/daemon/internal/dispatch/executor_handoff_test.go
+++ b/apps/daemon/internal/dispatch/executor_handoff_test.go
@@ -147,7 +147,7 @@ func TestPreparedDonePublishesAfterExecutorHandoff(t *testing.T) {
 					}
 				}
 			}
-			request := proto.ExecutionPreparePayload{SessionID: "session", Configuration: proto.PromptRequestPayload{AgentKind: "handoff", AgentStateKey: "agents-api-session", DisableExecutionEnvironment: true}}
+			request := proto.ExecutionPreparePayload{SessionID: "session", Configuration: proto.PromptRequestPayload{AgentKind: "handoff", AgentStateKey: "session", DisableExecutionEnvironment: true}}
 			admit := func(id string) proto.PreparationStatusPayload {
 				t.Helper()
 				handle(proto.TypeExecutionPrepare, id, request)
diff --git a/apps/daemon/internal/dispatch/executor_test.go b/apps/daemon/internal/dispatch/executor_test.go
index 2cba36047..e5ed86a39 100644
--- a/apps/daemon/internal/dispatch/executor_test.go
+++ b/apps/daemon/internal/dispatch/executor_test.go
@@ -71,7 +71,7 @@ func (t *reusableTurn) AwaitSettlement(ctx context.Context) (agent.TurnSettlemen
 
 // noEnvironmentPreparation prepares config for session without an execution environment.
 func noEnvironmentPreparation(session string, config proto.PromptRequestPayload) proto.ExecutionPreparePayload {
-	config.AgentStateKey, config.DisableExecutionEnvironment = "agents-api-"+session, true
+	config.AgentStateKey, config.DisableExecutionEnvironment = session, true
 	return proto.ExecutionPreparePayload{SessionID: session, Configuration: config}
 }
 func executorRequest() proto.ExecutionPreparePayload {
@@ -247,7 +247,7 @@ func poolRouter(t *testing.T, factory agent.ExecutorFactory) (*dispatch.Router,
 func poolRequest(id string) proto.ExecutionPreparePayload {
 	req := executorRequest()
 	req.SessionID = id
-	req.Configuration.AgentStateKey = "agents-api-" + id
+	req.Configuration.AgentStateKey = id
 	return req
 }
 
diff --git a/apps/daemon/internal/dispatch/local_directory_test.go b/apps/daemon/internal/dispatch/local_directory_test.go
index 8319fbecc..7ac10720f 100644
--- a/apps/daemon/internal/dispatch/local_directory_test.go
+++ b/apps/daemon/internal/dispatch/local_directory_test.go
@@ -40,7 +40,7 @@ func TestLocalDirectoryPreparationNeedsNoHarnessAndRejectsOtherOwners(t *testing
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = r.Shutdown(context.Background()) })
-	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, WorkspaceReadOnly: true}
+	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: session, WorkspaceReadOnly: true}
 	if err := r.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "idle", proto.ExecutionPreparePayload{Configuration: request})); err != nil {
 		t.Fatal(err)
 	}
@@ -67,7 +67,7 @@ func TestLocalDirectoryPreparationNeedsNoHarnessAndRejectsOtherOwners(t *testing
 		t.Fatal("read preparation admitted execution")
 	}
 	bad := request
-	bad.AgentStateKey = "agents-api-" + uuid.NewString()
+	bad.AgentStateKey = uuid.NewString()
 	if err := r.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "wrong-session", proto.ExecutionPreparePayload{Configuration: bad})); err == nil {
 		t.Fatal("wrong Session accepted")
 	}
@@ -118,7 +118,7 @@ func TestLocalDirectoryKeepsNotDirectorySeparateFromFailures(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = r.Shutdown(context.Background()) })
-	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, WorkspaceReadOnly: true}
+	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: session, WorkspaceReadOnly: true}
 	if err := r.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "idle", proto.ExecutionPreparePayload{Configuration: request})); err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/dispatch/mcp_http_test.go b/apps/daemon/internal/dispatch/mcp_http_test.go
index 3ba64f237..ff6805d3e 100644
--- a/apps/daemon/internal/dispatch/mcp_http_test.go
+++ b/apps/daemon/internal/dispatch/mcp_http_test.go
@@ -96,7 +96,6 @@ func TestLocalMCPOriginAndCapabilityAdmission(t *testing.T) {
 			req.Configuration.MCPHTTPServers = &servers
 			if strings.HasPrefix(mode, "environment") {
 				servers[0].ConnectionOrigin = "environment"
-				req.Configuration.LocalEnvironment.NetworkAccess = "enabled"
 			}
 			if strings.Contains(mode, "bearer") {
 				token := "synthetic-private-token"
diff --git a/apps/daemon/internal/dispatch/preparation_executor_fixture_test.go b/apps/daemon/internal/dispatch/preparation_executor_fixture_test.go
index 0ab84ce26..73206099f 100644
--- a/apps/daemon/internal/dispatch/preparation_executor_fixture_test.go
+++ b/apps/daemon/internal/dispatch/preparation_executor_fixture_test.go
@@ -107,19 +107,10 @@ func (t *preparationTurn) SubmitFunctionResult(ctx context.Context, p proto.Func
 	}
 	return agent.ErrUnknownFunctionCall
 }
-func (t *preparationTurn) Steer(ctx context.Context, p proto.PromptSteerPayload) error {
-	if target, ok := t.Session.(agent.Steerer); ok {
-		return target.Steer(ctx, p)
-	}
-	return agent.ErrSteeringInactive
-}
 func (t *preparationTurn) SteerWithReceipt(ctx context.Context, p proto.PromptSteerPayload, write func()) error {
 	if target, ok := t.Session.(agent.DurableSteerer); ok {
 		return target.SteerWithReceipt(ctx, p, write)
 	}
-	if target, ok := t.Session.(agent.Steerer); ok {
-		return target.Steer(ctx, p)
-	}
 	return agent.ErrSteeringInactive
 }
 func (t *preparationTurn) ReadWorkspaceFile(ctx context.Context, path string, limit int) (agent.WorkspaceReadResult, error) {
diff --git a/apps/daemon/internal/dispatch/preparation_test.go b/apps/daemon/internal/dispatch/preparation_test.go
index d987fc818..41f97ded1 100644
--- a/apps/daemon/internal/dispatch/preparation_test.go
+++ b/apps/daemon/internal/dispatch/preparation_test.go
@@ -86,8 +86,6 @@ func preparationWorkspace(t *testing.T) *localworkspace.Binding {
 		"OAC_RUNTIME_WORKSPACE":            t.TempDir(),
 		"OAC_RUNTIME_CAPABILITY_DIRECTORY": t.TempDir(),
 		"OAC_RUNTIME_HOME":                 runtimeHome,
-		"OAC_RUNTIME_NETWORK_ACCESS":       "enabled",
-		"OAC_RUNTIME_ALLOWED_DOMAINS":      "",
 	} {
 		t.Setenv(name, value)
 	}
@@ -113,13 +111,13 @@ func localPreparationHarness(t *testing.T) *harness {
 }
 
 func preparationRequest() proto.ExecutionPreparePayload {
-	return proto.ExecutionPreparePayload{SessionID: preparationSessionID, Configuration: proto.PromptRequestPayload{AgentKind: "prepared", AgentStateKey: "agents-api-" + preparationSessionID, LocalEnvironment: &proto.LocalEnvironment{ID: preparationEnvironmentID, NetworkAccess: "enabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}}}
+	return proto.ExecutionPreparePayload{SessionID: preparationSessionID, Configuration: proto.PromptRequestPayload{AgentKind: "prepared", AgentStateKey: preparationSessionID, LocalEnvironment: &proto.LocalEnvironment{ID: preparationEnvironmentID, WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}}}
 }
 
 func preparationRouter(t *testing.T, sender dispatch.Sender, timeout time.Duration, factory preparationFactory) *dispatch.Router {
 	t.Helper()
 	reg := agent.NewRegistry()
-	reg.RegisterKind(proto.SupportedAgentKind{Kind: "prepared", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{LocalEnvironment: proto.CapabilitySupported, WorkspaceReadPreparation: proto.CapabilitySupported, FunctionTools: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{})
+	reg.RegisterKind(proto.SupportedAgentKind{Kind: "prepared", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{LocalEnvironment: proto.CapabilitySupported, WorkspaceReadPreparation: proto.CapabilitySupported, FunctionTools: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{})
 	reg.RegisterExecutor("prepared", preparationExecutorFixture(factory))
 	r, err := dispatch.New(dispatch.Config{Registry: reg, Sender: sender, PreparationTimeout: timeout, LocalWorkspace: preparationWorkspace(t)})
 	if err != nil {
diff --git a/apps/daemon/internal/dispatch/prepared_handoff_mutation_test.go b/apps/daemon/internal/dispatch/prepared_handoff_mutation_test.go
index 9e86b0168..39c557936 100644
--- a/apps/daemon/internal/dispatch/prepared_handoff_mutation_test.go
+++ b/apps/daemon/internal/dispatch/prepared_handoff_mutation_test.go
@@ -30,7 +30,7 @@ func (s *preparedMutationSession) SubmitFunctionResult(context.Context, proto.Fu
 	return nil
 }
 
-func (s *preparedMutationSession) Steer(context.Context, proto.PromptSteerPayload) error {
+func (s *preparedMutationSession) SteerWithReceipt(context.Context, proto.PromptSteerPayload, func()) error {
 	s.steers.Add(1)
 	return nil
 }
@@ -278,4 +278,3 @@ func TestPreparedHandoffEarlyDonePublishesAfterStarted(t *testing.T) {
 }
 
 var _ agent.FunctionResultSubmitter = (*preparedMutationSession)(nil)
-var _ agent.Steerer = (*preparedMutationSession)(nil)
diff --git a/apps/daemon/internal/dispatch/receipt_order_test.go b/apps/daemon/internal/dispatch/receipt_order_test.go
index 13d3edf50..847e216d9 100644
--- a/apps/daemon/internal/dispatch/receipt_order_test.go
+++ b/apps/daemon/internal/dispatch/receipt_order_test.go
@@ -50,7 +50,7 @@ func TestDurableCompletionWaitsForSteeringReceiptSend(t *testing.T) {
 			registry := agent.NewRegistry()
 			var session *fakeSession
 			var calls atomic.Int32
-			registerExecutorKind(registry, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
+			registerExecutorKind(registry, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 				session = &fakeSession{out: out, closeOutOnCancel: true}
 				return &steeringSession{fakeSession: session, steer: func(context.Context, proto.PromptSteerPayload) error {
 					calls.Add(1)
@@ -128,7 +128,7 @@ func TestShutdownReleasesSteeringWorkerAndReceiptJoin(t *testing.T) {
 			registry := agent.NewRegistry()
 			entered, exited := make(chan struct{}), make(chan struct{})
 			var session *fakeSession
-			registerExecutorKind(registry, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
+			registerExecutorKind(registry, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 				session = &fakeSession{out: out, closeOutOnCancel: true}
 				return &steeringSession{fakeSession: session, steer: func(ctx context.Context, _ proto.PromptSteerPayload) error {
 					close(entered)
diff --git a/apps/daemon/internal/dispatch/receipt_shutdown_test.go b/apps/daemon/internal/dispatch/receipt_shutdown_test.go
index e736bf867..42ff7efaa 100644
--- a/apps/daemon/internal/dispatch/receipt_shutdown_test.go
+++ b/apps/daemon/internal/dispatch/receipt_shutdown_test.go
@@ -45,7 +45,7 @@ func TestShutdownCancelsCompletionErrorSend(t *testing.T) {
 	sender := &shutdownAllSendsBlockSender{entered: make(chan struct{}), terminal: make(chan context.Context, 1), rescue: make(chan struct{})}
 	registry := agent.NewRegistry()
 	var session *fakeSession
-	registerExecutorKind(registry, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
+	registerExecutorKind(registry, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 		session = &fakeSession{out: out, closeOutOnCancel: true}
 		return &steeringSession{fakeSession: session, steer: func(context.Context, proto.PromptSteerPayload) error { return nil }}, nil
 	}))
diff --git a/apps/daemon/internal/dispatch/steering.go b/apps/daemon/internal/dispatch/steering.go
index fa71133ac..cde7c7725 100644
--- a/apps/daemon/internal/dispatch/steering.go
+++ b/apps/daemon/internal/dispatch/steering.go
@@ -22,7 +22,6 @@ const (
 type steeringReceipt struct {
 	fingerprint [32]byte
 	ack         proto.PromptSteerAckPayload
-	durable     bool
 }
 
 func (r *Router) handlePromptSteer(ctx context.Context, env proto.Envelope) error {
@@ -89,7 +88,7 @@ func (r *Router) queueSteering(ctx context.Context, env proto.Envelope, input pr
 	encoded, _ := json.Marshal(input.Input)
 	fingerprint := sha256.Sum256(encoded)
 	if previous, ok := state.steering[input.InputID]; ok {
-		if previous.fingerprint != fingerprint || previous.durable != input.DurableReceipt {
+		if previous.fingerprint != fingerprint {
 			ack.ErrorCode, ack.Error = "input_conflict", "This input ID was already used with different text."
 			return &ack
 		}
@@ -110,24 +109,18 @@ func (r *Router) queueSteering(ctx context.Context, env proto.Envelope, input pr
 	ack.ErrorCode, ack.Error = "not_ready", "The run is still starting."
 	// Bind input identity before any retryable state so changed text cannot
 	// slip through a startup or in-flight retry.
-	state.steering[input.InputID] = steeringReceipt{fingerprint: fingerprint, ack: ack, durable: input.DurableReceipt}
+	state.steering[input.InputID] = steeringReceipt{fingerprint: fingerprint, ack: ack}
 	if state.session == nil {
 		return &ack
 	}
 	// The admitted declaration is immutable even if discovery changes later.
-	if input.DurableReceipt && !state.capabilities.DurableInputReceipts.IsSupported() || !input.DurableReceipt && !state.capabilities.Steering.IsSupported() {
+	if !state.capabilities.DurableInputReceipts.IsSupported() {
 		ack.ErrorCode, ack.Error = "unsupported", "The runtime declaration does not support this input operation."
 		return &ack
 	}
-	session := state.session
-	steerer, supportsSteering := session.(agent.Steerer)
-	if !input.DurableReceipt && !supportsSteering {
-		ack.ErrorCode, ack.Error = "unsupported", "This engine does not support active-turn input."
-		return &ack
-	}
 	if state.steerBusy {
 		ack.ErrorCode, ack.Error = "busy", "Another input is awaiting an engine receipt; retry this input later."
-		state.steering[input.InputID] = steeringReceipt{fingerprint: fingerprint, ack: ack, durable: input.DurableReceipt}
+		state.steering[input.InputID] = steeringReceipt{fingerprint: fingerprint, ack: ack}
 		return &ack
 	}
 	session, finishOperation, ready := r.preparedOperationLocked(state)
@@ -136,7 +129,7 @@ func (r *Router) queueSteering(ctx context.Context, env proto.Envelope, input pr
 		return &ack
 	}
 	ack.ErrorCode, ack.Error = "in_flight", "This input is awaiting an engine receipt."
-	state.steering[input.InputID] = steeringReceipt{fingerprint: fingerprint, ack: ack, durable: input.DurableReceipt}
+	state.steering[input.InputID] = steeringReceipt{fingerprint: fingerprint, ack: ack}
 	state.steerBusy = true
 	r.shutdownWG.Add(1)
 	go func() {
@@ -149,14 +142,7 @@ func (r *Router) queueSteering(ctx context.Context, env proto.Envelope, input pr
 		}()
 		ctx, stop := r.shutdownContext(ctx)
 		defer stop()
-		var err error
-		if input.DurableReceipt {
-			err = r.steerDurably(ctx, state, session, env, input, fingerprint)
-		} else {
-			callCtx, cancel := context.WithTimeout(ctx, steeringCallTimeout)
-			err = steerer.Steer(callCtx, input)
-			cancel()
-		}
+		err := r.steerDurably(ctx, state, session, env, input, fingerprint)
 		r.publishSteeringReceipt(ctx, state, env, input, fingerprint, steeringResult(input.InputID, err))
 	}()
 	return nil
diff --git a/apps/daemon/internal/dispatch/steering_lifetime.go b/apps/daemon/internal/dispatch/steering_lifetime.go
index 93a59ebb2..4e1f4e83a 100644
--- a/apps/daemon/internal/dispatch/steering_lifetime.go
+++ b/apps/daemon/internal/dispatch/steering_lifetime.go
@@ -32,7 +32,7 @@ func (r *Router) steerDurably(sendCtx context.Context, state *sessionState, sess
 
 func (r *Router) publishSteeringReceipt(ctx context.Context, state *sessionState, env proto.Envelope, input proto.PromptSteerPayload, fingerprint [32]byte, ack proto.PromptSteerAckPayload) bool {
 	r.mu.Lock()
-	state.steering[input.InputID] = steeringReceipt{fingerprint: fingerprint, ack: ack, durable: input.DurableReceipt}
+	state.steering[input.InputID] = steeringReceipt{fingerprint: fingerprint, ack: ack}
 	r.mu.Unlock()
 	// Credit waits follow the Run/connection lifetime, not a short native-call
 	// budget. Dropping an accepted receipt would make its outcome unknown.
diff --git a/apps/daemon/internal/dispatch/steering_lifetime_test.go b/apps/daemon/internal/dispatch/steering_lifetime_test.go
index 9a2419768..bb162e544 100644
--- a/apps/daemon/internal/dispatch/steering_lifetime_test.go
+++ b/apps/daemon/internal/dispatch/steering_lifetime_test.go
@@ -26,7 +26,7 @@ func TestDurableSteeringWaitsBeyondTransportDeadline(t *testing.T) {
 	var session *fakeSession
 	var calls atomic.Int32
 	release := make(chan struct{})
-	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
+	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 		session = &fakeSession{out: out, closeOutOnCancel: true}
 		return &durableSteeringSession{steeringSession: &steeringSession{fakeSession: session}, phased: func(ctx context.Context, input proto.PromptSteerPayload, written func()) error {
 			calls.Add(1)
@@ -41,7 +41,7 @@ func TestDurableSteeringWaitsBeyondTransportDeadline(t *testing.T) {
 	}))
 	startRun(t, h.router, h.sender, "durable", proto.PromptRequestPayload{AgentKind: "codex"})
 	base := len(h.sender.snapshot())
-	input := proto.PromptSteerPayload{InputID: "extra", Input: proto.TextInput("additional"), DurableReceipt: true}
+	input := proto.PromptSteerPayload{InputID: "extra", Input: proto.TextInput("additional")}
 	env := mustEnv(t, proto.TypePromptSteer, "durable", input)
 	if err := handleSteeringAndWait(t, h, env); err != nil {
 		t.Fatal(err)
@@ -78,7 +78,7 @@ func TestDurableSteeringTransportTimeoutAndShutdown(t *testing.T) {
 			h := newHarness(t)
 			defer h.router.Shutdown(context.Background())
 			exited := make(chan struct{})
-			registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
+			registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 				return &durableSteeringSession{steeringSession: &steeringSession{fakeSession: &fakeSession{out: out, closeOutOnCancel: true}}, phased: func(ctx context.Context, _ proto.PromptSteerPayload, written func()) error {
 					defer close(exited)
 					if phase == "written" {
@@ -91,7 +91,7 @@ func TestDurableSteeringTransportTimeoutAndShutdown(t *testing.T) {
 			ctx := context.Background()
 			startRun(t, h.router, h.sender, "run", proto.PromptRequestPayload{AgentKind: "codex"})
 			base := len(h.sender.snapshot())
-			if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptSteer, "run", proto.PromptSteerPayload{InputID: "one", Input: proto.TextInput("text"), DurableReceipt: true})); err != nil {
+			if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptSteer, "run", proto.PromptSteerPayload{InputID: "one", Input: proto.TextInput("text")})); err != nil {
 				t.Fatal(err)
 			}
 			if phase == "blocked-write" {
diff --git a/apps/daemon/internal/dispatch/steering_test.go b/apps/daemon/internal/dispatch/steering_test.go
index 1c14917fd..59b6df2e7 100644
--- a/apps/daemon/internal/dispatch/steering_test.go
+++ b/apps/daemon/internal/dispatch/steering_test.go
@@ -17,7 +17,7 @@ type steeringSession struct {
 	steer func(context.Context, proto.PromptSteerPayload) error
 }
 
-func (s *steeringSession) Steer(ctx context.Context, input proto.PromptSteerPayload) error {
+func (s *steeringSession) SteerWithReceipt(ctx context.Context, input proto.PromptSteerPayload, _ func()) error {
 	return s.steer(ctx, input)
 }
 
@@ -31,15 +31,12 @@ func TestSteeringReceiptsAndRetries(t *testing.T) {
 			h := newHarness(t)
 			defer h.router.Shutdown(context.Background())
 			calls, starts := 0, 0
-			registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
+			registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 				starts++
 				return &steeringSession{
 					fakeSession: &fakeSession{out: out, closeOutOnCancel: true},
 					steer: func(ctx context.Context, input proto.PromptSteerPayload) error {
 						calls++
-						if _, ok := ctx.Deadline(); !ok {
-							t.Error("native request has no deadline")
-						}
 						if input.InputID != "input-1" || *input.Input[0].Content[0].Text != "additional text" {
 							t.Errorf("input lost: %+v", input)
 						}
@@ -90,7 +87,7 @@ func TestSteeringReadinessAndUnsupportedRuns(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 	calls := 0
-	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
+	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 		return &steeringSession{
 			fakeSession: &fakeSession{out: out, closeOutOnCancel: true},
 			steer: func(context.Context, proto.PromptSteerPayload) error {
@@ -164,7 +161,7 @@ func TestSteeringDoesNotBlockOtherRunCancellation(t *testing.T) {
 	defer h.router.Shutdown(context.Background())
 	entered, release := make(chan struct{}), make(chan struct{})
 	defer close(release)
-	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
+	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 		return &steeringSession{
 			fakeSession: &fakeSession{out: out, closeOutOnCancel: true},
 			steer: func(context.Context, proto.PromptSteerPayload) error {
@@ -232,7 +229,7 @@ func TestSteeringCapacityPreservesExistingReceipts(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 	calls := 0
-	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
+	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 		return &steeringSession{
 			fakeSession: &fakeSession{out: out, closeOutOnCancel: true},
 			steer: func(context.Context, proto.PromptSteerPayload) error {
diff --git a/apps/daemon/internal/localworkspace/binding.go b/apps/daemon/internal/localworkspace/binding.go
index 9d24e3555..1dfdd84e5 100644
--- a/apps/daemon/internal/localworkspace/binding.go
+++ b/apps/daemon/internal/localworkspace/binding.go
@@ -10,14 +10,11 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentcapabilities"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
 )
 
 // Binding freezes operator-owned identity and paths for one Runtime lifetime.
 type Binding struct {
 	environment    string
-	networkAccess  string
-	allowedDomains []string
 	stateKey       string
 	workspace      string
 	writer         *fileWriter
@@ -42,13 +39,8 @@ func NewWithCapabilityDirectory(environment, session, workspace, directory strin
 
 func Load() (*Binding, error) {
 	values := []string{os.Getenv("OAC_RUNTIME_ENVIRONMENT_ID"), os.Getenv("OAC_RUNTIME_SESSION_ID"), os.Getenv("OAC_RUNTIME_WORKSPACE")}
-	policy, err := RuntimeNetworkPolicy()
-	if err != nil {
-		return nil, err
-	}
-	network := policy.Access
 	capabilityDirectory := os.Getenv("OAC_RUNTIME_CAPABILITY_DIRECTORY")
-	if strings.Join(values, "") == "" && network == "" && capabilityDirectory == "" {
+	if strings.Join(values, "") == "" && capabilityDirectory == "" {
 		return nil, nil
 	}
 	if capabilityDirectory == "" {
@@ -58,9 +50,6 @@ func Load() (*Binding, error) {
 	if err != nil {
 		return nil, err
 	}
-	b.networkAccess = network
-	b.allowedDomains = policy.Hosts()
-
 	return b, nil
 }
 
@@ -73,12 +62,6 @@ func (b *Binding) Configure(r proto.PromptRequestPayload) (proto.PromptRequestPa
 		r.DisableExecutionEnvironment {
 		return r, errors.New("request does not match the dedicated local Environment")
 	}
-	if !r.WorkspaceReadOnly || r.LocalEnvironment.NetworkAccess != "" || len(r.LocalEnvironment.AllowedDomains) > 0 {
-		requested := agentnetwork.Policy{Access: r.LocalEnvironment.NetworkAccess, AllowedDomains: r.LocalEnvironment.AllowedDomains}
-		if !b.NetworkPolicy().Equal(requested) {
-			return r, errors.New("request does not match the local Runtime network policy")
-		}
-	}
 	if !r.WorkspaceReadOnly {
 		local := *r.LocalEnvironment
 		if local.WorkspaceDirectory != "/workspace" && local.WorkspaceDirectory != b.workspace {
@@ -100,5 +83,5 @@ func (b *Binding) Configure(r proto.PromptRequestPayload) (proto.PromptRequestPa
 }
 
 func (b *Binding) Matches(environment, session string) bool {
-	return b != nil && b.environment == environment && b.stateKey == "agents-api-"+session
+	return b != nil && b.environment == environment && b.stateKey == session
 }
diff --git a/apps/daemon/internal/localworkspace/binding_test.go b/apps/daemon/internal/localworkspace/binding_test.go
index b23ea8c0f..321f092b3 100644
--- a/apps/daemon/internal/localworkspace/binding_test.go
+++ b/apps/daemon/internal/localworkspace/binding_test.go
@@ -24,8 +24,7 @@ func testBinding(t *testing.T) (*Binding, proto.PromptRequestPayload) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	b.networkAccess = "disabled"
-	return b, proto.PromptRequestPayload{LocalEnvironment: &proto.LocalEnvironment{ID: environment, NetworkAccess: "disabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}, AgentStateKey: "agents-api-" + session}
+	return b, proto.PromptRequestPayload{LocalEnvironment: &proto.LocalEnvironment{ID: environment, WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}, AgentStateKey: session}
 }
 
 func TestBindingRejectsScopeOverrides(t *testing.T) {
@@ -39,7 +38,7 @@ func TestBindingRejectsScopeOverrides(t *testing.T) {
 		"other Environment": func(r *proto.PromptRequestPayload) {
 			r.LocalEnvironment = &proto.LocalEnvironment{ID: uuid.NewString()}
 		},
-		"other Session": func(r *proto.PromptRequestPayload) { r.AgentStateKey = "agents-api-" + uuid.NewString() },
+		"other Session": func(r *proto.PromptRequestPayload) { r.AgentStateKey = uuid.NewString() },
 		"none":          func(r *proto.PromptRequestPayload) { r.DisableExecutionEnvironment = true },
 	} {
 		t.Run(name, func(t *testing.T) {
diff --git a/apps/daemon/internal/localworkspace/capabilities.go b/apps/daemon/internal/localworkspace/capabilities.go
index 3dd410248..4199aac3f 100644
--- a/apps/daemon/internal/localworkspace/capabilities.go
+++ b/apps/daemon/internal/localworkspace/capabilities.go
@@ -56,10 +56,16 @@ func (b *Binding) Prepare(ctx context.Context, r proto.PromptRequestPayload) (pr
 			return r, err
 		}
 	}
-	if len(manifest.MCP) != 0 {
-		if b.NetworkPolicy().Access != "enabled" {
-			return r, agentcapabilities.ErrInvalid
+	if r.MCPHTTPServers != nil {
+		values, readErr := b.ReadToolEnvironment()
+		if readErr == nil {
+			readErr = requireDeclaredVariables(*r.MCPHTTPServers, values)
+		}
+		if readErr != nil {
+			return r, readErr
 		}
+	}
+	if len(manifest.MCP) != 0 {
 		values, readErr := b.ReadToolEnvironment()
 		if readErr != nil {
 			return r, readErr
@@ -144,6 +150,10 @@ func (b *Binding) loadCapabilitySnapshot(root *os.Root, input agentcapabilities.
 		return agentcapabilities.Manifest{}, agentcapabilities.ErrInvalid
 	}
 	manifest, err := agentcapabilities.Load(root)
+	if err == nil && !completed && manifest.Identity != identity {
+		// A preparation restored from an identical earlier Session carries that Session's identity.
+		err = agentcapabilities.Rebind(root, &manifest, input, identity)
+	}
 	if err != nil || agentcapabilities.ValidateSelection(manifest, input, identity) != nil {
 		return agentcapabilities.Manifest{}, agentcapabilities.ErrInvalid
 	}
@@ -151,7 +161,7 @@ func (b *Binding) loadCapabilitySnapshot(root *os.Root, input agentcapabilities.
 }
 
 func (b *Binding) capabilityIdentity() agentcapabilities.Identity {
-	return agentcapabilities.Identity{EnvironmentID: b.environment, SessionID: strings.TrimPrefix(b.stateKey, "agents-api-")}
+	return agentcapabilities.Identity{EnvironmentID: b.environment, SessionID: b.stateKey}
 }
 
 // The current Linux Runtime layout is shared by user-owned and managed hosts.
diff --git a/apps/daemon/internal/localworkspace/capability_preparation_test.go b/apps/daemon/internal/localworkspace/capability_preparation_test.go
index dc061b085..8bb807e19 100644
--- a/apps/daemon/internal/localworkspace/capability_preparation_test.go
+++ b/apps/daemon/internal/localworkspace/capability_preparation_test.go
@@ -44,7 +44,6 @@ func TestPreparationFreezesLocalContentsAcrossReconnect(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	reconnect.networkAccess = b.networkAccess
 	again, err := reconnect.Prepare(t.Context(), configured)
 	if err != nil || len(again.LocalEnvironment.Skills) != 1 {
 		t.Fatalf("reconnection: %v", err)
@@ -67,20 +66,20 @@ func TestPreparationFreezesLocalContentsAcrossReconnect(t *testing.T) {
 	if err != nil || string(fresh[len(fresh)-6:]) != "second" {
 		t.Fatal("new Session did not capture new source", err)
 	}
-	// Reusing a snapshot under another identity or selection cannot start native work.
-	reconnect.stateKey = "agents-api-" + uuid.NewString()
-	changed := configured
-	changed.AgentStateKey = reconnect.stateKey
-	if _, err = reconnect.Prepare(t.Context(), changed); err == nil {
-		t.Fatal("foreign snapshot accepted")
-	}
-	changed = configured
+	// Reusing a snapshot under another selection cannot start native work, even
+	// for another Session.
 	local := *configured.LocalEnvironment
 	local.CapabilitySources = &agentcapabilities.Input{}
+	changed := configured
 	changed.LocalEnvironment = &local
 	if _, err = b.Prepare(t.Context(), changed); err == nil {
 		t.Fatal("changed selection accepted")
 	}
+	reconnect.stateKey = uuid.NewString()
+	changed.AgentStateKey = reconnect.stateKey
+	if _, err = reconnect.Prepare(t.Context(), changed); err == nil {
+		t.Fatal("foreign snapshot accepted")
+	}
 }
 
 func TestPreparationUsesOperatorSourcesAndLeavesFailuresInert(t *testing.T) {
@@ -209,7 +208,6 @@ func TestPreparationFreezesToolOnlyEnvironmentAcrossReconnect(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			reconnect.networkAccess = b.networkAccess
 			if _, err := reconnect.Prepare(t.Context(), configured); err != nil {
 				t.Fatal(err)
 			}
diff --git a/apps/daemon/internal/localworkspace/capability_rebind_test.go b/apps/daemon/internal/localworkspace/capability_rebind_test.go
new file mode 100644
index 000000000..e1f4cbd3a
--- /dev/null
+++ b/apps/daemon/internal/localworkspace/capability_rebind_test.go
@@ -0,0 +1,37 @@
+package localworkspace
+
+import (
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentcapabilities"
+	"github.com/google/uuid"
+)
+
+func TestFinalizeRebindsIdenticalRestoredInstallation(t *testing.T) {
+	first, _ := testBinding(t)
+	source := t.TempDir()
+	writeSourceSkill(t, source, "restored")
+	input := agentcapabilities.Input{Directories: []string{source}}
+	root, unlock, err := first.openCapabilities(t.Context(), false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer unlock()
+	if _, err = first.loadCapabilitySnapshot(root, input, first.capabilityIdentity(), false); err != nil {
+		t.Fatal(err)
+	}
+	// The next Session's directory holds the files restored from the first.
+	next, err := NewWithCapabilityDirectory(uuid.NewString(), uuid.NewString(), first.workspace, first.capabilityRoot)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = next.loadCapabilitySnapshot(root, agentcapabilities.Input{}, next.capabilityIdentity(), false); err == nil {
+		t.Fatal("different selection accepted")
+	}
+	if _, err = next.loadCapabilitySnapshot(root, input, next.capabilityIdentity(), false); err != nil {
+		t.Fatal(err)
+	}
+	if manifest, err := agentcapabilities.Load(root); err != nil || manifest.Identity != next.capabilityIdentity() {
+		t.Fatal("identity not rebound", err)
+	}
+}
diff --git a/apps/daemon/internal/localworkspace/mcp.go b/apps/daemon/internal/localworkspace/mcp.go
index 820c852e4..75725f694 100644
--- a/apps/daemon/internal/localworkspace/mcp.go
+++ b/apps/daemon/internal/localworkspace/mcp.go
@@ -45,3 +45,19 @@ func resolveEnvironmentMCP(installed []agentcapabilities.InstalledMCP, values ma
 	}
 	return result, nil
 }
+
+// requireDeclaredVariables fails a public stdio server that names a variable the
+// initialized env does not set, as resolveEnvironmentMCP does for installed servers.
+func requireDeclaredVariables(servers []proto.MCPHTTPServer, values map[string]string) error {
+	for _, server := range servers {
+		if server.Stdio == nil {
+			continue
+		}
+		for _, name := range server.Stdio.EnvVars {
+			if _, exists := values[name]; !exists {
+				return errors.New("declared environment MCP variable unavailable")
+			}
+		}
+	}
+	return nil
+}
diff --git a/apps/daemon/internal/localworkspace/mcp_test.go b/apps/daemon/internal/localworkspace/mcp_test.go
index d0e52e3cc..1ff8b336b 100644
--- a/apps/daemon/internal/localworkspace/mcp_test.go
+++ b/apps/daemon/internal/localworkspace/mcp_test.go
@@ -28,6 +28,14 @@ func TestEnvironmentMCPCredentialsNeverFallBackToNativeEnv(t *testing.T) {
 	}
 }
 
+func TestDeclaredMCPVariablesNeverFallBackToNativeEnv(t *testing.T) {
+	t.Setenv("SERVER_TOKEN", "native-private-value")
+	servers := []proto.MCPHTTPServer{{ServerLabel: "local", Stdio: &proto.MCPStdio{Command: "run", Cwd: "/", EnvVars: []string{"SERVER_TOKEN"}}}}
+	if requireDeclaredVariables(servers, nil) == nil || requireDeclaredVariables(servers, map[string]string{"SERVER_TOKEN": ""}) != nil {
+		t.Fatal("env_vars did not resolve only from the initialized env")
+	}
+}
+
 func TestMCPStdioLauncherContainsOnlyInstalledIdentity(t *testing.T) {
 	server := proto.EnvironmentMCP{InstallationRoot: "/private/runtime/capabilities", WorkspaceRoot: "/private/runtime/workspace", PackageRoot: "plugins/0", Server: agentplugin.MCPServer{
 		Name: "package_tool", Type: "stdio", Command: "untrusted-command", Args: []string{"private-argument"},
diff --git a/apps/daemon/internal/localworkspace/native_binding.go b/apps/daemon/internal/localworkspace/native_binding.go
index 4805dba7b..02c57adae 100644
--- a/apps/daemon/internal/localworkspace/native_binding.go
+++ b/apps/daemon/internal/localworkspace/native_binding.go
@@ -25,7 +25,7 @@ func newNativeBinding(environment, session, workspace, capabilities string) (*Bi
 	if err != nil || !info.IsDir() {
 		return nil, errors.New("local workspace root must be an existing directory")
 	}
-	return &Binding{environment: environment, stateKey: "agents-api-" + session, workspace: workspace, capabilityRoot: capabilities, writer: &fileWriter{}}, nil
+	return &Binding{environment: environment, stateKey: session, workspace: workspace, capabilityRoot: capabilities, writer: &fileWriter{}}, nil
 }
 
 // ReadToolEnvironment reads explicit initialization values for this installation.
diff --git a/apps/daemon/internal/localworkspace/network.go b/apps/daemon/internal/localworkspace/network.go
deleted file mode 100644
index 220561590..000000000
--- a/apps/daemon/internal/localworkspace/network.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package localworkspace
-
-import (
-	"encoding/json"
-	"errors"
-	"os"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
-)
-
-// RuntimeNetworkPolicy reads deployment configuration, never caller options.
-func RuntimeNetworkPolicy() (agentnetwork.Policy, error) {
-	policy := agentnetwork.Policy{Access: os.Getenv("OAC_RUNTIME_NETWORK_ACCESS")}
-	if raw := os.Getenv("OAC_RUNTIME_ALLOWED_DOMAINS"); raw != "" {
-		if err := json.Unmarshal([]byte(raw), &policy.AllowedDomains); err != nil {
-			return policy, errors.New("invalid local Runtime network domains")
-		}
-	}
-	// Unbound runtimes may serve operations without a hosted workspace.
-	if policy.Access == "" && len(policy.AllowedDomains) == 0 {
-		return policy, nil
-	}
-	if err := policy.Validate(); err != nil {
-		return policy, errors.New("unsupported local Runtime network policy")
-	}
-	return policy, nil
-}
-
-// NetworkPolicy returns a copy of the frozen execution authority.
-func (b *Binding) NetworkPolicy() agentnetwork.Policy {
-	return agentnetwork.Policy{Access: b.networkAccess, AllowedDomains: append([]string(nil), b.allowedDomains...)}
-}
diff --git a/apps/daemon/internal/localworkspace/network_policy_test.go b/apps/daemon/internal/localworkspace/network_policy_test.go
deleted file mode 100644
index 96a7a9d10..000000000
--- a/apps/daemon/internal/localworkspace/network_policy_test.go
+++ /dev/null
@@ -1,74 +0,0 @@
-package localworkspace
-
-import (
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
-	"testing"
-)
-
-func TestRuntimeNetworkPolicyMustMatchExecutionButNotReadOnly(t *testing.T) {
-	for _, deployed := range []string{"", "enabled", "disabled"} {
-		for _, requested := range []string{"", "enabled", "disabled", "restricted"} {
-			b, req := testBinding(t)
-			b.networkAccess = deployed
-			req.LocalEnvironment.NetworkAccess = requested
-			_, err := b.Configure(req)
-			if (err == nil) != (deployed != "" && deployed == requested) {
-				t.Fatalf("execution policy %q/%q: %v", deployed, requested, err)
-			}
-			req.WorkspaceReadOnly = true
-			req.LocalEnvironment = &proto.LocalEnvironment{ID: b.environment}
-			if _, err := b.Configure(req); err != nil {
-				t.Fatal("read-only operation requires unrelated execution policy", err)
-			}
-		}
-	}
-}
-
-func TestRestrictedPolicyBindingCannotBeChangedByARequest(t *testing.T) {
-	b, req := testBinding(t)
-	b.networkAccess, b.allowedDomains = "restricted", []string{"example.com", "api.example.com"}
-	for _, domains := range [][]string{{"api.example.com", "EXAMPLE.com", "example.com"}, {"example.com"}, {"other.example.com"}, nil} {
-		req.LocalEnvironment.NetworkAccess = "restricted"
-		req.LocalEnvironment.AllowedDomains = domains
-		_, err := b.Configure(req)
-		if (err == nil) != (len(domains) == 3) {
-			t.Fatalf("binding changed by domains %v: %v", domains, err)
-		}
-	}
-	copy := b.NetworkPolicy()
-	copy.AllowedDomains[0] = "other.example.com"
-	if !b.NetworkPolicy().Equal(agentnetwork.Policy{Access: "restricted", AllowedDomains: []string{"example.com", "api.example.com"}}) {
-		t.Fatal("caller mutated frozen policy")
-	}
-	req.WorkspaceReadOnly = true
-	req.LocalEnvironment = &proto.LocalEnvironment{ID: b.environment}
-	if _, err := b.Configure(req); err != nil {
-		t.Fatal("read requires execution network", err)
-	}
-	req.LocalEnvironment.AllowedDomains = []string{"other.example.com"}
-	if _, err := b.Configure(req); err == nil {
-		t.Fatal("read accepted a conflicting supplied policy")
-	}
-}
-
-func TestRuntimeNetworkPolicyRejectsMalformedDeploymentInput(t *testing.T) {
-	for _, tc := range []struct {
-		access, domains string
-		valid           bool
-	}{
-		{"restricted", `["example.com"]`, true},
-		{"restricted", `[]`, false},
-		{"restricted", `["*"]`, false},
-		{"restricted", `"example.com"`, false},
-		{"enabled", `["example.com"]`, false},
-		{"", `["example.com"]`, false},
-		{"disabled", `[]`, true},
-	} {
-		t.Setenv("OAC_RUNTIME_NETWORK_ACCESS", tc.access)
-		t.Setenv("OAC_RUNTIME_ALLOWED_DOMAINS", tc.domains)
-		if _, err := RuntimeNetworkPolicy(); (err == nil) != tc.valid {
-			t.Fatalf("%s/%s: %v", tc.access, tc.domains, err)
-		}
-	}
-}
diff --git a/apps/daemon/internal/localworkspace/write.go b/apps/daemon/internal/localworkspace/write.go
index 05e7a6dc2..062f49330 100644
--- a/apps/daemon/internal/localworkspace/write.go
+++ b/apps/daemon/internal/localworkspace/write.go
@@ -16,7 +16,7 @@ const WriteMaxBytes = proto.WorkspaceWriteMaxBytes
 var _ agent.WorkspaceWriter = (*Binding)(nil)
 
 func (b *Binding) AcceptsFileWrite(environment, session string) bool {
-	return b != nil && b.writer != nil && b.environment == environment && b.stateKey == "agents-api-"+session
+	return b != nil && b.writer != nil && b.environment == environment && b.stateKey == session
 }
 
 // WriteWorkspaceFile starts only after the caller supplies the complete bounded
diff --git a/apps/daemon/internal/placement/controller_linux.go b/apps/daemon/internal/placement/controller_linux.go
deleted file mode 100644
index f31c0f378..000000000
--- a/apps/daemon/internal/placement/controller_linux.go
+++ /dev/null
@@ -1,211 +0,0 @@
-//go:build linux
-
-package placement
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"regexp"
-	"time"
-)
-
-var fullID = regexp.MustCompile(`^[a-f0-9]{64}$`)
-var ownerID = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$`)
-
-// Controller is the bounded local Linux/Docker retirement consumer. Its authority
-// is the operator's private enrollment, never a public executor credential.
-type Controller struct {
-	root       string
-	run        func(context.Context, ...string) ([]byte, error)
-	procRoot   string
-	cgroupRoot string
-	socketPath string
-	syncDir    func(string) error
-}
-
-// New uses a fixed local Docker endpoint and private state beneath ~/.oac.
-func New() (*Controller, error) {
-	home, err := os.UserHomeDir()
-	if err != nil {
-		return nil, err
-	}
-	return &Controller{root: filepath.Join(home, ".oac", "placements"), run: runDocker,
-		procRoot: "/proc", cgroupRoot: "/sys/fs/cgroup", socketPath: localDockerSocket, syncDir: syncDirectory}, nil
-}
-
-func (c *Controller) enroll(ctx context.Context, id, owner, workspace, environment string) (*Receipt, error) {
-	if !ownerID.MatchString(owner) {
-		return nil, errors.New("invalid placement owner")
-	}
-	unlock, err := c.lock(ctx, id)
-	if err != nil {
-		return nil, err
-	}
-	defer unlock()
-	if _, err := os.Lstat(c.recordPath(id)); !errors.Is(err, os.ErrNotExist) {
-		return nil, errors.New("placement already enrolled or record unavailable; use retire to reconcile")
-	}
-	unit, err := c.inspect(ctx, id)
-	if err != nil {
-		return nil, err
-	}
-	if !unit.State.Running {
-		return nil, errors.New("enrollment requires a running placement")
-	}
-	if err := c.validateProfile(unit, owner, workspace); err != nil {
-		return nil, err
-	}
-	host, supervisor, err := c.host(ctx)
-	if err != nil {
-		return nil, err
-	}
-	init, _, err := c.process(unit.State.Pid)
-	if err != nil {
-		return nil, err
-	}
-	group, err := c.group(init.PID, id)
-	if err != nil {
-		return nil, err
-	}
-	members, err := c.members(group)
-	if err != nil {
-		return nil, err
-	}
-	if len(members) == 0 {
-		return nil, errors.New("running placement has no observed members")
-	}
-	version := 1
-	if environment != "" {
-		version = 2
-	}
-	r := &Receipt{Version: version, EnvironmentID: environment, State: "enrolled", Owner: owner, RequestedAt: time.Now().UTC(),
-		Members: members, Target: Target{HostBootID: host, Supervisor: supervisor, Container: id,
-			Created: unit.Created, Started: unit.State.StartedAt, Restarts: unit.RestartCount,
-			Image: unit.Image, Workspace: workspace, Cgroup: group, Init: init}}
-	if err := c.save(r); err != nil {
-		return nil, err
-	}
-	return r, nil
-}
-
-func (c *Controller) retirePlacement(ctx context.Context, id, environment string) (*Receipt, error) {
-	unlock, err := c.lock(ctx, id)
-	if err != nil {
-		return nil, err
-	}
-	defer unlock()
-	r, err := c.load(id)
-	if err != nil {
-		return nil, err
-	}
-	if r.EnvironmentID != environment {
-		return nil, errors.New("placement Environment does not match enrollment")
-	}
-	if r.State == "retired" {
-		// A previous process may have published the rename without completing
-		// its directory sync. Finish that barrier before recovering success.
-		if err := c.syncDir(c.root); err != nil {
-			return nil, fmt.Errorf("placement receipt durability unknown: %w", err)
-		}
-		return r, nil
-	}
-	err = c.retire(ctx, r)
-	if err != nil {
-		return r, fmt.Errorf("placement retirement unknown: %w", err)
-	}
-	return r, nil
-}
-
-func (c *Controller) retire(ctx context.Context, r *Receipt) error {
-	host, supervisor, err := c.host(ctx)
-	if err != nil {
-		return err
-	}
-	if host != r.Target.HostBootID || supervisor != r.Target.Supervisor {
-		return errors.New("local supervisor incarnation changed")
-	}
-	unit, err := c.inspect(ctx, r.Target.Container)
-	if err != nil {
-		return err
-	}
-	if err := c.validateProfile(unit, r.Owner, r.Target.Workspace); err != nil {
-		return err
-	}
-	if unit.Created != r.Target.Created || unit.Image != r.Target.Image ||
-		unit.State.StartedAt != r.Target.Started || unit.RestartCount != r.Target.Restarts {
-		return errors.New("container incarnation changed")
-	}
-	if unit.State.Running {
-		init, _, err := c.process(unit.State.Pid)
-		if err != nil {
-			return err
-		}
-		if init != r.Target.Init {
-			return errors.New("container init identity changed")
-		}
-		group, err := c.group(init.PID, unit.ID)
-		if err != nil || group != r.Target.Cgroup {
-			return errors.New("container cgroup changed")
-		}
-		members, err := c.members(group)
-		if err != nil {
-			return err
-		}
-		r.Members = append(r.Members, members...)
-	}
-	// The immutable target and current members are durable before any stop.
-	r.State = "stopping"
-	if err := c.save(r); err != nil {
-		return err
-	}
-	if unit.State.Running {
-		if _, err := c.run(ctx, "container", "stop", "--time", "1", r.Target.Container); err != nil {
-			return err
-		}
-	}
-	unit, err = c.inspect(ctx, r.Target.Container)
-	if err != nil {
-		return err
-	}
-	if unit.State.Running || unit.State.Pid != 0 || unit.State.StartedAt != r.Target.Started ||
-		unit.RestartCount != r.Target.Restarts {
-		return errors.New("container is live or restarted")
-	}
-	if err := c.observeRetired(r); err != nil {
-		return err
-	}
-	// Non-forced removal fails if an external operator restarted the unit. No
-	// volumes are deleted. A crash between removal and save stays unknown.
-	if _, err := c.run(ctx, "container", "rm", r.Target.Container); err != nil {
-		return err
-	}
-	r.State = "retired"
-	now := time.Now().UTC()
-	r.RetiredAt = &now
-	if err := c.save(r); err != nil {
-		r.State = "stopping"
-		r.RetiredAt = nil
-		return err
-	}
-	return nil
-}
-
-func (c *Controller) host(ctx context.Context) (string, string, error) {
-	boot, err := os.ReadFile(filepath.Join(c.procRoot, "sys/kernel/random/boot_id"))
-	if err != nil {
-		return "", "", err
-	}
-	out, err := c.run(ctx, "info", "--format", "{{json .ID}}")
-	if err != nil {
-		return "", "", err
-	}
-	var id string
-	if err := json.Unmarshal(out, &id); err != nil || id == "" || len(boot) == 0 {
-		return "", "", errors.New("missing supervisor identity")
-	}
-	return string(boot), id, nil
-}
diff --git a/apps/daemon/internal/placement/controller_linux_test.go b/apps/daemon/internal/placement/controller_linux_test.go
deleted file mode 100644
index 16e5d2026..000000000
--- a/apps/daemon/internal/placement/controller_linux_test.go
+++ /dev/null
@@ -1,411 +0,0 @@
-//go:build linux
-
-package placement
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-)
-
-const testID = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-
-type fixture struct {
-	c               *Controller
-	unit            *container
-	workspace       string
-	stops, removals int
-	fail            string
-	t               *testing.T
-}
-
-func writeTestFile(t *testing.T, path, data string) {
-	t.Helper()
-	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(path, []byte(data), 0600); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func newFixture(t *testing.T) *fixture {
-	t.Helper()
-	home, err := os.UserHomeDir()
-	if err != nil {
-		t.Fatal(err)
-	}
-	base := filepath.Join(home, ".oac", "placement-tests")
-	if err := os.MkdirAll(base, 0700); err != nil {
-		t.Fatal(err)
-	}
-	dir, err := os.MkdirTemp(base, "case-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = os.RemoveAll(dir) })
-	f := &fixture{t: t, workspace: filepath.Join(dir, "workspace")}
-	if err := os.Mkdir(f.workspace, 0700); err != nil {
-		t.Fatal(err)
-	}
-	f.c = &Controller{root: filepath.Join(dir, "state"), procRoot: filepath.Join(dir, "proc"), cgroupRoot: filepath.Join(dir, "cgroup"), socketPath: filepath.Join(dir, "run/docker.sock"), syncDir: syncDirectory}
-	f.c.run = f.run
-	writeTestFile(t, f.c.socketPath, "fake supervisor socket")
-	f.unit = &container{ID: testID, Created: "created-1", Image: "sha256:image"}
-	f.unit.State.Running = true
-	f.unit.State.Pid = 123
-	f.unit.State.StartedAt = "start-1"
-	f.unit.Config.User = "1000:1000"
-	f.unit.Config.Labels = map[string]string{BindingLabel: "owner-1"}
-	f.unit.HostConfig.NetworkMode = "none"
-	f.unit.HostConfig.IpcMode = "private"
-	f.unit.HostConfig.CgroupnsMode = "private"
-	f.unit.HostConfig.CapDrop = []string{"ALL"}
-	f.unit.HostConfig.SecurityOpt = []string{"no-new-privileges"}
-	f.unit.HostConfig.RestartPolicy.Name = "no"
-	f.unit.Mounts = append(f.unit.Mounts, struct {
-		Type, Source, Destination, Propagation string
-		RW                                     bool
-	}{Type: "bind", Source: f.workspace, Destination: "/workspace", Propagation: "rprivate", RW: true})
-	writeTestFile(t, filepath.Join(f.c.procRoot, "sys/kernel/random/boot_id"), "boot-1")
-	writeTestFile(t, filepath.Join(f.c.procRoot, "self/mountinfo"), "1 0 8:2 / / rw - ext4 /dev/test rw\n")
-	writeTestFile(t, filepath.Join(f.c.procRoot, "123/stat"), "123 (native (worker)) S "+strings.Repeat("0 ", 18)+"999 0")
-	writeTestFile(t, filepath.Join(f.c.procRoot, "123/cgroup"), "0::/docker-"+testID+".scope\n")
-	writeTestFile(t, filepath.Join(f.c.cgroupRoot, "docker-"+testID+".scope/cgroup.procs"), "123\n")
-	writeTestFile(t, filepath.Join(f.c.cgroupRoot, "docker-"+testID+".scope/cgroup.events"), "populated 1\n")
-	return f
-}
-
-func (f *fixture) run(_ context.Context, args ...string) ([]byte, error) {
-	if args[0] == "info" {
-		if f.fail == "supervisor" {
-			return nil, errors.New("unavailable")
-		}
-		return []byte(`"supervisor-1"`), nil
-	}
-	switch args[1] {
-	case "inspect":
-		if f.unit == nil {
-			return nil, os.ErrNotExist
-		}
-		return json.Marshal([]container{*f.unit})
-	case "stop":
-		r, err := f.c.load(testID)
-		if err != nil || r.State != "stopping" || len(r.Members) == 0 {
-			f.t.Fatal("stop before durable intent", err)
-		}
-		f.stops++
-		if f.fail == "stop" {
-			return nil, errors.New("stop unavailable")
-		}
-		f.unit.State.Running = false
-		f.unit.State.Pid = 0
-		if f.fail != "live" && f.fail != "escaped" {
-			_ = os.RemoveAll(filepath.Join(f.c.procRoot, "123"))
-			_ = os.RemoveAll(filepath.Join(f.c.cgroupRoot, "docker-"+testID+".scope"))
-		}
-		if f.fail == "escaped" {
-			_ = os.RemoveAll(filepath.Join(f.c.cgroupRoot, "docker-"+testID+".scope"))
-		}
-		return nil, nil
-	case "rm":
-		f.removals++
-		f.unit = nil
-		if f.fail == "lost-remove-ack" {
-			return nil, errors.New("controller lost removal acknowledgement")
-		}
-		return nil, nil
-	}
-	return nil, errors.New("unexpected Docker command")
-}
-
-func (f *fixture) enroll() *Receipt {
-	f.t.Helper()
-	r, err := f.c.Enroll(context.Background(), testID, "owner-1", f.workspace)
-	if err != nil {
-		f.t.Fatal(err)
-	}
-	return r
-}
-
-func TestRetirementPersistsBeforeStopAndRecoversIdenticalReceipt(t *testing.T) {
-	f := newFixture(t)
-	f.enroll()
-	writeTestFile(t, filepath.Join(f.workspace, "history"), "retained")
-	r, err := f.c.Retire(context.Background(), testID)
-	if err != nil || r.State != "retired" {
-		t.Fatal(r, err)
-	}
-	fresh := *f.c
-	fresh.run = func(context.Context, ...string) ([]byte, error) {
-		t.Fatal("completed receipt must not need supervisor")
-		return nil, nil
-	}
-	again, err := fresh.Retire(context.Background(), testID)
-	if err != nil || !reflect.DeepEqual(r, again) {
-		t.Fatal("receipt changed across controller restart", err)
-	}
-	if f.stops != 1 || f.removals != 1 {
-		t.Fatal("repeated destructive action")
-	}
-	if data, err := os.ReadFile(filepath.Join(f.workspace, "history")); err != nil || string(data) != "retained" {
-		t.Fatal("history lost")
-	}
-}
-
-func TestUnknownEvidenceNeverRemovesOrReportsRetired(t *testing.T) {
-	for _, failure := range []string{"supervisor", "stop", "live", "escaped", "missing", "restart", "boot", "lost-remove-ack"} {
-		t.Run(failure, func(t *testing.T) {
-			f := newFixture(t)
-			f.enroll()
-			f.fail = failure
-			switch failure {
-			case "missing":
-				f.unit = nil
-			case "restart":
-				f.unit.State.StartedAt = "start-2"
-			case "boot":
-				writeTestFile(t, filepath.Join(f.c.procRoot, "sys/kernel/random/boot_id"), "boot-2")
-			}
-			r, err := f.c.Retire(context.Background(), testID)
-			if err == nil || r.State == "retired" {
-				t.Fatal("uncertain retirement reported success", r, err)
-			}
-			persisted, err := f.c.load(testID)
-			if err != nil || persisted.State == "retired" {
-				t.Fatal("uncertainty lost", err)
-			}
-			if failure != "lost-remove-ack" && f.removals != 0 {
-				t.Fatal("removed without proof")
-			}
-			if failure == "lost-remove-ack" {
-				fresh := *f.c
-				r, err = fresh.Retire(context.Background(), testID)
-				if err == nil || r.State == "retired" {
-					t.Fatal("absence manufactured success")
-				}
-			}
-		})
-	}
-}
-
-func TestReconcileStoppedTargetAfterInterruptedController(t *testing.T) {
-	f := newFixture(t)
-	r := f.enroll()
-	r.State = "stopping"
-	if err := f.c.save(r); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := f.run(context.Background(), "container", "stop"); err != nil {
-		t.Fatal(err)
-	}
-	fresh := *f.c
-	result, err := fresh.Retire(context.Background(), testID)
-	if err != nil || result.State != "retired" || f.stops != 1 {
-		t.Fatal(result, err)
-	}
-}
-
-func TestConcurrentRetirementUsesOneDestructiveAttempt(t *testing.T) {
-	f := newFixture(t)
-	f.enroll()
-	var wg sync.WaitGroup
-	for range 4 {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			fresh := *f.c
-			r, err := fresh.Retire(context.Background(), testID)
-			if err != nil || r.State != "retired" {
-				t.Error(r, err)
-			}
-		}()
-	}
-	wg.Wait()
-	if f.stops != 1 || f.removals != 1 {
-		t.Fatal("duplicate destructive attempts")
-	}
-}
-
-func TestTargetLockHonorsCancellation(t *testing.T) {
-	f := newFixture(t)
-	unlock, err := f.c.lock(context.Background(), testID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer unlock()
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Millisecond)
-	defer cancel()
-	if _, err := f.c.lock(ctx, testID); !errors.Is(err, context.DeadlineExceeded) {
-		t.Fatal(err)
-	}
-}
-
-func TestEnrollmentRejectsUnqualifiedAuthorityAndProfile(t *testing.T) {
-	for _, bad := range []string{"short-id", "wrong-owner", "privileged", "host-pid", "network", "capability", "security", "restart", "workspace", "state-mount", "socket-mount", "relative", "stopped"} {
-		t.Run(bad, func(t *testing.T) {
-			f := newFixture(t)
-			id, owner, workspace := testID, "owner-1", f.workspace
-			switch bad {
-			case "short-id":
-				id = "aaaa"
-			case "wrong-owner":
-				owner = "someone-else"
-			case "privileged":
-				f.unit.HostConfig.Privileged = true
-			case "host-pid":
-				f.unit.HostConfig.PidMode = "host"
-			case "network":
-				f.unit.HostConfig.NetworkMode = "bridge"
-			case "capability":
-				f.unit.HostConfig.CapAdd = []string{"SYS_ADMIN"}
-			case "security":
-				f.unit.HostConfig.SecurityOpt = append(f.unit.HostConfig.SecurityOpt, "seccomp=unconfined")
-			case "restart":
-				f.unit.HostConfig.RestartPolicy.Name = "always"
-			case "workspace":
-				f.unit.Mounts = nil
-			case "state-mount":
-				f.unit.Mounts[0].Source = filepath.Dir(f.c.root)
-			case "socket-mount":
-				f.unit.Mounts[0].Type = "volume"
-			case "relative":
-				workspace = "workspace"
-			case "stopped":
-				f.unit.State.Running = false
-			}
-			if _, err := f.c.Enroll(context.Background(), id, owner, workspace); err == nil {
-				t.Fatal("accepted unqualified enrollment")
-			}
-			if f.stops+f.removals != 0 {
-				t.Fatal("enrollment mutated supervisor")
-			}
-		})
-	}
-}
-
-func TestUntrustedStateIsRejected(t *testing.T) {
-	f := newFixture(t)
-	f.enroll()
-	if err := os.Chmod(f.c.recordPath(testID), 0644); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := f.c.Retire(context.Background(), testID); err == nil {
-		t.Fatal("accepted exposed authority")
-	}
-	if f.stops+f.removals != 0 {
-		t.Fatal("mutated supervisor before authorization")
-	}
-}
-
-func TestBindingCannotBeOverwrittenOrAppliedToAnotherContainer(t *testing.T) {
-	f := newFixture(t)
-	f.enroll()
-	if _, err := f.c.Enroll(context.Background(), testID, "owner-1", f.workspace); err == nil {
-		t.Fatal("binding overwritten")
-	}
-	if _, err := f.c.Retire(context.Background(), strings.Repeat("b", 64)); err == nil {
-		t.Fatal("another target authorized")
-	}
-	f.unit.ID = strings.Repeat("b", 64)
-	if _, err := f.c.Retire(context.Background(), testID); err == nil {
-		t.Fatal("supervisor target substitution accepted")
-	}
-	if f.stops+f.removals != 0 {
-		t.Fatal("wrong target mutated")
-	}
-}
-
-func TestSymlinkedStateAndChangedProfileAreRejected(t *testing.T) {
-	f := newFixture(t)
-	f.enroll()
-	path := f.c.recordPath(testID)
-	if err := os.Rename(path, path+".original"); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Symlink(path+".original", path); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := f.c.Retire(context.Background(), testID); err == nil {
-		t.Fatal("symlinked authority accepted")
-	}
-	if err := os.Remove(path); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Rename(path+".original", path); err != nil {
-		t.Fatal(err)
-	}
-	f.unit.HostConfig.Privileged = true
-	if _, err := f.c.Retire(context.Background(), testID); err == nil {
-		t.Fatal("changed profile accepted")
-	}
-	if f.stops+f.removals != 0 {
-		t.Fatal("mutated unqualified placement")
-	}
-}
-
-func TestRootAndCanonicalSupervisorSocketAreNeverExposed(t *testing.T) {
-	f := newFixture(t)
-	if !inside("/", f.c.root) || !inside("/", f.c.socketPath) {
-		t.Fatal("filesystem root hides protected descendants")
-	}
-	f.workspace = filepath.Dir(f.c.socketPath)
-	f.unit.Mounts[0].Source = f.workspace
-	alias := filepath.Join(filepath.Dir(f.c.root), "socket-alias")
-	if err := os.Symlink(f.c.socketPath, alias); err != nil {
-		t.Fatal(err)
-	}
-	f.c.socketPath = alias
-	if _, err := f.c.Enroll(context.Background(), testID, "owner-1", f.workspace); err == nil || !strings.Contains(err.Error(), "supervisor socket") {
-		t.Fatal("canonical socket exposed", err)
-	}
-	if f.stops+f.removals != 0 {
-		t.Fatal("unqualified supervisor mutated")
-	}
-}
-
-func TestPublishedReceiptMustCompleteDirectorySyncOnRecovery(t *testing.T) {
-	f := newFixture(t)
-	f.enroll()
-	f.c.syncDir = func(path string) error {
-		r, err := f.c.load(testID)
-		if err != nil {
-			return err
-		}
-		if r.State == "retired" {
-			return errors.New("injected directory sync failure after rename")
-		}
-		return syncDirectory(path)
-	}
-	if r, err := f.c.Retire(context.Background(), testID); err == nil || r.State == "retired" {
-		t.Fatal("reported success before durable receipt", r, err)
-	}
-	published, err := f.c.load(testID)
-	if err != nil || published.State != "retired" {
-		t.Fatal("failure did not exercise published rename", published, err)
-	}
-	fresh := *f.c
-	fresh.run = func(context.Context, ...string) ([]byte, error) {
-		t.Fatal("receipt recovery must not mutate supervisor")
-		return nil, nil
-	}
-	if _, err := fresh.Retire(context.Background(), testID); err == nil {
-		t.Fatal("recovery skipped durability barrier")
-	}
-	synced := false
-	fresh.syncDir = func(path string) error { synced = true; return syncDirectory(path) }
-	recovered, err := fresh.Retire(context.Background(), testID)
-	if err != nil || !synced || !reflect.DeepEqual(recovered, published) {
-		t.Fatal("durable receipt recovery failed", recovered, err)
-	}
-	if f.stops != 1 || f.removals != 1 {
-		t.Fatal("repeated destructive action")
-	}
-}
diff --git a/apps/daemon/internal/placement/controller_other.go b/apps/daemon/internal/placement/controller_other.go
deleted file mode 100644
index 2bd82f666..000000000
--- a/apps/daemon/internal/placement/controller_other.go
+++ /dev/null
@@ -1,24 +0,0 @@
-//go:build !linux
-
-package placement
-
-import (
-	"context"
-	"errors"
-)
-
-// Controller requires the qualified local Linux supervisor profile.
-type Controller struct{}
-
-// New rejects unqualified hosts before any supervisor operation.
-func New() (*Controller, error) {
-	return nil, errors.New("placement retirement requires local Linux/Docker with cgroup v2")
-}
-
-func (*Controller) enroll(context.Context, string, string, string, string) (*Receipt, error) {
-	return nil, errors.New("unsupported placement host")
-}
-
-func (*Controller) retirePlacement(context.Context, string, string) (*Receipt, error) {
-	return nil, errors.New("unsupported placement host")
-}
diff --git a/apps/daemon/internal/placement/docker_linux.go b/apps/daemon/internal/placement/docker_linux.go
deleted file mode 100644
index 1eb115f18..000000000
--- a/apps/daemon/internal/placement/docker_linux.go
+++ /dev/null
@@ -1,164 +0,0 @@
-//go:build linux
-
-package placement
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"syscall"
-)
-
-const localDockerSocket = "/var/run/docker.sock"
-
-// Do not inherit a remote Docker context while observing local /proc and cgroups.
-func runDocker(ctx context.Context, args ...string) ([]byte, error) {
-	cmd := exec.CommandContext(ctx, "docker", append([]string{"--host", "unix://" + localDockerSocket}, args...)...)
-	for _, v := range os.Environ() {
-		if !strings.HasPrefix(v, "DOCKER_") {
-			cmd.Env = append(cmd.Env, v)
-		}
-	}
-	out, err := cmd.Output()
-	if err != nil {
-		return nil, fmt.Errorf("local Docker %s failed: %w", args[0], err)
-	}
-	return out, nil
-}
-
-type container struct {
-	ID           string `json:"Id"`
-	Created      string
-	Image        string
-	RestartCount int
-	State        struct {
-		Running    bool
-		Pid        int
-		StartedAt  string
-		Paused     bool
-		Restarting bool
-	}
-	Config struct {
-		Labels map[string]string
-		User   string
-	}
-	HostConfig struct {
-		Privileged        bool
-		PidMode           string
-		IpcMode           string
-		CgroupnsMode      string
-		NetworkMode       string
-		CapAdd            []string
-		CapDrop           []string
-		SecurityOpt       []string
-		Devices           []json.RawMessage
-		DeviceRequests    []json.RawMessage
-		DeviceCgroupRules []string
-		VolumesFrom       []string
-		RestartPolicy     struct{ Name string }
-	}
-	Mounts []struct {
-		Type, Source, Destination, Propagation string
-		RW                                     bool
-	}
-}
-
-func (c *Controller) inspect(ctx context.Context, id string) (*container, error) {
-	out, err := c.run(ctx, "container", "inspect", id)
-	if err != nil {
-		return nil, err
-	}
-	var units []container
-	if err := json.Unmarshal(out, &units); err != nil {
-		return nil, err
-	}
-	if len(units) != 1 || units[0].ID != id {
-		return nil, errors.New("supervisor returned wrong target")
-	}
-	return &units[0], nil
-}
-
-func contains(values []string, value string) bool {
-	for _, v := range values {
-		if v == value {
-			return true
-		}
-	}
-	return false
-}
-
-func inside(parent, path string) bool {
-	relative, err := filepath.Rel(parent, path)
-	return err == nil && relative != ".." && !strings.HasPrefix(relative, ".."+string(os.PathSeparator))
-}
-
-func (c *Controller) validateProfile(u *container, owner, workspace string) error {
-	h := u.HostConfig
-	uid, err := strconv.Atoi(strings.Split(u.Config.User, ":")[0])
-	if err != nil || uid <= 0 || u.Config.Labels[BindingLabel] != owner || u.State.Paused || u.State.Restarting ||
-		h.Privileged || h.PidMode != "" || h.IpcMode != "private" || h.CgroupnsMode != "private" ||
-		h.NetworkMode != "none" || len(h.CapAdd) != 0 || !contains(h.CapDrop, "ALL") ||
-		(len(h.SecurityOpt) != 1 || !contains(h.SecurityOpt, "no-new-privileges")) || len(h.Devices)+len(h.DeviceRequests)+len(h.DeviceCgroupRules)+len(h.VolumesFrom) != 0 ||
-		h.RestartPolicy.Name != "no" {
-		return errors.New("placement is outside qualified unprivileged local Docker profile")
-	}
-	if !filepath.IsAbs(workspace) || filepath.Clean(workspace) != workspace {
-		return errors.New("workspace must be canonical and absolute")
-	}
-	resolved, err := filepath.EvalSymlinks(workspace)
-	if err != nil || resolved != workspace {
-		return errors.New("workspace must exist without symlink aliases")
-	}
-	info, err := os.Stat(workspace)
-	if err != nil || !info.IsDir() {
-		return errors.New("workspace must be a directory")
-	}
-	var fs syscall.Statfs_t
-	if err := syscall.Statfs(workspace, &fs); err != nil {
-		return err
-	}
-	switch uint64(fs.Type) {
-	case 0xef53, 0x58465342, 0x9123683e, 0x01021994:
-	default:
-		return errors.New("unqualified workspace filesystem")
-	}
-	socket, err := filepath.EvalSymlinks(c.socketPath)
-	if err != nil {
-		return fmt.Errorf("cannot resolve supervisor socket: %w", err)
-	}
-	mounts, err := c.hostMounts(workspace)
-	if err != nil {
-		return err
-	}
-	found := false
-	for _, m := range u.Mounts {
-		canonical, err := filepath.EvalSymlinks(m.Source)
-		if err != nil || canonical != m.Source || inside(m.Source, c.root) || inside(c.root, m.Source) || inside(m.Source, socket) {
-			return errors.New("mount aliases or exposes controller state or supervisor socket")
-		}
-		if err := unaliasedSource(m.Source, mounts); err != nil {
-			return err
-		}
-		if m.Type != "bind" || (m.Propagation != "rprivate" && m.Propagation != "") {
-			return errors.New("only private bind mounts are qualified")
-		}
-		if m.Source == workspace && m.RW && !found {
-			found = true
-			continue
-		}
-		info, err := os.Stat(m.Source)
-		if err != nil || m.RW || !info.Mode().IsRegular() {
-			return errors.New("additional mounts must be read-only regular files")
-		}
-	}
-	if !found {
-		return errors.New("missing exact retained workspace bind")
-	}
-	return nil
-}
diff --git a/apps/daemon/internal/placement/environment.go b/apps/daemon/internal/placement/environment.go
deleted file mode 100644
index 1be6113bf..000000000
--- a/apps/daemon/internal/placement/environment.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package placement
-
-import (
-	"context"
-	"errors"
-	"github.com/google/uuid"
-)
-
-func validEnvironment(id string) bool {
-	parsed, err := uuid.Parse(id)
-	return err == nil && parsed != uuid.Nil && parsed.String() == id
-}
-
-// Enroll records an unscoped operator placement without Environment authority.
-func (c *Controller) Enroll(ctx context.Context, id, owner, workspace string) (*Receipt, error) {
-	return c.enroll(ctx, id, owner, workspace, "")
-}
-
-// EnrollEnvironment records an immutable operator-confirmed Environment association.
-func (c *Controller) EnrollEnvironment(ctx context.Context, id, owner, workspace, environment string) (*Receipt, error) {
-	if !validEnvironment(environment) {
-		return nil, errors.New("invalid placement Environment ID")
-	}
-	return c.enroll(ctx, id, owner, workspace, environment)
-}
-
-// Retire reconciles only unscoped operator enrollment.
-func (c *Controller) Retire(ctx context.Context, id string) (*Receipt, error) {
-	return c.retirePlacement(ctx, id, "")
-}
-
-// RetireEnvironment requires the same Environment before any supervisor access.
-func (c *Controller) RetireEnvironment(ctx context.Context, id, environment string) (*Receipt, error) {
-	if !validEnvironment(environment) {
-		return nil, errors.New("invalid placement Environment ID")
-	}
-	return c.retirePlacement(ctx, id, environment)
-}
diff --git a/apps/daemon/internal/placement/environment_linux_test.go b/apps/daemon/internal/placement/environment_linux_test.go
deleted file mode 100644
index 4c5998268..000000000
--- a/apps/daemon/internal/placement/environment_linux_test.go
+++ /dev/null
@@ -1,198 +0,0 @@
-//go:build linux
-
-package placement
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"reflect"
-	"sync"
-	"testing"
-)
-
-const testEnvironment = "3fb4bdd9-d8c7-4f12-810c-9da932e06bc4"
-const otherEnvironment = "384ff427-c83f-4484-80a7-58aa95662f97"
-
-func (f *fixture) enrollEnvironment() *Receipt {
-	f.t.Helper()
-	r, err := f.c.EnrollEnvironment(context.Background(), testID, "owner-1", f.workspace, testEnvironment)
-	if err != nil {
-		f.t.Fatal(err)
-	}
-	return r
-}
-
-func TestEnvironmentScopeRejectsBeforeSupervisorAccess(t *testing.T) {
-	for _, state := range []string{"enrolled", "retired"} {
-		t.Run(state, func(t *testing.T) {
-			f := newFixture(t)
-			f.enrollEnvironment()
-			if state == "retired" {
-				if _, err := f.c.RetireEnvironment(t.Context(), testID, testEnvironment); err != nil {
-					t.Fatal(err)
-				}
-			}
-			f.c.run = func(context.Context, ...string) ([]byte, error) {
-				t.Fatal("scope rejection accessed supervisor")
-				return nil, nil
-			}
-			if _, err := f.c.Retire(t.Context(), testID); err == nil {
-				t.Fatal("scope omitted")
-			}
-			for _, id := range []string{otherEnvironment, "", "not-a-uuid", "00000000-0000-0000-0000-000000000000"} {
-				if _, err := f.c.RetireEnvironment(t.Context(), testID, id); err == nil {
-					t.Fatal("invalid scope accepted", id)
-				}
-			}
-		})
-	}
-}
-
-func TestEnvironmentEnrollmentIsImmutableAndSeparateFromLegacy(t *testing.T) {
-	f := newFixture(t)
-	r := f.enrollEnvironment()
-	if r.Version != 2 || r.EnvironmentID != testEnvironment {
-		t.Fatal("scope not versioned", r)
-	}
-	if _, err := f.c.EnrollEnvironment(t.Context(), testID, "owner-1", f.workspace, otherEnvironment); err == nil {
-		t.Fatal("scope reassigned")
-	}
-	if _, err := f.c.Enroll(t.Context(), testID, "owner-1", f.workspace); err == nil {
-		t.Fatal("scope downgraded")
-	}
-	retained, err := f.c.load(testID)
-	if err != nil || !reflect.DeepEqual(r, retained) {
-		t.Fatal("enrollment changed", err)
-	}
-	legacy := newFixture(t)
-	old := legacy.enroll()
-	if old.Version != 1 || old.EnvironmentID != "" {
-		t.Fatal("legacy enrollment changed")
-	}
-	if _, err := legacy.c.RetireEnvironment(t.Context(), testID, testEnvironment); err == nil {
-		t.Fatal("legacy record gained scope")
-	}
-	if legacy.stops+legacy.removals != 0 {
-		t.Fatal("legacy target mutated")
-	}
-	if _, err := legacy.c.Retire(t.Context(), testID); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestEnvironmentReceiptVersionRejectsMissingOrDowngradedScope(t *testing.T) {
-	for _, mode := range []string{"missing", "malformed", "downgraded", "future"} {
-		t.Run(mode, func(t *testing.T) {
-			f := newFixture(t)
-			r := f.enrollEnvironment()
-			switch mode {
-			case "missing":
-				r.EnvironmentID = ""
-			case "malformed":
-				r.EnvironmentID = "invalid"
-			case "downgraded":
-				r.Version = 1
-			case "future":
-				r.Version = 3
-			}
-			data, err := json.Marshal(r)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if err := os.WriteFile(f.c.recordPath(testID), data, 0600); err != nil {
-				t.Fatal(err)
-			}
-			f.c.run = func(context.Context, ...string) ([]byte, error) {
-				t.Fatal("invalid receipt accessed supervisor")
-				return nil, nil
-			}
-			if _, err := f.c.RetireEnvironment(t.Context(), testID, testEnvironment); err == nil {
-				t.Fatal("invalid scoped receipt accepted")
-			}
-			if _, err := f.c.Retire(t.Context(), testID); err == nil {
-				t.Fatal("invalid scoped receipt accepted by legacy path")
-			}
-		})
-	}
-}
-
-func TestEnvironmentRetirementConcurrentRecovery(t *testing.T) {
-	f := newFixture(t)
-	f.enrollEnvironment()
-	var wg sync.WaitGroup
-	results := make(chan *Receipt, 4)
-	for range 4 {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			fresh := *f.c
-			r, err := fresh.RetireEnvironment(t.Context(), testID, testEnvironment)
-			if err != nil {
-				t.Error(err)
-				return
-			}
-			results <- r
-		}()
-	}
-	wg.Wait()
-	close(results)
-	var expected *Receipt
-	for r := range results {
-		if expected == nil {
-			expected = r
-		}
-		if !reflect.DeepEqual(expected, r) {
-			t.Fatal("concurrent receipt changed")
-		}
-	}
-	if expected == nil || expected.State != "retired" || expected.EnvironmentID != testEnvironment || f.stops != 1 || f.removals != 1 {
-		t.Fatal("retirement not unique", expected)
-	}
-	fresh := *f.c
-	fresh.run = func(context.Context, ...string) ([]byte, error) {
-		t.Fatal("recovered receipt touched supervisor")
-		return nil, nil
-	}
-	again, err := fresh.RetireEnvironment(t.Context(), testID, testEnvironment)
-	if err != nil || !reflect.DeepEqual(expected, again) {
-		t.Fatal("fresh recovery differs", err)
-	}
-}
-
-func TestEnvironmentUnknownAndChangedTargetRemainUnresolved(t *testing.T) {
-	for _, failure := range []string{"lost-remove-ack", "restart"} {
-		t.Run(failure, func(t *testing.T) {
-			f := newFixture(t)
-			f.enrollEnvironment()
-			f.fail = failure
-			if failure == "restart" {
-				f.unit.State.StartedAt = "replacement"
-			}
-			if r, err := f.c.RetireEnvironment(t.Context(), testID, testEnvironment); err == nil || r.State == "retired" {
-				t.Fatal("uncertainty lost", r, err)
-			}
-			fresh := *f.c
-			if r, err := fresh.RetireEnvironment(t.Context(), testID, testEnvironment); err == nil || r.State == "retired" {
-				t.Fatal("retry fabricated retirement", r, err)
-			}
-			if _, err := fresh.Retire(t.Context(), testID); err == nil {
-				t.Fatal("unscoped retry bypassed unknown scope")
-			}
-		})
-	}
-}
-
-func TestInvalidEnvironmentEnrollmentDoesNotTouchSupervisor(t *testing.T) {
-	f := newFixture(t)
-	f.c.run = func(context.Context, ...string) ([]byte, error) {
-		t.Fatal("invalid scope touched supervisor")
-		return nil, errors.New("unexpected")
-	}
-	for _, id := range []string{"", "3FB4BDD9-D8C7-4F12-810C-9DA932E06BC4", "00000000-0000-0000-0000-000000000000"} {
-		if _, err := f.c.EnrollEnvironment(t.Context(), testID, "owner-1", f.workspace, id); err == nil {
-			t.Fatal("invalid scope enrolled")
-		}
-	}
-}
diff --git a/apps/daemon/internal/placement/mounts_linux.go b/apps/daemon/internal/placement/mounts_linux.go
deleted file mode 100644
index bb32822bf..000000000
--- a/apps/daemon/internal/placement/mounts_linux.go
+++ /dev/null
@@ -1,69 +0,0 @@
-//go:build linux
-
-package placement
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-type hostMount struct {
-	device, root, point string
-}
-
-// The initial profile excludes host mount aliases rather than trying to resolve
-// arbitrary backing-path graphs. Mount administration remains a trusted host act.
-func (c *Controller) hostMounts(workspace string) ([]hostMount, error) {
-	data, err := os.ReadFile(filepath.Join(c.procRoot, "self/mountinfo"))
-	if err != nil {
-		return nil, err
-	}
-	decode := strings.NewReplacer(`\040`, " ", `\011`, "\t", `\012`, "\n", `\134`, `\`)
-	var mounts []hostMount
-	for _, line := range strings.Split(strings.TrimSpace(string(data)), "\n") {
-		fields := strings.Fields(line)
-		if len(fields) < 10 {
-			return nil, errors.New("incomplete host mount evidence")
-		}
-		mount := hostMount{device: fields[2], root: decode.Replace(fields[3]), point: decode.Replace(fields[4])}
-		if !filepath.IsAbs(mount.point) || filepath.Clean(mount.point) != mount.point {
-			return nil, errors.New("invalid host mount evidence")
-		}
-		if mount.point != workspace && inside(workspace, mount.point) {
-			return nil, errors.New("nested workspace mounts are unqualified")
-		}
-		mounts = append(mounts, mount)
-	}
-	return mounts, nil
-}
-
-func unaliasedSource(source string, mounts []hostMount) error {
-	selected := -1
-	for i, mount := range mounts {
-		if !inside(mount.point, source) {
-			continue
-		}
-		if selected == -1 || len(mount.point) > len(mounts[selected].point) {
-			selected = i
-		}
-	}
-	if selected == -1 || mounts[selected].root != "/" {
-		return errors.New("mount source lacks whole-filesystem evidence; host aliases and subvolume roots are unqualified")
-	}
-	count := 0
-	for _, mount := range mounts {
-		if mount.device == mounts[selected].device {
-			count++
-		}
-		// A stacked mount point is ambiguous even if it uses another device.
-		if mount.point == mounts[selected].point && mount.device != mounts[selected].device {
-			return errors.New("stacked source mounts are unqualified")
-		}
-	}
-	if count != 1 {
-		return errors.New("multiple host mounts of the source filesystem are unqualified")
-	}
-	return nil
-}
diff --git a/apps/daemon/internal/placement/mounts_linux_test.go b/apps/daemon/internal/placement/mounts_linux_test.go
deleted file mode 100644
index f50089fdb..000000000
--- a/apps/daemon/internal/placement/mounts_linux_test.go
+++ /dev/null
@@ -1,56 +0,0 @@
-//go:build linux
-
-package placement
-
-import (
-	"context"
-	"fmt"
-	"path/filepath"
-	"testing"
-)
-
-func TestAmbiguousHostMountsCannotAuthorizeEnrollment(t *testing.T) {
-	for _, scenario := range []string{"directory-bind", "whole-filesystem-bind", "nested-mount", "stacked-mount", "missing-evidence"} {
-		t.Run(scenario, func(t *testing.T) {
-			f := newFixture(t)
-			info := "1 0 8:2 / / rw - ext4 /dev/test rw\n"
-			switch scenario {
-			case "directory-bind":
-				info += fmt.Sprintf("2 1 8:2 /home/operator %s rw - ext4 /dev/test rw\n", f.workspace)
-			case "whole-filesystem-bind":
-				info += fmt.Sprintf("2 1 8:2 / %s rw - ext4 /dev/test rw\n", f.workspace)
-			case "nested-mount":
-				info += fmt.Sprintf("2 1 0:8 / %s/secret rw - tmpfs tmpfs rw\n", f.workspace)
-			case "stacked-mount":
-				info += fmt.Sprintf("2 1 0:8 / %s rw - tmpfs tmpfs rw\n3 1 0:9 / %s rw - tmpfs tmpfs rw\n", f.workspace, f.workspace)
-			case "missing-evidence":
-				info = ""
-			}
-			writeTestFile(t, filepath.Join(f.c.procRoot, "self/mountinfo"), info)
-			if _, err := f.c.Enroll(context.Background(), testID, "owner-1", f.workspace); err == nil {
-				t.Fatal("ambiguous host mount authorized")
-			}
-			if f.stops+f.removals != 0 {
-				t.Fatal("unqualified supervisor mutated")
-			}
-		})
-	}
-}
-
-func TestNewHostAliasIsRejectedBeforeRetirement(t *testing.T) {
-	f := newFixture(t)
-	f.enroll()
-	writeTestFile(t, filepath.Join(f.c.procRoot, "self/mountinfo"), "1 0 8:2 / / rw - ext4 /dev/test rw\n2 1 8:2 /home/operator /mnt/alias rw - ext4 /dev/test rw\n")
-	if _, err := f.c.Retire(context.Background(), testID); err == nil {
-		t.Fatal("changed host mount topology accepted")
-	}
-	if f.stops+f.removals != 0 {
-		t.Fatal("supervisor mutated before mount qualification")
-	}
-}
-
-func TestUnrelatedNamespaceMountDoesNotInvalidateStorageEvidence(t *testing.T) {
-	f := newFixture(t)
-	writeTestFile(t, filepath.Join(f.c.procRoot, "self/mountinfo"), "1 0 8:2 / / rw - ext4 /dev/test rw\n2 1 0:4 net:[12345] /run/docker/netns/example rw - nsfs nsfs rw\n")
-	f.enroll()
-}
diff --git a/apps/daemon/internal/placement/observe_linux.go b/apps/daemon/internal/placement/observe_linux.go
deleted file mode 100644
index 90401a26f..000000000
--- a/apps/daemon/internal/placement/observe_linux.go
+++ /dev/null
@@ -1,123 +0,0 @@
-//go:build linux
-
-package placement
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-)
-
-func (c *Controller) process(pid int) (Process, bool, error) {
-	if pid <= 0 {
-		return Process{}, false, errors.New("missing process identity")
-	}
-	data, err := os.ReadFile(filepath.Join(c.procRoot, strconv.Itoa(pid), "stat"))
-	if err != nil {
-		return Process{}, false, err
-	}
-	end := strings.LastIndexByte(string(data), ')')
-	if end < 0 {
-		return Process{}, false, errors.New("malformed process identity")
-	}
-	fields := strings.Fields(string(data[end+1:]))
-	if len(fields) < 20 {
-		return Process{}, false, errors.New("incomplete process identity")
-	}
-	return Process{PID: pid, Start: fields[19]}, fields[0] != "Z" && fields[0] != "X", nil
-}
-
-func (c *Controller) group(pid int, id string) (string, error) {
-	data, err := os.ReadFile(filepath.Join(c.procRoot, strconv.Itoa(pid), "cgroup"))
-	if err != nil {
-		return "", err
-	}
-	for _, line := range strings.Split(string(data), "\n") {
-		if !strings.HasPrefix(line, "0::/") {
-			continue
-		}
-		path := strings.TrimPrefix(line, "0::")
-		base := filepath.Base(path)
-		if filepath.Clean(path) != path || (base != id && base != "docker-"+id+".scope") {
-			return "", errors.New("cgroup does not identify the exact container")
-		}
-		return path, nil
-	}
-	return "", errors.New("placement requires cgroup v2")
-}
-
-func (c *Controller) groupPath(group string) (string, error) {
-	if !filepath.IsAbs(group) || filepath.Clean(group) != group || group == "/" {
-		return "", errors.New("invalid saved cgroup")
-	}
-	return filepath.Join(c.cgroupRoot, group), nil
-}
-
-func (c *Controller) members(group string) ([]Process, error) {
-	path, err := c.groupPath(group)
-	if err != nil {
-		return nil, err
-	}
-	var members []Process
-	err = filepath.WalkDir(path, func(p string, entry os.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		if entry.Name() != "cgroup.procs" {
-			return nil
-		}
-		data, err := os.ReadFile(p)
-		if err != nil {
-			return err
-		}
-		for _, value := range strings.Fields(string(data)) {
-			pid, err := strconv.Atoi(value)
-			if err != nil {
-				return err
-			}
-			identity, _, err := c.process(pid)
-			if errors.Is(err, os.ErrNotExist) {
-				continue
-			}
-			if err != nil {
-				return err
-			}
-			members = append(members, identity)
-		}
-		return nil
-	})
-	return members, err
-}
-
-func (c *Controller) observeRetired(r *Receipt) error {
-	path, err := c.groupPath(r.Target.Cgroup)
-	if err != nil {
-		return err
-	}
-	data, err := os.ReadFile(filepath.Join(path, "cgroup.events"))
-	if errors.Is(err, os.ErrNotExist) {
-		if _, statErr := os.Lstat(path); !errors.Is(statErr, os.ErrNotExist) {
-			return errors.New("cgroup evidence unavailable")
-		}
-	} else if err != nil {
-		return err
-	} else if !strings.Contains("\n"+string(data), "\npopulated 0\n") {
-		return errors.New("placement cgroup remains populated")
-	}
-	for _, old := range append(append([]Process{}, r.Members...), r.Target.Init) {
-		current, live, err := c.process(old.PID)
-		if errors.Is(err, os.ErrNotExist) {
-			continue
-		}
-		if err != nil {
-			return err
-		}
-		if current == old && live {
-			return fmt.Errorf("old placement process %d remains live", old.PID)
-		}
-	}
-	return nil
-}
diff --git a/apps/daemon/internal/placement/state_linux.go b/apps/daemon/internal/placement/state_linux.go
deleted file mode 100644
index 31b72aa9a..000000000
--- a/apps/daemon/internal/placement/state_linux.go
+++ /dev/null
@@ -1,161 +0,0 @@
-//go:build linux
-
-package placement
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"syscall"
-	"time"
-)
-
-func (c *Controller) recordPath(id string) string { return filepath.Join(c.root, id+".json") }
-
-func privateFile(f *os.File) error {
-	info, err := f.Stat()
-	if err != nil {
-		return err
-	}
-	st, ok := info.Sys().(*syscall.Stat_t)
-	if !ok || !info.Mode().IsRegular() || info.Mode().Perm() != 0600 || st.Uid != uint32(os.Getuid()) || st.Nlink != 1 {
-		return errors.New("placement state must be a private, owned regular file")
-	}
-	return nil
-}
-
-func secureDirectory(path string) error {
-	if !filepath.IsAbs(path) || filepath.Clean(path) != path {
-		return errors.New("state directory must be canonical and absolute")
-	}
-	if path != "/" {
-		if err := secureDirectory(filepath.Dir(path)); err != nil {
-			return err
-		}
-	}
-	info, err := os.Lstat(path)
-	if errors.Is(err, os.ErrNotExist) {
-		if err := os.Mkdir(path, 0700); err != nil && !errors.Is(err, os.ErrExist) {
-			return err
-		}
-		parent, syncErr := os.Open(filepath.Dir(path))
-		if syncErr != nil {
-			return syncErr
-		}
-		syncErr = parent.Sync()
-		closeErr := parent.Close()
-		if syncErr != nil {
-			return syncErr
-		}
-		if closeErr != nil {
-			return closeErr
-		}
-		info, err = os.Lstat(path)
-	}
-	if err != nil {
-		return err
-	}
-	st, ok := info.Sys().(*syscall.Stat_t)
-	if !ok || !info.IsDir() || info.Mode().Perm()&0022 != 0 || (st.Uid != 0 && st.Uid != uint32(os.Getuid())) {
-		return fmt.Errorf("untrusted placement state directory: %s", path)
-	}
-	return nil
-}
-
-func (c *Controller) lock(ctx context.Context, id string) (func(), error) {
-	if !fullID.MatchString(id) {
-		return nil, errors.New("require full immutable container ID")
-	}
-	if err := secureDirectory(c.root); err != nil {
-		return nil, err
-	}
-	info, err := os.Stat(c.root)
-	if err != nil || info.Mode().Perm() != 0700 {
-		return nil, errors.New("placement state directory must have mode 0700")
-	}
-	f, err := os.OpenFile(filepath.Join(c.root, id+".lock"), os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
-	if err != nil {
-		return nil, err
-	}
-	if err := privateFile(f); err != nil {
-		f.Close()
-		return nil, err
-	}
-	for {
-		err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
-		if err == nil {
-			break
-		}
-		if err != syscall.EWOULDBLOCK {
-			f.Close()
-			return nil, err
-		}
-		select {
-		case <-ctx.Done():
-			f.Close()
-			return nil, ctx.Err()
-		case <-time.After(20 * time.Millisecond):
-		}
-	}
-	return func() { _ = f.Close() }, nil
-}
-
-func (c *Controller) load(id string) (*Receipt, error) {
-	f, err := os.OpenFile(c.recordPath(id), os.O_RDONLY|syscall.O_NOFOLLOW, 0)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-	if err := privateFile(f); err != nil {
-		return nil, err
-	}
-	var r Receipt
-	if err := json.NewDecoder(f).Decode(&r); err != nil {
-		return nil, err
-	}
-	validScope := (r.Version == 1 && r.EnvironmentID == "") || (r.Version == 2 && validEnvironment(r.EnvironmentID))
-	if !validScope || r.Target.Container != id || !ownerID.MatchString(r.Owner) ||
-		(r.State != "enrolled" && r.State != "stopping" && r.State != "retired") ||
-		(r.State == "retired") != (r.RetiredAt != nil) {
-		return nil, errors.New("invalid placement receipt")
-	}
-	return &r, nil
-}
-
-func (c *Controller) save(r *Receipt) error {
-	data, err := json.MarshalIndent(r, "", "  ")
-	if err != nil {
-		return err
-	}
-	f, err := os.CreateTemp(c.root, ".receipt-*")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(f.Name())
-	if _, err = f.Write(append(data, '\n')); err == nil {
-		err = f.Sync()
-	}
-	closeErr := f.Close()
-	if err != nil {
-		return err
-	}
-	if closeErr != nil {
-		return closeErr
-	}
-	if err := os.Rename(f.Name(), c.recordPath(r.Target.Container)); err != nil {
-		return err
-	}
-	return c.syncDir(c.root)
-}
-
-func syncDirectory(path string) error {
-	dir, err := os.Open(path)
-	if err != nil {
-		return err
-	}
-	defer dir.Close()
-	return dir.Sync()
-}
diff --git a/apps/daemon/internal/placement/types.go b/apps/daemon/internal/placement/types.go
deleted file mode 100644
index 23079dca4..000000000
--- a/apps/daemon/internal/placement/types.go
+++ /dev/null
@@ -1,41 +0,0 @@
-// Package placement owns explicit operator-managed execution placement retirement.
-// It does not authorize Core dispatch, release harnesses or replay native work.
-package placement
-
-import "time"
-
-// BindingLabel marks a container explicitly created for operator enrollment.
-const BindingLabel = "io.oac.placement"
-
-// Receipt is durable local evidence for one exact placement incarnation.
-// Only State == "retired" reports qualified settlement; other states are unknown.
-type Receipt struct {
-	EnvironmentID string     `json:"environment_id,omitempty"`
-	Version       int        `json:"version"`
-	State         string     `json:"state"`
-	Owner         string     `json:"owner"`
-	Target        Target     `json:"target"`
-	Members       []Process  `json:"members"`
-	RequestedAt   time.Time  `json:"requested_at"`
-	RetiredAt     *time.Time `json:"retired_at,omitempty"`
-}
-
-// Target binds local supervisor, immutable container and observed incarnation.
-type Target struct {
-	HostBootID string  `json:"host_boot_id"`
-	Supervisor string  `json:"supervisor"`
-	Container  string  `json:"container"`
-	Created    string  `json:"created"`
-	Started    string  `json:"started"`
-	Restarts   int     `json:"restarts"`
-	Image      string  `json:"image"`
-	Workspace  string  `json:"workspace"`
-	Cgroup     string  `json:"cgroup"`
-	Init       Process `json:"init"`
-}
-
-// Process includes Linux start ticks to distinguish a reused PID.
-type Process struct {
-	PID   int    `json:"pid"`
-	Start string `json:"start"`
-}
diff --git a/apps/daemon/internal/transport/event_flow_test.go b/apps/daemon/internal/transport/event_flow_test.go
index 4d7cf10ff..abc2e631a 100644
--- a/apps/daemon/internal/transport/event_flow_test.go
+++ b/apps/daemon/internal/transport/event_flow_test.go
@@ -178,3 +178,23 @@ func TestOversizedExecutionEventClosesConnection(t *testing.T) {
 		t.Fatalf("connection failure: %v", c.Err())
 	}
 }
+
+// Reasoning is the upstream replacement for thinking; it must consume the same
+// negotiated window without starving control receipts on a saturated Run.
+func TestReasoningCreditPreservesControlReceipt(t *testing.T) {
+	c := flowConn(t, "run")
+	event := proto.Envelope{Type: proto.TypeReasoning, ID: "run"}
+	for range proto.ExecutionEventWindow {
+		if err := reserveCredit(c, t.Context(), event); err != nil {
+			t.Fatal(err)
+		}
+	}
+	ctx, cancel := context.WithTimeout(t.Context(), 20*time.Millisecond)
+	defer cancel()
+	if err := reserveCredit(c, ctx, event); !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("reasoning bypassed credit: %v", err)
+	}
+	if err := reserveCredit(c, t.Context(), proto.Envelope{Type: proto.TypeInteractionDecisionAck, ID: "run"}); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/apps/daemon/internal/transport/ws.go b/apps/daemon/internal/transport/ws.go
index 8ab3c4604..3276a9c17 100644
--- a/apps/daemon/internal/transport/ws.go
+++ b/apps/daemon/internal/transport/ws.go
@@ -464,14 +464,13 @@ func isPermanentClose(err error) bool {
 	return websocket.IsCloseError(err, CloseRuntimeDeleted)
 }
 
-// withQueryParams appends non-secret parameters and removes legacy credentials.
+// withQueryParams appends non-secret parameters.
 func withQueryParams(raw string, params map[string]string) (string, error) {
 	u, err := url.Parse(raw)
 	if err != nil {
 		return "", fmt.Errorf("transport: invalid ws url")
 	}
 	q := u.Query()
-	q.Del("token")
 	for k, v := range params {
 		q.Set(k, v)
 	}
diff --git a/apps/daemon/internal/transport/ws_test.go b/apps/daemon/internal/transport/ws_test.go
index 3e4d8a7d4..12e4859dd 100644
--- a/apps/daemon/internal/transport/ws_test.go
+++ b/apps/daemon/internal/transport/ws_test.go
@@ -98,7 +98,7 @@ func TestDialPassesAuthOnlyInHeader(t *testing.T) {
 
 	headers := http.Header{"Authorization": {"Bearer obsolete"}, "X-Test": {"preserved"}}
 	conn, err := transport.Dial(context.Background(), transport.DialOptions{
-		WSURL:         httpToWS(srv.URL) + "/agent-daemon/ws?token=legacy",
+		WSURL:         httpToWS(srv.URL) + "/agent-daemon/ws",
 		HTTPHeader:    headers,
 		DeviceID:      "rt_abc",
 		Credential:    "shh-secret",
diff --git a/apps/daemon/testdata/onboarding/main.go b/apps/daemon/testdata/onboarding/main.go
index 0a08375ae..5f25d52af 100644
--- a/apps/daemon/testdata/onboarding/main.go
+++ b/apps/daemon/testdata/onboarding/main.go
@@ -126,9 +126,6 @@ func (s *session) Cancel(context.Context) error {
 func (s *session) CancellationOutcome() proto.DonePayload {
 	return proto.DonePayload{Content: "cancelled", Metadata: map[string]any{proto.DoneMetaAgentSessionID: s.native}}
 }
-func (s *session) Steer(ctx context.Context, p proto.PromptSteerPayload) error {
-	return s.SteerWithReceipt(ctx, p, func() {})
-}
 func (s *session) SteerWithReceipt(_ context.Context, p proto.PromptSteerPayload, written func()) error {
 	text, err := p.Input.TextOnly()
 	if err != nil {
@@ -162,7 +159,7 @@ func run() error {
 	registry := agent.NewRegistry()
 	h := &harness{history: map[string]string{}}
 	registry.RegisterKind(proto.SupportedAgentKind{Kind: "fixture_harness", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{
-		Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported,
+		Streaming: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported,
 	})}, harnessconfig.Configuration{})
 	registry.RegisterExecutor("fixture_harness", h.prepare)
 	sink := &sender{encoder: json.NewEncoder(os.Stdout)}
diff --git a/apps/web/DESIGN.md b/apps/web/DESIGN.md
index 5966de38f..4ce53087f 100644
--- a/apps/web/DESIGN.md
+++ b/apps/web/DESIGN.md
@@ -366,10 +366,10 @@ Dialogs are 448px Paper cards (960px when wide) with 8px corners, a 52px header
 - **ConfirmDialog**: the one grammar for destructive actions. The body states what will be deleted and its consequences; the footer holds Cancel (outline) and the confirm button (danger), whose label changes while busy. Core's reason for a rejection, or an uncertain-outcome warning, appears in red inside the dialog. The Skill page's delete dialogs follow the same grammar; deleting a whole Skill also requires typing its name. Archiving a project says in bold that it can't be undone, then how many active keys it revokes (the project read's count, or more when its loaded key list shows more) and that assets and accepted work stay; with active keys it too requires typing the project's name, shown in mono with its inner spaces kept (surrounding spaces are forgiven, Unicode compared in NFC). While the project list is read again Archive waits; if that read failed, a red line says the count may be out of date and Archive stays disabled.
 - **Key dialogs**: name fields carry their rules in a help tip and their problem in red underneath. The issued key appears in a read-only field with a copy button, under a notice that it is shown once; only "I've saved this key" dismisses it. Closing the dialog moves the key into a pending notice card on the page.
 - **Executor credential dialog** (640px): the shown-once notice, then a prompt to save the JSON privately before Done. Download credential file is primary; Copy credential is secondary. Installation commands are not repeated here. Done forgets the credential; closing preserves it in the pending card. The native installer reads the unchanged JSON file: its absolute path is entered during interactive installation or passed with `--credential-file`; tokens never enter command arguments.
-- **Add node**: the sandbox limits first, then the one-time command in a Terminal block (expiry countdown and Copy command in its header), the three progress steps, and, once the installer's minute passes, an amber card with the reason and a copyable system-service log command. Below, the Host requirements Hairline disclosure is open until this browser has shown it once. Installation requires root or sudo, creates the `oac-node` system service, and serves one Core per host because nodes share the service account. The docker group's root-equivalent access is stated once, in **Use Docker instead of microsandbox?**. Do not expose an ordinary-user installation command or user-service prerequisites. The command downloads from the installation's public URL, never the browser's address, so it works as shown on any host. Until the installation is read, a line says it is being checked; a failed read, a public URL other machines can't use (loopback or not HTTPS), or a console without the provider's node files replaces the limits with one line saying why (the failed read with Try again), and the footer offers nothing to generate. Once the node is ready, while Getting started is open, one line under the green status names the next step (set a default model provider, or finish Getting started) with a text action to Settings → Models and credentials or the Overview.
+- **Add node**: the Limits choice first (Recommended, which leaves the limits for Core to derive from the host once it enrolls, or Custom with the two numbers), then the one-time command in a Terminal block (expiry countdown and Copy command in its header), the three progress steps, and, once the installer's minute passes, an amber card with the reason and a copyable system-service log command. Below, the Host requirements Hairline disclosure is open until this browser has shown it once. Installation requires root or sudo, creates the `oac-node` system service, and serves one Core per host because nodes share the service account. The docker group's root-equivalent access is stated once, in **Use Docker instead of microsandbox?**. Do not expose an ordinary-user installation command or user-service prerequisites. The command downloads from the installation's public URL, never the browser's address, so it works as shown on any host. Until the installation is read, a line says it is being checked; a failed read, a public URL other machines can't use (loopback or not HTTPS), or a console without the provider's node files replaces the limits with one line saying why (the failed read with Try again), and the footer offers nothing to generate. Once the node is ready, while Getting started is open, one line under the green status names the next step (set a default model provider, or finish Getting started) with a text action to Settings → Models and credentials or the Overview.
 - **Clean up the host**: after a node is removed, a dialog gives the host's uninstall command in the same Terminal block, a Graphite line that it deletes no sandboxes, volumes or images; the uninstaller prints what it keeps. The command requires root or sudo; there is no user-service alternative. A node enrolled with an earlier Core address adds an "Old Core address gone?" disclosure with the `--force` form. The command, too, downloads from the public URL, which the dialog reads again if it is not at hand: until then one line says it is being checked, a failed read says so with Try again, and a public URL other machines can't use (loopback, or none) gets a line saying the service stays on the host and no command can be given. Done dismisses it and focus returns to the page heading.
 - **Use Docker instead of microsandbox?**: choosing Docker in sandbox setup lists what it gives up, each point a 600 Ink lead over a Graphite line: weaker isolation (containers share the host kernel; microsandbox gives each sandbox its own microVM), root-equivalent access (the node's account joins the docker group) and limited use (trusted workloads, or hosts without KVM). The footer holds Use Docker (outline) and Keep microsandbox (primary), which takes focus; closing or Escape keeps microsandbox too.
-- **Edit node**: the name, then the sandbox limit with a question-mark help tip once the node's heartbeat has the host's CPUs and memory: the host, each sandbox's size and at most how many fit. The Nodes list and a node's Capacity show "Active / limit" for Docker and microsandbox alike, so a saved limit shows where it was set.
+- **Edit node**: the name, then the Limits choice, Recommended showing the node's `recommended_capacity` while Core has one, or Custom with the numbers. The Nodes list and a node's Capacity show "Active / limit" for Docker and microsandbox alike, so a saved limit shows where it was set.
 - **How to call**: wherever a new key is shown, a card under it gives three copyable samples, each a Margin Gray block with a Hairline and its label and copy button in a header row: a Shell block exporting `OPENAI_BASE_URL` (the installation's API base URL) and `OPENAI_API_KEY` (the new key) together, then curl and Python (with the pinned SDK), each listing the project's Agents and creating a Session with a first message (`environment`, an inline `agent` with `model: "<model>"`, and `input`). A copy the clipboard refuses selects the sample and says so in red underneath. One Graphite line says to put a model the model provider serves in place of `<model>`, and that running an Agent needs a model provider: in each request, saved on the Agent, or the deployment default. An active project's page shows the same samples as a section without any key: the Shell block exports a quoted placeholder, and a Graphite line above the samples says to use a key issued for this project, shown only once at issuance. When the public address is loopback, a note above the samples says the API is reachable only on the Core machine; without a public address only a note to set one shows. Before the installation is read, a skeleton holds the first sample's place.
 
 ### Navigation
@@ -434,7 +434,7 @@ Sandbox and scheduling contains sandbox setup or Deployment provider (Provider,
 
 Workspace storage shows the selected configuration's adapter and tenant capacity (in bytes units, or No tenant capacity limit) under Storage configuration, with Select new configuration in the section header and Edit tenant capacity on the capacity row. The configuration ID and parameters JSON sit in a closed Configuration details disclosure at the end of the card. Select new configuration accepts an adapter identifier, configuration ID, parameters JSON object and optional write-only credential JSON object. Edit tenant capacity keeps the current configuration identity. Explain adapter preparation and existing-workspace behavior behind help tips, with a link to the owning configuration document; keep required form labels and validation visible. Never prefill credentials or persist their drafts across navigation. A failed read is not an unconfigured filesystem, and an uncertain write is not a safe automatic retry.
 
-Models and credentials stacks one default-model card per Harness. Its header carries the Harness name, its readiness (Ready in green; Model provider not set in amber, with Set as the primary button; Disabled in neutral, with a View startup settings text action), a Default pill, a help tip and the Set, Replace and Clear actions; rows hold model ID, provider protocol, base URL, key presence, token limits when set and update time, and a foot holds Usage details. Set and Replace open one form dialog. The adapter declaration supplies supported protocols, native JSON support and required limits without harness-specific branches. Native settings use an optional JSON object editor with formatting and inline syntax errors. Changing model identity clears native JSON; replacing only the required write-only API key does not. Keys are never prefilled and are forgotten when the form closes. Core rejections remain visible in the form; Clear uses ConfirmDialog. Usage details opens Core's observations separately.
+Models and credentials stacks one default-model card per Harness. Its header carries the Harness name, its readiness (Ready in green; Model provider not set in amber, with Set as the primary button; Disabled in neutral, with a View startup settings text action), a Default pill, a help tip and the Set, Replace and Clear actions; rows hold model ID, provider protocol, base URL, key presence, token limits when set and update time, and a foot holds Usage details. Set and Replace open one form dialog. The adapter declaration supplies supported protocols and native JSON support without harness-specific branches. Native settings use an optional JSON object editor with formatting and inline syntax errors. Changing model identity clears native JSON; replacing only the required write-only API key does not. Keys are never prefilled and are forgotten when the form closes. Core rejections remain visible in the form; Clear uses ConfirmDialog. Usage details opens Core's observations separately.
 
 Service and deployment shows installation addresses, an Installation details disclosure, closed by default, with the installation ID and source commit, existing Domain and HTTPS actions, and the startup settings Core loaded. Process settings remain read-only here; their source stays the installation configuration. Each row's label is the setting's environment variable in code style (OAC_LOG_LEVEL), as Core reports it, wrapping after an underscore so a phone keeps all three columns; values show as is, with arrays joined, On or Off for booleans and None for an empty list. How to change a setting in the section header links to the configuration guide. Sensitive settings show only Configured or Not set. Default uses a neutral pill.
 
diff --git a/apps/web/PRODUCT.md b/apps/web/PRODUCT.md
index 4c14c1539..e7320e85a 100644
--- a/apps/web/PRODUCT.md
+++ b/apps/web/PRODUCT.md
@@ -31,11 +31,11 @@ The console runs beside the administrator's own Core, with execution, files and
 
 - **Monitor**: Overview (service status, running Sessions, sandbox slots, the Needs attention count for the last 24 hours, 24-hour Session activity, a compact inventory of Core and up to four nodes, prioritizing offline and degraded nodes when the list is full, where Core opens Core metrics, a node opens its page on Nodes and E2B opens Sandbox metrics, the Needs attention table, whose rows name each Session, its project, its one-line reason and last activity and open it, with older ones left to the Session log, usage by project), Core metrics (whether Core can run Turns: execution slots, the Turn queue, its p95 wait and interrupted Turns, connected daemons, database latency, the Core process's CPU and memory, and background jobs; Go heap, goroutines and the database pool sit in a collapsed Diagnostics area), Agent metrics (requests, errors, duration, tokens, models, tools, Agents and API keys for 1 h / 6 h / 24 h / 7 d), Sandbox metrics (hosted Runtimes across projects over time, active against total; a sandbox opens in a dialog with its figures and CPU and memory charts; an E2B deployment adds what Core holds in E2B's cloud), Request log (recent public or administration HTTP requests, status, duration, safe error code and correlation IDs; bounded to the serving Core instance, with manual refresh and no body capture), Session log (every Session, read-only, with a failed Session's reason under its status, opening one Session's history, which jumps to its failed Turns; a self-hosted Session's page also has its environment's executor credentials). Session facts and Agent metrics link to an Agent's page only when that saved resource exists; inline snapshots and snapshots of deleted Agents remain readable without a broken resource link. Agent metrics' failed Turns open the Agent's Sessions in the Session log.
 - **Resources**: Agents, Environment templates, Skills, Files, Vaults. Each list shows one project or all projects, with a Project column when all are shown and a Creator column naming the creating key. Detail pages show the resource's facts and offer Delete. An empty list says, in one sentence, that applications create these resources through the Agents API, and links to that resource's section of the API guide; Agent metrics does the same for Sessions.
-- **Platform**: Projects and keys (projects, their assets and usage, named keys, write history), Nodes (the node list, each node's capacity and limits, host figures and charts, allocations, Add node, Edit node and individual removal operations), and Settings, the single entry for platform configuration. Settings has four groups: Sandbox and scheduling, Workspace storage, Models and credentials, and Service and deployment. Sandbox and scheduling owns setup, resource edits, rollout, reset and the idle policy, and links to Nodes for nodes and their capacity. Add node on Nodes asks for limits before issuing its one-time command; installers use Core's public URL and require supported node artifacts. Edit node changes a node's name and limits; removal stays on the node page and offers the host's uninstall command. Models and credentials owns each Harness's default model and shows whether each Harness is ready: Ready when it is enabled and has a default model provider, otherwise the missing step, Model provider not set (with Set as the primary action) or Disabled (with a link to the startup settings). Getting started uses the same readiness. Service and deployment owns installation facts (the public and API base URLs, with the installation ID and source commit behind Installation details), Domain and HTTPS actions and read-only startup settings, each named by its environment variable, with a link to the configuration guide's section on changing them.
-- A node whose provider is not ready names the reason as one Provider-neutral readiness class (provider unavailable, host unsupported, provider files or Runtime image missing, Runtime download failed, a host too small) and its fix in the help tip beside its status, wherever that status shows.
+- **Platform**: Projects and keys (projects, their assets and usage, named keys, write history), Nodes (the node list, each node's capacity and limits, host figures and charts, allocations, Add node, Edit node and individual removal operations), and Settings, the single entry for platform configuration. Settings has four groups: Sandbox and scheduling, Workspace storage, Models and credentials, and Service and deployment. Sandbox and scheduling owns setup, resource edits, rollout, reset and the idle policy, and links to Nodes for nodes and their capacity. Add node on Nodes offers Recommended or Custom limits before issuing its one-time command; installers use Core's public URL and require supported node artifacts. Edit node changes a node's name and limits; removal stays on the node page and offers the host's uninstall command. Models and credentials owns each Harness's default model and shows whether each Harness is ready: Ready when it is enabled and has a default model provider, otherwise the missing step, Model provider not set (with Set as the primary action) or Disabled (with a link to the startup settings). Getting started uses the same readiness. Service and deployment owns installation facts (the public and API base URLs, with the installation ID and source commit behind Installation details), Domain and HTTPS actions and read-only startup settings, each named by its environment variable, with a link to the configuration guide's section on changing them.
+- A node whose provider is not ready names the reason as one Provider-neutral readiness class (provider unavailable, host unsupported, provider files or Runtime image missing, a host too small) and its fix in the help tip beside its status, wherever that status shows.
 - A node enrolled with an earlier Core address gets no new sandboxes, so on the Nodes list and its page its status is Old address, with "Remove and add again", never Available.
 - **Sandbox reset** is an explicit administrator operation in Settings → Sandbox and scheduling. Auto clear is the default, with a one-hour deadline (5 minutes–24 hours); Force clear requires destructive confirmation. Reset stops new hosted Session admission, clears idle, suspended and pending hosted work, and waits for busy Turns and file writes until Core forces the remaining work. It does not affect self-hosted execution. Histories and persisted Files/Artifacts remain; archived Sessions cannot resume, and unpersisted workspace contents may be lost. Cancel stops further clearing without undoing archives. Core alone reports progress and completion, including resources blocked on named offline nodes; force does not bypass their cleanup. Completion clears the backend configuration and retires old nodes/enrollment credentials. A new configuration is then a separate deliberate save.
-- **Online sandbox configuration** changes the same backend's resources, Runtime or E2B template without retiring existing nodes or changing existing Sessions' resource ownership. New placement follows Core's qualified capacity; saving a target does not promise immediate placement on it. Changes keep the saved Runtime. When it differs from the Runtime this console serves, Sandbox and scheduling adds a Runtime row with both source commits and Use this installation's Runtime, which opens Change resources on its review with that Runtime; a console without a Runtime manifest leaves the release to Advanced settings. Configuration rollout shows Core's target preparation and retained previous-generation sandbox count. A settled rollout can still have failed, update-required or unknown nodes and old resources. An offline node stays offline even when it has a recorded serving generation. Node and allocation detail distinguish the serving pin, target preparation and each resource's configuration generation.
+- **Online sandbox configuration** changes the same backend's resources or E2B template without retiring existing nodes or changing existing Sessions' resource ownership. New placement follows Core's qualified capacity; saving a target does not promise immediate placement on it. Configuration rollout shows Core's target preparation and retained previous-generation sandbox count. A settled rollout can still have failed or unknown nodes and old resources. An offline node stays offline even when it has a recorded serving generation. Node and allocation detail distinguish the serving pin, target preparation and each resource's configuration generation.
 - **E2B credential replacement** uses the same configuration form. Setup requires a key; leaving it blank during an update keeps the saved key. An explicit key, even the same value, is verified as a replacement and advances the target generation after successful verification. Another backend or E2B team requires a deliberate reset. A rejected or uncertain replacement never clears the committed configuration or replays the write.
 - **E2B deployments** have no machines: Nodes offers a link to Settings → Sandbox and scheduling. Overview and Sandbox metrics show the sandboxes Core holds in E2B's cloud (running, starting, size, template build) instead of node capacity, with no Add node action; a sandbox's dialog adds its disk use.
 - **Automatic suspension** appears when the deployment declares a suspension policy. Nodes shows each node's suspended count and retained limit, the most sandboxes it keeps running and suspended together, with Edit node for its limits; Overview adds the suspended total of all registered nodes under its sandbox slots. Settings → Sandbox and scheduling owns **Automatic suspension**: deployment-wide idle seconds are editable there; snapshot retention remains read-only. Necessary policy explanations belong in help tips, not persistent helper paragraphs. These are Core records, not measured CPU or memory savings. Node allocations show the recorded compute phase and elapsed phase time, never an inferred snapshot-expiry countdown. Sandbox metrics' Hosted Runtimes has one Status column: Core's lifecycle record of each sandbox (Active, Suspended, Changing state, Waiting for allocation or Stopped), which Core derives from the allocation's recorded phase. The Session page's Runtime state reads the same way. When an active sandbox has no sample, its CPU and Memory cells name why. Independent workspace persistence is explained only when the deployment declares it. Nodes refreshes its inventory every 30 seconds while visible; reset and active preparation retain their faster polling.
diff --git a/apps/web/README.md b/apps/web/README.md
index d81b9c0ac..4f1b69efa 100644
--- a/apps/web/README.md
+++ b/apps/web/README.md
@@ -11,7 +11,7 @@
 
 ## Run the console locally
 
-Set up the checkout as described in the [development guide](../../docs/development.md), then start the fixture console and the development server in separate terminals from the repository root:
+Set up the checkout as described in [Develop OpenAgentCore](../../docs/development.md), then start the fixture console and the development server in separate terminals from the repository root:
 
 ```sh
 node apps/web/e2e/fixture-console.mjs
@@ -40,7 +40,7 @@ pnpm test:web:acceptance
 
 ## README screenshots
 
-The fixture has an opt-in scene for Overview and Agent metrics, including five available nodes. From the repository root, start these in separate terminals:
+The fixture console has an opt-in demo scene that fills Overview and Agent metrics with five available nodes. From the repository root, start these in separate terminals, then sign in at `http://127.0.0.1:4394` with the fixture key `fixture-core-key-3f9a2c71`:
 
 ```sh
 OAC_WEB_SCREENSHOT_DEMO=1 AGENTS_FIXTURE_PORT=18394 node apps/web/e2e/fixture-console.mjs
@@ -50,4 +50,4 @@ OAC_WEB_SCREENSHOT_DEMO=1 AGENTS_FIXTURE_PORT=18394 node apps/web/e2e/fixture-co
 OAC_WEB_DEV_PROXY_TARGET=http://127.0.0.1:18394 pnpm --filter @oac/web exec vite --host 127.0.0.1 --mode test --port 4394
 ```
 
-Open `http://127.0.0.1:4394` in Chrome and sign in with the fixture key `fixture-core-key-3f9a2c71`. Capture Overview and Agent metrics in light mode, once in English and once in Chinese using the console language menu. Check that all five nodes load and metrics have no partial-data warning before capturing. For a remote preview, forward port 4394 over SSH and capture in local Chrome. Keep the original resolution, crop browser chrome and add a plain macOS-style window bar. Save the four images as `docs/assets/console-*.webp`; the READMEs link them and the distribution manifest includes them. Normal acceptance data and production builds do not enable this scene.
+The `docs/assets/console-*.webp` images are captured from this scene in light mode, once in English and once in Chinese. Acceptance runs and production builds never enable the scene.
diff --git a/apps/web/e2e/console.ts b/apps/web/e2e/console.ts
index 2735ebc8c..fbe39052b 100644
--- a/apps/web/e2e/console.ts
+++ b/apps/web/e2e/console.ts
@@ -55,7 +55,7 @@ export async function failNext(request: APIRequestContext, failure: { method: st
 }
 
 /** Registers a node, or changes one, as a host running the last enrollment command (or, with its `enrollment_id`, another one) would. */
-export async function setNode(request: APIRequestContext, node: { id: string; name?: string; online?: boolean; provider_ready?: boolean; diagnostic?: string; enrollment_id?: string; rollout?: SandboxNodeRollout }) {
+export async function setNode(request: APIRequestContext, node: { id: string; name?: string; online?: boolean; provider_ready?: boolean; enrollment_id?: string; rollout?: SandboxNodeRollout }) {
   await request.post(`${fixture}/__fixture/node`, { data: node });
 }
 
diff --git a/apps/web/e2e/data/routes.mjs b/apps/web/e2e/data/routes.mjs
index 124a7966c..535af7a62 100644
--- a/apps/web/e2e/data/routes.mjs
+++ b/apps/web/e2e/data/routes.mjs
@@ -84,9 +84,9 @@ export function buildDemo(now = Math.floor(Date.now() / 1000), publicUrl = "http
   });
   sessions.sort((a, b) => b.created_at - a.created_at);
   const nodes = [
-    { rollout: { state: "ready", ready_generation: 1 }, id: "node-local", name: "core-01", provider: "docker", online: true, provider_ready: true, cpu_count: 16, available_memory_bytes: 38 * 2 ** 30, available_disk_bytes: 410 * 2 ** 30, running: 5, snapshots: 2, last_seen_at: new Date((now - 8) * 1000).toISOString(), max_active: 8, max_retained: 16, active: 5, reserved: 1, retained: 2, cleanup_pending: 0, created_at: new Date((now - 86400 * 30) * 1000).toISOString() },
-    { rollout: { state: "failed", ready_generation: null, diagnostic: "host_unsupported" }, id: "node-gpu", name: "gpu-worker-02", provider: "docker", online: true, provider_ready: false, diagnostic: "host_unsupported", cpu_count: 32, available_memory_bytes: 12 * 2 ** 30, available_disk_bytes: 96 * 2 ** 30, running: 7, snapshots: 5, last_seen_at: new Date((now - 12) * 1000).toISOString(), max_active: 8, max_retained: 16, active: 7, reserved: 0, retained: 5, cleanup_pending: 1, created_at: new Date((now - 86400 * 12) * 1000).toISOString() },
-    { rollout: { state: "unknown", ready_generation: 1 }, id: "node-edge", name: "edge-03", provider: "docker", online: false, provider_ready: false, cpu_count: 8, available_memory_bytes: null, available_disk_bytes: null, running: 0, snapshots: 0, last_seen_at: new Date((now - 5400) * 1000).toISOString(), max_active: 4, max_retained: 8, active: 0, reserved: 0, retained: 0, cleanup_pending: 0, created_at: new Date((now - 86400 * 3) * 1000).toISOString() },
+    { rollout: { state: "ready", ready_generation: 1 }, id: "node-local", name: "core-01", provider: "docker", online: true, provider_ready: true, cpu_count: 16, available_memory_bytes: 38 * 2 ** 30, available_disk_bytes: 410 * 2 ** 30, running: 5, snapshots: 2, last_seen_at: new Date((now - 8) * 1000).toISOString(), max_active: 8, max_retained: 16, recommended_capacity: { max_active: 6, max_retained: 6 }, active: 5, reserved: 1, retained: 2, cleanup_pending: 0, created_at: new Date((now - 86400 * 30) * 1000).toISOString() },
+    { rollout: { state: "failed", ready_generation: null, diagnostic: "host_unsupported" }, id: "node-gpu", name: "gpu-worker-02", provider: "docker", online: true, provider_ready: false, cpu_count: 32, available_memory_bytes: 12 * 2 ** 30, available_disk_bytes: 96 * 2 ** 30, running: 7, snapshots: 5, last_seen_at: new Date((now - 12) * 1000).toISOString(), max_active: 8, max_retained: 16, recommended_capacity: null, active: 7, reserved: 0, retained: 5, cleanup_pending: 1, created_at: new Date((now - 86400 * 12) * 1000).toISOString() },
+    { rollout: { state: "unknown", ready_generation: 1 }, id: "node-edge", name: "edge-03", provider: "docker", online: false, provider_ready: false, cpu_count: 8, available_memory_bytes: null, available_disk_bytes: null, running: 0, snapshots: 0, last_seen_at: new Date((now - 5400) * 1000).toISOString(), max_active: 4, max_retained: 8, recommended_capacity: null, active: 0, reserved: 0, retained: 0, cleanup_pending: 0, created_at: new Date((now - 86400 * 3) * 1000).toISOString() },
   ];
   const hosted = sessions.filter((session) => session.environment.type === "openai_hosted");
   const allocations = hosted.map((session, index) => {
diff --git a/apps/web/e2e/fixture-console.mjs b/apps/web/e2e/fixture-console.mjs
index e662bc01a..1f2513802 100644
--- a/apps/web/e2e/fixture-console.mjs
+++ b/apps/web/e2e/fixture-console.mjs
@@ -22,10 +22,9 @@ const LOCKOUT_AFTER = 3;
 const LOCKOUT_SECONDS = 30;
 
 let state;
-const hex = (c) => c.repeat(64);
-/** The Runtime release this fixture's distribution manifest describes. */
-const release = { source_commit: "c0ffee".padEnd(40, "0"), image_id: `sha256:${hex("1")}`, image_manifest_digest: `sha256:${hex("2")}`, microsandbox_ref: `oac-runtime@sha256:${hex("3")}`, runtime_sha256: hex("4"), firmware_sha256: hex("5") };
-const manifest = { platform: "linux/amd64", source_commit: release.source_commit, images: { runtime: release.image_id }, image_manifest_digests: { runtime: release.image_manifest_digest }, runtime_ref: release.microsandbox_ref, microsandbox: { runtime_sha256: release.runtime_sha256, firmware_sha256: release.firmware_sha256 }, artifacts: {} };
+const SOURCE_COMMIT = "c0ffee".padEnd(40, "0");
+// microsandbox runs every sandbox on workspace storage, so the installation has it selected.
+const WORKSPACE_STORAGE = { id: "5d0c2a4e-8f6b-4c1d-9e3a-7b2f1a0c6d48", adapter: "nfs", parameters: { root: "/srv/oac-workspaces", namespace_id: "22222222-2222-4222-8222-222222222222", uid: 65532 }, tenant_capacity_mib: 0 };
 
 /**
  * config.json's public_url. "public": an HTTPS address, so applications get an API base URL;
@@ -50,7 +49,7 @@ function installation() {
   return {
     // As Core: api_base_url is always public_url followed by /v1; local_only marks a loopback public_url.
     object: "core.installation", installation_id: INSTALLATION_ID, public_url: publicUrl(), api_base_url: `${publicUrl()}/v1`,
-    local_only: local, source_commit: release.source_commit,
+    local_only: local, source_commit: SOURCE_COMMIT,
     configuration: {
       settings: [
         // The settings Core reports (services/core/internal/processconfig), with the enabled harnesses of this fixture.
@@ -77,7 +76,7 @@ function installation() {
 
 const noNodeRollout = () => ({ state: "settled", previous_generation_sandboxes: 0, nodes: null });
 function nodeRollout(previous = 0) {
-  const nodes = { ready: 0, preparing: 0, failed: 0, update_required: 0, unknown: 0 };
+  const nodes = { ready: 0, preparing: 0, failed: 0, unknown: 0 };
   for (const node of state.nodes) nodes[node.rollout.state]++;
   return { state: nodes.preparing > 0 ? "preparing" : "settled", previous_generation_sandboxes: previous, nodes };
 }
@@ -87,7 +86,7 @@ function unconfiguredDeployment(generation = 0, ownerEpoch = 3) {
 }
 
 function configuredDeployment() {
-  return { installation_id: INSTALLATION_ID, provider: "docker", credential_configured: false, configuration: {}, metadata: {}, core_url: publicUrl(), reset: null, rollout: nodeRollout(), owner_epoch: 3, generation: 1, mode: "nodes", resources: { allocations: 0, pending: 0 }, specification: { resources: { cpus: 2, memory_mib: 4096 }, runtime: release }, specification_digest: "fixture", suspension: null };
+  return { installation_id: INSTALLATION_ID, provider: "docker", credential_configured: false, configuration: {}, metadata: {}, core_url: publicUrl(), reset: null, rollout: nodeRollout(), owner_epoch: 3, generation: 1, mode: "nodes", resources: { allocations: 0, pending: 0 }, specification: { resources: { cpus: 2, memory_mib: 4096 } }, specification_digest: "fixture", suspension: null };
 }
 /** The E2B template build as Core read it when the selection was saved. */
 const templateBuild = { status: "ready", resources: { cpus: 2, memory_mib: 2048, root_disk_mib: 10240 } };
@@ -262,6 +261,7 @@ async function adminWrite(request, response, path) {
 function adminRead(response, path, url) {
   const a = state.admin;
   if (path === "/installation") return send(response, 200, installation());
+  if (path === "/workspace-storage") return send(response, 200, WORKSPACE_STORAGE);
   if (path === "/projects") return send(response, 200, { data: a.projects.map(a.publicProject), has_more: false });
   if (path === "/summary") return send(response, 200, a.summary(url));
   if (path === "/request-logs") return send(response, 200, requestLog(url));
@@ -397,7 +397,7 @@ async function sandboxRoute(request, response, path, url) {
     if (initialize && state.deployment.provider) return error(response, 409, "The sandbox deployment is already configured.", "sandbox_deployment_conflict");
     if (!initialize && !state.deployment.provider) return error(response, 409, "The sandbox deployment is not configured.", "sandbox_deployment_conflict");
     const e2b = input.provider === "e2b";
-    if (!e2b && (!input.resources || !input.runtime)) return error(response, 400, "resources and runtime are required.", "invalid_sandbox_configuration");
+    if (!e2b && !input.resources) return error(response, 400, "resources are required.", "invalid_sandbox_configuration");
     // As Core (ErrSandboxPublicURLUnreachable): E2B sandboxes reach Core over the internet, which a loopback public_url cannot serve.
     if (e2b && state.installation === "local") return error(response, 409, "E2B sandboxes reach Core over the internet. Set an HTTPS public URL that is not loopback (public_url in config.json, OAC_PUBLIC_URL for Core).", "sandbox_configuration_error");
     // Synthetic classifier outcomes only; never persist or echo submitted keys.
@@ -409,7 +409,7 @@ async function sandboxRoute(request, response, path, url) {
     // As Core: E2B may omit resources and adopt its template build's CPU and memory; only microsandbox suspends.
     const resources = input.resources ?? { cpus: templateBuild.resources.cpus, memory_mib: templateBuild.resources.memory_mib };
     const previous = state.deployment;
-    const specification = { resources, ...(input.runtime ? { runtime: input.runtime } : {}) };
+    const specification = { resources };
     const explicitKey = e2b && Object.hasOwn(input, "credential");
     const sameSelection = !initialize && JSON.stringify(specification) === JSON.stringify(previous.specification) && (!e2b || input.configuration.template === previous.configuration?.template);
     // Omission can be a no-op; every explicit key, including identical bytes,
@@ -516,12 +516,11 @@ async function executorCredentialRoute(request, response, projectId, environment
 
 /**
  * A node as it first registers with the last enrollment command: not yet connected,
- * provider not ready, with the token's limits and enrollment ID. Like Core, it has no
- * diagnostic field until one is reported.
+ * provider not ready, with the token's limits and enrollment ID.
  */
 function registeredNode(nodeId) {
   const { enrollment_id = null, ...limits } = state.enrollment ?? { max_active: 1, max_retained: 1 };
-  return { rollout: { state: "unknown", ready_generation: null }, id: nodeId, name: nodeId, provider: state.deployment?.provider ?? "docker", core_url: publicUrl(), enrollment_id, online: false, provider_ready: false, cpu_count: null, available_memory_bytes: null, available_disk_bytes: null, running: 0, snapshots: 0, last_seen_at: null, ...limits, active: 0, reserved: 0, retained: 0, cleanup_pending: 0, created_at: new Date().toISOString() };
+  return { rollout: { state: "unknown", ready_generation: null }, id: nodeId, name: nodeId, provider: state.deployment?.provider ?? "docker", core_url: publicUrl(), enrollment_id, online: false, provider_ready: false, cpu_count: null, available_memory_bytes: null, available_disk_bytes: null, running: 0, snapshots: 0, last_seen_at: null, recommended_capacity: null, ...limits, active: 0, reserved: 0, retained: 0, cleanup_pending: 0, created_at: new Date().toISOString() };
 }
 
 const HARNESS_PROVIDER = /^\/harnesses\/([^/]+)\/model-configuration$/;
@@ -540,8 +539,7 @@ function providerProblem(harness, input) {
   if (!httpsBase(input.base_url)) return "model provider requires an HTTPS base_url without credentials, query or fragment";
   if (!["anthropic", "responses", "chat_completions"].includes(input.protocol)) return "unsupported model provider protocol";
   if (!input.api_key.trim() || Buffer.byteLength(input.api_key) > 16384 || /[\0\r\n]/.test(input.api_key)) return "invalid model provider API key";
-  if ((input.max_output_tokens ?? 0) > (input.context_window ?? 0)) return "invalid model token limits";
-  if (harness === "mcode" && !(input.context_window > 0 && input.max_output_tokens > 0)) return "selected harness requires positive model context_window and max_output_tokens";
+  if (input.context_window && (input.max_output_tokens ?? 0) > input.context_window) return "invalid model token limits";
   return null;
 }
 
@@ -550,11 +548,11 @@ function providerProblem(harness, input) {
  * (services/core/internal/api/harness_model_providers.go): the list
  * reflects every write; an unknown harness or an unset provider is 404; PUT
  * takes a JSON object of at most 32 KiB, is a full replacement that needs the
- * key every time (mcode also both limits) and answers with the safe view;
+ * key every time and answers with the safe view;
  * DELETE is 204 and safe to repeat. A disabled harness may still be configured.
  */
 async function harnessRoute(request, response, path) {
-  const support = (id) => ({ protocols: id === "codex" ? ["responses"] : id === "claude_sdk" ? ["anthropic"] : ["anthropic", "responses", "chat_completions"], accepts_harness_config: id !== "mcode", token_limits_required: id === "mcode" });
+  const support = (id) => ({ protocols: id === "codex" ? ["responses"] : id === "claude_sdk" ? ["anthropic"] : ["anthropic", "responses", "chat_completions"], accepts_harness_config: id === "claude_sdk", accepts_max_output_tokens: id !== "codex" });
   const view = (id) => ({ model_configuration_support: support(id), object: "core.harness", id, enabled: state.harnesses[id].enabled, default: state.harnesses[id].default, model_configuration: state.harnesses[id].provider });
   if (path === "/harnesses" && request.method === "GET") return send(response, 200, { object: "list", data: Object.keys(state.harnesses).map(view) });
   const match = path.match(HARNESS_PROVIDER);
@@ -624,21 +622,20 @@ async function fixtureRoute(request, response, url) {
     return send(response, 200, { ok: true });
   }
   if (url.pathname === "/__fixture/node" && request.method === "POST") {
-    // { id, ...fields }: registers the node on first use, then applies the fields (online, provider_ready, diagnostic,
-    // or another command's enrollment_id); an empty diagnostic removes the field, as Core omits it.
+    // { id, ...fields }: registers the node on first use, then applies the fields (online, provider_ready,
+    // or another command's enrollment_id).
     const { id: nodeId, ...fields } = await body(request);
     let node = state.nodes.find((entry) => entry.id === nodeId);
     if (!node) state.nodes.push(node = registeredNode(nodeId));
     Object.assign(node, fields);
     // A control may supply an explicit target observation. Existing enrollment
     // cases only supply connection facts, so give that newly joined target a pin.
-    if (!fields.rollout && ("online" in fields || "provider_ready" in fields || "diagnostic" in fields)) {
+    if (!fields.rollout && ("online" in fields || "provider_ready" in fields)) {
       node.rollout = !node.online ? { state: "unknown", ready_generation: node.rollout.ready_generation }
         : node.provider_ready ? { state: "ready", ready_generation: state.deployment.generation }
-        : { state: "failed", ready_generation: node.rollout.ready_generation, diagnostic: node.diagnostic || "provider_unavailable" };
+        : { state: "failed", ready_generation: node.rollout.ready_generation, diagnostic: "provider_unavailable" };
     }
     if (state.deployment.mode === "nodes") state.deployment.rollout = nodeRollout(state.deployment.rollout.previous_generation_sandboxes);
-    if (!node.diagnostic) delete node.diagnostic;
     return send(response, 200, node);
   }
   if (url.pathname === "/__fixture/requests") return send(response, 200, { violations: state.violations, writes: state.writes });
@@ -649,8 +646,6 @@ http.createServer(async (request, response) => {
   const url = new URL(request.url, `http://127.0.0.1:${port}`);
   try {
     if (url.pathname.startsWith("/__fixture/")) return await fixtureRoute(request, response, url);
-    // The console service serves its distribution manifest to anyone, as nodes download it.
-    if (url.pathname === "/node-install/manifest.json") return send(response, 200, manifest);
     if (request.headers.authorization) state.violations.push(`Authorization header on ${request.method} ${url.pathname}`);
     if (url.pathname.startsWith("/console/")) return await consoleRoute(request, response, url);
     const signedIn = state.auth.mode === "authenticated" && request.headers.cookie?.includes(SESSION_COOKIE);
diff --git a/apps/web/e2e/nodes.spec.ts b/apps/web/e2e/nodes.spec.ts
index 51c22b49b..5fb60fca2 100644
--- a/apps/web/e2e/nodes.spec.ts
+++ b/apps/web/e2e/nodes.spec.ts
@@ -24,6 +24,7 @@ test("adds a node: host requirements, a root/sudo command, a countdown, the same
   // Node installation only offers a system service; there is no user-mode alternative.
   await expect(add.getByText("No sudo on this host?")).toHaveCount(0);
   await expect(add.getByLabel("One-time enrollment command without sudo", { exact: true })).toHaveCount(0);
+  await add.getByRole("radio", { name: "Custom" }).click();
   await add.getByLabel("Sandboxes at once").fill("3");
   const tokenRequest = () => page.waitForRequest((sent) => sent.method() === "POST" && sent.url().endsWith("/core/v1/sandbox/enrollment-tokens"));
   const issued = tokenRequest();
@@ -91,17 +92,27 @@ test("adds a node: host requirements, a root/sudo command, a countdown, the same
   await expect(problem).toContainText("Not connected yet");
   await expect(problem).toContainText("sudo journalctl -u oac-node-7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f.service");
   await expect(add.getByText("No sudo on this host?")).toHaveCount(0);
-  // Connected, it reports why its provider isn't ready; once ready, the node is connected.
-  await setNode(request, { id: "node-new", online: true, diagnostic: "host_unsupported" });
-  await expect(problem).toContainText("Host unsupported");
+  // Connected but not ready, it keeps waiting for its provider; once ready, the node is connected.
+  await setNode(request, { id: "node-new", online: true });
+  await expect(problem).toContainText("Sandbox provider unavailable");
   await expect(progress).toContainText("Waiting for Docker");
-  await setNode(request, { id: "node-new", provider_ready: true, diagnostic: "" });
+  await setNode(request, { id: "node-new", provider_ready: true });
   await expect(progress).toHaveText("edge-04 · Connected");
   await add.getByRole("button", { name: "Done" }).click();
   await expect(add).toBeHidden();
-  // A finished flow leaves no limits behind: the next node starts from the defaults.
+  // A finished flow leaves no limits behind: the next node starts from the recommended ones.
   await page.getByRole("button", { name: "Add node" }).click();
-  await expect(add.getByLabel("Sandboxes at once")).toHaveValue("2");
+  await expect(add.getByRole("radio", { name: "Recommended" })).toBeChecked();
+  await expect(add.getByLabel("Sandboxes at once")).toHaveCount(0);
+});
+
+test("asks Core to recommend a new node's limits unless the administrator enters them", async ({ page, request }) => {
+  await openConsole(page, request, "nodes");
+  await page.getByRole("button", { name: "Add node" }).click();
+  const add = page.getByRole("dialog", { name: "Add node" });
+  const issued = page.waitForRequest((sent) => sent.method() === "POST" && sent.url().endsWith("/core/v1/sandbox/enrollment-tokens"));
+  await add.getByRole("button", { name: "Generate command" }).click();
+  expect((await issued).postDataJSON()).toEqual({});
 });
 
 test("issues no command before the installation is read, for a loopback public URL or without node files, and sees a fix on reopening", async ({ page, request }) => {
@@ -192,7 +203,7 @@ test("gives the host's uninstall command even when the installation must be read
   await expect(cleanup.getByLabel("Uninstall command", { exact: true })).toHaveValue(/'https:\/\/core\.example\.com\/node-install\/node-install\.pyz'/);
 });
 
-test("sets up own-machine sandboxes page by page, with the Runtime from the distribution", async ({ page, request }) => {
+test("sets up own-machine sandboxes page by page", async ({ page, request }) => {
   await openConsole(page, request, "settings?id=sandbox", { sandbox: "none" });
   await expect(page.getByRole("heading", { name: "Where should sandboxes run?" })).toBeVisible();
   await page.getByRole("button", { name: "Own machines" }).click();
@@ -201,8 +212,8 @@ test("sets up own-machine sandboxes page by page, with the Runtime from the dist
   await expect(page.getByRole("heading", { name: "Review and save" })).toBeVisible();
   await page.getByRole("button", { name: "Save configuration" }).click();
 
-  // Own machines continue straight to adding the first node, at its limits: no command is issued yet.
-  await expect(page.getByRole("dialog", { name: "Add node" }).getByLabel("Sandboxes at once")).toBeVisible();
+  // Own machines continue straight to adding the first node, with Recommended limits: no command is issued yet.
+  await expect(page.getByRole("dialog", { name: "Add node" }).getByRole("radio", { name: "Recommended" })).toBeChecked();
   const add = page.getByRole("dialog", { name: "Add node" });
   await expect(add.getByText("No sudo on this host?")).toHaveCount(0);
   // None is requested within a second of opening, and Core saw only the deployment write.
@@ -211,9 +222,6 @@ test("sets up own-machine sandboxes page by page, with the Runtime from the dist
   expect(await writes(request)).toEqual(["POST /core/v1/sandbox/deployment"]);
   await add.getByRole("button", { name: "Close dialog" }).click();
   await page.getByRole("button", { name: "Settings", exact: true }).click();
-  // The saved specification carries the Runtime read from the console's manifest.
-  await page.getByRole("button", { name: "Configuration details", exact: true }).click();
-  await expect(page.locator(".help-tip-popover").getByText("c0ffee000000", { exact: true })).toBeVisible();
 });
 
 test("preselects microsandbox and asks once before switching to Docker", async ({ page, request }) => {
@@ -305,11 +313,9 @@ test("shows the retained E2B build while a replacement key is checked", async ({
   await expect(edit.getByRole("button", { name: "Next" })).toBeEnabled();
 });
 
-test("edits only the saved backend, preserving a custom size and Runtime", async ({ page, request }) => {
-  const runtime = { source_commit: "0".repeat(40), image_id: `sha256:${"a".repeat(64)}`, image_manifest_digest: `sha256:${"b".repeat(64)}`,
-    microsandbox_ref: `oac-runtime@sha256:${"b".repeat(64)}`, runtime_sha256: "c".repeat(64), firmware_sha256: "d".repeat(64) };
-  const current = { resources: { cpus: 7, memory_mib: 8192 }, runtime };
-  let deployment = { configuration: {}, metadata: {}, credential_configured: false, installation_id: "94be54a1-138c-4f30-bc87-b13686272dbe", provider: "docker", core_url: "https://core.example", reset: null, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 0, preparing: 0, failed: 0, update_required: 0, unknown: 0 } },
+test("edits only the saved backend, preserving a custom size", async ({ page, request }) => {
+  const current = { resources: { cpus: 7, memory_mib: 8192 } };
+  let deployment = { configuration: {}, metadata: {}, credential_configured: false, installation_id: "94be54a1-138c-4f30-bc87-b13686272dbe", provider: "docker", core_url: "https://core.example", reset: null, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 0, preparing: 0, failed: 0, unknown: 0 } },
     owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 0, pending: 0 }, specification: current, specification_digest: "e".repeat(64),
     suspension: null };
   let submitted: Record<string, unknown> | null = null;
@@ -327,7 +333,7 @@ test("edits only the saved backend, preserving a custom size and Runtime", async
   await expect(page.getByRole("button", { name: "E2B cloud" })).toHaveCount(0);
   await page.getByRole("button", { name: /^Current/ }).click();
   await page.getByRole("button", { name: "Save configuration" }).click();
-  await expect.poll(() => submitted).toMatchObject({ provider: "docker", expected_generation: 1, resources: current.resources, runtime });
+  await expect.poll(() => submitted).toMatchObject({ provider: "docker", expected_generation: 1, resources: current.resources });
   expect(submitted).not.toHaveProperty("core_url");
 });
 
@@ -351,9 +357,6 @@ test("keeps the page usable when Core refuses a sandbox change, and shows a safe
   const added = page.getByRole("dialog", { name: "Add node" });
   await expect(added).toBeVisible();
   await added.getByRole("button", { name: "Close dialog" }).click();
-  await page.getByRole("button", { name: "Settings", exact: true }).click();
-  await page.getByRole("button", { name: "Configuration details", exact: true }).click();
-  await expect(page.locator(".help-tip-popover").getByText("c0ffee000000", { exact: true })).toBeVisible();
 });
 
 test("renames a node and sets how many sandboxes run on it at once", async ({ page, request }) => {
@@ -365,7 +368,9 @@ test("renames a node and sets how many sandboxes run on it at once", async ({ pa
   await page.getByRole("row").filter({ hasText: "core-01" }).getByRole("button", { name: "Edit node" }).click();
   const edit = page.getByRole("dialog", { name: "Edit node" });
   await edit.getByLabel("Name").fill("core-01-large");
-  await edit.getByLabel("Sandboxes at once").fill("6");
+  await expect(edit).toContainText("Recommended: 6 at once.");
+  await edit.getByRole("button", { name: "Use recommended" }).click();
+  await expect(edit.getByLabel("Sandboxes at once")).toHaveValue("6");
   await edit.getByRole("button", { name: "Save" }).click();
   await expect(edit).toBeHidden();
   await expect(capacity).toContainText("core-01-large");
diff --git a/apps/web/e2e/sandbox-generation.spec.ts b/apps/web/e2e/sandbox-generation.spec.ts
index 5f6fd2aef..7f19b121a 100644
--- a/apps/web/e2e/sandbox-generation.spec.ts
+++ b/apps/web/e2e/sandbox-generation.spec.ts
@@ -105,22 +105,6 @@ test("online configuration retains existing resources and stops rapid polling wh
   expect(await writes(request)).toEqual([`PUT ${deploymentPath}`]);
 });
 
-test("a saved Runtime moves to the one this installation serves through the reviewed update", async ({ page, request }) => {
-  await openConsole(page, request, "settings?id=sandbox");
-  const served = await (await page.request.get(new URL("/node-install/manifest.json", page.url()).href)).json() as { source_commit: string; images: { runtime: string } };
-  const hex = (c: string) => c.repeat(64);
-  const saved = { source_commit: "a".repeat(40), image_id: `sha256:${hex("a")}`, image_manifest_digest: `sha256:${hex("b")}`, microsandbox_ref: `oac-runtime@sha256:${hex("c")}`, runtime_sha256: hex("d"), firmware_sha256: hex("e") };
-  await setDeployment(request, { specification: { resources: { cpus: 2, memory_mib: 4096 }, runtime: saved } });
-  await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
-  await expect(page.getByText(`Saved ${saved.source_commit.slice(0, 12)} · this installation serves ${served.source_commit.slice(0, 12)}`)).toBeVisible();
-  const use = page.getByRole("button", { name: "Use this installation's Runtime", exact: true });
-  await use.click();
-  const sent = await saveConfiguration(page);
-  expect(sent.input.runtime).toMatchObject({ source_commit: served.source_commit, image_id: served.images.runtime });
-  await expect(use).toHaveCount(0);
-  await inspectRollout(page, { "Core preparation": "Preparing configuration", "Target generation": "2" });
-});
-
 test("unknown target preparation preserves live old-generation service while an offline pin stays offline", async ({ page, request }, info) => {
   await page.setViewportSize({ width: 1280, height: 1000 });
   await page.emulateMedia({ colorScheme: "light", reducedMotion: "reduce" });
@@ -128,9 +112,9 @@ test("unknown target preparation preserves live old-generation service while an
   await setDeployment(request, { generation: 2 });
   await setNode(request, { id: "node-local", online: true, provider_ready: true, rollout: { state: "unknown", ready_generation: 1 } });
   await setNode(request, { id: "node-edge", online: false, provider_ready: true, rollout: { state: "unknown", ready_generation: 1 } });
-  await setNode(request, { id: "node-gpu", rollout: { state: "update_required", ready_generation: 1 } });
+  await setNode(request, { id: "node-gpu", rollout: { state: "failed", ready_generation: 1 } });
   await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
-  await inspectRollout(page, { "Node software incompatible": "1" });
+  await inspectRollout(page, { "Preparation failed": "1" });
   await page.getByRole("button", { name: "Nodes", exact: true }).click();
   const serving = page.getByRole("row", { name: /core-01/ });
   await expect(serving).toContainText("Available");
@@ -149,7 +133,7 @@ test("unknown target preparation preserves live old-generation service while an
   await expect(setup).toContainText("Done");
   await expect(rollout(page)).toHaveCount(0);
   await page.getByRole("button", { name: "Settings", exact: true }).click();
-  await inspectRollout(page, { "Target generation": "2", "Target readiness unknown": "2", "Node software incompatible": "1" });
+  await inspectRollout(page, { "Target generation": "2", "Target readiness unknown": "2", "Preparation failed": "1" });
   await capture(page, info, "generation-configuration-summary-en", rollout(page));
   expect(await writes(request)).toEqual([]);
 });
diff --git a/apps/web/e2e/sandbox-lifecycle.spec.ts b/apps/web/e2e/sandbox-lifecycle.spec.ts
index db98679e0..ffb53a7e7 100644
--- a/apps/web/e2e/sandbox-lifecycle.spec.ts
+++ b/apps/web/e2e/sandbox-lifecycle.spec.ts
@@ -7,7 +7,7 @@ test("shows each node's retained limit and elapsed phase time without inventing
   await page.route("**/core/v1/sandbox/deployment", async (route) => {
     const response = await route.fetch();
     const deployment = await response.json();
-    await route.fulfill({ response, json: { ...deployment, provider: "microsandbox", suspension: { idle_seconds: 300, retention_seconds: 86400 }, specification: { ...deployment.specification, resources: { ...deployment.specification.resources, root_disk_mib: 8192, environment_disk_mib: 8192 } } } });
+    await route.fulfill({ response, json: { ...deployment, provider: "microsandbox", suspension: { idle_seconds: 300, retention_seconds: 86400 }, specification: { ...deployment.specification, resources: { ...deployment.specification.resources, root_disk_mib: 8192 } } } });
   });
   await page.route("**/core/v1/sandbox/nodes", async (route) => {
     const response = await route.fetch();
@@ -50,7 +50,7 @@ test("edits deployment idle time without changing generation", async ({ page, re
   page.on("request", (sent) => { if (new URL(sent.url()).pathname.startsWith("/core/v1/sandbox/nodes")) nodeReads.push(sent.url()); });
   await openConsole(page, request, "settings?id=sandbox");
   const deployment = await setDeployment(request, { suspension: { idle_seconds: 300, retention_seconds: 86400 } });
-  await setDeployment(request, { provider: "microsandbox", specification: { ...deployment.specification!, resources: { ...deployment.specification!.resources, root_disk_mib: 8192, environment_disk_mib: 8192 } } });
+  await setDeployment(request, { provider: "microsandbox", specification: { ...deployment.specification!, resources: { ...deployment.specification!.resources, root_disk_mib: 8192 } } });
   await page.getByRole("button", { name: "Refresh sandbox state" }).click();
   const area = page.getByRole("region", { name: "Automatic suspension" });
   const idle = area.getByLabel("Idle before suspension (seconds)");
diff --git a/apps/web/e2e/sandbox-rollout-details.spec.ts b/apps/web/e2e/sandbox-rollout-details.spec.ts
index bf9618dd2..4695ac5ee 100644
--- a/apps/web/e2e/sandbox-rollout-details.spec.ts
+++ b/apps/web/e2e/sandbox-rollout-details.spec.ts
@@ -9,7 +9,7 @@ test("keeps rollout summary brief and opens all Core observations in details", a
   await page.route("**/core/v1/sandbox/deployment", async (route) => {
     const response = await route.fetch();
     const deployment = await response.json();
-    await route.fulfill({ response, json: { ...deployment, generation: 4, resources: { allocations: 8, pending: 0 }, rollout: { state: "settled", previous_generation_sandboxes: 8, nodes: { ready: 1, preparing: 0, failed: 2, update_required: 3, unknown: 4 } } } });
+    await route.fulfill({ response, json: { ...deployment, generation: 4, resources: { allocations: 8, pending: 0 }, rollout: { state: "settled", previous_generation_sandboxes: 8, nodes: { ready: 1, preparing: 0, failed: 2, unknown: 4 } } } });
   });
   await openConsole(page, request, "settings?id=sandbox");
   const summary = page.getByRole("region", { name: "Configuration rollout", exact: true });
@@ -23,7 +23,6 @@ test("keeps rollout summary brief and opens all Core observations in details", a
   await expect(fact(dialog, "Target generation")).toHaveText("4");
   await expect(fact(dialog, "Previous-generation sandboxes")).toHaveText("8");
   await expect(fact(dialog, "Preparation failed")).toHaveText("2");
-  await expect(fact(dialog, "Node software incompatible")).toHaveText("3");
   await expect(fact(dialog, "Target readiness unknown")).toHaveText("4");
   await page.keyboard.press("Escape");
   await expect(dialog).not.toBeVisible();
@@ -35,7 +34,7 @@ test("labels unknown target readiness without declaring settled nodes ready", as
   await page.route("**/core/v1/sandbox/deployment", async (route) => {
     const response = await route.fetch();
     const deployment = await response.json();
-    await route.fulfill({ response, json: { ...deployment, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 1 } } } });
+    await route.fulfill({ response, json: { ...deployment, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, unknown: 1 } } } });
   });
   await openConsole(page, request, "settings?id=sandbox");
   const summary = page.getByRole("region", { name: "Configuration rollout", exact: true });
diff --git a/apps/web/e2e/system.spec.ts b/apps/web/e2e/system.spec.ts
index 052e2eb98..cf4277fac 100644
--- a/apps/web/e2e/system.spec.ts
+++ b/apps/web/e2e/system.spec.ts
@@ -38,31 +38,18 @@ test("sets, replaces and clears a harness's default model configuration, and kee
   }
   expect(await writes(request)).toEqual([]);
   await set.getByLabel("Base URL").fill("https://model.example/v1");
-  await expect(set.getByLabel("Harness configuration (JSON)")).toBeHidden();
+  // Codex accepts no native Harness configuration.
   await set.getByText("Advanced settings", { exact: true }).click();
-  const config = set.getByLabel("Harness configuration (JSON)");
-  await config.fill("[]");
-  await config.blur();
-  await expect(set.getByText("Enter a valid JSON object, such as {}.")).toBeVisible();
-  await expect(set.getByRole("button", { name: "Save", exact: true })).toBeDisabled();
-  await config.fill('{"model_reasoning_effort":"high"}');
-  await set.getByRole("button", { name: "Format JSON" }).click();
-  await expect(config).toHaveValue('{\n  "model_reasoning_effort": "high"\n}');
-  // Limits are Core's 32-bit whole numbers, and max output needs a context window at least as large.
-  await set.getByLabel("Max output tokens").fill("32000");
-  await expect(set.getByText("Set a context window at least this large.")).toBeVisible();
-  await expect(set.getByLabel("Context window", { exact: true })).toHaveAttribute("aria-invalid", "true");
-  await expect(set.getByLabel("Context window", { exact: true })).toHaveAccessibleDescription(/Set a context window at least this large/);
-  await expect(set.getByLabel("Max output tokens", { exact: true })).not.toHaveAttribute("aria-invalid", "true");
-  await set.getByLabel("Context window", { exact: true }).fill("1000");
-  await expect(set.getByLabel("Context window", { exact: true })).toHaveAttribute("aria-invalid", "true");
+  await expect(set.getByLabel("Harness configuration (JSON)")).toHaveCount(0);
+  // Codex has no native output limit; limits are Core's 32-bit whole numbers.
+  await expect(set.getByLabel("Max output tokens")).toHaveCount(0);
   await set.getByLabel("Context window").fill("2147483648");
   await expect(set.getByText("Enter a whole number up to 2147483647.")).toBeVisible();
   await expect(set.getByRole("button", { name: "Save" })).toBeDisabled();
   await set.getByLabel("Context window").fill("200000");
   await set.getByRole("button", { name: "Save" }).click();
   await expect(set).toBeHidden();
-  for (const text of ["Ready", "OpenAI Responses", "https://model.example/v1", "Configured", "200,000", "32,000"]) await expect(codex).toContainText(text);
+  for (const text of ["Ready", "OpenAI Responses", "https://model.example/v1", "Configured", "200,000"]) await expect(codex).toContainText(text);
   expect(await page.content()).not.toContain(KEY);
 
   // Replacing starts from the saved fields but never from the key; closing the form forgets a typed key.
@@ -70,30 +57,19 @@ test("sets, replaces and clears a harness's default model configuration, and kee
   let replace = page.getByRole("dialog", { name: "Replace default model configuration for Codex" });
   await expect(replace.getByRole("combobox", { name: "Protocol", exact: true })).toHaveText("OpenAI Responses");
   await expect(replace.getByLabel("Default model ID")).toHaveValue("fixture-model");
-  await expect(replace.getByLabel("Harness configuration (JSON)")).toHaveValue(/model_reasoning_effort/);
   await expect(replace.getByLabel("Base URL")).toHaveValue("https://model.example/v1");
   await expect(replace.getByLabel("API key")).toHaveValue("");
   await expect(replace.getByRole("button", { name: "Save" })).toBeDisabled();
   await replace.getByLabel("API key").fill(KEY);
-  const nativeSettings = replace.getByLabel("Harness configuration (JSON)");
-  await expect(nativeSettings).toHaveValue(/model_reasoning_effort/);
-  await replace.getByLabel("Default model ID").fill("different-model");
-  await expect(nativeSettings).toHaveValue("{}");
-  await nativeSettings.fill('{"model_reasoning_effort":"low"}');
-  await replace.getByLabel("Base URL").fill("https://another-model.example/v1");
-  await expect(nativeSettings).toHaveValue("{}");
-  await nativeSettings.fill('{"model_reasoning_effort":"high"}');
   await replace.getByRole("button", { name: "Cancel" }).click();
   expect(await page.content()).not.toContain(KEY);
   await codex.getByRole("button", { name: "Replace the default model configuration for Codex" }).click();
   replace = page.getByRole("dialog", { name: "Replace default model configuration for Codex" });
   await expect(replace.getByRole("combobox", { name: "Protocol", exact: true })).toHaveText("OpenAI Responses");
   await expect(replace.getByLabel("Default model ID")).toHaveValue("fixture-model");
-  await expect(replace.getByLabel("Harness configuration (JSON)")).toHaveValue(/model_reasoning_effort/);
   await expect(replace.getByLabel("API key")).toHaveValue("");
   await replace.getByLabel("Base URL").fill("https://model.example/v2");
   await replace.getByLabel("API key").fill(KEY);
-  await expect(replace.getByLabel("Harness configuration (JSON)")).toHaveValue("{}");
   // Enter saves.
   await replace.getByLabel("API key").press("Enter");
   await expect(replace).toBeHidden();
@@ -106,7 +82,40 @@ test("sets, replaces and clears a harness's default model configuration, and kee
   await expect(confirm).toBeHidden();
   await expect(codex).toContainText("Model provider not set");
 
-  // MiniMax Code needs both limits; the form shows Core's reason. A disabled harness may still be configured.
+  // Claude Code accepts the native `thinking` configuration: invalid JSON blocks saving, and the values follow the model and URL they were set for.
+  await section.getByRole("article", { name: "Claude Code" }).getByRole("button", { name: "Set the default model configuration for Claude Code" }).click();
+  const claude = page.getByRole("dialog", { name: "Set default model configuration for Claude Code" });
+  await claude.getByRole("combobox", { name: "Protocol", exact: true }).click();
+  await page.getByRole("option", { name: "Anthropic Messages", exact: true }).click();
+  await claude.getByLabel("Base URL").fill("https://model.example/anthropic");
+  await claude.getByLabel("API key").fill(KEY);
+  await claude.getByLabel("Default model ID").fill("fixture-model");
+  await expect(claude.getByLabel("Harness configuration (JSON)")).toBeHidden();
+  await claude.getByText("Advanced settings", { exact: true }).click();
+  const config = claude.getByLabel("Harness configuration (JSON)");
+  await config.fill("[]");
+  await config.blur();
+  await expect(claude.getByText("Enter a valid JSON object, such as {}.")).toBeVisible();
+  await expect(claude.getByRole("button", { name: "Save", exact: true })).toBeDisabled();
+  await config.fill('{"thinking":{"type":"adaptive"}}');
+  await claude.getByRole("button", { name: "Format JSON" }).click();
+  await expect(config).toHaveValue('{\n  "thinking": {\n    "type": "adaptive"\n  }\n}');
+  await claude.getByRole("button", { name: "Save", exact: true }).click();
+  await expect(claude).toBeHidden();
+  await section.getByRole("article", { name: "Claude Code" }).getByRole("button", { name: "Replace the default model configuration for Claude Code" }).click();
+  const claudeReplace = page.getByRole("dialog", { name: "Replace default model configuration for Claude Code" });
+  const saved = claudeReplace.getByLabel("Harness configuration (JSON)");
+  await expect(saved).toHaveValue(/adaptive/);
+  await claudeReplace.getByLabel("API key").fill(KEY);
+  await claudeReplace.getByLabel("Default model ID").fill("different-model");
+  await expect(saved).toHaveValue("{}");
+  await saved.fill('{"thinking":{"type":"disabled"}}');
+  await claudeReplace.getByLabel("Base URL").fill("https://another-model.example/anthropic");
+  await expect(saved).toHaveValue("{}");
+  await claudeReplace.getByRole("button", { name: "Cancel" }).click();
+  expect(await page.content()).not.toContain(KEY);
+
+  // A disabled harness may still be configured; token limits are optional.
   await mcode.getByRole("button", { name: "Set the default model configuration for MiniMax Code" }).click();
   const limits = page.getByRole("dialog", { name: "Set default model configuration for MiniMax Code" });
   await expect(limits.getByRole("combobox", { name: "Protocol", exact: true })).toHaveText("Anthropic Messages");
@@ -116,7 +125,16 @@ test("sets, replaces and clears a harness's default model configuration, and kee
   await limits.getByLabel("Base URL").fill("https://model.example/anthropic");
   await limits.getByLabel("API key").fill(KEY);
   await limits.getByLabel("Default model ID").fill("fixture-model");
-  await expect(limits.getByRole("button", { name: "Save" })).toBeDisabled();
+  // Max output alone is valid and must fit a set context window.
+  await limits.getByText("Advanced settings", { exact: true }).click();
+  await limits.getByLabel("Max output tokens").fill("32000");
+  await expect(limits.getByLabel("Context window", { exact: true })).not.toHaveAttribute("aria-invalid", "true");
+  await limits.getByLabel("Context window", { exact: true }).fill("1000");
+  await expect(limits.getByText("Set a context window at least this large.")).toBeVisible();
+  await expect(limits.getByLabel("Context window", { exact: true })).toHaveAccessibleDescription(/Set a context window at least this large/);
+  await expect(limits.getByLabel("Max output tokens", { exact: true })).not.toHaveAttribute("aria-invalid", "true");
+  await limits.getByLabel("Context window", { exact: true }).fill("");
+  await expect(limits.getByRole("button", { name: "Save" })).toBeEnabled();
   await limits.getByRole("button", { name: "Cancel" }).click();
   await expect(mcode).toContainText("Not set");
 
@@ -124,6 +142,7 @@ test("sets, replaces and clears a harness's default model configuration, and kee
     "PUT /core/v1/harnesses/codex/model-configuration",
     "PUT /core/v1/harnesses/codex/model-configuration",
     "DELETE /core/v1/harnesses/codex/model-configuration",
+    "PUT /core/v1/harnesses/claude_sdk/model-configuration",
   ]);
   const browserState = await page.evaluate(() => JSON.stringify({ local: { ...localStorage }, session: { ...sessionStorage }, url: location.href, cookie: document.cookie }));
   expect(browserState).not.toContain(KEY);
@@ -154,7 +173,6 @@ test("requires an explicit supported protocol choice for an older default config
     const data = await response.json();
     const codex = data.data.find((harness: { id: string }) => harness.id === "codex");
     codex.model_configuration.model_provider.protocol = "chat_completions";
-    codex.model_configuration.harness_config = { model_reasoning_effort: "high" };
     await route.fulfill({ response, json: data });
   });
   await openConsole(page, request, "settings?id=models");
@@ -173,7 +191,7 @@ test("requires an explicit supported protocol choice for an older default config
   await expect(page.getByRole("option")).toHaveText(["OpenAI Responses"]);
   await page.getByRole("option", { name: "OpenAI Responses", exact: true }).click();
   await expect(dialog.getByRole("alert")).toHaveCount(0);
-  await expect(dialog.getByLabel("Harness configuration (JSON)")).toHaveValue("{}");
+  await expect(dialog.getByLabel("Harness configuration (JSON)")).toHaveCount(0);
   await expect(dialog.getByRole("button", { name: "Save", exact: true })).toBeEnabled();
   expect(await writes(request)).toEqual([]);
 });
diff --git a/apps/web/public/onboarding/monitor-en.webp b/apps/web/public/onboarding/monitor-en.webp
index 70aab640b..61873b45a 100644
Binary files a/apps/web/public/onboarding/monitor-en.webp and b/apps/web/public/onboarding/monitor-en.webp differ
diff --git a/apps/web/public/onboarding/monitor-zh.webp b/apps/web/public/onboarding/monitor-zh.webp
index 0d223ac70..ea98ed16f 100644
Binary files a/apps/web/public/onboarding/monitor-zh.webp and b/apps/web/public/onboarding/monitor-zh.webp differ
diff --git a/apps/web/public/onboarding/platform-en.webp b/apps/web/public/onboarding/platform-en.webp
index 490cf5e87..ce208ca41 100644
Binary files a/apps/web/public/onboarding/platform-en.webp and b/apps/web/public/onboarding/platform-en.webp differ
diff --git a/apps/web/public/onboarding/platform-zh.webp b/apps/web/public/onboarding/platform-zh.webp
index d77f29b8a..92b25e43c 100644
Binary files a/apps/web/public/onboarding/platform-zh.webp and b/apps/web/public/onboarding/platform-zh.webp differ
diff --git a/apps/web/public/onboarding/resources-en.webp b/apps/web/public/onboarding/resources-en.webp
index 3660c2922..c4e9c9a17 100644
Binary files a/apps/web/public/onboarding/resources-en.webp and b/apps/web/public/onboarding/resources-en.webp differ
diff --git a/apps/web/public/onboarding/resources-zh.webp b/apps/web/public/onboarding/resources-zh.webp
index de269a8ee..0e17ec4a5 100644
Binary files a/apps/web/public/onboarding/resources-zh.webp and b/apps/web/public/onboarding/resources-zh.webp differ
diff --git a/apps/web/src/features/environment-templates/TemplateDetail.tsx b/apps/web/src/features/environment-templates/TemplateDetail.tsx
index b7bcaf7a7..0f0538e07 100644
--- a/apps/web/src/features/environment-templates/TemplateDetail.tsx
+++ b/apps/web/src/features/environment-templates/TemplateDetail.tsx
@@ -9,7 +9,7 @@ import type {
   EnvironmentTemplateSkill,
 } from "@oac/agents-client";
 
-import { PageBody, PageHeader, RefreshButton, Section, StatusDot } from "../../components/console-ui";
+import { HelpTip, PageBody, PageHeader, RefreshButton, Section, StatusDot } from "../../components/console-ui";
 import { formatBytes, formatDateTime, MISSING } from "../../lib/format";
 import { CopyableId, CopyIdButton } from "../../components/list-ui";
 import { templateName } from "./template-name";
@@ -169,12 +169,12 @@ export function TemplateDetailPage({
           <div><dt>{t("detail.updated")}</dt><dd>{formatDateTime(template.updated_at, locale)}</dd></div>
           <div>
             <dt>{t("detail.network")}</dt>
-            <dd>{network ? t(`access.${network.access}`) : <StatusDot tone="warning" label={t("unrecognizedValue")} />}</dd>
+            <dd>{network ? <>{t(`access.${network.access}`)}{network.access !== "enabled" ? <HelpTip>{t("accessHelp")}</HelpTip> : null}</> : <StatusDot tone="warning" label={t("unrecognizedValue")} />}</dd>
           </div>
         </dl>
 
         {network?.access === "restricted" ? (
-          <Section headingId="template-domains-heading" title={<>{t("detail.allowedDomains")} <Count value={network.allowed_domains.length} /></>} help={t("accessHelp.restricted")}>
+          <Section headingId="template-domains-heading" title={<>{t("detail.allowedDomains")} <Count value={network.allowed_domains.length} /></>}>
             <Values values={network.allowed_domains} />
           </Section>
         ) : null}
diff --git a/apps/web/src/features/fleet/SandboxResetNotice.test.tsx b/apps/web/src/features/fleet/SandboxResetNotice.test.tsx
index 427c1c816..0cb7598a1 100644
--- a/apps/web/src/features/fleet/SandboxResetNotice.test.tsx
+++ b/apps/web/src/features/fleet/SandboxResetNotice.test.tsx
@@ -6,7 +6,7 @@ import { SandboxResetNotice } from "./SandboxResetNotice";
 
 const reset: SandboxReset = { clear: "auto", requested_at: "2026-09-27T10:00:00Z", deadline_at: "2026-09-27T11:00:00Z", forced_at: null,
   remaining: { busy: 1, idle: 0, cleanup: 2, on_offline_nodes: 1, offline_nodes: [{ node_id: "n1", name: "Node 1", resources: 1 }] } };
-const deployment = (reset: SandboxReset | null): SandboxDeployment => ({ credential_configured: false, configuration: {}, metadata: {}, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "http://core", reset, owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 3, pending: 0 }, suspension: null });
+const deployment = (reset: SandboxReset | null): SandboxDeployment => ({ credential_configured: false, configuration: {}, metadata: {}, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "http://core", reset, owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 3, pending: 0 }, suspension: null });
 const render = (value: SandboxDeployment | undefined, failed = false) => renderToStaticMarkup(<SandboxResetNotice deployment={value} failed={failed} onRetry={() => {}} />);
 
 describe("reset notices on read-only surfaces", () => {
diff --git a/apps/web/src/features/fleet/fleet-model.test.ts b/apps/web/src/features/fleet/fleet-model.test.ts
index c8de45dbc..700ea2250 100644
--- a/apps/web/src/features/fleet/fleet-model.test.ts
+++ b/apps/web/src/features/fleet/fleet-model.test.ts
@@ -15,7 +15,7 @@ describe("fleet model", () => {
 
   it("classifies node health", () => {
     expect(nodeHealth(node("a"))).toBe("available");
-    expect(nodeHealth(node("a", { diagnostic: "provider_unavailable" }))).toBe("degraded");
+    expect(nodeHealth(node("a", { provider_ready: false }))).toBe("degraded");
     expect(nodeHealth(node("a", { online: false }))).toBe("offline");
   });
 
diff --git a/apps/web/src/features/fleet/fleet-model.ts b/apps/web/src/features/fleet/fleet-model.ts
index 48cd3a1c6..cbbdbc1bf 100644
--- a/apps/web/src/features/fleet/fleet-model.ts
+++ b/apps/web/src/features/fleet/fleet-model.ts
@@ -10,7 +10,7 @@ export type NodeHealth = "available" | "degraded" | "offline";
 
 export function nodeHealth(node: SandboxNode): NodeHealth {
   if (!node.online) return "offline";
-  return node.provider_ready && !node.diagnostic ? "available" : "degraded";
+  return node.provider_ready ? "available" : "degraded";
 }
 
 /** Live provider evidence is independent of target preparation and durable serving pins. */
diff --git a/apps/web/src/features/fleet/fleet-queries.test.ts b/apps/web/src/features/fleet/fleet-queries.test.ts
index 963af5991..e0eb11cc1 100644
--- a/apps/web/src/features/fleet/fleet-queries.test.ts
+++ b/apps/web/src/features/fleet/fleet-queries.test.ts
@@ -5,7 +5,7 @@ import { afterEach, describe, expect, it, vi } from "vitest";
 import { sandboxAdmin, sandboxDeploymentQuery, sandboxScope } from "../sandbox/sandbox-queries";
 import { fleetQuery } from "./fleet-queries";
 
-const deployment: SandboxDeployment = { credential_configured: false, configuration: {}, metadata: {}, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "http://core", owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 1, pending: 0 }, suspension: null,
+const deployment: SandboxDeployment = { credential_configured: false, configuration: {}, metadata: {}, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "http://core", owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 1, pending: 0 }, suspension: null,
   reset: { clear: "auto", requested_at: "2026-09-27T10:00:00Z", deadline_at: "2026-09-27T11:00:00Z", forced_at: null, remaining: { busy: 1, idle: 0, cleanup: 0, on_offline_nodes: 0, offline_nodes: [] } } };
 
 afterEach(() => { vi.restoreAllMocks(); vi.unstubAllGlobals(); });
diff --git a/apps/web/src/features/fleet/use-sandbox-fleet.test.tsx b/apps/web/src/features/fleet/use-sandbox-fleet.test.tsx
index c97c61b5e..756ae7660 100644
--- a/apps/web/src/features/fleet/use-sandbox-fleet.test.tsx
+++ b/apps/web/src/features/fleet/use-sandbox-fleet.test.tsx
@@ -10,7 +10,7 @@ import { fleetQuery, type FleetSnapshot } from "./fleet-queries";
 import { FleetReadNotice } from "./FleetReadNotice";
 import { fleetSnapshot, useSandboxFleet } from "./use-sandbox-fleet";
 
-const configured: SandboxDeployment = { credential_configured: false, configuration: {}, metadata: {}, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "http://core", reset: null, owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 1, pending: 0 }, suspension: null };
+const configured: SandboxDeployment = { credential_configured: false, configuration: {}, metadata: {}, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "http://core", reset: null, owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 1, pending: 0 }, suspension: null };
 
 function Probe() {
   const { state, deployment } = useSandboxFleet();
@@ -51,7 +51,7 @@ describe("fleet evidence after deployment changes", () => {
   });
 
   it("retains older resource evidence across an online generation change with an explicit qualification", () => {
-    const html = render({ ...configured, generation: 2, rollout: { state: "preparing", previous_generation_sandboxes: 1, nodes: { ready: 0, preparing: 1, failed: 0, update_required: 0, unknown: 0 } } });
+    const html = render({ ...configured, generation: 2, rollout: { state: "preparing", previous_generation_sandboxes: 1, nodes: { ready: 0, preparing: 1, failed: 0, unknown: 0 } } });
     expect(html).toContain('data-fleet="ready"');
     expect(html).toContain("1 nodes / 1 allocations");
     expect(html).toContain("configuration generation 1; the current target is 2");
diff --git a/apps/web/src/features/metrics/CoreMetricsPage.tsx b/apps/web/src/features/metrics/CoreMetricsPage.tsx
index 2fc0a9297..b0232180e 100644
--- a/apps/web/src/features/metrics/CoreMetricsPage.tsx
+++ b/apps/web/src/features/metrics/CoreMetricsPage.tsx
@@ -1,6 +1,5 @@
-import { AgentCoreError, type CoreJobStatus, type CoreMetrics, type CoreMetricsRange } from "@oac/agents-client";
+import { type CoreJobStatus, type CoreMetrics, type CoreMetricsRange } from "@oac/agents-client";
 import { keepPreviousData, useQuery } from "@tanstack/react-query";
-import { Network } from "lucide-react";
 import { useMemo, useState, type ReactNode } from "react";
 import { useTranslation } from "react-i18next";
 
@@ -55,17 +54,14 @@ export function CoreMetricsPage() {
   const [range, setRange] = useState<CoreMetricsRange>("1h");
   const query = useQuery({ ...coreMetricsQuery(range), placeholderData: keepPreviousData, refetchInterval: REFRESH_MS, refetchIntervalInBackground: false });
   const metrics = query.data ?? null;
-  const missing = query.error instanceof AgentCoreError && (query.error.status === 404 || query.error.status === 501);
   const error = query.isError ? coreError(query.error, tCommon) : "";
   useFailureToast(metrics !== null && query.isError, t("core.stale", { reason: error }), "core-metrics-refresh");
 
   let body: ReactNode;
   if (!metrics) {
-    body = missing
-      ? <EmptyState icon={Network} title={t("core.missingTitle")} hint={t("core.missingDescription")} />
-      : query.isError
-        ? <p className="page-status" role="alert">{t("core.failed", { reason: error })}</p>
-        : <DashboardSkeleton label={t("core.loading")} figures={5} />;
+    body = query.isError
+      ? <p className="page-status" role="alert">{t("core.failed", { reason: error })}</p>
+      : <DashboardSkeleton label={t("core.loading")} figures={5} />;
   } else {
     body = <CoreMetricsBody metrics={metrics} />;
   }
diff --git a/apps/web/src/features/overview/getting-started.test.ts b/apps/web/src/features/overview/getting-started.test.ts
index 97249ca59..3952215bf 100644
--- a/apps/web/src/features/overview/getting-started.test.ts
+++ b/apps/web/src/features/overview/getting-started.test.ts
@@ -6,17 +6,17 @@ import { checklistStorageKey, checklistView, gettingStartedSteps, nextStepAfterN
 import { node, project } from "./test-fixtures";
 
 const deployment = (overrides: Partial<SandboxDeployment> = {}): SandboxDeployment => ({ credential_configured: false, configuration: {}, metadata: {},
-  rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "http://core", reset: null, owner_epoch: 1, generation: 1, mode: "nodes",
+  rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "http://core", reset: null, owner_epoch: 1, generation: 1, mode: "nodes",
   resources: { allocations: 0, pending: 0 }, suspension: null, ...overrides,
 });
 const fleet = (value: SandboxDeployment, nodes = [node("n1")]): FleetState => ({ status: "ready", snapshot: { deployment: value, nodes, allocations: [], loadedAt: 0 }, targetGeneration: value.generation, refreshing: false, error: null });
 const sandboxes = (state: FleetState) => gettingStartedSteps({ sandboxReset: false, fleet: state, localOnly: false, projects: [], sessions: 0, harnesses: [] }).sandboxes;
 const provider = { object: "core.model_configuration", model: "fixture-model", harness_config: {}, model_provider: { protocol: "responses", base_url: "https://model.example/v1", api_key_configured: true }, last_used_at: null, last_error_code: null, last_error_at: null, updated_at: "2026-09-25T00:00:00Z" } as const;
-const harness = (id: CoreHarness["id"], fields: Partial<CoreHarness> = {}): CoreHarness => ({ object: "core.harness", model_configuration_support: { protocols: ["responses"], accepts_harness_config: true, token_limits_required: false }, id, enabled: true, default: false, model_configuration: null, ...fields });
+const harness = (id: CoreHarness["id"], fields: Partial<CoreHarness> = {}): CoreHarness => ({ object: "core.harness", model_configuration_support: { protocols: ["responses"], accepts_harness_config: true, accepts_max_output_tokens: false }, id, enabled: true, default: false, model_configuration: null, ...fields });
 
 describe("Getting started steps", () => {
   it("uses live provider readiness independently of target state or a durable pin", () => {
-    for (const state of ["preparing", "failed", "update_required", "unknown"] as const) {
+    for (const state of ["preparing", "failed", "unknown"] as const) {
       const serving = node("n1", { rollout: { state, ready_generation: 1 } });
       expect(sandboxes(fleet(deployment({ generation: 2 }), [serving])).state).toBe("done");
       expect(sandboxes(fleet(deployment({ generation: 2 }), [{ ...serving, provider_ready: false }])).state).toBe("todo");
diff --git a/apps/web/src/features/overview/test-fixtures.ts b/apps/web/src/features/overview/test-fixtures.ts
index e11dfcea3..135f60cae 100644
--- a/apps/web/src/features/overview/test-fixtures.ts
+++ b/apps/web/src/features/overview/test-fixtures.ts
@@ -39,7 +39,7 @@ export function node(id: string, overrides: Partial<SandboxNode> = {}): SandboxN
     rollout: { state: overrides.online === false ? "unknown" : "ready", ready_generation: 1 },
     cpu_count: 8, available_memory_bytes: 1024, available_disk_bytes: 2048,
     running: 1, snapshots: 0, last_seen_at: "2026-09-24T00:00:00Z",
-    max_active: 4, max_retained: 8, active: 1, reserved: 0, retained: 0, cleanup_pending: 0,
+    max_active: 4, max_retained: 8, recommended_capacity: null, active: 1, reserved: 0, retained: 0, cleanup_pending: 0,
     created_at: "2026-09-01T00:00:00Z", core_url: "https://core.example", enrollment_id: null,
     ...overrides,
   };
diff --git a/apps/web/src/features/sandbox/NodeCapacityFields.tsx b/apps/web/src/features/sandbox/NodeCapacityFields.tsx
index 67b21e05f..24e100866 100644
--- a/apps/web/src/features/sandbox/NodeCapacityFields.tsx
+++ b/apps/web/src/features/sandbox/NodeCapacityFields.tsx
@@ -1,4 +1,3 @@
-import type { ReactNode } from "react";
 import { useTranslation } from "react-i18next";
 import { HelpTip } from "../../components/console-ui";
 
@@ -11,14 +10,14 @@ export function nodeCapacity(active: string, retained: string) {
     retainedError: !valid(maxRetained) ? "Enter a whole number from 1 to 1,000,000." as const : valid(maxActive) && maxRetained < maxActive ? "Enter at least the number of sandboxes at once." as const : null };
 }
 
-export function NodeCapacityFields({ id, active, retained, suspends, activeError, retainedError, onActive, onRetained, autoFocus, help }: {
+export function NodeCapacityFields({ id, active, retained, suspends, activeError, retainedError, onActive, onRetained, autoFocus }: {
   id: string; active: string; retained: string; suspends: boolean; activeError: string | null; retainedError: string | null;
-  onActive: (value: string) => void; onRetained: (value: string) => void; autoFocus?: boolean; help?: ReactNode;
+  onActive: (value: string) => void; onRetained: (value: string) => void; autoFocus?: boolean;
 }) {
   const { t } = useTranslation("sandbox");
   return <>
     <div className="field">
-      <span className="field-label-row"><label htmlFor={`${id}-active`}>{t("Sandboxes at once")}</label><HelpTip>{t("The most sandboxes Core places on this node at the same time.")}{help}</HelpTip></span>
+      <span className="field-label-row"><label htmlFor={`${id}-active`}>{t("Sandboxes at once")}</label><HelpTip>{t("The most sandboxes Core places on this node at the same time.")}</HelpTip></span>
       <input id={`${id}-active`} inputMode="numeric" autoComplete="off" autoFocus={autoFocus} value={active} onChange={(event) => onActive(event.target.value)} aria-invalid={Boolean(activeError)} aria-errormessage={activeError ? `${id}-active-error` : undefined} />
       {activeError ? <span id={`${id}-active-error`} className="field-error">{activeError}</span> : null}
     </div>
diff --git a/apps/web/src/features/sandbox/NodeEditDialog.tsx b/apps/web/src/features/sandbox/NodeEditDialog.tsx
index 554bbb41c..7768dbad2 100644
--- a/apps/web/src/features/sandbox/NodeEditDialog.tsx
+++ b/apps/web/src/features/sandbox/NodeEditDialog.tsx
@@ -1,29 +1,22 @@
 import { useId, useState } from "react";
-import type { SandboxAdminClient, SandboxNode, SandboxResources } from "@oac/agents-client";
-import { useQuery } from "@tanstack/react-query";
+import type { SandboxAdminClient, SandboxNode } from "@oac/agents-client";
 import { useTranslation } from "react-i18next";
 
 import { nodeCapacity, NodeCapacityFields } from "./NodeCapacityFields";
 import { Modal } from "../../components/Modal";
 import { coreFieldError } from "../../lib/core-error";
-import { formatBytes } from "../../lib/format";
 import { sandboxRequestError } from "../../lib/sandbox-labels";
-import { nodeDetailQuery } from "../fleet/fleet-queries";
-import { sandboxesThatFit } from "./deployment-specification";
 
 /**
  * A node's name and sandbox limits (`PATCH /core/v1/sandbox/nodes/{id}`). Core
  * takes all three together. Only a deployment whose Provider suspends sandboxes
  * shows the retained limit; otherwise the saved one is kept, raised to at least
- * the active limit because Core requires it. Under the limit, the host's CPUs
- * and memory from the node's last heartbeat, each sandbox's size and how many
- * of those the host holds.
+ * the active limit because Core requires it. Beneath the fields, Core's
+ * recommendation for the node's host, which one action fills in.
  */
-export function NodeEditDialog({ client, node, size, suspends, onClose, onSaved }: {
+export function NodeEditDialog({ client, node, suspends, onClose, onSaved }: {
   client: SandboxAdminClient;
   node: SandboxNode | null;
-  /** Each sandbox's CPUs and memory, from the deployment. */
-  size: SandboxResources | null;
   /** Whether the deployment's Provider suspends sandboxes, which its suspension policy declares. */
   suspends: boolean;
   onClose: () => void;
@@ -34,8 +27,8 @@ export function NodeEditDialog({ client, node, size, suspends, onClose, onSaved
   const { t: tCommon } = useTranslation("common");
   const id = useId();
   const [name, setName] = useState(node?.name ?? "");
-  const [active, setActive] = useState(String(node?.max_active ?? 2));
-  const [retained, setRetained] = useState(String(node?.max_retained ?? 8));
+  const [active, setActive] = useState(String(node?.max_active ?? ""));
+  const [retained, setRetained] = useState(String(node?.max_retained ?? ""));
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<unknown>(null);
   const limits = nodeCapacity(active, suspends ? retained : String(Math.max(node?.max_retained ?? 0, Number(active) || 0)));
@@ -48,19 +41,7 @@ export function NodeEditDialog({ client, node, size, suspends, onClose, onSaved
   const activeError = coreFieldError(error, "max_active", tCommon) ?? activeProblem;
   const retainedError = coreFieldError(error, "max_retained", tCommon) ?? retainedProblem;
   const ready = node !== null && !nameProblem && !activeProblem && !retainedProblem && !busy;
-  // The node detail read adds the host's total memory to its CPU count.
-  const detail = useQuery({ ...nodeDetailQuery(node?.id ?? "", "1h"), enabled: node !== null });
-  const host = detail.data?.id === node?.id ? detail.data?.host : undefined;
-  const hostCpus = host?.effective_cpu_cores ?? node?.cpu_count ?? null;
-  const hostMemory = host?.total_memory_bytes ?? null;
-  const fit = sandboxesThatFit({ cpus: hostCpus, memoryBytes: hostMemory }, size);
-  const measure = (cpus: number, memory: number) => t("{{cpus}} CPU · {{memory}}", { cpus, memory: formatBytes(memory) });
-  // Sentences run on with a space in English and without one in Chinese.
-  const hostFacts = hostCpus !== null && hostMemory !== null ? [
-    t("Host: {{host}}.", { host: measure(hostCpus, hostMemory) }),
-    ...(size ? [t("Each sandbox: {{size}}.", { size: measure(size.cpus, size.memory_mib * 2 ** 20) })] : []),
-    ...(fit !== null && fit > 0 ? [t("Suggested: at most {{count}} at once.", { count: fit })] : []),
-  ].join(locale === "zh-CN" ? "" : " ") : null;
+  const recommended = node?.recommended_capacity ?? null;
 
   async function save() {
     if (!ready || !node) return;
@@ -92,7 +73,11 @@ export function NodeEditDialog({ client, node, size, suspends, onClose, onSaved
           <input id={`${id}-name`} value={name} onChange={(event) => { setName(event.target.value); setError(null); }} autoComplete="off" aria-invalid={Boolean(nameError)} aria-describedby={nameError ? `${id}-name-error` : undefined} />
           {nameError ? <span id={`${id}-name-error`} className="field-error">{nameError}</span> : null}
         </label>
-        <NodeCapacityFields id={id} active={active} retained={retained} suspends={suspends} activeError={activeError} retainedError={retainedError} help={hostFacts ? <> {hostFacts}</> : null} onActive={(value) => { setActive(value); setError(null); }} onRetained={(value) => { setRetained(value); setError(null); }} />
+        <NodeCapacityFields id={id} active={active} retained={retained} suspends={suspends} activeError={activeError} retainedError={retainedError} onActive={(value) => { setActive(value); setError(null); }} onRetained={(value) => { setRetained(value); setError(null); }} />
+        {recommended ? <p>
+          {suspends ? t("Recommended: {{active}} at once, {{retained}} retained.", { active: recommended.max_active, retained: recommended.max_retained }) : t("Recommended: {{active}} at once.", { active: recommended.max_active })}{" "}
+          <button className="text-action" type="button" onClick={() => { setActive(String(recommended.max_active)); setRetained(String(recommended.max_retained)); setError(null); }}>{t("Use recommended")}</button>
+        </p> : null}
         {error !== null ? <p className="confirm-dialog-error" role="alert">{sandboxRequestError(error, locale)}</p> : null}
       </form>
     </Modal>
diff --git a/apps/web/src/features/sandbox/NodeEnrollment.tsx b/apps/web/src/features/sandbox/NodeEnrollment.tsx
index 164a65e2b..3b46d2d83 100644
--- a/apps/web/src/features/sandbox/NodeEnrollment.tsx
+++ b/apps/web/src/features/sandbox/NodeEnrollment.tsx
@@ -4,7 +4,7 @@ import { useCallback, useEffect, useId, useRef, useState } from "react";
 import type { SandboxAdminClient, SandboxDeployment, SandboxEnrollment, SandboxNode } from "@oac/agents-client";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useTranslation } from "react-i18next";
-import { HelpTip, StatusDot, type Tone } from "../../components/console-ui";
+import { HelpTip, SegmentedControl, StatusDot, type Tone } from "../../components/console-ui";
 import { Modal } from "../../components/Modal";
 import { coreFieldError } from "../../lib/core-error";
 import { formatBytes } from "../../lib/format";
@@ -30,13 +30,10 @@ function rememberRequirementsSeen() {
   try { window.localStorage.setItem(REQUIREMENTS_SEEN, "1"); } catch { /* Storage can be unavailable; the list then opens each time. */ }
 }
 
-/** The limits a new flow starts from. */
-const DEFAULT_ACTIVE = "2";
-const DEFAULT_RETAINED = "8";
-
 /**
- * Add node: the administrator sets the node's sandbox limits, then Core issues a
- * one-time enrollment command that approves them
+ * Add node: the administrator keeps the recommended limits, which Core derives
+ * from the host when the node registers, or enters both numbers; then Core
+ * issues a one-time enrollment command
  * (`POST /core/v1/sandbox/enrollment-tokens`). Only a deployment with a
  * suspension policy, which its Provider's checkpoint support declares, asks for
  * a retained limit; otherwise a node retains exactly the sandboxes it runs at
@@ -73,8 +70,9 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   const locale = i18n.resolvedLanguage?.startsWith("zh") ? "zh-CN" : "en";
   const { t: tCommon } = useTranslation("common");
   const id = useId();
-  const [active, setActive] = useState(DEFAULT_ACTIVE);
-  const [retained, setRetained] = useState(DEFAULT_RETAINED);
+  const [custom, setCustom] = useState(false);
+  const [active, setActive] = useState("");
+  const [retained, setRetained] = useState("");
   const [busy, setBusy] = useState(false);
   const [enrollment, setEnrollment] = useState<SandboxEnrollment | null>(null);
   const [appeared, setAppeared] = useState<{ id: string; at: number } | null>(null);
@@ -116,9 +114,10 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   const retainedLimit = limits.retained;
   const activeProblem = limits.activeError ? t(limits.activeError) : null;
   const retainedProblem = suspends && limits.retainedError ? t(limits.retainedError) : null;
-  const activeError = coreFieldError(error, "max_active", tCommon) ?? activeProblem;
-  const retainedError = coreFieldError(error, "max_retained", tCommon) ?? retainedProblem;
-  const limitsReady = !activeProblem && !retainedProblem;
+  // An empty field is not an error yet; it only keeps Generate command off.
+  const activeError = coreFieldError(error, "max_active", tCommon) ?? (active.trim() ? activeProblem : null);
+  const retainedError = coreFieldError(error, "max_retained", tCommon) ?? (retained.trim() ? retainedProblem : null);
+  const limitsReady = !custom || (!activeProblem && !retainedProblem);
   const node = enrollment ? enrolledNode(nodes, enrollment) : null;
   const progress = enrollmentProgress(node, node && appeared?.id === node.id ? appeared.at : undefined, now);
   // Registration uses the token, so from then on its expiry no longer matters; rerunning
@@ -188,7 +187,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
     // A connected node ends the command; otherwise it waits here for the next opening.
     if (ready) { setEnrollment(null); setAppeared(null); }
     // The limits, and which command was copied, stay only with an unfinished flow: a command still waiting for its node.
-    if (!enrollment || ready) { setActive(DEFAULT_ACTIVE); setRetained(DEFAULT_RETAINED); }
+    if (!enrollment || ready) { setCustom(false); setActive(""); setRetained(""); }
     onClose();
   }
   /**
@@ -201,8 +200,8 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
     setEnrollment(null); setAppeared(null); setError(null);
   }
   async function generate() {
-    if (request.current || !fresh || !available || blocker || !limitsReady || activeLimit === null || retainedLimit === null) return;
-    const capacity = { max_active: activeLimit, max_retained: retainedLimit };
+    if (request.current || !fresh || !available || blocker || !limitsReady) return;
+    const capacity = custom ? { max_active: activeLimit!, max_retained: retainedLimit! } : {};
     generation.current++;
     const controller = new AbortController(); request.current = controller;
     setBusy(true); setError(null);
@@ -270,8 +269,8 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
         : <p role="status">{blocker.text}</p>
       : !enrollment ? (
         <form id={limitsForm} className="form-stack" onSubmit={(event) => { event.preventDefault(); void generate(); }}>
-          <p>{t("Set the sandbox limits for the host you want to add.")}</p>
-          <NodeCapacityFields id={id} active={active} retained={retained} suspends={suspends} activeError={activeError} retainedError={retainedError} autoFocus={open} onActive={(value) => { setActive(value); setError(null); }} onRetained={(value) => { setRetained(value); setError(null); }} />
+          <SegmentedControl label={t("Limits")} value={custom ? "custom" : "recommended"} options={[{ value: "recommended", label: t("Recommended") }, { value: "custom", label: t("Custom") }]} onChange={(value) => { setCustom(value === "custom"); setError(null); }} />
+          {custom ? <NodeCapacityFields id={id} active={active} retained={retained} suspends={suspends} activeError={activeError} retainedError={retainedError} autoFocus={open} onActive={(value) => { setActive(value); setError(null); }} onRetained={(value) => { setRetained(value); setError(null); }} /> : null}
           {error !== null ? <p role="alert" className="sandbox-error">{sandboxRequestError(error, locale)}</p> : null}
           {requirements}
         </form>
diff --git a/apps/web/src/features/sandbox/NodeList.test.ts b/apps/web/src/features/sandbox/NodeList.test.ts
index d90258500..5aa689af4 100644
--- a/apps/web/src/features/sandbox/NodeList.test.ts
+++ b/apps/web/src/features/sandbox/NodeList.test.ts
@@ -10,7 +10,7 @@ const core = "https://core.example";
 
 describe("node state", () => {
   it("keeps live serving health independent of target preparation and durable pins", () => {
-    for (const state of ["unknown", "preparing", "failed", "update_required"] as const) {
+    for (const state of ["unknown", "preparing", "failed"] as const) {
       const serving = node("a", { online: true, provider_ready: true, rollout: { state, ready_generation: 1 } });
       expect(nodeState(serving, [], false, core)).toBe("available");
       expect(nodeState({ ...serving, online: false }, [], false, core)).toBe("offline");
diff --git a/apps/web/src/features/sandbox/NodeRolloutStatus.tsx b/apps/web/src/features/sandbox/NodeRolloutStatus.tsx
index 4e41978a8..02205b850 100644
--- a/apps/web/src/features/sandbox/NodeRolloutStatus.tsx
+++ b/apps/web/src/features/sandbox/NodeRolloutStatus.tsx
@@ -1,11 +1,11 @@
 import type { SandboxNode, SandboxNodeRollout } from "@oac/agents-client";
 import { useTranslation } from "react-i18next";
-import { HelpTip, StatusDot, type Tone } from "../../components/console-ui";
+import { StatusDot, type Tone } from "../../components/console-ui";
 import type { ParseKeys } from "i18next";
 import { DiagnosticTip } from "../fleet/DiagnosticTip";
 
-const labels: Record<SandboxNodeRollout["state"], ParseKeys<"sandbox">> = { ready: "Ready for target", preparing: "Preparing target", failed: "Preparation failed", update_required: "Node software incompatible", unknown: "Target readiness unknown" };
-const tones: Record<SandboxNodeRollout["state"], Tone> = { ready: "ok", preparing: "neutral", failed: "warning", update_required: "warning", unknown: "neutral" };
+const labels: Record<SandboxNodeRollout["state"], ParseKeys<"sandbox">> = { ready: "Ready for target", preparing: "Preparing target", failed: "Preparation failed", unknown: "Target readiness unknown" };
+const tones: Record<SandboxNodeRollout["state"], Tone> = { ready: "ok", preparing: "neutral", failed: "warning", unknown: "neutral" };
 
 /** A serving pin is historical ownership, not proof of a live connection or capacity. */
 export function NodeRolloutStatus({ node, stale = false }: { node: SandboxNode; stale?: boolean }) {
@@ -14,6 +14,5 @@ export function NodeRolloutStatus({ node, stale = false }: { node: SandboxNode;
   return <span className="status-with-help">
     <StatusDot tone={tones[state]} label={t(labels[state])} />
     {state === "failed" && node.rollout.diagnostic ? <DiagnosticTip code={node.rollout.diagnostic} /> : null}
-    {state === "update_required" ? <HelpTip>{t("This node can't prepare new sandbox configurations and keeps serving the one it registered with. To move it to the current configuration, choose Remove node, then add the host again with Add node.")}</HelpTip> : null}
   </span>;
 }
diff --git a/apps/web/src/features/sandbox/SandboxDeploymentSettings.tsx b/apps/web/src/features/sandbox/SandboxDeploymentSettings.tsx
index 3b1affcaf..a41e04ded 100644
--- a/apps/web/src/features/sandbox/SandboxDeploymentSettings.tsx
+++ b/apps/web/src/features/sandbox/SandboxDeploymentSettings.tsx
@@ -1,15 +1,13 @@
 import { useState, type ReactNode } from "react";
-import type { UpdateSandboxDeployment, SandboxDeployment, SandboxRuntimeRelease } from "@oac/agents-client";
-import { useQuery } from "@tanstack/react-query";
-import { Trans, useTranslation } from "react-i18next";
+import type { UpdateSandboxDeployment, SandboxDeployment } from "@oac/agents-client";
+import { useTranslation } from "react-i18next";
 import { Modal } from "../../components/Modal";
 import { HelpTip, RefreshButton } from "../../components/console-ui";
 import { formatBytes, formatPeriod, MISSING } from "../../lib/format";
 import type { ParseKeys } from "i18next";
 import { sandboxProviderLabel } from "../../lib/sandbox-labels";
 import { Fact } from "../system/Fact";
-import { RUNTIME_RELEASE_FIELDS, sandboxSize, templateBuildSize, templateBuildStatus } from "./deployment-specification";
-import { distributionRuntimeQuery } from "./sandbox-queries";
+import { sandboxSize, templateBuildSize, templateBuildStatus } from "./deployment-specification";
 import { SandboxRolloutSummary } from "./SandboxRolloutSummary";
 import { SandboxSetupWizard } from "./SandboxSetupWizard";
 
@@ -31,21 +29,14 @@ export function SandboxDeploymentSettings({ deployment, disabled, fresh, onUpdat
   const locale = i18n.resolvedLanguage?.startsWith("zh") ? "zh-CN" : "en";
   const [changing, setChanging] = useState(false);
   const [editKey, setEditKey] = useState(0);
-  const [proposedRuntime, setProposedRuntime] = useState<SandboxRuntimeRelease>();
   const spec = deployment.specification;
-  // Only Docker and microsandbox save a Runtime. Changes keep it; moving to the
-  // one this console serves is an explicit change of its own.
-  const savedRuntime = spec?.runtime;
-  const served = useQuery({ ...distributionRuntimeQuery, enabled: Boolean(savedRuntime) }).data;
-  const offered = savedRuntime && served && !deployment.reset && RUNTIME_RELEASE_FIELDS.some((field) => savedRuntime[field] !== served[field]) ? served : null;
   // An E2B selection may adopt its template build's size instead of saving one.
   const size = sandboxSize(deployment);
   const build = deployment.metadata?.template_build;
   const buildSize = templateBuildSize(deployment);
   const sizeLabel = (value: { cpus: number; memory_mib: number }) => t("{{cpus}} CPU · {{memory}}", { cpus: value.cpus, memory: formatBytes(value.memory_mib * MIB) });
   const canEdit = fresh && !deployment.reset;
-  const change = (runtime?: SandboxRuntimeRelease) => { setEditKey((key) => key + 1); setProposedRuntime(runtime); setChanging(true); };
-  const short = (release: SandboxRuntimeRelease) => <code className="system-code" title={release.source_commit}>{release.source_commit.slice(0, 12)}</code>;
+  const change = () => { setEditKey((key) => key + 1); setChanging(true); };
   return <section className="console-section" aria-labelledby="sandbox-provider-heading">
     <header className="console-section-header">
       <div className="console-section-title">
@@ -54,7 +45,6 @@ export function SandboxDeploymentSettings({ deployment, disabled, fresh, onUpdat
           {t("One provider serves this deployment. Reset it before choosing a different backend.")}
           {deployment.mode === "direct" ? ` ${t("Core creates E2B sandboxes directly. No node enrollment is needed.")} ${t("Saved configuration does not confirm execution readiness. Session and Environment state report actual execution.")}` : ""}
           <dl className="sandbox-summary">
-            {spec?.runtime ? <div><dt>{t("Runtime")}</dt><dd><code title={spec.runtime.source_commit}>{spec.runtime.source_commit.slice(0, 12)}</code></dd></div> : null}
             {deployment.suspension ? <div><dt>{t("Idle suspension")}</dt><dd>{t("After {{idle}} · kept {{retention}}", { idle: formatPeriod(deployment.suspension.idle_seconds, i18n.resolvedLanguage), retention: formatPeriod(deployment.suspension.retention_seconds, i18n.resolvedLanguage) })}</dd></div> : null}
             <div><dt>{t("Allocated resources")}</dt><dd>{deployment.resources?.allocations ?? t("Unknown state")}</dd></div>
             <div><dt>{t("Pending environments")}</dt><dd>{deployment.resources?.pending ?? t("Unknown state")}</dd></div>
@@ -63,15 +53,12 @@ export function SandboxDeploymentSettings({ deployment, disabled, fresh, onUpdat
       </div>
       {!deployment.reset ? <div className="console-section-actions">
         <HelpTip>{t("Changes keep this backend and existing Sessions and nodes. Core prepares the new target for future work; placement may continue on qualified earlier generations.")}</HelpTip>
-        <button type="button" className="button outline" disabled={disabled || !canEdit || changing} onClick={() => change()}>{t("Change resources")}</button>
+        <button type="button" className="button outline" disabled={disabled || !canEdit || changing} onClick={change}>{t("Change resources")}</button>
       </div> : null}
     </header>
     <div className="settings-rows">
       <Fact label={t("Provider")}>{sandboxProviderLabel(deployment.provider, locale)}</Fact>
-      <Fact label={t("Each sandbox")} help={spec?.workspace && !spec.workspace.capacity_quota ? t("Workspace storage is configured by the operator; no capacity quota is enforced.") : undefined}>{size ? `${sizeLabel(size)}${size.root_disk_mib ? ` · ${spec?.workspace ? t("Root disk {{root}} · external workspace", { root: formatBytes(size.root_disk_mib * MIB) }) : t("Root disk {{root}} · data disk {{data}}", { root: formatBytes(size.root_disk_mib * MIB), data: formatBytes((size.environment_disk_mib ?? 0) * MIB) })}` : ""}` : MISSING}</Fact>
-      {savedRuntime && offered ? <Fact label={t("Runtime")} help={t("Other changes keep the saved Runtime. Existing sandboxes keep their Runtime while nodes prepare the new one.")} action={<button type="button" className="button outline" disabled={disabled || !canEdit || changing} onClick={() => change(offered)}>{t("Use this installation's Runtime")}</button>}>
-        <Trans t={t} i18nKey="Saved <saved/> · this installation serves <served/>" components={{ saved: short(savedRuntime), served: short(offered) }} />
-      </Fact> : null}
+      <Fact label={t("Each sandbox")} help={spec?.workspace && !spec.workspace.capacity_quota ? t("Workspace storage is configured by the operator; no capacity quota is enforced.") : undefined}>{size ? `${sizeLabel(size)}${size.root_disk_mib ? ` · ${t("Root disk {{root}} · external workspace", { root: formatBytes(size.root_disk_mib * MIB) })}` : ""}` : MISSING}</Fact>
       {deployment.provider === "e2b" ? <>
         <Fact label={t("Sandbox API URL")}><code className="system-code">{deployment.configuration?.api_url}</code></Fact>
         <Fact label={t("Sandbox data-plane domain")}><code className="system-code">{deployment.configuration?.domain}</code></Fact>
@@ -92,7 +79,6 @@ export function SandboxDeploymentSettings({ deployment, disabled, fresh, onUpdat
         current={deployment.provider ? { provider: deployment.provider, specification: deployment.specification, e2bTemplate: deployment.configuration?.template, e2bAPIURL: deployment.configuration?.api_url, e2bDomain: deployment.configuration?.domain } : undefined}
         disabled={disabled || !canEdit}
         editing
-        proposedRuntime={proposedRuntime}
         onSubmit={async (input) => { if (await onUpdate(input)) setChanging(false); }}
       />
       {writeFailure}
diff --git a/apps/web/src/features/sandbox/SandboxManagerView.tsx b/apps/web/src/features/sandbox/SandboxManagerView.tsx
index 4995d8654..1406a33f0 100644
--- a/apps/web/src/features/sandbox/SandboxManagerView.tsx
+++ b/apps/web/src/features/sandbox/SandboxManagerView.tsx
@@ -18,7 +18,6 @@ import { NodeList, onOldAddress } from "./NodeList";
 import { NodeDetail } from "./NodeDetail";
 import { NodeEnrollment } from "./NodeEnrollment";
 import { NodeEditDialog } from "./NodeEditDialog";
-import { sandboxSize } from "./deployment-specification";
 import { NodeCleanupDialog, type NodeCleanup } from "./NodeCleanupDialog";
 import "./SandboxManagerView.css";
 
@@ -142,7 +141,6 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
     key={editTarget?.id ?? "closed"}
     client={client}
     node={editTarget}
-    size={snapshot ? sandboxSize(snapshot.deployment) : null}
     suspends={suspends}
     onClose={() => setEditId(null)}
     onSaved={() => {
diff --git a/apps/web/src/features/sandbox/SandboxResetControls.test.tsx b/apps/web/src/features/sandbox/SandboxResetControls.test.tsx
index 7d95ba13c..c5184de13 100644
--- a/apps/web/src/features/sandbox/SandboxResetControls.test.tsx
+++ b/apps/web/src/features/sandbox/SandboxResetControls.test.tsx
@@ -5,7 +5,7 @@ import { SandboxResetControls } from "./SandboxResetControls";
 
 const reset: SandboxReset = { clear: "auto", requested_at: "2020-01-01T10:00:00Z", deadline_at: "2020-01-01T11:00:00Z", forced_at: null,
   remaining: { busy: 2, idle: 1, cleanup: 3, on_offline_nodes: 2, offline_nodes: [{ node_id: "offline-a", name: "Offline A", resources: 2 }] } };
-const deployment = (value: SandboxReset | null): SandboxDeployment => ({ credential_configured: false, configuration: {}, metadata: {}, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "https://core.example", reset: value, owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 5, pending: 1 }, suspension: null });
+const deployment = (value: SandboxReset | null): SandboxDeployment => ({ credential_configured: false, configuration: {}, metadata: {}, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "https://core.example", reset: value, owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 5, pending: 1 }, suspension: null });
 const render = (value: SandboxReset | null, stale = false) => renderToStaticMarkup(<SandboxResetControls deployment={deployment(value)} disabled={stale} stale={stale} onStart={async () => true} onCancel={async () => true} />);
 
 describe("authoritative reset progress", () => {
diff --git a/apps/web/src/features/sandbox/SandboxRolloutSummary.test.tsx b/apps/web/src/features/sandbox/SandboxRolloutSummary.test.tsx
index a6d724701..0364ada21 100644
--- a/apps/web/src/features/sandbox/SandboxRolloutSummary.test.tsx
+++ b/apps/web/src/features/sandbox/SandboxRolloutSummary.test.tsx
@@ -8,7 +8,7 @@ import { NodeRolloutStatus } from "./NodeRolloutStatus";
 import { SandboxDeploymentSettings } from "./SandboxDeploymentSettings";
 
 const deployment: SandboxDeployment = { credential_configured: false, configuration: {}, metadata: {}, installation_id: "i", owner_epoch: 1, generation: 4, provider: "docker", mode: "nodes", core_url: "https://core.example", resources: { allocations: 8, pending: 2 }, reset: null, suspension: null,
-  rollout: { state: "settled", previous_generation_sandboxes: 8, nodes: { ready: 1, preparing: 0, failed: 2, update_required: 3, unknown: 4 } } };
+  rollout: { state: "settled", previous_generation_sandboxes: 8, nodes: { ready: 1, preparing: 0, failed: 2, unknown: 4 } } };
 
 describe("authoritative configuration rollout", () => {
   it("keeps attention visible while moving detailed counts off the main page", () => {
@@ -30,14 +30,14 @@ describe("authoritative configuration rollout", () => {
   });
 
   it("does not call settled nodes ready when Core reports unknown target readiness", () => {
-    const html = renderToStaticMarkup(<SandboxRolloutSummary deployment={{ ...deployment, rollout: { ...deployment.rollout, nodes: { ready: 2, preparing: 0, failed: 0, update_required: 0, unknown: 1 } } }} compact />);
+    const html = renderToStaticMarkup(<SandboxRolloutSummary deployment={{ ...deployment, rollout: { ...deployment.rollout, nodes: { ready: 2, preparing: 0, failed: 0, unknown: 1 } } }} compact />);
     expect(html).toContain("Target readiness unknown");
     expect(html).not.toContain("No active preparation");
     expect(html).not.toContain("Ready for target");
   });
 
   it("reports preparing and settled without turning settled into readiness", () => {
-    const quiet = { ...deployment, rollout: { state: "settled" as const, previous_generation_sandboxes: 0, nodes: { ready: 2, preparing: 0, failed: 0, update_required: 0, unknown: 0 } } };
+    const quiet = { ...deployment, rollout: { state: "settled" as const, previous_generation_sandboxes: 0, nodes: { ready: 2, preparing: 0, failed: 0, unknown: 0 } } };
     expect(renderToStaticMarkup(<SandboxRolloutSummary deployment={quiet} compact />)).toContain("No active preparation");
     expect(renderToStaticMarkup(<SandboxRolloutSummary deployment={{ ...quiet, rollout: { ...quiet.rollout, state: "preparing" } }} />)).toContain("Preparing configuration");
     expect(renderToStaticMarkup(<SandboxRolloutSummary deployment={{ ...quiet, provider: "" }} />)).toBe("");
diff --git a/apps/web/src/features/sandbox/SandboxRolloutSummary.tsx b/apps/web/src/features/sandbox/SandboxRolloutSummary.tsx
index 67f3c521f..3749f300f 100644
--- a/apps/web/src/features/sandbox/SandboxRolloutSummary.tsx
+++ b/apps/web/src/features/sandbox/SandboxRolloutSummary.tsx
@@ -13,7 +13,7 @@ export function SandboxRolloutSummary({ deployment, stale = false, onOpen }: { d
   const [open, setOpen] = useState(false);
   if (!deployment.provider || deployment.reset) return null;
   const { rollout } = deployment;
-  const needsAttention = !!rollout.nodes && (rollout.nodes.failed > 0 || rollout.nodes.update_required > 0);
+  const needsAttention = !!rollout.nodes && (rollout.nodes.failed > 0);
   const unknown = !!rollout.nodes && rollout.nodes.unknown > 0;
   const label = stale ? "Rollout state unconfirmed" : needsAttention ? "Needs attention" : unknown ? "Target readiness unknown" : rollout.state === "preparing" ? "Preparing configuration" : "No active preparation";
   const tone: Tone = stale || needsAttention || unknown ? "warning" : rollout.state === "preparing" ? "pending" : "neutral";
@@ -32,7 +32,7 @@ export function SandboxRolloutSummary({ deployment, stale = false, onOpen }: { d
           <StatusDot tone={tone} label={t(label)} />
           <HelpTip>
             {t(stale ? "Rollout state is unconfirmed. These are the last confirmed observations." : rollout.state === "settled" ? "Core reports no active preparation. This does not mean every node is ready." : "Core is preparing the target configuration.")}
-            {needsAttention || unknown ? ` ${t("Review affected nodes for preparation errors, incompatible node software or an unconfirmed connection. Qualified earlier generations may still serve work.")}` : null}
+            {needsAttention || unknown ? ` ${t("Review affected nodes for preparation errors or an unconfirmed connection. Qualified earlier generations may still serve work.")}` : null}
           </HelpTip>
         </div>
         <dl className="sandbox-rollout-facts">
@@ -43,7 +43,6 @@ export function SandboxRolloutSummary({ deployment, stale = false, onOpen }: { d
             <div><dt>{t("Ready for target")}</dt><dd>{count(rollout.nodes.ready)}</dd></div>
             <div><dt>{t("Preparing target")}</dt><dd>{count(rollout.nodes.preparing)}</dd></div>
             <div><dt>{t("Preparation failed")}</dt><dd>{count(rollout.nodes.failed)}</dd></div>
-            <div><dt>{t("Node software incompatible")}</dt><dd>{count(rollout.nodes.update_required)}</dd></div>
             <div><dt>{t("Target readiness unknown")}</dt><dd>{count(rollout.nodes.unknown)}</dd></div>
           </> : null}
         </dl>
diff --git a/apps/web/src/features/sandbox/SandboxSetupWizard.tsx b/apps/web/src/features/sandbox/SandboxSetupWizard.tsx
index 7644af628..45fad9877 100644
--- a/apps/web/src/features/sandbox/SandboxSetupWizard.tsx
+++ b/apps/web/src/features/sandbox/SandboxSetupWizard.tsx
@@ -1,4 +1,4 @@
-import { AgentCoreError, deploymentContract, type InitializeSandboxDeployment, type UpdateSandboxDeployment, type SandboxE2BReadyBuild, type SandboxE2BTemplate, type SandboxProvider, type SandboxResources, type SandboxRuntimeRelease, type SandboxSpecification } from "@oac/agents-client";
+import { AgentCoreError, deploymentContract, type InitializeSandboxDeployment, type UpdateSandboxDeployment, type SandboxE2BReadyBuild, type SandboxE2BTemplate, type SandboxProvider, type SandboxResources, type SandboxSpecification } from "@oac/agents-client";
 import { useQuery } from "@tanstack/react-query";
 import { AnimatePresence } from "motion/react";
 import * as m from "motion/react-m";
@@ -15,9 +15,10 @@ import { formatBytes } from "../../lib/format";
 import { installationQuery } from "../../lib/installation";
 import type { ParseKeys } from "i18next";
 import { sandboxConfigurationRejection, sandboxProviderLabel } from "../../lib/sandbox-labels";
-import { defaultSandboxResources, isRuntimeRelease, isRuntimeReleaseField, RUNTIME_RELEASE_FIELDS, savedSpecification, validSandboxResources } from "./deployment-specification";
+import { defaultSandboxResources, savedSpecification, selectedWorkspace, validSandboxResources } from "./deployment-specification";
+import { workspaceStorageQuery } from "../settings/workspace-storage";
 import { e2bKeyReady, e2bUpdateSelection } from "./sandbox-update";
-import { distributionRuntimeQuery, sandboxAdmin } from "./sandbox-queries";
+import { sandboxAdmin } from "./sandbox-queries";
 import "./sandbox-wizard.css";
 
 type Where = "nodes" | "direct";
@@ -70,30 +71,21 @@ export function validEndpoint(apiURL: string, domain: string): boolean {
  * double of it, disks included where the default declares them. A Provider
  * whose configuration selects the size declares none and has no presets.
  */
-function presets(provider: SandboxProvider, workspace?: SandboxSpecification["workspace"]): Record<Preset, SandboxResources> | null {
-  const standard = defaultSandboxResources(provider, workspace);
+function presets(provider: SandboxProvider): Record<Preset, SandboxResources> | null {
+  const standard = defaultSandboxResources(provider);
   if (!standard) return null;
   const scale = (factor: number): SandboxResources => ({
     cpus: Math.max(1, standard.cpus * factor),
     memory_mib: standard.memory_mib * factor,
-    ...(standard.root_disk_mib ? { root_disk_mib: standard.root_disk_mib * factor, environment_disk_mib: standard.environment_disk_mib! * factor } : {}),
+    ...(standard.root_disk_mib ? { root_disk_mib: standard.root_disk_mib * factor } : {}),
   });
   return { small: scale(0.5), standard, large: scale(2) };
 }
 
-const releaseLabels: Record<keyof SandboxRuntimeRelease, ParseKeys<"sandbox">> = {
-  source_commit: "Source commit",
-  image_id: "Image ID",
-  image_manifest_digest: "Image manifest digest",
-  microsandbox_ref: "microsandbox reference",
-  runtime_sha256: "Runtime SHA-256",
-  firmware_sha256: "Firmware SHA-256",
-};
-
-function presetOf(provider: SandboxProvider, resources: SandboxResources, workspace?: SandboxSpecification["workspace"]): Preset | null {
+function presetOf(provider: SandboxProvider, resources: SandboxResources): Preset | null {
   const same = (a: SandboxResources, b: SandboxResources) => a.cpus === b.cpus && a.memory_mib === b.memory_mib
     && (a.root_disk_mib ?? 0) === (b.root_disk_mib ?? 0) && (a.environment_disk_mib ?? 0) === (b.environment_disk_mib ?? 0);
-  const all = presets(provider, workspace);
+  const all = presets(provider);
   return all ? (Object.keys(all) as Preset[]).find((key) => same(all[key], resources)) ?? null : null;
 }
 
@@ -102,12 +94,11 @@ function presetOf(provider: SandboxProvider, resources: SandboxResources, worksp
  * which backend (own machines, microsandbox preselected) or the E2B account,
  * how big each sandbox is (only for a Provider that declares a default size:
  * E2B sandboxes take the template build's size), then a review. The Provider's
- * declarations decide the size, disk and Runtime inputs. Advanced settings
- * hold the complete form. The Runtime release comes from this console's
- * distribution manifest when it serves one.
+ * declarations decide the size and disk inputs. Advanced settings hold the
+ * complete form.
  * `current` pre-selects the saved choices when a deployment changes. Keeping
- * the backend keeps its saved size and Runtime; another backend starts from its
- * defaults and this console's Runtime. E2B updates can retain the saved key.
+ * the backend keeps its saved size; another backend starts from its defaults.
+ * E2B updates can retain the saved key.
  * Docker isolates less than microsandbox, so choosing it takes a confirmation,
  * once per wizard session; a saved Docker deployment has already made it.
  * Core's address is config.json's `public_url`: the review only shows it, and
@@ -118,25 +109,26 @@ type WizardProps = {
   expectedGeneration: number;
   current?: { provider: SandboxProvider; specification?: SandboxSpecification; e2bTemplate?: string; e2bAPIURL?: string; e2bDomain?: string };
   disabled: boolean;
-  /** A Runtime release an update proposes; the wizard opens on its review. */
-  proposedRuntime?: SandboxRuntimeRelease;
 } & ({ editing: true; onSubmit: (input: UpdateSandboxDeployment) => Promise<void> } |
   { editing?: false; onSubmit: (input: InitializeSandboxDeployment) => Promise<void> });
 
-export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disabled, editing, proposedRuntime, onSubmit }: WizardProps) {
+export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disabled, editing, onSubmit }: WizardProps) {
   const { t, i18n } = useTranslation("sandbox");
   const { t: tCommon } = useTranslation("common");
   const id = useId();
   const locale = i18n.resolvedLanguage?.startsWith("zh") ? "zh-CN" : "en";
   const currentMode: Where | null = current ? deploymentContract.providers[current.provider].mode : null;
-  const [step, setStep] = useState<Step>(proposedRuntime ? "review" : editing ? currentMode === "direct" ? "e2b" : "size" : "where");
+  const [step, setStep] = useState<Step>(editing ? currentMode === "direct" ? "e2b" : "size" : "where");
   const [where, setWhere] = useState<Where | null>(currentMode);
   const [provider, setProvider] = useState<SandboxProvider | null>(current?.provider ?? null);
   const policy = provider ? deploymentContract.providers[provider] : null;
   const saved = provider && current ? savedSpecification(provider, current.provider, current.specification) : null;
+  // The selected storage sizes a first initialization; a saved specification takes precedence.
+  const storage = useQuery(workspaceStorageQuery).data;
+  const workspace = saved?.workspace ?? (provider ? selectedWorkspace(provider, storage) : undefined);
   // Choosing a Provider that declares a default size replaces this placeholder.
   const [resources, setResources] = useState<SandboxResources>(current?.specification?.resources ?? { cpus: 0, memory_mib: 0 });
-  const [size, setSize] = useState<Size>(current?.specification ? presetOf(current.provider, current.specification.resources, current.specification.workspace) ?? "current" : "standard");
+  const [size, setSize] = useState<Size>(current?.specification ? presetOf(current.provider, current.specification.resources) ?? "current" : "standard");
   const [apiKey, setApiKey] = useState("");
   const [replacementRequested, setReplacementRequested] = useState(false);
   const [template, setTemplate] = useState(current?.e2bTemplate ?? "");
@@ -151,7 +143,6 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
   const [discovery, setDiscovery] = useState<"idle" | "loading" | "ready" | "error">("idle");
   const [buildDiscovery, setBuildDiscovery] = useState<"idle" | "loading" | "ready" | "error">("idle");
   const [discoveryRetry, setDiscoveryRetry] = useState(0);
-  const [runtime, setRuntime] = useState<Partial<SandboxRuntimeRelease>>(proposedRuntime ?? {});
   const [busy, setBusy] = useState(false);
   const [dockerConfirmed, setDockerConfirmed] = useState(current?.provider === "docker");
   const [confirmingDocker, setConfirmingDocker] = useState(false);
@@ -195,35 +186,27 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
     setTemplate(""); setSelectedTemplate(""); setTemplates([]); setBuilds([]);
   }
 
-  // A release the administrator entered or an update proposes comes first, then the saved one of the same backend,
-  // then the one this console distributes (the release its node installer verifies).
-  const matched = useQuery(distributionRuntimeQuery);
-  const release: Partial<SandboxRuntimeRelease> = Object.keys(runtime).length ? runtime : saved?.runtime ?? matched.data ?? {};
-
-  const needsRuntime = policy?.runtime ?? false;
-  const runtimeReady = !needsRuntime || isRuntimeRelease(release);
   // Initial setup requires a key; an update may retain the committed key.
   const keyReady = e2bKeyReady(Boolean(editing), replacementRequested, apiKey);
   const connectionChanged = Boolean(editing && (apiURL.trim() !== (current?.e2bAPIURL || E2B_PRESETS.official.apiURL) || domain.trim() !== (current?.e2bDomain || E2B_PRESETS.official.domain)));
   const e2bReady = provider !== "e2b" || (keyReady && validTemplate(template.trim()) && validEndpoint(apiURL.trim(), domain.trim()) && (!editing || !connectionChanged || apiKey.trim().length > 0));
   // A Provider without a declared default size takes it from its configuration, so the selection sends no resources.
   const sized = Boolean(policy?.default_resources);
-  const sizeReady = provider !== null && (!sized || validSandboxResources(provider, resources, saved?.workspace));
-  const ready = provider !== null && runtimeReady && e2bReady && sizeReady && !disabled && !busy;
+  const sizeReady = provider !== null && (!sized || validSandboxResources(provider, resources, workspace));
+  const ready = provider !== null && e2bReady && sizeReady && !disabled && !busy;
 
   const order: Step[] = editing ? where === "direct" ? ["e2b", "review"] : ["size", "review"] : where === "direct" ? ["where", "e2b", "review"] : ["where", "backend", "size", "review"];
   const index = Math.max(0, order.indexOf(step === "advanced" ? "review" : step));
   const back = () => setStep(step === "advanced" ? "review" : order[Math.max(0, index - 1)]!);
 
-  // The saved backend keeps its size and Runtime; another starts from its declared default size and this console's Runtime.
+  // The saved backend keeps its size; another starts from its declared default size.
   function choose(next: SandboxProvider) {
     if (next !== provider) {
       setRejection(null);
       const kept = current ? savedSpecification(next, current.provider, current.specification) : null;
       const proposed = kept?.resources ?? defaultSandboxResources(next);
       if (proposed) setResources(proposed);
-      setSize(kept ? presetOf(next, kept.resources, kept.workspace) ?? "current" : "standard");
-      setRuntime({});
+      setSize(kept ? presetOf(next, kept.resources) ?? "current" : "standard");
     }
     setProvider(next);
   }
@@ -243,7 +226,6 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
       const selection = {
         provider, expected_generation: expectedGeneration,
         ...(sized ? { resources } : {}),
-        ...(needsRuntime ? { runtime: release as SandboxRuntimeRelease } : {}),
       };
       if (editing) await onSubmit({ ...selection, ...(provider === "e2b" ? { ...e2bUpdateSelection(template, apiKey), configuration: { template: template.trim(), api_url: apiURL.trim(), domain: domain.trim() } } : {}) });
       else await onSubmit({ ...selection, ...(provider === "e2b" ? { credential: { api_key: apiKey.trim() }, configuration: { template: template.trim(), api_url: apiURL.trim(), domain: domain.trim() } } : {}) });
@@ -255,7 +237,7 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
       setFieldRejection(error);
       if (error instanceof AgentCoreError && error.param) {
         if (["credential", "configuration", "e2b.api_url", "e2b.domain"].includes(error.param) && error.code !== "sandbox_credential_ownership") setStep("e2b");
-        else if (error.param === "runtime" || error.param.startsWith("resources.")) setStep("advanced");
+        else if (error.param.startsWith("resources.")) setStep("advanced");
       }
       setResetRequired(error instanceof AgentCoreError && ["sandbox_credential_ownership", "sandbox_reset_required"].includes(error.code ?? ""));
       setAddressRejected(error instanceof AgentCoreError && error.code === "sandbox_configuration_error");
@@ -266,7 +248,7 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
   }
 
   const sizeLabel = (value: SandboxResources) => t("{{cpus}} CPU · {{memory}}", { cpus: value.cpus, memory: formatBytes(value.memory_mib * MIB) });
-  const diskLabel = (value: SandboxResources) => saved?.workspace ? t("Root disk {{root}} · external workspace", { root: formatBytes((value.root_disk_mib ?? 0) * MIB) }) : t("Root disk {{root}} · data disk {{data}}", { root: formatBytes((value.root_disk_mib ?? 0) * MIB), data: formatBytes((value.environment_disk_mib ?? 0) * MIB) });
+  const diskLabel = (value: SandboxResources) => t("Root disk {{root}} · external workspace", { root: formatBytes((value.root_disk_mib ?? 0) * MIB) });
 
   let page: ReactNode;
   if (step === "where") {
@@ -280,7 +262,7 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
     );
   } else if (step === "backend") {
     page = (
-      <Question title={t("Which sandbox backend?")} help={t("microsandbox, the recommended default, runs each sandbox as a lightweight virtual machine: stronger isolation and its own root and data disks with size limits, but the host needs KVM. Docker runs each sandbox as a container on the host's kernel: CPU and memory limits but no disk quota, for trusted workloads or hosts without KVM.")}>
+      <Question title={t("Which sandbox backend?")} help={t("microsandbox, the recommended default, runs each sandbox as a lightweight virtual machine: stronger isolation and a root disk size limit, with each sandbox's /environment on workspace storage, but the host needs KVM. Docker runs each sandbox as a container on the host's kernel: CPU and memory limits but no disk quota, for trusted workloads or hosts without KVM.")}>
         <div className="wizard-choices">
           <Choice icon={Cpu} title="microsandbox" badge={t("Recommended")} selected={provider === "microsandbox"} onClick={() => { choose("microsandbox"); setStep("size"); }} />
           <Choice icon={Box} title="Docker" selected={provider === "docker"} onClick={() => { if (dockerConfirmed) selectDocker(); else setConfirmingDocker(true); }} />
@@ -344,9 +326,9 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
       </Question>
     );
   } else if (step === "size") {
-    const options = provider ? presets(provider, saved?.workspace) : null;
+    const options = provider ? presets(provider) : null;
     // A saved size outside the presets stays on offer as the current one.
-    const kept = saved && provider && presetOf(provider, saved.resources, saved.workspace) === null ? saved.resources : null;
+    const kept = saved && provider && presetOf(provider, saved.resources) === null ? saved.resources : null;
     const disks = (value: SandboxResources) => (policy?.disk ? diskLabel(value) : undefined);
     page = (
       <Question title={t("How big is each sandbox?")} help={t("These limits apply to the selected configuration generation. Existing sandboxes keep their limits. Concurrency is set per node.")}>
@@ -363,6 +345,7 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
             />
           ))}
         </div>
+        {policy && "workspace" in policy && !workspace ? <p>{t("This backend runs every sandbox on workspace storage. Select it under Settings, Workspace storage first.")}</p> : null}
         <button className="wizard-link" type="button" onClick={() => { setSize("custom"); setStep("advanced"); }}>
           <SlidersHorizontal size={14} aria-hidden="true" />{t("Custom size in advanced settings")}
         </button>
@@ -379,12 +362,6 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
           {provider === "e2b" ? <div><dt>{t("Sandbox API URL")}</dt><dd><code>{apiURL || "https://api.e2b.app"}</code></dd></div> : null}
           {provider === "e2b" ? <div><dt>{t("Sandbox data-plane domain")}</dt><dd><code>{domain || "e2b.app"}</code></dd></div> : null}
           {provider === "e2b" && editing ? <div><dt>{t("E2B credential")}</dt><dd>{t(replacementRequested ? "Replace saved key" : "Keep saved key")}</dd></div> : null}
-          {needsRuntime ? (
-            <div>
-              <dt>{t("Runtime")}<HelpTip>{t("The target Runtime release. Existing sandboxes keep their owned release while nodes prepare the target.")}</HelpTip></dt>
-              <dd>{runtimeReady ? <code>{release.source_commit!.slice(0, 12)}</code> : <span className="wizard-missing">{t("Runtime release needed")}<HelpTip>{t("This console serves no Runtime manifest. Enter the release under advanced settings.")}</HelpTip></span>}</dd>
-            </div>
-          ) : null}
           <div>
             <dt>{t("Core address")}<HelpTip>{t("The address nodes and sandboxes use to reach Core.")}</HelpTip></dt>
             <dd>
@@ -431,24 +408,10 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
               <NumberField error={fieldError("resources.memory_mib")} id={`${id}-memory`} label={t("Memory (MiB)")} value={resources.memory_mib} onChange={(memory_mib) => { setSize("custom"); setResources({ ...resources, memory_mib }); setFieldRejection(null); }} />
               {policy?.disk ? <>
                 <NumberField error={fieldError("resources.root_disk_mib")} id={`${id}-root`} label={t("Root disk (MiB)")} value={resources.root_disk_mib ?? 0} onChange={(root_disk_mib) => { setResources({ ...resources, root_disk_mib }); setFieldRejection(null); }} />
-                {saved?.workspace && !saved.workspace.capacity_quota ? <p>{t("Workspace storage is configured by the operator; no capacity quota is enforced.")}</p> : <NumberField error={fieldError("resources.environment_disk_mib")} id={`${id}-data`} label={t("Data disk at /environment (MiB)")} value={resources.environment_disk_mib ?? 0} onChange={(environment_disk_mib) => { setResources({ ...resources, environment_disk_mib }); setFieldRejection(null); }} />}
+                {workspace?.capacity_quota ? <NumberField error={fieldError("resources.environment_disk_mib")} id={`${id}-data`} label={t("Capacity quota at /environment (MiB)")} value={resources.environment_disk_mib ?? 0} onChange={(environment_disk_mib) => { setResources({ ...resources, environment_disk_mib }); setFieldRejection(null); }} /> : workspace ? <p>{t("Workspace storage is configured by the operator; no capacity quota is enforced.")}</p> : null}
               </> : null}
             </div>
           </fieldset> : null}
-          {needsRuntime ? (
-            <fieldset className="wizard-group">
-              <legend>{t("Runtime release")}<HelpTip>{t("Filled in from this console's distribution when it serves one. Otherwise copy these from the distribution manifest that matches your nodes; image configuration IDs and manifest digests are different values.")}</HelpTip></legend>
-              {fieldError("runtime") ? <p id={`${id}-runtime-error`} className="field-error" role="alert">{fieldError("runtime")}</p> : null}
-              {RUNTIME_RELEASE_FIELDS.map((field) => {
-                const value = release[field] ?? "";
-                return (
-                  <Field key={field} id={`${id}-${field}`} label={t(releaseLabels[field])} error={value && !isRuntimeReleaseField(field, value) ? t("Check this value") : null}>
-                    <input id={`${id}-${field}`} value={value} spellCheck={false} autoComplete="off" aria-invalid={Boolean(fieldError("runtime"))} aria-describedby={fieldError("runtime") ? `${id}-runtime-error` : undefined} onChange={(event) => { setRuntime({ ...release, [field]: event.target.value.trim() }); setFieldRejection(null); }} />
-                  </Field>
-                );
-              })}
-            </fieldset>
-          ) : null}
           {provider === "e2b" ? (
             <Field id={`${id}-template-advanced`} label={t("Template build")} error={fieldError("configuration") ?? (template && !validTemplate(template.trim()) ? t("Enter a template ID and build UUID separated by a colon.") : null)}>
               <input id={`${id}-template-advanced`} value={template} onChange={(event) => { setTemplate(event.target.value); setFieldRejection(null); }} autoComplete="off" spellCheck={false} />
diff --git a/apps/web/src/features/sandbox/deployment-specification.test.ts b/apps/web/src/features/sandbox/deployment-specification.test.ts
index a55925899..0c9e1cf26 100644
--- a/apps/web/src/features/sandbox/deployment-specification.test.ts
+++ b/apps/web/src/features/sandbox/deployment-specification.test.ts
@@ -1,25 +1,10 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { defaultSandboxResources, distributionRuntime, isRuntimeReleaseField, sandboxesThatFit, savedSpecification, validSandboxResources } from "./deployment-specification";
+import { describe, expect, it } from "vitest";
+import { defaultSandboxResources, savedSpecification, selectedWorkspace, validSandboxResources } from "./deployment-specification";
 import { deploymentContract, type SandboxProvider, type SandboxSpecification } from "@oac/agents-client";
 
-const manifest = { platform: "linux/amd64", source_commit: "0".repeat(40), images: { runtime: `sha256:${"a".repeat(64)}` },
-  image_manifest_digests: { runtime: `sha256:${"b".repeat(64)}` }, runtime_ref: `oac-runtime@sha256:${"b".repeat(64)}`,
-  microsandbox: { runtime_sha256: "c".repeat(64), firmware_sha256: "d".repeat(64) } };
-afterEach(() => vi.unstubAllGlobals());
-
-describe("deployment resources and Runtime", () => {
-  it("maps the exact six identities from one matched distribution", async () => {
-    const fetcher = vi.fn().mockResolvedValue(new Response(JSON.stringify(manifest)));
-    vi.stubGlobal("fetch", fetcher);
-    expect(await distributionRuntime(new AbortController().signal)).toEqual({ source_commit: manifest.source_commit,
-      image_id: manifest.images.runtime, image_manifest_digest: manifest.image_manifest_digests.runtime,
-      microsandbox_ref: manifest.runtime_ref, runtime_sha256: manifest.microsandbox.runtime_sha256, firmware_sha256: manifest.microsandbox.firmware_sha256 });
-    expect(fetcher.mock.calls.map((call) => call[0])).toEqual(["/node-install/manifest.json"]);
-  });
-  it("preserves saved resources and Runtime only for the same provider", () => {
-    const current: SandboxSpecification = { resources: { cpus: 7, memory_mib: 8192 }, runtime: { source_commit: manifest.source_commit,
-      image_id: manifest.images.runtime, image_manifest_digest: manifest.image_manifest_digests.runtime,
-      microsandbox_ref: manifest.runtime_ref, runtime_sha256: manifest.microsandbox.runtime_sha256, firmware_sha256: manifest.microsandbox.firmware_sha256 } };
+describe("deployment resources", () => {
+  it("preserves saved resources only for the same provider", () => {
+    const current: SandboxSpecification = { resources: { cpus: 7, memory_mib: 8192 } };
     expect(savedSpecification("docker", "docker", current)).toEqual(current);
     expect(savedSpecification("docker", "docker", current)).not.toBe(current);
     expect(savedSpecification("microsandbox", "docker", current)).toBeNull();
@@ -33,7 +18,7 @@ describe("deployment resources and Runtime", () => {
       expect(resources).toEqual(declared);
       if (resources) {
         expect(resources).not.toBe(declared);
-        expect(validSandboxResources(provider, resources)).toBe(true);
+        expect(validSandboxResources(provider, resources, selectedWorkspace(provider, { tenant_capacity_mib: 0 }))).toBe(true);
       }
     }
   });
@@ -43,12 +28,12 @@ describe("deployment resources and Runtime", () => {
     expect(validSandboxResources("docker", { cpus: 2, memory_mib: 511 })).toBe(false);
     expect(validSandboxResources("docker", { cpus: 2, memory_mib: 1048577 })).toBe(false);
     expect(validSandboxResources("e2b", { cpus: 2, memory_mib: 2048, root_disk_mib: 1024 })).toBe(false);
-    expect(validSandboxResources("microsandbox", { cpus: 2, memory_mib: 2048, root_disk_mib: 1023, environment_disk_mib: 8192 })).toBe(false);
+    expect(validSandboxResources("microsandbox", { cpus: 2, memory_mib: 2048, root_disk_mib: 1023 }, { ...deploymentContract.providers.microsandbox.workspace, capacity_quota: false })).toBe(false);
   });
-  it("validates external storage without fabricating a disk quota or weakening root disk bounds", () => {
+  it("runs microsandbox only on selected storage, where the environment disk is a quota request", () => {
     const workspace = { ...deploymentContract.providers.microsandbox.workspace, capacity_quota: false };
-    const resources = defaultSandboxResources("microsandbox", workspace)!;
-    expect(resources.environment_disk_mib).toBe(0);
+    const resources = defaultSandboxResources("microsandbox")!;
+    expect(resources.environment_disk_mib).toBeUndefined();
     expect(validSandboxResources("microsandbox", resources, workspace)).toBe(true);
     expect(validSandboxResources("microsandbox", resources)).toBe(false);
     expect(validSandboxResources("microsandbox", { ...resources, root_disk_mib: 0 }, workspace)).toBe(false);
@@ -57,34 +42,10 @@ describe("deployment resources and Runtime", () => {
     expect(validSandboxResources("docker", { cpus: 2, memory_mib: 2048 }, workspace)).toBe(false);
     expect(validSandboxResources("microsandbox", { ...resources, environment_disk_mib: 8192 }, { ...workspace, capacity_quota: true })).toBe(true);
   });
-  it("accepts only Core's Runtime image in the Runtime reference", async () => {
-    const digest = "b".repeat(64);
-    const runtime_ref = `oac-runtime@sha256:${digest}`;
-    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(new Response(JSON.stringify({ ...manifest, runtime_ref }))));
-    expect((await distributionRuntime(new AbortController().signal)).microsandbox_ref).toBe(runtime_ref);
-    expect(isRuntimeReleaseField("microsandbox_ref", runtime_ref)).toBe(true);
-    for (const runtime_ref of [`custom-runtime@sha256:${digest}`, `oac-runtime:${digest}`, `oac-runtime@sha256:${"b".repeat(63)}`, `oac-runtime@sha256:${"B".repeat(64)}`, `@sha256:${digest}`]) {
-      vi.stubGlobal("fetch", vi.fn().mockResolvedValue(new Response(JSON.stringify({ ...manifest, runtime_ref }))));
-      await expect(distributionRuntime(new AbortController().signal)).rejects.toThrow();
-      expect(isRuntimeReleaseField("microsandbox_ref", runtime_ref)).toBe(false);
-    }
-  });
-  it("rejects unavailable, mutable or incomplete release identities", async () => {
-    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(new Response("{}", { status: 404 })));
-    await expect(distributionRuntime(new AbortController().signal)).rejects.toThrow();
-    for (const invalid of [{ ...manifest, platform: "linux/arm64" }, { ...manifest, source_commit: "main" }, { ...manifest, runtime_ref: "oac-runtime:latest" }, { ...manifest, microsandbox: {} }]) {
-      vi.stubGlobal("fetch", vi.fn().mockResolvedValue(new Response(JSON.stringify(invalid))));
-      await expect(distributionRuntime(new AbortController().signal)).rejects.toThrow();
-    }
-  });
-});
-
-describe("sandboxes a host holds", () => {
-  it("is the smaller of what its CPUs and its memory hold, and unknown without either or the size", () => {
-    const size = { cpus: 2, memory_mib: 4096 };
-    expect(sandboxesThatFit({ cpus: 16, memoryBytes: 64 * 2 ** 30 }, size)).toBe(8);
-    expect(sandboxesThatFit({ cpus: 64, memoryBytes: 18 * 2 ** 30 }, size)).toBe(4);
-    expect(sandboxesThatFit({ cpus: null, memoryBytes: 64 * 2 ** 30 }, size)).toBeNull();
-    expect(sandboxesThatFit({ cpus: 16, memoryBytes: 64 * 2 ** 30 }, null)).toBeNull();
+  it("takes the workspace requirement from the selected storage", () => {
+    expect(selectedWorkspace("microsandbox", { tenant_capacity_mib: 0 })).toMatchObject({ capacity_quota: false });
+    expect(selectedWorkspace("microsandbox", { tenant_capacity_mib: 1024 })).toMatchObject({ capacity_quota: true });
+    expect(selectedWorkspace("microsandbox", null)).toBeUndefined();
+    expect(selectedWorkspace("docker", { tenant_capacity_mib: 0 })).toBeUndefined();
   });
 });
diff --git a/apps/web/src/features/sandbox/deployment-specification.ts b/apps/web/src/features/sandbox/deployment-specification.ts
index 2beb67bb4..5e6cfc596 100644
--- a/apps/web/src/features/sandbox/deployment-specification.ts
+++ b/apps/web/src/features/sandbox/deployment-specification.ts
@@ -1,45 +1,29 @@
-import { deploymentContract, type SandboxDeployment, type SandboxE2BTemplateBuild, type SandboxProvider, type SandboxResources, type SandboxRuntimeRelease, type SandboxSpecification } from "@oac/agents-client";
-
-interface Manifest {
-  platform?: string;
-  source_commit?: string;
-  images?: { runtime?: string };
-  image_manifest_digests?: { runtime?: string };
-  runtime_ref?: string;
-  microsandbox?: { runtime_sha256?: string; firmware_sha256?: string };
-}
+import { deploymentContract, type SandboxDeployment, type SandboxE2BTemplateBuild, type SandboxProvider, type SandboxResources, type SandboxSpecification } from "@oac/agents-client";
 
 /** The size the Provider declares for setup to propose; null when its configuration selects the size. */
-export function defaultSandboxResources(provider: SandboxProvider, workspace?: SandboxSpecification["workspace"]): SandboxResources | null {
+export function defaultSandboxResources(provider: SandboxProvider): SandboxResources | null {
   const size: SandboxResources | null = deploymentContract.providers[provider].default_resources;
-  return size && { ...size, ...(workspace ? { environment_disk_mib: 0 } : {}) };
+  return size && { ...size };
+}
+
+/** The workspace requirement a Provider takes from the selected storage; none when it owns its workspaces or no storage is selected. */
+export function selectedWorkspace(provider: SandboxProvider, storage: { tenant_capacity_mib: number } | null | undefined): SandboxSpecification["workspace"] {
+  const policy = deploymentContract.providers[provider];
+  return storage && "workspace" in policy ? { ...policy.workspace, capacity_quota: storage.tenant_capacity_mib > 0 } : undefined;
 }
 
-/** Core keeps owned disk limits; external workspace capacity is optional and requires real quota support. */
+/** A Provider that declares a workspace policy runs every Environment on the selected storage; its environment disk is only a quota request. */
 export function validSandboxResources(provider: SandboxProvider, resources: SandboxResources, workspace?: SandboxSpecification["workspace"]): boolean {
   const policy = deploymentContract.providers[provider];
-  if (workspace) {
-    if (!("workspace" in policy) || workspace.attachment !== policy.workspace.attachment || (policy.workspace.user_xattr && !workspace.user_xattr) || ((resources.environment_disk_mib ?? 0) > 0 && !workspace.capacity_quota)) return false;
-  }
+  if ("workspace" in policy !== Boolean(workspace)) return false;
+  if (workspace && "workspace" in policy && (workspace.attachment !== policy.workspace.attachment || (policy.workspace.user_xattr && !workspace.user_xattr))) return false;
   return deploymentContract.resources.every((rule) => {
-    const [min, max] = workspace && rule.name === "environment_disk_mib" && (resources.environment_disk_mib ?? 0) === 0 ? [0, 0] : !rule.omit_zero ? [rule.min, rule.max] : deploymentContract.providers[provider].disk ? [deploymentContract.minimum_disk, rule.max] : [0, 0];
     const value = resources[rule.name] ?? 0;
+    const [min, max] = !rule.omit_zero ? [rule.min, rule.max] : rule.name === "environment_disk_mib" && workspace?.capacity_quota ? [value === 0 ? 0 : deploymentContract.minimum_disk, rule.max] : rule.name === "root_disk_mib" && policy.disk ? [deploymentContract.minimum_disk, rule.max] : [0, 0];
     return Number.isInteger(value) && value >= min && value <= max;
   });
 }
 
-const releasePatterns = Object.fromEntries(deploymentContract.runtime.map(({ name, pattern }) => [name, new RegExp(`^(?:${pattern})$`)])) as Record<keyof SandboxRuntimeRelease, RegExp>;
-
-export const RUNTIME_RELEASE_FIELDS = deploymentContract.runtime.map(({ name }) => name);
-
-export function isRuntimeReleaseField(field: keyof SandboxRuntimeRelease, value: string): boolean {
-  return releasePatterns[field].test(value);
-}
-
-export function isRuntimeRelease(value: Partial<SandboxRuntimeRelease>): value is SandboxRuntimeRelease {
-  return RUNTIME_RELEASE_FIELDS.every((field) => typeof value[field] === "string" && releasePatterns[field].test(value[field]));
-}
-
 export function savedSpecification(provider: SandboxProvider, savedProvider?: SandboxProvider | "", specification?: SandboxSpecification): SandboxSpecification | null {
   return provider === savedProvider && specification ? structuredClone(specification) : null;
 }
@@ -60,24 +44,3 @@ export function templateBuildStatus(build: SandboxE2BTemplateBuild | undefined):
 export function sandboxSize(deployment: SandboxDeployment): SandboxResources | null {
   return deployment.specification?.resources ?? templateBuildSize(deployment);
 }
-
-/**
- * At most how many sandboxes of this size a host's CPUs and memory hold at once,
- * each at its full limits; null while a figure or the size is unknown. A
- * suggestion for a node's limit, which Core itself never derives.
- */
-export function sandboxesThatFit(host: { cpus: number | null; memoryBytes: number | null }, size: Pick<SandboxResources, "cpus" | "memory_mib"> | null): number | null {
-  if (!size || host.cpus === null || host.memoryBytes === null || size.cpus <= 0 || size.memory_mib <= 0) return null;
-  return Math.min(Math.floor(host.cpus / size.cpus), Math.floor(host.memoryBytes / (size.memory_mib * 2 ** 20)));
-}
-
-/** The paired console serves one matched distribution; Core persists approval. */
-export async function distributionRuntime(signal: AbortSignal): Promise<SandboxRuntimeRelease> {
-  const response = await fetch("/node-install/manifest.json", { signal, credentials: "include", redirect: "error" });
-  if (!response.ok) throw new Error("distribution unavailable");
-  const manifest = await response.json() as Manifest;
-  const release = { source_commit: manifest.source_commit, image_id: manifest.images?.runtime, image_manifest_digest: manifest.image_manifest_digests?.runtime,
-    microsandbox_ref: manifest.runtime_ref, runtime_sha256: manifest.microsandbox?.runtime_sha256, firmware_sha256: manifest.microsandbox?.firmware_sha256 };
-  if (manifest.platform !== "linux/amd64" || !isRuntimeRelease(release)) throw new Error("invalid distribution");
-  return release;
-}
diff --git a/apps/web/src/features/sandbox/node-enrollment.test.ts b/apps/web/src/features/sandbox/node-enrollment.test.ts
index 74025f841..91d6273a9 100644
--- a/apps/web/src/features/sandbox/node-enrollment.test.ts
+++ b/apps/web/src/features/sandbox/node-enrollment.test.ts
@@ -31,7 +31,6 @@ describe("node enrollment", () => {
     const connected = { ...fresh, online: true };
     expect(enrollmentProgress(connected, 0, 1_000)).toEqual({ stage: "connected", problem: "" });
     expect(enrollmentProgress(connected, 0, NODE_READY_WAIT_MS)).toEqual({ stage: "connected", problem: "provider_unavailable" });
-    expect(enrollmentProgress({ ...connected, diagnostic: "host_unsupported" }, 0, 1_000)).toEqual({ stage: "connected", problem: "host_unsupported" });
     expect(enrollmentProgress({ ...connected, provider_ready: true }, 0, NODE_READY_WAIT_MS * 2)).toEqual({ stage: "ready", problem: "" });
   });
 
diff --git a/apps/web/src/features/sandbox/node-enrollment.ts b/apps/web/src/features/sandbox/node-enrollment.ts
index 93328f795..067a41b9f 100644
--- a/apps/web/src/features/sandbox/node-enrollment.ts
+++ b/apps/web/src/features/sandbox/node-enrollment.ts
@@ -95,5 +95,5 @@ export function enrollmentProgress(node: SandboxNode | null, appearedAt: number
   if (node.online && node.provider_ready) return { stage: "ready", problem: "" };
   const late = appearedAt !== undefined && now - appearedAt >= NODE_READY_WAIT_MS;
   if (!node.online) return { stage: "registered", problem: late ? "not_connected" : "" };
-  return { stage: "connected", problem: node.diagnostic || late ? nodeProviderDiagnostic(node) : "" };
+  return { stage: "connected", problem: late ? nodeProviderDiagnostic(node) : "" };
 }
diff --git a/apps/web/src/features/sandbox/sandbox-deployment-write.test.ts b/apps/web/src/features/sandbox/sandbox-deployment-write.test.ts
index 552b4f541..be04e2036 100644
--- a/apps/web/src/features/sandbox/sandbox-deployment-write.test.ts
+++ b/apps/web/src/features/sandbox/sandbox-deployment-write.test.ts
@@ -5,7 +5,7 @@ import { sandboxAdmin, sandboxDeploymentQuery } from "./sandbox-queries";
 import { writeSandboxDeployment } from "./sandbox-deployment-write";
 import { sandboxWriteOwnershipQuery } from "./sandbox-write-ownership";
 
-const deployment: SandboxDeployment = { credential_configured: false, configuration: {}, metadata: {}, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 0 } }, installation_id: "i", owner_epoch: 1, generation: 1, provider: "docker", core_url: "http://core", mode: "nodes", reset: null, resources: { allocations: 0, pending: 0 }, suspension: null };
+const deployment: SandboxDeployment = { credential_configured: false, configuration: {}, metadata: {}, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, unknown: 0 } }, installation_id: "i", owner_epoch: 1, generation: 1, provider: "docker", core_url: "http://core", mode: "nodes", reset: null, resources: { allocations: 0, pending: 0 }, suspension: null };
 function deferred<T>() {
   let resolve!: (value: T) => void;
   let reject!: (error: Error) => void;
diff --git a/apps/web/src/features/sandbox/sandbox-queries.test.ts b/apps/web/src/features/sandbox/sandbox-queries.test.ts
index 643c2fab4..62bef4afb 100644
--- a/apps/web/src/features/sandbox/sandbox-queries.test.ts
+++ b/apps/web/src/features/sandbox/sandbox-queries.test.ts
@@ -9,7 +9,7 @@ const reset: SandboxReset = {
   remaining: { busy: 1, idle: 0, cleanup: 1, on_offline_nodes: 1, offline_nodes: [{ node_id: "node-a", name: "Offline host", resources: 1 }] },
 };
 const deployment = (overrides: Partial<SandboxDeployment> = {}): SandboxDeployment => ({ credential_configured: false, configuration: {}, metadata: {},
-  rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 0 } }, installation_id: "installation-a", provider: "docker", core_url: "https://core.example", reset,
+  rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, unknown: 0 } }, installation_id: "installation-a", provider: "docker", core_url: "https://core.example", reset,
   owner_epoch: 1, generation: 2, mode: "nodes", resources: { allocations: 2, pending: 0 }, suspension: null, ...overrides,
 });
 const clients: QueryClient[] = [];
@@ -18,7 +18,7 @@ afterEach(() => { for (const client of clients.splice(0)) client.clear(); vi.res
 
 describe("sandbox reset reads", () => {
   it("polls only Core preparation or reset, never settled old resources or failed/unknown nodes", () => {
-    const settled = deployment({ reset: null, rollout: { state: "settled", previous_generation_sandboxes: 9, nodes: { ready: 0, preparing: 0, failed: 2, update_required: 1, unknown: 3 } } });
+    const settled = deployment({ reset: null, rollout: { state: "settled", previous_generation_sandboxes: 9, nodes: { ready: 0, preparing: 0, failed: 2, unknown: 3 } } });
     expect(sandboxResetPollInterval(settled)).toBe(false);
     expect(sandboxResetPollInterval({ ...settled, rollout: { ...settled.rollout, state: "preparing" } })).toBe(5000);
     expect(sandboxResetPollInterval({ ...settled, reset })).toBe(5000);
diff --git a/apps/web/src/features/sandbox/sandbox-queries.ts b/apps/web/src/features/sandbox/sandbox-queries.ts
index 5bf2fe68d..81029f64e 100644
--- a/apps/web/src/features/sandbox/sandbox-queries.ts
+++ b/apps/web/src/features/sandbox/sandbox-queries.ts
@@ -3,7 +3,6 @@ import { queryOptions, useQuery } from "@tanstack/react-query";
 
 import { confirmSandboxRead, startSandboxRead } from "./sandbox-write-ownership";
 import { sandboxConsoleConfig } from "./console-config";
-import { distributionRuntime } from "./deployment-specification";
 
 /**
  * Cache entries for the sandbox deployment (`/core/v1/sandbox`). Every read
@@ -25,14 +24,6 @@ export const sandboxConsoleConfigQuery = queryOptions({
   },
 });
 
-/** The Runtime release of this console's distribution manifest, the release its node installer verifies; null when it serves none. */
-export const distributionRuntimeQuery = queryOptions({
-  queryKey: ["sandbox-runtime-release"],
-  queryFn: ({ signal }) => distributionRuntime(signal).catch(() => null),
-  staleTime: Infinity,
-  retry: false,
-});
-
 /** The deployment alone, for pages that only describe it. */
 export const sandboxDeploymentQuery = queryOptions<SandboxDeployment>({
   queryKey: [...sandboxScope, "deployment"],
diff --git a/apps/web/src/features/sandbox/use-sandbox-page-state.test.tsx b/apps/web/src/features/sandbox/use-sandbox-page-state.test.tsx
index 8ce16999d..63c8667c2 100644
--- a/apps/web/src/features/sandbox/use-sandbox-page-state.test.tsx
+++ b/apps/web/src/features/sandbox/use-sandbox-page-state.test.tsx
@@ -6,7 +6,7 @@ import { node } from "../overview/test-fixtures";
 import { sandboxAdmin, sandboxDeploymentQuery, sandboxSnapshotQuery } from "./sandbox-queries";
 import { useSandboxPageState } from "./use-sandbox-page-state";
 
-const configured: SandboxDeployment = { credential_configured: false, configuration: {}, metadata: {}, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "http://core", reset: null, owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 1, pending: 0 }, suspension: null };
+const configured: SandboxDeployment = { credential_configured: false, configuration: {}, metadata: {}, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "http://core", reset: null, owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 1, pending: 0 }, suspension: null };
 const resetting: SandboxDeployment = { ...configured, reset: { clear: "auto", requested_at: "2026-09-27T10:00:00Z", deadline_at: "2026-09-27T11:00:00Z", forced_at: null, remaining: { busy: 1, idle: 0, cleanup: 0, on_offline_nodes: 0, offline_nodes: [] } } };
 const clients: QueryClient[] = [];
 function cache() {
diff --git a/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx b/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx
index b668a1599..1f46ea59c 100644
--- a/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx
+++ b/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx
@@ -1,4 +1,4 @@
-import { AgentCoreError, type ExecutorCredential, type IssuedExecutorCredential } from "@oac/agents-client";
+import { AgentCoreError, randomUuid, type ExecutorCredential, type IssuedExecutorCredential } from "@oac/agents-client";
 import { useQuery } from "@tanstack/react-query";
 import { Plus } from "lucide-react";
 import { useEffect, useState } from "react";
@@ -24,16 +24,6 @@ import { ExecutorConnectionPanel } from "./ExecutorConnectionPanel";
 /** An issuance that gets no answer in this time has an unknown outcome. */
 const WRITE_TIMEOUT_MS = 30_000;
 
-/** A key ID for a new credential. Plain-HTTP consoles lack `crypto.randomUUID`, so it falls back to a v4 UUID. */
-function newKeyId(): string {
-  if (typeof crypto.randomUUID === "function") return crypto.randomUUID();
-  const bytes = crypto.getRandomValues(new Uint8Array(16));
-  bytes[6] = (bytes[6]! & 0x0f) | 0x40;
-  bytes[8] = (bytes[8]! & 0x3f) | 0x80;
-  const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
-
 /**
  * A write either failed before Core acted ("rejected", with Core's error) or
  * has an unknown outcome: no answer, a timeout, a 5xx or an unreadable reply.
@@ -135,7 +125,7 @@ export function ExecutorCredentialsSection({ projectId, sessionId, environmentId
   const issue = async () => {
     if (busy) return;
     // A listed key ID is managed from its row; reusing it would recover a credential that was since rotated or revoked.
-    const keyId = kept !== null && !credentials?.some((credential) => sameKey(credential.key_id, kept)) ? kept : newKeyId();
+    const keyId = kept !== null && !credentials?.some((credential) => sameKey(credential.key_id, kept)) ? kept : randomUuid();
     setKept(keyId);
     setIssuing(true);
     try {
diff --git a/apps/web/src/features/settings/WorkspaceStorageSettings.tsx b/apps/web/src/features/settings/WorkspaceStorageSettings.tsx
index 78c55c1af..a0146d3c2 100644
--- a/apps/web/src/features/settings/WorkspaceStorageSettings.tsx
+++ b/apps/web/src/features/settings/WorkspaceStorageSettings.tsx
@@ -1,4 +1,4 @@
-import { type WorkspaceStorageSelection } from "@oac/agents-client";
+import { randomUuid, type WorkspaceStorageSelection } from "@oac/agents-client";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useId, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
@@ -21,7 +21,7 @@ function StorageEditor({ current, replacement, onClose }: { current: WorkspaceSt
   const formId = useId();
   // Retain this identity across failed or uncertain saves. Credentials never enter the query cache.
   const [selection] = useState(current);
-  const [configurationId] = useState(() => replacement ? crypto.randomUUID() : selection?.id ?? "");
+  const [configurationId] = useState(() => replacement ? randomUuid() : selection?.id ?? "");
   const selectionChanged = !replacement && (!selection || current?.id !== selection.id);
   const [adapter, setAdapter] = useState(current?.adapter ?? "");
   const [parameters, setParameters] = useState(JSON.stringify(current?.parameters ?? {}, null, 2));
@@ -61,7 +61,7 @@ function StorageEditor({ current, replacement, onClose }: { current: WorkspaceSt
     <form id={formId} className="form-stack" onSubmit={(event) => { event.preventDefault(); void save(); }}>
       {replacement ? <>
         <p>{t("newSelection")}</p>
-        <a href={docsUrl("docs/configuration#independent-workspace-storage", i18n.resolvedLanguage)} target="_blank" rel="noreferrer">{t("instructions")}</a>
+        <a href={docsUrl("docs/getting-started/workspace-storage", i18n.resolvedLanguage)} target="_blank" rel="noreferrer">{t("instructions")}</a>
         <div className="field"><div className="field-label-row"><label htmlFor={`${formId}-adapter`}>{t("adapter")}</label><HelpTip>{t("adapterHelp")}</HelpTip></div><input id={`${formId}-adapter`} value={adapter} onChange={(event) => setAdapter(event.target.value)} required disabled={busy} /></div>
         <div className="field"><div className="field-label-row"><label htmlFor={`${formId}-parameters`}>{t("parameters")}</label><HelpTip>{t("parametersHelp")}</HelpTip></div><textarea id={`${formId}-parameters`} rows={8} value={parameters} onChange={(event) => setParameters(event.target.value)} disabled={busy} spellCheck={false} /></div>
         <div className="field"><div className="field-label-row"><label htmlFor={`${formId}-credential`}>{t("credential")}</label><HelpTip>{t("credentialHelp")}</HelpTip></div><input id={`${formId}-credential`} type="password" value={credential} onChange={(event) => setCredential(event.target.value)} disabled={busy} autoComplete="new-password" spellCheck={false} /></div>
diff --git a/apps/web/src/features/skills/skill-operations.ts b/apps/web/src/features/skills/skill-operations.ts
index 52fd7a2c1..3df3f118b 100644
--- a/apps/web/src/features/skills/skill-operations.ts
+++ b/apps/web/src/features/skills/skill-operations.ts
@@ -3,27 +3,12 @@ import { AgentCoreError, type Skill, type SkillVersion } from "@oac/agents-clien
 import type { ProjectClient } from "../../lib/projects";
 import { appendCollectionPage } from "../../lib/collection-pagination";
 
-/**
- * Skill navigation support, from the first Skill list request:
- * - `supported`: the list succeeded;
- * - `unsupported`: 404 or 405, an older Core without Skills (hide the entry);
- * - `error`: anything else (show the entry with a retry).
- */
-export type SkillsSupport = "supported" | "unsupported" | "error";
-
 export const SKILLS_PAGE_SIZE = 20;
 
 export function isAbortError(error: unknown): boolean {
   return (error instanceof DOMException || error instanceof Error) && error.name === "AbortError";
 }
 
-export function classifySkillsError(error: unknown): Exclude<SkillsSupport, "supported"> {
-  if (error instanceof AgentCoreError) {
-    if (error.status === 404 || error.status === 405) return "unsupported";
-  }
-  return "error";
-}
-
 /** Core rejects deleting the default while other versions remain (400 invalid_value on `version`). */
 export function isDefaultVersionConflict(error: unknown): boolean {
   return error instanceof AgentCoreError && error.status === 400 && error.code === "invalid_value" && error.param === "version";
diff --git a/apps/web/src/features/system/ModelProviderDialog.tsx b/apps/web/src/features/system/ModelProviderDialog.tsx
index 9a145278f..b62a876ff 100644
--- a/apps/web/src/features/system/ModelProviderDialog.tsx
+++ b/apps/web/src/features/system/ModelProviderDialog.tsx
@@ -1,4 +1,4 @@
-import { AgentCoreError, type CoreHarness, type CoreHarnessKind, type ModelProviderInput } from "@oac/agents-client";
+import { AgentCoreError, type CoreHarness, type CoreHarnessKind, type ModelProviderInput, tokenLimitsFit } from "@oac/agents-client";
 import { useId, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { ConsoleSelect } from "../../components/console-select";
@@ -56,7 +56,6 @@ export function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
   const configuration = harness?.model_configuration ?? null;
   const current = configuration?.model_provider ?? null;
   const support = harness?.model_configuration_support;
-  const limitsRequired = support?.token_limits_required ?? false;
   const protocolOptions = (support?.protocols ?? []).map((value) => ({ value, label: protocolNames[value] }));
   const [protocol, setProtocol] = useState<Protocol | "">(current?.protocol ?? support?.protocols[0] ?? "");
   const [baseUrl, setBaseUrl] = useState(current?.base_url ?? "");
@@ -64,7 +63,7 @@ export function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
   const [model, setModel] = useState(configuration?.model ?? "");
   const [configText, setConfigText] = useState(JSON.stringify(configuration?.harness_config ?? {}, null, 2));
   const [configTouched, setConfigTouched] = useState(false);
-  const [advancedOpen, setAdvancedOpen] = useState(Boolean(configuration && (Object.keys(configuration.harness_config ?? {}).length || current?.context_window || current?.max_output_tokens)) || limitsRequired);
+  const [advancedOpen, setAdvancedOpen] = useState(Boolean(configuration && (Object.keys(configuration.harness_config ?? {}).length || current?.context_window || current?.max_output_tokens)));
   let nativeConfig: Record<string, unknown> | null = null;
   try {
     const parsed: unknown = configText.trim() ? JSON.parse(configText) : {};
@@ -84,12 +83,12 @@ export function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
   const url = baseUrl.trim();
   const urlProblem = url && !isProviderUrl(url) ? t("models.form.baseUrlInvalid") : null;
   const context = tokenLimit(contextWindow);
-  const output = tokenLimit(maxOutputTokens);
+  const output = tokenLimit(support?.accepts_max_output_tokens ? maxOutputTokens : "");
   const limitProblem = (limit: ReturnType<typeof tokenLimit>) => (limit.problem === "whole" ? t("models.form.wholeNumber") : limit.problem === "large" ? t("models.form.tooLarge") : null);
   const outputProblem = limitProblem(output);
-  // The missing or undersized window is the field the administrator must fix.
-  const contextProblem = limitProblem(context) ?? (!outputProblem && output.value !== undefined && output.value > (context.value ?? 0) ? t("models.form.needsContext") : null);
-  const ready = harness !== null && !busy && url !== "" && !urlProblem && apiKey.trim() !== "" && model.trim() !== "" && nativeConfig !== null && !configTooLarge && !protocolProblem && (!limitsRequired || Boolean(context.value && output.value)) && !contextProblem && !outputProblem;
+  // An undersized window is the field the administrator must fix.
+  const contextProblem = limitProblem(context) ?? (!outputProblem && !tokenLimitsFit(context.value, output.value) ? t("models.form.needsContext") : null);
+  const ready = harness !== null && !busy && url !== "" && !urlProblem && apiKey.trim() !== "" && model.trim() !== "" && nativeConfig !== null && !configTooLarge && !protocolProblem && !contextProblem && !outputProblem;
 
   function clearNativeConfig() {
     setConfigText("{}");
@@ -133,7 +132,7 @@ export function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
       <div className="field">
         <span className="field-label-row">
           <label htmlFor={inputId}>{t(field === "context" ? "models.contextWindow" : "models.maxOutputTokens")}</label>
-          <HelpTip id={`${inputId}-help`}>{t(`models.form.${field}Help${limitsRequired ? "Required" : ""}`)}</HelpTip>
+          <HelpTip id={`${inputId}-help`}>{t(`models.form.${field}Help`)}</HelpTip>
         </span>
         <input
           id={inputId}
@@ -141,7 +140,6 @@ export function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
           autoComplete="off"
           value={value}
           onChange={(event) => { setValue(event.target.value); setRejection(null); setError(null); }}
-          aria-required={limitsRequired}
           aria-invalid={problem ? true : undefined}
           aria-describedby={`${inputId}-help${problem ? ` ${inputId}-problem` : ""}`}
         />
@@ -222,7 +220,7 @@ export function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
             </div> : null}
             <div className="system-model-limits">
               {limitField("context", contextWindow, setContextWindow, contextProblem)}
-              {limitField("output", maxOutputTokens, setMaxOutputTokens, outputProblem)}
+              {support?.accepts_max_output_tokens ? limitField("output", maxOutputTokens, setMaxOutputTokens, outputProblem) : null}
             </div>
           </div>
         </details>
diff --git a/apps/web/src/i18n/locales/en/core-errors.ts b/apps/web/src/i18n/locales/en/core-errors.ts
index e90ef877f..6e38ff03c 100644
--- a/apps/web/src/i18n/locales/en/core-errors.ts
+++ b/apps/web/src/i18n/locales/en/core-errors.ts
@@ -2,6 +2,7 @@
 export const coreErrors = {
   "invalid_workspace_configuration": "Invalid workspace storage configuration.",
   "workspace_operation_unsupported": "The selected workspace storage does not support the operation or sandbox combination.",
+  "workspace_storage_required": "This sandbox provider needs workspace storage. Select workspace storage first.",
   "workspace_storage_not_found": "Workspace storage is not configured or the requested object does not exist.",
   "workspace_storage_conflict": "Workspace storage ownership or configuration conflicts with the current state.",
   "workspace_storage_unavailable": "Workspace storage is unavailable or an operation remains unconfirmed.",
@@ -18,8 +19,8 @@ export const coreErrors = {
   "model_provider_base_url_invalid": "Use an HTTPS URL without credentials, query parameters or a fragment.",
   "model_provider_protocol_unsupported": "This protocol is not supported by the Harness.",
   "model_provider_api_key_invalid": "Enter a valid API key without control characters.",
-  "model_provider_token_limits_invalid": "Use valid token limits; output cannot exceed context, and required limits must be positive.",
-  "invalid_sandbox_configuration": "Check the sandbox resources and Runtime release.",
+  "model_provider_token_limits_invalid": "Use valid token limits; output cannot exceed context.",
+  "invalid_sandbox_configuration": "Check the sandbox resources.",
   "project_archived": "This Project is archived.",
   "project_exists": "A Project with this name already exists.",
   "project_api_key_exists": "An active API key with this name already exists.",
@@ -57,6 +58,5 @@ export const coreErrorDetails = {
   "protocols": "Allowed protocols: {{protocols}}.",
   "keyLimit": "Enter a valid API key of at most {{max}} characters.",
   "resourceRange": "Enter a whole number from {{min}} to {{max}}.",
-  "resourceMin": "Enter a whole number of at least {{min}}.",
-  "runtime": "Use a valid immutable Runtime release for this backend."
+  "resourceMin": "Enter a whole number of at least {{min}}."
 } as const;
diff --git a/apps/web/src/i18n/locales/en/metrics.ts b/apps/web/src/i18n/locales/en/metrics.ts
index eee22ec69..5abbf61aa 100644
--- a/apps/web/src/i18n/locales/en/metrics.ts
+++ b/apps/web/src/i18n/locales/en/metrics.ts
@@ -110,8 +110,6 @@ export const metrics = {
     loading: "Reading Core metrics…",
     failed: "Core metrics could not be read. {{reason}}",
     stale: "Refresh failed; showing the last metrics read. {{reason}}",
-    missingTitle: "Core does not report its own metrics yet",
-    missingDescription: "Core needs to provide /core/v1/metrics before execution, database and background jobs can show.",
     kpiLabel: "Core summary",
     meta: "{{status}} · {{revision}} · up {{uptime}}",
     notOwner: "Does not hold the execution lease",
diff --git a/apps/web/src/i18n/locales/en/sessions.ts b/apps/web/src/i18n/locales/en/sessions.ts
index 00285837d..3384645fe 100644
--- a/apps/web/src/i18n/locales/en/sessions.ts
+++ b/apps/web/src/i18n/locales/en/sessions.ts
@@ -1,11 +1,6 @@
 import { coreHarnessNames } from "@oac/agents-client";
 
-/**
- * Session log and one Session's read-only history (Monitor › Session log).
- * `validation` and `actions.errors` serve the retired Session-creation and
- * metadata helpers that the orphaned API workbench still imports; remove them
- * together with that code.
- */
+/** Session log and one Session's read-only history (Monitor › Session log). */
 export const sessions = {
   common: {
     agent: "Agent", session: "Session", status: "Status", unknown: "Unknown", unavailable: "Unavailable", untitledAgent: "Unnamed Agent",
@@ -272,25 +267,4 @@ export const sessions = {
     toolDurationSentence: "Tool-reported duration: {{duration}}.", toolDuration: "Tool-reported duration: {{duration}}", durationUnknown: "Reported duration is unknown.", durationInvalid: "The reported duration could not be interpreted.", perItemNotProvided: "Per-item timing not provided by Core.", perItemTimingMissing: "Core does not provide per-item timing.",
     turnDuration: "Turn {{duration}}", turnTimeUnknown: "Turn time unknown", turnTimeNotProvided: "Turn time not provided", payloadAvailable: "Payload available", resultAvailable: "Result available", noPreview: "No preview available", configuredInstructions: "Configured instructions", userMessage: "User message", assistantMessage: "Assistant message", unsupportedItem: "Unsupported Item", agentConfiguration: "Agent configuration", turnNumber: "Turn {{number}}", unassociatedItemsNumber: "Unassociated Items {{number}}", unknownCount: "{{count}} unknown",
   },
-  actions: {
-    errors: {
-      metadataConflict: "Metadata changed in OpenAgentCore while you were editing: {{keys}}. Your draft was kept; review the latest values before saving again.",
-      metadataValidJson: "Metadata must be valid JSON.", metadataObject: "Metadata must be a JSON object.", metadataStringValues: "Every metadata value must be a string.",
-      metadataTitleField: "Edit title in the Title field, not in additional metadata.", metadataMaxPairs: "Session metadata supports at most 16 pairs, including title.", metadataLength: "Metadata keys must be at most 64 characters and values at most 512 characters.",
-      invalidRetrieval: "OpenAgentCore returned an invalid Session retrieval response. The Web kept its current durable view and did not send a write.",
-      updateLabel: "update", deletionLabel: "deletion", notFound: "This Session was not found in OpenAgentCore. The Web kept its current durable view; refresh Sessions before trying again.",
-      busyDelete: "OpenAgentCore deletes a Session only when it is idle or failed without required actions. This Session still has queued, running or waiting work or pending input, so nothing was changed. Choose Cancel work and delete to cancel it, wait until it is idle and then delete it.",
-      readLifecycleConflict: "The latest Session could not be retrieved because this compatible Core returned a lifecycle conflict (409), so no update request was sent. Your draft and current durable view were kept.",
-      writeLifecycleConflict: "This compatible Core rejected the Session {{action}} because it conflicts with the current lifecycle state. The Web did not retry.",
-      noUpdateSent: "No update request was sent.", unknownWriteSuffix: "The write result is unknown. The Web kept its current durable view and did not retry; refresh before deciding whether to try again.",
-      coreUnavailable: "OpenAgentCore could not complete the Session {{action}} ({{status}}). {{suffix}}", uncertainStatus: "The Session {{action}} result is uncertain after OpenAgentCore returned {{status}}. The Web kept its current durable view and did not retry; refresh before deciding whether to try again.",
-      readFailureWithDetail: "{{detail}} No update request was sent; your draft and current durable view were kept.", writeFailureWithDetail: "{{detail}} The Web kept its current durable view and did not retry.",
-      latestReadFailure: "The latest Session could not be retrieved, so no update request was sent. Your draft and the current durable view were kept.", unknownConnection: "The Session {{action}} result is unknown because the connection ended before Core confirmed it. The Web kept its current durable view and did not retry; refresh before deciding whether to try again.",
-      invalidUpdateConfirmation: "OpenAgentCore returned an invalid Session update confirmation. The write result is unknown; the Web kept its current durable view and did not retry.",
-      inputPending: "OpenAgentCore deletes a Session only when it is idle or failed without required actions. This Session has input waiting to start in its Environment, which cannot be cancelled, so nothing was changed. Delete it after that input starts, expires or fails; once it starts, cancel its work first.",
-      invalidDeletionConfirmation: "OpenAgentCore returned an invalid deletion confirmation. The Web kept the Session; refresh durable state before taking another action.",
-      cancelRejected: "OpenAgentCore rejected the cancellation ({{status}}): {{detail}}", cancelUnknown: "The cancellation result is unknown because the connection ended before Core confirmed it.", cancelDeleteKept: "{{detail}} The Session was not deleted and the Web did not retry.",
-      waitReadFailure: "Cancellation was requested, but the Session could not be read while waiting for it to become idle. It was not deleted.", waitTimeout: "Cancellation was requested, but the Session was still {{status}} after {{seconds}} seconds. It was not deleted; try again once it is idle.",
-    },
-  },
 } as const;
diff --git a/apps/web/src/i18n/locales/en/system.ts b/apps/web/src/i18n/locales/en/system.ts
index 4fd419cf0..c5230056a 100644
--- a/apps/web/src/i18n/locales/en/system.ts
+++ b/apps/web/src/i18n/locales/en/system.ts
@@ -81,9 +81,7 @@ export const system = {
       baseUrlInvalid: "Enter an HTTPS URL with a hostname and no credentials, query or fragment, such as https://api.example.com/v1.",
       apiKeyHelp: "Required every time. Core encrypts it and never shows it again.",
       contextHelp: "The model's context window, in tokens. Optional.",
-      contextHelpRequired: "The model's context window, in tokens. This Harness requires it.",
       outputHelp: "The most tokens the model writes in one response. Optional; it needs a context window at least as large.",
-      outputHelpRequired: "The most tokens the model writes in one response. This Harness requires it, with a context window at least as large.",
       protocolHelp: "Choose a protocol supported by both this Harness and your model provider.",
       wholeNumber: "Enter a whole number.",
       tooLarge: "Enter a whole number up to 2147483647.",
diff --git a/apps/web/src/i18n/locales/en/templates.ts b/apps/web/src/i18n/locales/en/templates.ts
index c5e7a0f9a..929094790 100644
--- a/apps/web/src/i18n/locales/en/templates.ts
+++ b/apps/web/src/i18n/locales/en/templates.ts
@@ -18,9 +18,7 @@ export const templates = {
     plugins: "Plugins", updated: "Updated", actions: "Actions",
   },
   access: { enabled: "Enabled", disabled: "Disabled", restricted: "Restricted" },
-  accessHelp: {
-    restricted: "Native tools can reach only the listed hostnames. Subdomains and redirect targets need their own entries.",
-  },
+  accessHelp: "Sessions with this policy are rejected, because the Runtime does not restrict network access.",
   edit: "Edit",
   delete: "Delete",
   deleteLabel: "Delete {{name}}",
diff --git a/apps/web/src/i18n/locales/zh-CN/core-errors.ts b/apps/web/src/i18n/locales/zh-CN/core-errors.ts
index 025305f7c..570ab2c25 100644
--- a/apps/web/src/i18n/locales/zh-CN/core-errors.ts
+++ b/apps/web/src/i18n/locales/zh-CN/core-errors.ts
@@ -1,6 +1,7 @@
 export const coreErrors = {
   "invalid_workspace_configuration": "工作区存储配置无效。",
   "workspace_operation_unsupported": "所选工作区存储不支持该操作或沙箱组合。",
+  "workspace_storage_required": "该沙箱提供方需要工作区存储。请先选择工作区存储。",
   "workspace_storage_not_found": "尚未配置工作区存储或请求的对象不存在。",
   "workspace_storage_conflict": "工作区存储归属或配置与当前状态冲突。",
   "workspace_storage_unavailable": "工作区存储不可用或操作尚未确认。",
@@ -17,8 +18,8 @@ export const coreErrors = {
   "model_provider_base_url_invalid": "请使用 HTTPS 地址，不要包含凭据、查询参数或片段。",
   "model_provider_protocol_unsupported": "此 Harness 不支持该协议。",
   "model_provider_api_key_invalid": "请输入有效的 API 密钥，不要包含控制字符。",
-  "model_provider_token_limits_invalid": "请填写有效的 token 限制；输出不能超过上下文，必填限制必须大于零。",
-  "invalid_sandbox_configuration": "请检查沙箱资源和 Runtime 版本。",
+  "model_provider_token_limits_invalid": "请填写有效的 token 限制；输出不能超过上下文。",
+  "invalid_sandbox_configuration": "请检查沙箱资源。",
   "project_archived": "此项目已归档。",
   "project_exists": "此项目名称已被使用。",
   "project_api_key_exists": "此名称已被使用中的 API 密钥占用。",
@@ -55,6 +56,5 @@ export const coreErrorDetails = {
   "protocols": "支持的协议：{{protocols}}。",
   "keyLimit": "请输入有效的 API 密钥，长度最多 {{max}} 个字符。",
   "resourceRange": "请输入 {{min}} 到 {{max}} 的整数。",
-  "resourceMin": "请输入不小于 {{min}} 的整数。",
-  "runtime": "请使用适用于此沙箱提供商的有效不可变 Runtime 版本。"
+  "resourceMin": "请输入不小于 {{min}} 的整数。"
 } as const;
diff --git a/apps/web/src/i18n/locales/zh-CN/metrics.ts b/apps/web/src/i18n/locales/zh-CN/metrics.ts
index 01e03a2da..6c37faea6 100644
--- a/apps/web/src/i18n/locales/zh-CN/metrics.ts
+++ b/apps/web/src/i18n/locales/zh-CN/metrics.ts
@@ -110,8 +110,6 @@ export const metrics = {
     loading: "正在读取 Core 指标…",
     failed: "无法读取 Core 指标。{{reason}}",
     stale: "刷新失败，显示的是上次读取的指标。{{reason}}",
-    missingTitle: "Core 尚未上报自身指标",
-    missingDescription: "需要 Core 提供 /core/v1/metrics，才能显示执行、数据库和后台任务。",
     kpiLabel: "Core 概况",
     meta: "{{status}} · {{revision}} · 已运行 {{uptime}}",
     notOwner: "未持有执行归属",
diff --git a/apps/web/src/i18n/locales/zh-CN/sandbox.ts b/apps/web/src/i18n/locales/zh-CN/sandbox.ts
index 850fd74c3..226abd64d 100644
--- a/apps/web/src/i18n/locales/zh-CN/sandbox.ts
+++ b/apps/web/src/i18n/locales/zh-CN/sandbox.ts
@@ -45,7 +45,6 @@ export const sandbox = {
   "Ready for target": "目标配置已就绪",
   "Preparing target": "正在准备目标配置",
   "Preparation failed": "目标配置准备失败",
-  "Node software incompatible": "节点程序不兼容",
   "Target readiness unknown": "目标配置就绪状态未知",
   "Target preparation": "目标配置准备状态",
   "Serving generation": "服务代次",
@@ -56,15 +55,13 @@ export const sandbox = {
   "Core is preparing the target configuration.": "Core 正在准备目标配置。",
   "Core reports no active preparation. This does not mean every node is ready.": "Core 报告当前没有正在进行的准备任务。这不代表所有节点都已就绪。",
   "Rollout state is unconfirmed. These are the last confirmed observations.": "配置更新状态尚未确认。当前显示的是上次确认的状态。",
-  "Review affected nodes for preparation errors, incompatible node software or an unconfirmed connection. Qualified earlier generations may still serve work.": "请检查相关节点的准备错误、不兼容的节点程序或尚未确认的连接。符合条件的旧代次仍可提供服务。",
+  "Review affected nodes for preparation errors or an unconfirmed connection. Qualified earlier generations may still serve work.": "请检查相关节点的准备错误或尚未确认的连接。符合条件的旧代次仍可提供服务。",
   "Existing sandboxes keep their configuration generation. Saving does not move them or prove the target is ready.": "现有沙箱保留所属配置代次。保存不会迁移沙箱，也不代表目标配置已就绪。",
   "Changes keep this backend and existing Sessions and nodes. Core prepares the new target for future work; placement may continue on qualified earlier generations.": "修改会保留当前沙箱提供商、现有 Session 和节点。Core 为后续任务准备新目标配置，期间仍可能将任务分配到符合条件的旧代次。",
-  "This node can't prepare new sandbox configurations and keeps serving the one it registered with. To move it to the current configuration, choose Remove node, then add the host again with Add node.": "该节点无法准备新的沙箱配置，会继续服务注册时的配置。要让它使用当前配置，请选择“移除节点”，再通过“添加节点”重新添加该主机。",
   "The saved serving generation is not proof that this node is online, ready or has free capacity.": "已保存的服务代次不代表节点当前在线、已就绪或有空闲容量。",
   "Node observations are from an earlier configuration generation. Refreshing does not change their owned sandboxes.": "节点观测来自较早的配置代次。刷新不会改变节点所属的沙箱。",
   "Leave blank to keep the saved key. Any key you enter is verified as a replacement, even if unchanged.": "留空可保留已保存的密钥。填写的密钥都会作为替换密钥进行验证，即使内容未变。",
   "These limits apply to the selected configuration generation. Existing sandboxes keep their limits. Concurrency is set per node.": "这些限制适用于所选配置代次。现有沙箱保留原有限制。并发数量按节点设置。",
-  "The target Runtime release. Existing sandboxes keep their owned release while nodes prepare the target.": "目标 Runtime 版本。节点准备目标版本时，现有沙箱仍使用其所属版本。",
   "Cancel editing to use Reset deployment. This change requires an explicit reset; the saved configuration is unchanged.": "取消编辑后可使用“重置部署”。此更改需要明确重置；已保存的配置未改变。",
 
   "Sandbox state is unconfirmed. Refresh before issuing a node command.": "沙箱状态尚未确认。请刷新后再生成节点命令。",
@@ -138,7 +135,6 @@ export const sandbox = {
   "Connection status unavailable. Refresh to check your node.": "连接状态暂不可用，请刷新以查看节点。",
   "Generate a new command to continue.": "请生成新命令后继续。",
   "Generate new command": "生成新命令",
-  "Set the sandbox limits for the host you want to add.": "为要添加的主机设置沙箱上限。",
   "Generate command": "生成命令",
   "Change limits": "修改上限",
   "Add another node": "添加另一个节点",
@@ -203,9 +199,11 @@ export const sandbox = {
   "Health": "健康状态",
   "Active / limit": "活跃 / 上限",
   "Sandboxes Core has placed on this node, against the most it places here at once.": "Core 在这台节点上放置的沙箱数，相对于同时运行的上限。",
-  "Host: {{host}}.": "主机：{{host}}。",
-  "Each sandbox: {{size}}.": "每个沙箱：{{size}}。",
-  "Suggested: at most {{count}} at once.": "建议同时运行不超过 {{count}} 个。",
+  "Limits": "上限",
+  "Custom": "自定义",
+  "Use recommended": "使用推荐值",
+  "Recommended: {{active}} at once, {{retained}} retained.": "推荐：同时运行 {{active}} 个，保留 {{retained}} 个。",
+  "Recommended: {{active}} at once.": "推荐：同时运行 {{active}} 个。",
   "Reserved": "已预留",
   "Retained / limit": "保留 / 上限",
   "Cleanup pending": "待清理",
@@ -263,17 +261,15 @@ export const sandbox = {
   "Sandbox ownership mismatch": "沙箱归属不一致",
   "Reconcile the assigned resource and its ownership record before resuming execution.": "请核对已分配资源及其归属记录，再恢复执行。",
   "Sandbox provider unavailable": "沙箱提供商不可用",
-  "Restore the provider on the assigned node, then refresh. Running the install command again on the host checks its requirements and names the fix; a manually registered node logs the local error.": "请恢复已分配节点上的沙箱提供商，然后刷新。在该主机上重新运行安装命令，会检查主机要求并指出修复方法；手动注册的节点会在日志中记录本地错误。",
+  "Restore the provider on the assigned node, then refresh. Running the install command again on the host checks its requirements and names the fix.": "请恢复已分配节点上的沙箱提供商，然后刷新。在该主机上重新运行安装命令，会检查主机要求并指出修复方法。",
   "Sandbox state needs attention": "沙箱状态需要检查",
   "Inspect the assigned node and resource, then refresh.": "请检查已分配节点和资源，然后刷新。",
   "Host unsupported": "主机不满足要求",
-  "The host lacks a capability its sandbox provider requires. Running the install command again on the host checks its requirements and names the fix; a manually registered node logs the local error.": "主机缺少沙箱提供商所需的能力。在该主机上重新运行安装命令，会检查主机要求并指出修复方法；手动注册的节点会在日志中记录本地错误。",
+  "The host lacks a capability its sandbox provider requires. Running the install command again on the host checks its requirements and names the fix.": "主机缺少沙箱提供商所需的能力。在该主机上重新运行安装命令，会检查主机要求并指出修复方法。",
   "Provider files missing": "沙箱提供商文件缺失",
   "Pinned provider files are missing or fail their checksum. Run the install command again.": "指定版本的沙箱提供商文件缺失或校验不通过。请重新运行安装命令。",
-  "Runtime download failed": "Runtime 下载失败",
-  "Runtime files could not be downloaded or verified. Check the node's network access and the configured Runtime release.": "Runtime 文件下载或验证失败。请检查节点网络连接及配置的 Runtime 发布版本。",
   "Runtime image missing": "缺少 Runtime 镜像",
-  "The pinned Runtime image isn't on the host. Run the install command again.": "主机上没有指定版本的 Runtime 镜像。请重新运行安装命令。",
+  "The Runtime image isn't on the host. Run the install command again.": "主机上没有 Runtime 镜像。请重新运行安装命令。",
   "Host too small": "主机资源不足",
   "The host has less CPU or memory than one sandbox needs. Use a bigger host or a smaller sandbox size.": "主机的 CPU 或内存不够运行一个沙箱。请换一台更大的主机，或调小沙箱规格。",
   "Connecting to this console's Core…": "正在连接此控制台的 Core…",
@@ -315,36 +311,23 @@ export const sandbox = {
   "{{cpus}} CPUs, {{memory}} MiB of memory. microsandbox disks are at least {{disk}} MiB.": "CPU {{cpus}} 核，内存 {{memory}} MiB；microsandbox 的磁盘至少 {{disk}} MiB。",
   "Advanced settings": "高级设置",
   "CPUs": "CPU（核）",
-  "Check this value": "请检查这个值",
   "Connect E2B": "连接 E2B",
   "Core address": "Core 地址",
   "Custom size in advanced settings": "在高级设置里自定义规格",
-  "Data disk at /environment (MiB)": "数据盘 /environment（MiB）",
-  "microsandbox, the recommended default, runs each sandbox as a lightweight virtual machine: stronger isolation and its own root and data disks with size limits, but the host needs KVM. Docker runs each sandbox as a container on the host's kernel: CPU and memory limits but no disk quota, for trusted workloads or hosts without KVM.": "microsandbox（推荐的默认沙箱提供商）：每个沙箱是一个轻量虚拟机，隔离更强，有独立的根盘和数据盘并能限制大小，但主机需要支持 KVM。Docker：每个沙箱是一个共用主机内核的容器，能限制 CPU 和内存，但没有磁盘配额，只适合可信的工作负载或没有 KVM 的主机。",
+  "Capacity quota at /environment (MiB)": "/environment 容量配额（MiB）",
+  "This backend runs every sandbox on workspace storage. Select it under Settings, Workspace storage first.": "这个后端的每个沙箱都运行在工作区存储上。请先在“设置”的“工作区存储”中选择。",
+  "microsandbox, the recommended default, runs each sandbox as a lightweight virtual machine: stronger isolation and a root disk size limit, with each sandbox's /environment on workspace storage, but the host needs KVM. Docker runs each sandbox as a container on the host's kernel: CPU and memory limits but no disk quota, for trusted workloads or hosts without KVM.": "microsandbox（推荐的默认沙箱提供商）：每个沙箱是一个轻量虚拟机，隔离更强，能限制根盘大小，每个沙箱的 /environment 位于工作区存储上，但主机需要支持 KVM。Docker：每个沙箱是一个共用主机内核的容器，能限制 CPU 和内存，但没有磁盘配额，只适合可信的工作负载或没有 KVM 的主机。",
   "E2B runs sandboxes in its cloud: no machines to manage, billed by E2B. Own machines run them on hosts you add, with microsandbox (recommended) or Docker.": "E2B 云端：沙箱跑在 E2B 的云上，不用管理机器，由 E2B 计费。自有机器：沙箱跑在你添加的主机上，用 microsandbox（推荐）或 Docker。",
   "Each sandbox": "每个沙箱",
-  "Filled in from this console's distribution when it serves one. Otherwise copy these from the distribution manifest that matches your nodes; image configuration IDs and manifest digests are different values.": "控制台提供发行清单时会自动填好；否则从与节点配套的发行清单里复制。镜像配置 ID 和清单摘要是两个不同的值。",
-  "Firmware SHA-256": "固件 SHA-256",
   "How big is each sandbox?": "每个沙箱多大？",
-  "Image ID": "镜像 ID",
-  "Image manifest digest": "镜像清单摘要",
   "Large": "大",
   "Memory (MiB)": "内存（MiB）",
   "Next": "下一步",
   "Review and save": "确认并保存",
   "Root disk (MiB)": "根盘（MiB）",
-  "Root disk {{root}} · data disk {{data}}": "根盘 {{root}} · 数据盘 {{data}}",
-  "Runtime": "Runtime",
-  "Saved <saved/> · this installation serves <served/>": "已保存 <saved/> · 本安装提供 <served/>",
-  "Other changes keep the saved Runtime. Existing sandboxes keep their Runtime while nodes prepare the new one.": "其他修改会保留已保存的 Runtime。节点准备新 Runtime 期间，现有沙箱继续使用原来的 Runtime。",
-  "Use this installation's Runtime": "使用本安装的 Runtime",
-  "Runtime SHA-256": "Runtime SHA-256",
-  "Runtime release": "Runtime 版本",
-  "Runtime release needed": "需要 Runtime 版本",
   "Sandboxes run on": "运行在",
   "Saving…": "保存中…",
   "Small": "小",
-  "Source commit": "源码提交",
   "Standard": "标准",
   "Template build": "模板构建",
   "Ready": "就绪",
@@ -355,7 +338,6 @@ export const sandbox = {
   "After {{idle}} · kept {{retention}}": "{{idle}}后 · 保留 {{retention}}",
   "Current": "当前规格",
   "The key is write-only: Core encrypts it and never shows it again.": "密钥只写入：Core 加密保存，之后不再显示。",
-  "This console serves no Runtime manifest. Enter the release under advanced settings.": "这个控制台没有提供 Runtime 清单，请在高级设置里填写。",
   "Where should sandboxes run?": "沙箱在哪里运行？",
   "Which sandbox backend?": "用哪个沙箱提供商？",
   "Recommended": "推荐",
@@ -368,7 +350,6 @@ export const sandbox = {
   "Docker suits only trusted workloads, or hosts without KVM.": "Docker 只适合可信的工作负载，或没有 KVM 的主机。",
   "Use Docker": "使用 Docker",
   "Keep microsandbox": "保留 microsandbox",
-  "microsandbox reference": "microsandbox 引用",
   "{{cpus}} CPU · {{memory}}": "{{cpus}} 核 · {{memory}}",
   "Save configuration": "保存配置",
   "Change the sandbox configuration": "修改沙箱配置",
diff --git a/apps/web/src/i18n/locales/zh-CN/sessions.ts b/apps/web/src/i18n/locales/zh-CN/sessions.ts
index d4135395a..cdec25270 100644
--- a/apps/web/src/i18n/locales/zh-CN/sessions.ts
+++ b/apps/web/src/i18n/locales/zh-CN/sessions.ts
@@ -272,27 +272,4 @@ export const sessions = {
     toolDurationSentence: "工具报告耗时：{{duration}}。", toolDuration: "工具报告耗时：{{duration}}", durationUnknown: "报告的耗时未知。", durationInvalid: "无法解析报告的耗时。", perItemNotProvided: "Core 未提供逐 Item 时间。", perItemTimingMissing: "Core 不提供逐 Item 时间。",
     turnDuration: "Turn {{duration}}", turnTimeUnknown: "Turn 耗时未知", turnTimeNotProvided: "未提供 Turn 耗时", payloadAvailable: "载荷可用", resultAvailable: "结果可用", noPreview: "无可用预览", configuredInstructions: "已配置指令", userMessage: "用户消息", assistantMessage: "助手消息", unsupportedItem: "不支持的 Item", agentConfiguration: "Agent 配置", turnNumber: "Turn {{number}}", unassociatedItemsNumber: "未关联 Item {{number}}", unknownCount: "{{count}} 个未知",
   },
-  actions: {
-    ...english.actions,
-    errors: {
-      ...english.actions.errors,
-      metadataConflict: "你编辑期间 OpenAgentCore 中的元数据已发生变化：{{keys}}。草稿已保留；请检查最新值后再保存。",
-      metadataValidJson: "元数据必须是有效的 JSON。", metadataObject: "元数据必须是 JSON 对象。", metadataStringValues: "每个元数据值都必须是字符串。",
-      metadataTitleField: "请在“标题”字段中编辑标题，不要放在其他元数据中。", metadataMaxPairs: "Session 元数据最多支持 16 个键值对（包括标题）。", metadataLength: "元数据键最多 64 个字符，值最多 512 个字符。",
-      invalidRetrieval: "OpenAgentCore 返回了无效的 Session 读取响应。Web 已保留当前持久化视图，且未发送写入请求。",
-      updateLabel: "更新", deletionLabel: "删除", notFound: "OpenAgentCore 中未找到此 Session。Web 已保留当前持久化视图；请刷新 Session 后重试。",
-      busyDelete: "OpenAgentCore 仅允许删除处于空闲或失败状态且没有必需操作的 Session。此 Session 仍有排队、运行、等待中的工作或待处理输入，因此未做任何更改。请选择“取消工作并删除”，等待 Session 空闲后再删除。",
-      readLifecycleConflict: "读取最新 Session 时，兼容的 Core 返回了生命周期冲突（409），因此未发送更新请求。草稿和当前持久化视图均已保留。",
-      writeLifecycleConflict: "兼容的 Core 拒绝了 Session{{action}}，因为它与当前生命周期状态冲突。Web 未自动重试。",
-      noUpdateSent: "未发送更新请求。", unknownWriteSuffix: "写入结果未知。Web 已保留当前持久化视图且未自动重试；请刷新状态后再决定是否重试。",
-      coreUnavailable: "OpenAgentCore 无法完成 Session{{action}}（{{status}}）。{{suffix}}", uncertainStatus: "OpenAgentCore 返回 {{status}} 后，Session{{action}}结果不确定。Web 已保留当前持久化视图且未自动重试；请刷新状态后再决定是否重试。",
-      readFailureWithDetail: "{{detail}} 未发送更新请求；草稿和当前持久化视图均已保留。", writeFailureWithDetail: "{{detail}} Web 已保留当前持久化视图且未自动重试。",
-      latestReadFailure: "无法读取最新 Session，因此未发送更新请求。草稿和当前持久化视图均已保留。", unknownConnection: "连接在 Core 确认前中断，因此 Session{{action}}结果未知。Web 已保留当前持久化视图且未自动重试；请刷新状态后再决定是否重试。",
-      invalidUpdateConfirmation: "OpenAgentCore 返回了无效的 Session 更新确认。写入结果未知；Web 已保留当前持久化视图且未自动重试。",
-      inputPending: "OpenAgentCore 仅允许删除处于空闲或失败状态且没有必需操作的 Session。此 Session 有等待在 Environment 中启动的输入，无法取消，因此未做任何更改。请等待输入启动、过期或失败后删除；输入启动后，请先取消其工作。",
-      invalidDeletionConfirmation: "OpenAgentCore 返回了无效的删除确认。Web 已保留该 Session；请刷新持久化状态后再操作。",
-      cancelRejected: "OpenAgentCore 拒绝取消请求（{{status}}）：{{detail}}", cancelUnknown: "连接在 Core 确认前中断，因此取消结果未知。", cancelDeleteKept: "{{detail}} Session 未删除，Web 也未自动重试。",
-      waitReadFailure: "已请求取消，但等待 Session 进入空闲状态期间无法读取该 Session，因此未删除。", waitTimeout: "已请求取消，但 {{seconds}} 秒后 Session 仍处于{{status}}状态，因此未删除；请在 Session 空闲后重试。",
-    },
-  },
 } as const;
diff --git a/apps/web/src/i18n/locales/zh-CN/system.ts b/apps/web/src/i18n/locales/zh-CN/system.ts
index 19c5c820d..7e63fcb06 100644
--- a/apps/web/src/i18n/locales/zh-CN/system.ts
+++ b/apps/web/src/i18n/locales/zh-CN/system.ts
@@ -83,9 +83,7 @@ export const system: TranslationShape<typeof english> = {
       baseUrlInvalid: "请输入包含主机名、不含账号密码、查询参数或片段的 HTTPS URL，例如 https://api.example.com/v1。",
       apiKeyHelp: "每次都必须填写。Core 会加密保存，之后不再显示。",
       contextHelp: "模型的上下文窗口，单位为 token。可选。",
-      contextHelpRequired: "模型的上下文窗口，单位为 token。此 Harness 必须填写。",
       outputHelp: "模型单次回复最多输出的 token 数。可选；填写时，上下文窗口必须不小于它。",
-      outputHelpRequired: "模型单次回复最多输出的 token 数。此 Harness 必须填写，且上下文窗口不能小于它。",
       protocolHelp: "选择此 Harness 和模型提供商都支持的协议。",
       wholeNumber: "请输入整数。",
       tooLarge: "请输入不超过 2147483647 的整数。",
diff --git a/apps/web/src/i18n/locales/zh-CN/templates.ts b/apps/web/src/i18n/locales/zh-CN/templates.ts
index 5c6e09529..a9cca78e0 100644
--- a/apps/web/src/i18n/locales/zh-CN/templates.ts
+++ b/apps/web/src/i18n/locales/zh-CN/templates.ts
@@ -10,9 +10,7 @@ export const templates: TranslationShape<typeof english> = {
   emptyTitle: "还没有 Environment 模板", noMatch: "没有匹配的模板", clearFilter: "清除筛选", listLabel: "Environment 模板",
   columns: { name: "名称", network: "网络", packages: "依赖包", files: "文件", skills: "Skill", plugins: "Plugin", updated: "更新时间", actions: "操作" },
   access: { enabled: "已启用", disabled: "已禁用", restricted: "受限" },
-  accessHelp: {
-    restricted: "原生工具只能访问列出的主机名。子域名和重定向目标需要单独列出。",
-  },
+  accessHelp: "使用此策略的 Session 会被拒绝，因为 Runtime 不限制网络访问。",
   edit: "编辑", delete: "删除", deleteLabel: "删除 {{name}}", open: "打开 {{name}}", back: "返回",
   unrecognized: "含无法识别的配置",
   unrecognizedHelp: "Core 返回了控制台无法识别的配置。可识别的部分照常显示，其余部分不做推测。",
diff --git a/apps/web/src/lib/core-error.ts b/apps/web/src/lib/core-error.ts
index d8608e2b2..fb94ba984 100644
--- a/apps/web/src/lib/core-error.ts
+++ b/apps/web/src/lib/core-error.ts
@@ -18,7 +18,6 @@ export function knownCoreError(error: unknown, t: TFunction<"common">, nameUnit:
   const min = number("min"), max = number("max");
   if (error.code === "invalid_node_capacity" && min !== undefined && max !== undefined && min <= max) return t("coreErrorDetails.capacityRange", { min, max });
   if (error.code === "invalid_sandbox_configuration") {
-    if (error.param === "runtime") return t("coreErrorDetails.runtime");
     if (resourceParams.has(error.param) && min !== undefined) {
       if (max !== undefined && min <= max) return t("coreErrorDetails.resourceRange", { min, max });
       if (max === undefined) return t("coreErrorDetails.resourceMin", { min });
diff --git a/apps/web/src/lib/locale.test.ts b/apps/web/src/lib/locale.test.ts
index 38278a9ad..15a4dcbaa 100644
--- a/apps/web/src/lib/locale.test.ts
+++ b/apps/web/src/lib/locale.test.ts
@@ -13,7 +13,7 @@ describe("sandbox localization", () => {
   });
   it("localizes all diagnostic labels and advice", () => {
     for (const code of ["node_unavailable", "resource_missing", "compute_unconfirmed", "ownership_mismatch", "provider_unavailable", "host_unsupported",
-      "artifacts_unavailable", "runtime_download_failed", "runtime_image_unavailable", "capacity_insufficient", "unknown"]) {
+      "artifacts_unavailable", "runtime_image_unavailable", "capacity_insufficient", "unknown"]) {
       const message = sandboxDiagnosticMessage(code, "zh-CN");
       expect(message?.label).toMatch(/[\u4e00-\u9fff]/);
       expect(message?.advice).toMatch(/[\u4e00-\u9fff]/);
diff --git a/apps/web/src/lib/sandbox-diagnostic.test.ts b/apps/web/src/lib/sandbox-diagnostic.test.ts
index 65a830b86..e1b5d934d 100644
--- a/apps/web/src/lib/sandbox-diagnostic.test.ts
+++ b/apps/web/src/lib/sandbox-diagnostic.test.ts
@@ -16,47 +16,17 @@ describe("sandbox diagnostics", () => {
     expect(sandboxDiagnosticMessage("ownership_mismatch")?.label).toBe("Sandbox ownership mismatch");
     expect(sandboxDiagnosticMessage("provider_unavailable")?.label).toBe("Sandbox provider unavailable");
   });
-  it("names why a node's provider is not ready, reading an unknown code as provider_unavailable", () => {
-    expect(sandboxDiagnosticMessage(nodeProviderDiagnostic({ online: true, provider_ready: false, diagnostic: "host_unsupported" }))?.label).toBe("Host unsupported");
-    expect(nodeProviderDiagnostic({ online: true, provider_ready: false, diagnostic: "future_code" as SandboxNodeDiagnostic })).toBe("provider_unavailable");
-    expect(nodeProviderDiagnostic({ online: true, provider_ready: true })).toBe("");
-    // An offline node's last code may no longer apply.
-    expect(nodeProviderDiagnostic({ online: false, provider_ready: false, diagnostic: "host_unsupported" })).toBe("");
+  it("names an online node's readiness class from its rollout and hides an offline one", () => {
+    const failed = { state: "failed", ready_generation: null, diagnostic: "host_unsupported" } as const;
+    const unknown = { state: "unknown", ready_generation: null } as const;
+    expect(sandboxDiagnosticMessage(nodeProviderDiagnostic({ online: true, provider_ready: false, rollout: failed }))?.label).toBe("Host unsupported");
+    expect(sandboxDiagnosticMessage(nodeProviderDiagnostic({ online: true, provider_ready: false, rollout: unknown }))?.label).toBe("Sandbox provider unavailable");
+    expect(nodeProviderDiagnostic({ online: true, provider_ready: true, rollout: failed })).toBe("");
+    expect(nodeProviderDiagnostic({ online: false, provider_ready: false, rollout: unknown })).toBe("");
   });
   it("does not expose an unknown raw error or turn it into a healthy state", () => {
     const message = sandboxDiagnosticMessage("private-provider-error-with-secret");
     expect(message?.label).toBe("Sandbox state needs attention");
     expect(JSON.stringify(message)).not.toContain("private-provider-error");
   });
-  it("preserves the typed download diagnostic on an online node and suppresses stale offline health", () => {
-    const diagnostic: SandboxNodeDiagnostic = "runtime_download_failed";
-    expect(nodeProviderDiagnostic({ online: true, provider_ready: false, diagnostic })).toBe(diagnostic);
-    expect(nodeProviderDiagnostic({ online: false, provider_ready: false, diagnostic })).toBe("");
-  });
-  it("explains download and verification failures separately from provider image failures in both languages", () => {
-    const diagnostic: SandboxNodeDiagnostic = "runtime_download_failed";
-    expect(sandboxDiagnosticMessage(diagnostic, "en")).toEqual({
-      label: "Runtime download failed",
-      advice: "Runtime files could not be downloaded or verified. Check the node's network access and the configured Runtime release.",
-    });
-    expect(sandboxDiagnosticMessage(diagnostic, "zh-CN")).toEqual({
-      label: "Runtime 下载失败",
-      advice: "Runtime 文件下载或验证失败。请检查节点网络连接及配置的 Runtime 发布版本。",
-    });
-    for (const locale of ["en", "zh-CN"] as const) {
-      expect(sandboxDiagnosticMessage(diagnostic, locale)).not.toEqual(sandboxDiagnosticMessage("runtime_image_unavailable", locale));
-    }
-  });
-});
-
-describe("shared node readiness diagnostics", () => {
-  it.each(sandboxNodeDiagnostics)("preserves %s with localized messages", (diagnostic) => {
-    expect(nodeProviderDiagnostic({ online: true, provider_ready: false, diagnostic })).toBe(diagnostic);
-    const english = sandboxDiagnosticMessage(diagnostic, "en");
-    const chinese = sandboxDiagnosticMessage(diagnostic, "zh-CN");
-    expect(english?.label).not.toBe("Sandbox state needs attention");
-    expect(english?.advice).not.toBe("Inspect the assigned node and resource, then refresh.");
-    expect(chinese?.label).not.toBe(english?.label);
-    expect(chinese?.advice).not.toBe(english?.advice);
-  });
 });
diff --git a/apps/web/src/lib/sandbox-diagnostic.ts b/apps/web/src/lib/sandbox-diagnostic.ts
index aaf2ecbd0..17ae8d24d 100644
--- a/apps/web/src/lib/sandbox-diagnostic.ts
+++ b/apps/web/src/lib/sandbox-diagnostic.ts
@@ -1,4 +1,4 @@
-import { normalizeSandboxNodeDiagnostic, type SandboxNode } from "@oac/agents-client";
+import type { SandboxNode } from "@oac/agents-client";
 import i18n, { type SupportedLanguage } from "../i18n";
 import type { ParseKeys } from "i18next";
 export interface SandboxDiagnosticMessage { label: string; advice: string }
@@ -22,24 +22,20 @@ const diagnostics: Record<string, { label: ParseKeys<"sandbox">; advice: ParseKe
   },
   provider_unavailable: {
     label: "Sandbox provider unavailable",
-    advice: "Restore the provider on the assigned node, then refresh. Running the install command again on the host checks its requirements and names the fix; a manually registered node logs the local error.",
+    advice: "Restore the provider on the assigned node, then refresh. Running the install command again on the host checks its requirements and names the fix.",
   },
   // Provider-neutral readiness classes; Core sends only the code, and the node keeps the local detail.
   host_unsupported: {
     label: "Host unsupported",
-    advice: "The host lacks a capability its sandbox provider requires. Running the install command again on the host checks its requirements and names the fix; a manually registered node logs the local error.",
+    advice: "The host lacks a capability its sandbox provider requires. Running the install command again on the host checks its requirements and names the fix.",
   },
   artifacts_unavailable: {
     label: "Provider files missing",
     advice: "Pinned provider files are missing or fail their checksum. Run the install command again.",
   },
-  runtime_download_failed: {
-    label: "Runtime download failed",
-    advice: "Runtime files could not be downloaded or verified. Check the node's network access and the configured Runtime release.",
-  },
   runtime_image_unavailable: {
     label: "Runtime image missing",
-    advice: "The pinned Runtime image isn't on the host. Run the install command again.",
+    advice: "The Runtime image isn't on the host. Run the install command again.",
   },
   capacity_insufficient: {
     label: "Host too small",
@@ -47,14 +43,10 @@ const diagnostics: Record<string, { label: ParseKeys<"sandbox">; advice: ParseKe
   },
 };
 
-/**
- * Why an online node's provider is not ready, as one fixed code; an unknown
- * value reads as provider_unavailable. Empty while the provider is ready, and
- * for an offline node, whose last code may no longer apply.
- */
-export function nodeProviderDiagnostic(node: Pick<SandboxNode, "online" | "provider_ready" | "diagnostic">): string {
-  if (!node.online || (node.provider_ready && !node.diagnostic)) return "";
-  return normalizeSandboxNodeDiagnostic(node.diagnostic ?? "");
+/** Why an online node is not ready: its target generation's fixed code, else provider_unavailable; empty otherwise. */
+export function nodeProviderDiagnostic(node: Pick<SandboxNode, "online" | "provider_ready" | "rollout">): string {
+  if (!node.online || node.provider_ready) return "";
+  return node.rollout.diagnostic ?? "provider_unavailable";
 }
 
 export function sandboxDiagnosticMessage(value?: string, locale: SupportedLanguage = "en"): SandboxDiagnosticMessage | null {
diff --git a/apps/web/src/style.css b/apps/web/src/style.css
index e74f8903b..00c0f0e3c 100644
--- a/apps/web/src/style.css
+++ b/apps/web/src/style.css
@@ -567,7 +567,7 @@ html[data-theme="dark"] .brand-mark {
   color: var(--fg-muted);
 }
 
-/* Shared ledger primitives and legacy Agent detail styles. */
+/* Shared ledger primitives. */
 
 .ledger {
   min-height: 0;
@@ -712,13 +712,6 @@ html[data-theme="dark"] .brand-mark {
 
 /* Sessions — conversation list and 48rem thread. */
 
-.status-label {
-  color: var(--fg-muted);
-  font-size: 12px;
-  line-height: 16px;
-  text-transform: capitalize;
-}
-
 .trace-workbench {
   display: flex;
   min-width: 0;
@@ -1288,50 +1281,6 @@ html[data-theme="dark"] .brand-mark {
   padding-left: 0;
 }
 
-.thread-content {
-  display: flex;
-  width: 100%;
-  max-width: 768px;
-  min-height: 100%;
-  flex-direction: column;
-  margin: 0 auto;
-  padding: 24px 16px;
-}
-
-.message-stack {
-  display: flex;
-  flex-direction: column;
-  gap: 20px;
-}
-
-.message-row {
-  display: flex;
-  width: 100%;
-}
-
-.message-row.user {
-  justify-content: flex-end;
-}
-
-.message-body {
-  display: flex;
-  min-width: 0;
-  max-width: 85%;
-  flex-direction: column;
-  color: var(--fg);
-}
-
-.message-row.user .message-body {
-  align-items: flex-end;
-}
-
-.message-byline {
-  margin-bottom: 4px;
-  color: var(--fg-muted);
-  font-size: 12px;
-  line-height: 16px;
-}
-
 .message-copy {
   color: var(--fg);
   font-size: 14px;
@@ -1645,12 +1594,6 @@ html[data-theme="dark"] .brand-mark {
   font-size: 13.5px;
 }
 
-.message-row.user .message-copy {
-  padding: 8px 12px;
-  background: var(--surface-muted);
-  border-radius: 6px;
-}
-
 .work-trace {
   width: 100%;
   min-width: 0;
diff --git a/apps/web/src/styles/app.css b/apps/web/src/styles/app.css
index 12894e03f..b46cbfd2f 100644
--- a/apps/web/src/styles/app.css
+++ b/apps/web/src/styles/app.css
@@ -2,7 +2,7 @@
  * The console's single stylesheet entry, in cascade order:
  * 1. Tailwind's theme variables (no preflight: the console keeps its base rules);
  * 2. IBM Plex Sans and Beautiful UI's foundation — the design tokens every surface uses;
- * 3. the console's legacy base and grammar, whose variables alias those tokens;
+ * 3. the console's base and grammar, whose variables alias those tokens;
  * 4. system.css, the component system in Beautiful UI's vocabulary;
  * 5. Tailwind utilities last, generated only for the registry components.
  */
diff --git a/apps/web/src/styles/system.css b/apps/web/src/styles/system.css
index 70790f706..095c43859 100644
--- a/apps/web/src/styles/system.css
+++ b/apps/web/src/styles/system.css
@@ -3,7 +3,7 @@
  * (src/app/beautifui/foundation.css): cool canvas, white cards drawn by a
  * hairline ring and a smooth shadow, an ink ramp for text, pill buttons with an
  * ink primary, filled fields with a hairline ring, dark tooltips, and
- * indigo as the only accent. Loaded after the legacy stylesheets, so every
+ * indigo as the only accent. Loaded after the base stylesheets, so every
  * shared atom is defined here once; feature stylesheets only arrange them.
  */
 
diff --git a/contracts/agents-api/admin-api.md b/contracts/agents-api/admin-api.md
index 34cb47bca..907d9e989 100644
--- a/contracts/agents-api/admin-api.md
+++ b/contracts/agents-api/admin-api.md
@@ -10,7 +10,7 @@ Applications never call `/core/v1`. It has no operation that creates or edits Ag
 
 Every `/core/v1` request, including one for an unknown path, must send `Authorization: Bearer <Core key>`. Without it Core answers 401 `invalid_admin_key` with `WWW-Authenticate: Bearer`; an unknown path answers 404 `not_found` only after authentication.
 
-- Core compares the SHA-256 of the bearer with the Core key digest it reads at startup from `generated/core-key-digests.json`, which `oac apply` derives from `secrets/core.key` ([Core key](../../docs/getting-started/operations.md#core-key)). A rotated Core key takes effect when Core restarts. Core serves no `/core/v1` route when no digest is configured.
+- Core compares the SHA-256 of the bearer with the [Core key](../../docs/getting-started/operations.md#core-key) digest it reads at startup. A rotated Core key takes effect when Core restarts. Core serves no `/core/v1` route when no digest is configured.
 - The Core key authenticates only `/core/v1`. Project API keys and machine credentials get 401 here, and the Core key gets 401 on `/v1` and `/api/v1` ([API namespaces and credentials](../../docs/api/index.md)).
 - `X-Core-Console-Actor` is a label the caller asserts. Core records it as the audit `actor_label` without checking it. The console server sends `console`; scripts normally send none, which records an empty label. Never use it for authorization or as proof of origin.
 - A `{project_id}` in a path selects the target Project, including an archived one; it grants nothing.
@@ -28,30 +28,44 @@ Paths are relative to `/core/v1`.
 | `projects/{project_id}/sessions/{session_id}/archive` | Archive one hosted Session | [Session archive](#session-archive) |
 | `projects/{project_id}/sessions/{session_id}/execution-configuration` | The Session's frozen model, Harness and provider selection | [Execution configuration](#execution-configuration) |
 | `projects/{project_id}/sessions/{session_id}/diagnostics`, `…/turns/{turn_id}/diagnostics` | Failure categories and Item receipt timing | [Session diagnostics](./session-diagnostics.md) |
-| `projects/{project_id}/sessions/{session_id}/runtime-observation`, `sandbox/runtime-observations` | Current Runtime observations | [Runtime observations](./runtime-observability-api.md), [the list's disk field](#runtime-observations) |
+| `projects/{project_id}/sessions/{session_id}/runtime-observation`, `sandbox/runtime-observations` | Current Runtime observations | [Runtime observations](./runtime-observability-api.md), [the list's disk field](./runtime-observability-api.md#disk) |
 | `projects/{project_id}/sessions/{session_id}/runtime-history` | Stored Runtime history | [Runtime history](./runtime-observability-api.md#session-runtime-history) |
 | `projects/{project_id}/environments/{environment_id}/installation` | Install commands of a `self_hosted` Environment | [Installation grant](./environment-executor-credentials.md#installation-grant) |
 | `projects/{project_id}/environments/{environment_id}/executor-credentials[/{key_id}]` | Executor credentials of a `self_hosted` Environment | [Executor credentials](./environment-executor-credentials.md#core-key-routes) |
 | `projects/{project_id}/resource-owners`, `projects/{project_id}/write-operations` | Which API key created a resource and each key's writes | [Write provenance](#write-provenance) |
 | `harnesses`, `harnesses/{harness}/model-configuration` | Enabled Harnesses and each Harness's deployment default model | [Deployment defaults](./model-execution.md#deployment-defaults) |
 | `sandbox/deployment`, `sandbox/deployment/reset`, `sandbox/providers/{provider}/discovery` | The sandbox provider, resources and Runtime, idle suspension policy, reset, and provider configuration discovery such as E2B templates | [Sandbox deployment](./sandbox-deployment.md#routes) |
-| `sandbox/enrollment-tokens`, `sandbox/nodes[/{node_id}[/allocations]]` | Node enrollment tokens, nodes and their allocations and host history | [Nodes guide](../../docs/getting-started/nodes.md), [sandbox deployment](./sandbox-deployment.md), [node host history](./runtime-observability-api.md#node-host-observations-and-history) |
+| `sandbox/enrollment-tokens`, `sandbox/nodes[/{node_id}[/allocations]]` | Node enrollment tokens, nodes and their allocations and host history | [Add and manage nodes](../../docs/getting-started/nodes.md), [sandbox deployment](./sandbox-deployment.md), [node host history](./runtime-observability-api.md#node-host-observations-and-history) |
 | `summary` | Session counts and usage by Project, Agent or key | [Summary](#summary) |
 | `metrics` | Core's own process, execution, database and job metrics | [Core metrics](./core-metrics.md) |
 | `request-logs` | Recent public or administration HTTP requests and their response metadata | [Request log](#request-log) |
 | `audit-log` | Administrator writes | [Audit log](#audit-log) |
 
-## Request log
+## Installation facts
 
-`GET /core/v1/request-logs` is a Core-key-only diagnostic read for Web's **Request log** and operator scripts. It observes HTTP requests that reach Core's `/v1` and `/core/v1` APIs, including rejected authentication and unsuccessful responses. The log read itself, health and documentation endpoints, Web sign-in/proxy failures before Core, machine transports and background execution are outside this view. It is not an audit archive or a distributed execution trace.
+`GET /installation` reports what an administrator needs to call and change this installation. It answers before any sandbox deployment exists and calls no provider or model.
 
-Each API instance retains the most recent 1,000 started requests for each surface independently: `public` for `/v1`, `admin` for `/core/v1`. Administration polling cannot evict application requests. Older entries, including long-lived requests, are overwritten when their surface fills. Restart clears the rings. `instance_id` and `instance_started_at` identify the serving API instance; a load balancer can return another instance's window. Core also emits each request's completion metadata through its existing structured logger; retention of that output belongs to the operator's log system, not this endpoint.
+| Field | Meaning |
+| --- | --- |
+| `object` | `core.installation` |
+| `installation_id` | The installation ID from `OAC_INSTALLATION_ID_FILE` ([Compose installations](../../docs/configuration.md#compose-installations)) |
+| `public_url` | The [`public_url`](../../docs/configuration.md#settings) setting: the origin applications, nodes, sandboxes and self-hosted executors use |
+| `api_base_url` | `public_url` followed by `/v1`, the `OPENAI_BASE_URL` for Project API keys |
+| `local_only` | True when `public_url` names a loopback host, which only the Core host reaches |
+| `source_commit` | The full source commit Core was built from; null for development builds |
+| `configuration` | The process settings Core loaded from its environment, under `settings` |
+| `address_bindings` | What a change of `public_url` affects, counted on each read |
 
-Query parameters are `surface=public|admin` (default `public`), `limit` (1–200, default 100), optional exact `request_id`, `outcome=all|errors|active` (default `all`) and optional `method`. Supported method values are `GET`, `HEAD`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `CONNECT`, `TRACE` and `OTHER`; other incoming methods are recorded as `OTHER`. Unsupported, repeated or malformed query parameters return 400. `errors` includes HTTP status 400 or above and aborted requests. Filtering scans only the retained window and returns newest-started first. `retained_count` describes that surface's retained window, `total_matching` counts retained matches, and `has_more` means the response limit omitted matches; it does not promise older evicted history is available.
+`configuration.settings` has one entry per setting Core loaded: its `key`, the environment variable that sets it (such as `OAC_LOG_LEVEL`), its effective `value`, `default`, whether it is `sensitive`, and the services it `restarts` (`core`, `web`).
 
-The response has `object: "core.request_log.list"`, instance identity, `surface`, `capacity`, coverage counts and `data`. Each entry contains `request_id`, `trace_id`, `started_at`, `method`, `route`, `state`, `status`, `duration_ms`, `response_bytes` and nullable `error_code`. `route` is a registered route template, a partially matched authentication prefix or `(unmatched)`, never the raw resource path or query. `status` is null until final response headers are committed. `state` distinguishes `active`, `completed` and `aborted`; duration and bytes describe the observation so far for active requests. `response_bytes` counts bytes accepted by the response writer, excluding headers and transport framing; it is not a network transfer measurement. An SSE response remains active until its handler ends. HTTP status and completion do not establish the outcome of an asynchronous Agent Turn; use [Session diagnostics](./session-diagnostics.md) and the Session's recorded history for that outcome.
+A sensitive setting has null `value` and `default` and a boolean `configured` instead; only sensitive settings have `configured`. `oac-core check-config` validates the same environment and exits without starting Core or printing a value. [Configuration reference](../../docs/configuration.md) describes each setting.
 
-Bodies, header values, credentials, prompts, file contents, raw paths, query values and error messages are not captured. Only the API's safe error code is retained. The returned request ID corresponds to `X-Request-Id` and can be used to find related existing process log entries. Trace IDs are correlation metadata, not proof of a complete component trace.
+| `address_bindings` field | Meaning |
+| --- | --- |
+| `nodes` | Enrolled nodes that are not removed |
+| `nodes_on_other_address` | Nodes enrolled with an address other than `public_url`. They receive no new sandboxes; remove and add them again. At most `nodes` |
+| `hosted_sandboxes` | Retained and pending hosted sandboxes, which run with the address current when they started |
+| `self_hosted_executors` | Unrevoked executor credentials, whose executors were installed with the `remote_url` then advertised |
 
 ## Workspace storage
 
@@ -128,7 +142,7 @@ After an uncertain `POST` response, `GET` the archive before writing again. Repe
   "session_id": "013773a9-44b9-4f84-baca-b51c04a01201",
   "model": {"value": "requested-model", "source": "session"},
   "harness": {"value": "codex", "source": "agent"},
-  "harness_config": {"value": {"model_reasoning_effort": "high"}, "source": "agent"},
+  "harness_config": {"value": {"thinking": {"type": "adaptive"}}, "source": "agent"},
   "model_provider": {
     "source": "agent",
     "status": "available",
@@ -147,32 +161,6 @@ Each `source` is `session`, `agent`, `deployment` or `unknown`, recorded indepen
 
 Core writes this record in the same transaction that creates the Session. Later Agent edits or deletion, deployment default changes, restarts and same-key creation retries never change it. A Session without the record reports its stored model and Harness with source `unknown`, a null value where none is stored, and an `unavailable` provider. A missing Session and one in another Project return the same 404. The response never contains keys, ciphertext, secret references, native headers or query parameters.
 
-## Installation facts
-
-`GET /installation` reports what an administrator needs to call and change this installation. It answers before any sandbox deployment exists and calls no provider or model.
-
-| Field | Meaning |
-| --- | --- |
-| `object` | `core.installation` |
-| `installation_id` | The installation ID from `OAC_INSTALLATION_ID_FILE` ([Compose installations](../../docs/configuration.md#compose-installations)) |
-| `public_url` | The [`public_url`](../../docs/configuration.md#settings) setting: the origin applications, nodes, sandboxes and self-hosted executors use |
-| `api_base_url` | `public_url` followed by `/v1`, the `OPENAI_BASE_URL` for Project API keys |
-| `local_only` | True when `public_url` names a loopback host, which only the Core host reaches |
-| `source_commit` | The full source commit Core was built from; null for development builds |
-| `configuration` | The process settings Core loaded from its environment, under `settings` |
-| `address_bindings` | What a change of `public_url` affects, counted on each read |
-
-`configuration.settings` has one entry per setting Core loaded: its `key`, the environment variable that sets it (such as `OAC_LOG_LEVEL`), its effective `value`, `default`, whether it is `sensitive`, and the services it `restarts` (`core`, `web`).
-
-A sensitive setting has null `value` and `default` and a boolean `configured` instead; only sensitive settings have `configured`. `oac-core check-config` validates the same environment and exits without starting Core or printing a value. [Configuration](../../docs/configuration.md) describes each setting.
-
-| `address_bindings` field | Meaning |
-| --- | --- |
-| `nodes` | Enrolled nodes that are not removed |
-| `nodes_on_other_address` | Nodes enrolled with an address other than `public_url`. They receive no new sandboxes; remove and add them again. At most `nodes` |
-| `hosted_sandboxes` | Retained and pending hosted sandboxes, which run with the address current when they started |
-| `self_hosted_executors` | Unrevoked executor credentials, whose executors were installed with the `remote_url` then advertised |
-
 ## Write provenance
 
 Core records which Project API key made each successful public write, in the same transaction as the write; if the record fails, the write fails. Reads, rejected requests and Core's own maintenance, such as OAuth token refresh and cleanup, are not recorded.
@@ -231,9 +219,17 @@ The response is `{data, has_more, next_cursor}`. Each row has `project_id`, null
 - A Session whose public usage is null adds no tokens but counts in the coverage denominator.
 - Each Project is read in one database snapshot; a page is not one snapshot of the whole deployment. Totals are operational counts, not billing records.
 
-## Runtime observations
+## Request log
+
+`GET /core/v1/request-logs` is a Core-key-only diagnostic read for Web's **Request log** and operator scripts. It observes HTTP requests that reach Core's `/v1` and `/core/v1` APIs, including rejected authentication and unsuccessful responses. The log read itself, health and documentation endpoints, Web sign-in/proxy failures before Core, machine transports and background execution are outside this view. It is not an audit archive or a distributed execution trace.
 
-The [Runtime telemetry API](./runtime-observability-api.md) owns current observations, the [list-only disk field](./runtime-observability-api.md#disk), Session history and node host observations and history.
+Each API instance retains the most recent 1,000 started requests for each surface independently: `public` for `/v1`, `admin` for `/core/v1`. Administration polling cannot evict application requests. Older entries, including long-lived requests, are overwritten when their surface fills. Restart clears the rings. `instance_id` and `instance_started_at` identify the serving API instance; a load balancer can return another instance's window. Core also emits each request's completion metadata through its existing structured logger; retention of that output belongs to the operator's log system, not this endpoint.
+
+Query parameters are `surface=public|admin` (default `public`), `limit` (1–200, default 100), optional exact `request_id`, `outcome=all|errors|active` (default `all`) and optional `method`. Supported method values are `GET`, `HEAD`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `CONNECT`, `TRACE` and `OTHER`; other incoming methods are recorded as `OTHER`. Unsupported, repeated or malformed query parameters return 400. `errors` includes HTTP status 400 or above and aborted requests. Filtering scans only the retained window and returns newest-started first. `retained_count` describes that surface's retained window, `total_matching` counts retained matches, and `has_more` means the response limit omitted matches; it does not promise older evicted history is available.
+
+The response has `object: "core.request_log.list"`, instance identity, `surface`, `capacity`, coverage counts and `data`. Each entry contains `request_id`, `trace_id`, `started_at`, `method`, `route`, `state`, `status`, `duration_ms`, `response_bytes` and nullable `error_code`. `route` is a registered route template, a partially matched authentication prefix or `(unmatched)`, never the raw resource path or query. `status` is null until final response headers are committed. `state` distinguishes `active`, `completed` and `aborted`; duration and bytes describe the observation so far for active requests. `response_bytes` counts bytes accepted by the response writer, excluding headers and transport framing; it is not a network transfer measurement. An SSE response remains active until its handler ends. HTTP status and completion do not establish the outcome of an asynchronous Agent Turn; use [Session diagnostics](./session-diagnostics.md) and the Session's recorded history for that outcome.
+
+Bodies, header values, credentials, prompts, file contents, raw paths, query values and error messages are not captured. Only the API's safe error code is retained. The returned request ID corresponds to `X-Request-Id` and can be used to find related existing process log entries. Trace IDs are correlation metadata, not proof of a complete component trace.
 
 ## Audit log
 
diff --git a/contracts/agents-api/core-errors.md b/contracts/agents-api/core-errors.md
index c6bec2e66..0184f3820 100644
--- a/contracts/agents-api/core-errors.md
+++ b/contracts/agents-api/core-errors.md
@@ -61,15 +61,14 @@ Each code returns HTTP 400 with `type: "invalid_request_error"`. A missing, malf
 | `model_provider_base_url_invalid` | `base_url` | omitted | Requires HTTPS without credentials, query or fragment |
 | `model_provider_protocol_unsupported` | `protocol` | `harness` and `allowed_protocols`, from the build's adapter catalog | The protocol is unknown or unsupported by the selected Harness |
 | `model_provider_api_key_invalid` | `api_key` | `max_length`: 16384 | The key is empty, too long or contains a prohibited character |
-| `model_provider_token_limits_invalid` | `context_window` or `max_output_tokens` | omitted | Limits are invalid, or the Harness requires positive limits that are missing |
+| `model_provider_token_limits_invalid` | `context_window` or `max_output_tokens` | omitted | A limit is negative, `max_output_tokens` exceeds a set `context_window`, or the Harness has no native setting for a set limit |
 | `model_configuration_model_invalid` | `model` | omitted | The deployment default's model is not a nonempty model identifier |
 | `harness_config_invalid` | `harness_config` | omitted | The deployment default's native parameters are unsupported or invalid |
 | `invalid_sandbox_configuration` | `resources.cpus` | `min`: 1, `max`: 255 | The CPU count is outside the supported bounds |
 | `invalid_sandbox_configuration` | `resources.memory_mib` | `min`: 512, `max`: 1048576 | Memory is outside the supported bounds |
-| `invalid_sandbox_configuration` | `resources.root_disk_mib` or `resources.environment_disk_mib` | `min`: 1024 for microsandbox; `min`: 0, `max`: 0 for Docker and E2B | Disk capacity is missing or unsupported by the provider |
-| `invalid_sandbox_configuration` | `runtime` | omitted | The Runtime release is missing, mutable, invalid or not allowed for E2B |
+| `invalid_sandbox_configuration` | `resources.root_disk_mib` or `resources.environment_disk_mib` | `min`: 1024 for microsandbox (`environment_disk_mib` also accepts 0); `min`: 0, `max`: 0 for Docker and E2B | Disk capacity is missing or unsupported by the provider |
 
-Bounds are validation constants, never submitted values. Node names are limited in bytes; Project and key names in trimmed Unicode characters without control characters. Only the first failure is reported, in this order: model provider URL, protocol, key, general limits, the Harness's protocol, then the Harness's required limits; sandbox resources CPU, memory, disk, then Runtime. Model-provider field errors inside a `model_provider` object keep that object's field as `param`. An unknown sandbox provider returns an error without these fields.
+Bounds are validation constants, never submitted values. Node names are limited in bytes; Project and key names in trimmed Unicode characters without control characters. Only the first failure is reported, in this order: model provider URL, protocol, key, limits, then the Harness's protocol; sandbox resources CPU, memory, then disk. Model-provider field errors inside a `model_provider` object keep that object's field as `param`. An unknown sandbox provider returns an error without these fields.
 
 ## Other administration errors
 
@@ -81,6 +80,7 @@ These codes have null `param` and no `details`. [Sandbox deployment](./sandbox-d
 | 400 | `workspace_operation_unsupported` | The selected workspace storage does not support the operation or sandbox combination |
 | 404 | `workspace_storage_not_found` | Workspace storage is not configured or the requested object does not exist |
 | 409 | `workspace_storage_conflict` | Workspace storage ownership or configuration conflicts with the current state |
+| 409 | `workspace_storage_required` | The sandbox provider runs every Environment on workspace storage and none is selected |
 | 503 | `workspace_storage_unavailable` | Workspace storage is unavailable or an operation remains unconfirmed |
 | 400 | `sandbox_operation_unsupported` | The selected sandbox provider does not support the operation |
 | 401 | `invalid_admin_key` | The bearer credential is not a valid Core key |
@@ -106,7 +106,7 @@ These codes have null `param` and no `details`. [Sandbox deployment](./sandbox-d
 
 ## Diagnostic failure categories
 
-The [Session and Turn diagnostics reads](./session-diagnostics.md) return these categories inside a successful 200 snapshot, not as an error envelope. Public `/v1` Turn errors do not change. `params` is `{}` unless the table says otherwise.
+The [Session diagnostics](./session-diagnostics.md) routes return these categories inside a successful 200 snapshot, not as an error envelope. Public `/v1` Turn errors do not change. `params` is `{}` unless the table says otherwise.
 
 | Code | Stored cause or safe meaning |
 | --- | --- |
diff --git a/contracts/agents-api/core-metrics.md b/contracts/agents-api/core-metrics.md
index 368c0deb4..3e009a658 100644
--- a/contracts/agents-api/core-metrics.md
+++ b/contracts/agents-api/core-metrics.md
@@ -1,5 +1,5 @@
 ---
-title: "Core operational metrics"
+title: "Core metrics"
 ---
 
 `GET /core/v1/metrics?range=1h|6h|24h|7d` reports Core's own health: its process, execution queue and slots, PostgreSQL and background jobs. It requires the Core key ([Core administration API](./admin-api.md)).
diff --git a/contracts/agents-api/core.openapi.yaml b/contracts/agents-api/core.openapi.yaml
index 82addb6bf..a3853fbc5 100644
--- a/contracts/agents-api/core.openapi.yaml
+++ b/contracts/agents-api/core.openapi.yaml
@@ -718,8 +718,19 @@ definitions:
     required:
       - data
     type: object
+  api.SandboxComputeProfileInput:
+    properties:
+      configuration:
+        type: object
+      resources:
+        $ref: '#/definitions/sandbox.Resources'
+    type: object
   api.SandboxDeploymentChangeInput:
     properties:
+      compute_profiles:
+        additionalProperties:
+          $ref: '#/definitions/api.SandboxComputeProfileInput'
+        type: object
       configuration:
         type: object
       credential:
@@ -734,13 +745,15 @@ definitions:
         description: |-
           Per-sandbox limits, required for Docker and microsandbox. E2B may omit
           them; Core then uses the validated template build's cpus and memory_mib.
-      runtime:
-        $ref: '#/definitions/sandbox.RuntimeRelease'
     required:
       - expected_generation
     type: object
   api.SandboxDeploymentInput:
     properties:
+      compute_profiles:
+        additionalProperties:
+          $ref: '#/definitions/api.SandboxComputeProfileInput'
+        type: object
       configuration:
         type: object
       credential:
@@ -755,8 +768,6 @@ definitions:
         description: |-
           Per-sandbox limits, required for Docker and microsandbox. E2B may omit
           them; Core then uses the validated template build's cpus and memory_mib.
-      runtime:
-        $ref: '#/definitions/sandbox.RuntimeRelease'
     required:
       - expected_generation
     type: object
@@ -777,6 +788,7 @@ definitions:
   api.SandboxEnrollmentTokenRequest:
     properties:
       max_active:
+        description: An omitted limit is derived from the node's host when it enrolls.
         type: integer
       max_retained:
         description: Docker never suspends, so Core replaces this with max_active; microsandbox uses both limits.
@@ -1256,6 +1268,27 @@ definitions:
       - nodes_on_other_address
       - self_hosted_executors
     type: object
+  deployment.Capacity:
+    properties:
+      max_active:
+        type: integer
+      max_retained:
+        type: integer
+    required:
+      - max_active
+      - max_retained
+    type: object
+  deployment.ComputeProfileRecord:
+    properties:
+      configuration:
+        type: object
+      generation:
+        type: integer
+      metadata:
+        type: object
+      specification:
+        $ref: '#/definitions/sandbox.DeploymentSpec'
+    type: object
   deployment.HostHistory:
     properties:
       points:
@@ -1309,10 +1342,6 @@ definitions:
         x-nullable: true
       created_at:
         type: string
-      diagnostic:
-        allOf:
-          - $ref: '#/definitions/sandbox.NodeDiagnosticCode'
-        description: Fixed reason for the last reported unreadiness; absent while the provider is ready. Clients treat an unknown value as provider_unavailable.
       enrollment_id:
         description: The enrollment_id of the command that registered this node (POST /core/v1/sandbox/enrollment-tokens); null for nodes enrolled before Core recorded it.
         type: string
@@ -1333,7 +1362,13 @@ definitions:
       provider:
         type: string
       provider_ready:
+        description: True while the node is online and its serving generation is ready.
         type: boolean
+      recommended_capacity:
+        allOf:
+          - $ref: '#/definitions/deployment.Capacity'
+        description: The limits Core recommends for the node's latest host measurements and the current specification; null before the node reports them.
+        x-nullable: true
       reserved:
         type: integer
       retained:
@@ -1361,6 +1396,7 @@ definitions:
       - online
       - provider
       - provider_ready
+      - recommended_capacity
       - reserved
       - retained
       - rollout
@@ -1438,10 +1474,6 @@ definitions:
         x-nullable: true
       created_at:
         type: string
-      diagnostic:
-        allOf:
-          - $ref: '#/definitions/sandbox.NodeDiagnosticCode'
-        description: Fixed reason for the last reported unreadiness; absent while the provider is ready. Clients treat an unknown value as provider_unavailable.
       enrollment_id:
         description: The enrollment_id of the command that registered this node (POST /core/v1/sandbox/enrollment-tokens); null for nodes enrolled before Core recorded it.
         type: string
@@ -1466,7 +1498,13 @@ definitions:
       provider:
         type: string
       provider_ready:
+        description: True while the node is online and its serving generation is ready.
         type: boolean
+      recommended_capacity:
+        allOf:
+          - $ref: '#/definitions/deployment.Capacity'
+        description: The limits Core recommends for the node's latest host measurements and the current specification; null before the node reports them.
+        x-nullable: true
       reserved:
         type: integer
       retained:
@@ -1496,6 +1534,7 @@ definitions:
       - online
       - provider
       - provider_ready
+      - recommended_capacity
       - reserved
       - retained
       - rollout
@@ -1551,14 +1590,12 @@ definitions:
       - ready
       - preparing
       - failed
-      - update_required
       - unknown
     type: string
     x-enum-varnames:
       - NodeRolloutReady
       - NodeRolloutPreparing
       - NodeRolloutFailed
-      - NodeRolloutUpdateRequired
       - NodeRolloutUnknown
   deployment.NodeUpdate:
     properties:
@@ -1686,14 +1723,11 @@ definitions:
         type: integer
       unknown:
         type: integer
-      update_required:
-        type: integer
     required:
       - failed
       - preparing
       - ready
       - unknown
-      - update_required
     type: object
   deployment.RolloutState:
     enum:
@@ -1715,6 +1749,10 @@ definitions:
     type: object
   deployment.View:
     properties:
+      compute_profiles:
+        additionalProperties:
+          $ref: '#/definitions/deployment.ComputeProfileRecord'
+        type: object
       configuration:
         type: object
       core_url:
@@ -1916,8 +1954,6 @@ definitions:
     properties:
       resources:
         $ref: '#/definitions/sandbox.Resources'
-      runtime:
-        $ref: '#/definitions/sandbox.RuntimeRelease'
       workspace:
         allOf:
           - $ref: '#/definitions/workspacefs.Declaration'
@@ -1931,7 +1967,6 @@ definitions:
       - provider_unavailable
       - host_unsupported
       - artifacts_unavailable
-      - runtime_download_failed
       - runtime_image_unavailable
       - capacity_insufficient
     type: string
@@ -1939,7 +1974,6 @@ definitions:
       - NodeProviderUnavailable
       - NodeHostUnsupported
       - NodeArtifactsUnavailable
-      - NodeRuntimeDownloadFailed
       - NodeRuntimeImageUnavailable
       - NodeCapacityInsufficient
   sandbox.Resources:
@@ -1956,28 +1990,6 @@ definitions:
       - cpus
       - memory_mib
     type: object
-  sandbox.RuntimeRelease:
-    properties:
-      firmware_sha256:
-        type: string
-      image_id:
-        type: string
-      image_manifest_digest:
-        type: string
-      microsandbox_ref:
-        type: string
-      runtime_sha256:
-        type: string
-      source_commit:
-        type: string
-    required:
-      - firmware_sha256
-      - image_id
-      - image_manifest_digest
-      - microsandbox_ref
-      - runtime_sha256
-      - source_commit
-    type: object
   sessions.AdminAssetCounts:
     properties:
       agents:
@@ -2529,6 +2541,7 @@ definitions:
           - input_image
           - output_text
           - encrypted_content
+          - summary_text
         type: string
     required:
       - type
@@ -2574,16 +2587,17 @@ definitions:
     properties:
       accepts_harness_config:
         type: boolean
+      accepts_max_output_tokens:
+        description: AcceptsMaxOutputTokens reports that the Harness maps max_output_tokens natively.
+        type: boolean
       protocols:
         items:
           type: string
         type: array
-      token_limits_required:
-        type: boolean
     required:
       - accepts_harness_config
+      - accepts_max_output_tokens
       - protocols
-      - token_limits_required
     type: object
   v1.ModelProviderInput:
     properties:
@@ -7057,7 +7071,7 @@ paths:
     post:
       consumes:
         - application/json
-      description: Selects a provider, enforced resource limits and pinned Runtime release. Core derives the deployment's core_url from the installation public URL and rejects a core_url member with 400. E2B returns 409 sandbox_configuration_error while the public URL is loopback. E2B credentials are write-only. E2B may omit resources to adopt the validated template build's CPU and memory, returned in specification.resources. Requires explicit expected_generation, including zero at first setup. Stale retries reject before provider validation. An identical selection at the current generation is a no-op; a differing selection rejects. This does not create compute or execute work.
+      description: Selects a provider and its enforced resource limits. Core derives the deployment's core_url from the installation public URL and rejects a core_url member with 400. E2B returns 409 sandbox_configuration_error while the public URL is loopback. E2B credentials are write-only. E2B may omit resources to adopt the validated template build's CPU and memory, returned in specification.resources. Requires explicit expected_generation, including zero at first setup. Stale retries reject before provider validation. An identical selection at the current generation is a no-op; a differing selection rejects. This does not create compute or execute work.
       parameters:
         - description: Deployment selection
           in: body
diff --git a/contracts/agents-api/environment-executor-credentials.md b/contracts/agents-api/environment-executor-credentials.md
index e3ddd57b1..06863c4e4 100644
--- a/contracts/agents-api/environment-executor-credentials.md
+++ b/contracts/agents-api/environment-executor-credentials.md
@@ -1,5 +1,5 @@
 ---
-title: "Environment executor credentials"
+title: "Executor credentials"
 ---
 
 An executor credential lets `oac-daemon` enroll and connect for one `self_hosted` Environment. It authorizes only the private daemon transport (`/api/v1/agent-daemon/*`) for that Environment, never `/v1`, `/core/v1`, sandbox-node enrollment or Project resources. The Project's principal is its execution principal. Core stores only a digest of the secret.
@@ -31,7 +31,7 @@ The installer calls these machine routes on Core:
 | Route | Authorization | Purpose |
 | --- | --- | --- |
 | `GET /api/v1/agent-daemon/install/{version}/bootstrap.sh`, `bootstrap.ps1` | None | Platform bootstrap scripts |
-| `GET /api/v1/agent-daemon/install/{version}/{os}-{arch}.sha256`, `{os}-{arch}.tar.gz` | None | Installer checksum and archive. Core serves a local copy, or redirects (307) to the versioned release URL in its catalog |
+| `GET /api/v1/agent-daemon/install/{version}/{os}-{arch}[-{component}].sha256`, `{os}-{arch}[-{component}].tar.gz` | None | Checksum and archive of a platform's base installer or of one of its components, named in its `bundle.json`. The installer downloads only the components it needs. Core serves a local copy, or redirects (307) to the versioned release URL in its catalog |
 | `POST /api/v1/agent-daemon/installation` | Grant | The frozen binding: `version`, `protocol_version`, `environment_id`, `remote_url`, `workspace_directory`, `harness` |
 | `POST /api/v1/agent-daemon/installation/claim` | Grant | `{"executor_token":"SECRET"}`; 204 |
 
diff --git a/contracts/agents-api/environments.md b/contracts/agents-api/environments.md
index 79126cbc7..85faf790b 100644
--- a/contracts/agents-api/environments.md
+++ b/contracts/agents-api/environments.md
@@ -35,7 +35,23 @@ An Environment read joins its live owning Session within the caller's Project an
 | [Environment resource](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/agents/environment_info.py) | `pending`, `connected`, `disconnected`, `expired`, `failed` |
 | [Session environment event](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/agent_session_environment_state.py) | `pending`, `ready`, `connected`, `disconnected`, `failed`, with a nullable error |
 
-The two vocabularies are separate; never cast one to the other. Session environment events carry Session and Environment identity and an optional Turn identity, and never configuration, credentials, registration IDs or revisions. A Session's `required_actions` can contain `{type: "environment_connection", environment_id}`, separate from function calls. Environment connection, Session status and Turn status are independent.
+The two vocabularies are separate; never cast one to the other. The resource moves as follows, and a failed or expired Environment is final:
+
+```mermaid
+stateDiagram-v2
+    [*] --> pending
+    pending --> connected
+    connected --> disconnected
+    disconnected --> connected
+    pending --> failed
+    connected --> failed
+    disconnected --> failed
+    pending --> expired
+    connected --> expired
+    disconnected --> expired
+```
+
+Session environment events carry Session and Environment identity and an optional Turn identity, and never configuration, credentials, registration IDs or revisions. A Session's `required_actions` can contain `{type: "environment_connection", environment_id}`, separate from function calls. Environment connection, Session status and Turn status are independent.
 
 Core creates the Environment record in the Session creation transaction; the Session upsert picks the retry winner, and retries never create or repair an Environment. The Environment derives its Project and immutable configuration from the owning Session. Its first state is `pending`. After the Session is deleted, reads hide the Environment while Core keeps the record for settlement and cleanup. A Session with `none` has no Environment.
 
@@ -117,21 +133,21 @@ Creation accepts initial text as a string or an ordered array of user messages.
 
 Core returns 202 only after the batch is durably admitted. For a cancellation, 202 confirms admission, not native completion or process exit. Under the Session lock, a retry recovers its original reservation or receipt before Core chooses between the active Turn and a new reservation, and keeps that target during later work. An unlocked read or a retry after a conflict never picks a different path.
 
-The waiting request uses bounded pooled operations, outside transactions and execution leases; it never prepares or starts native work. Only this route extends its response write deadline, to six minutes, covering the five-minute database deadline plus response time. Disconnecting stops the wait, not the reservation. Errors:
-
-| Condition | Response |
-| --- | --- |
-| Reservation expired | 409 `environment_input_expired` |
-| Reservation cancelled | 409 `environment_input_cancelled` |
-| New input on a failed `openai_hosted` Environment | 409 `conflict_error`, "the hosted environment failed to provision" |
-| New input on a failed `self_hosted` or an expired Environment, or input that was waiting when the Environment failed | 409 `environment_unavailable` |
-| Execution ownership lost | 503 `execution_unavailable` |
-| Session deleted | 404 |
+The waiting request uses bounded pooled operations, outside transactions and execution leases; it never prepares or starts native work. Only this route extends its response write deadline, to six minutes, covering the five-minute database deadline plus response time. Disconnecting stops the wait, not the reservation. [Input errors](./sessions-events.md#input-errors) lists every outcome of the request.
 
 ### Reservations
 
 A reservation stores one canonical message batch before Turn admission, with a five-minute deadline from the database clock.
 
+```mermaid
+stateDiagram-v2
+    [*] --> pending
+    pending --> admitted: Turn claim
+    pending --> expired: deadline
+    pending --> cancelled: cancellation, archive or reset
+    pending --> failed: preparation failure
+```
+
 - It requires an Environment-bearing Session without active work. Reservations and direct input share the Session lock and retry identity; a pending or settled key cannot bypass its reservation through direct admission.
 - A pending reservation blocks new direct batches, including cancellation, while successful earlier retries stay readable.
 - Promotion commits the original inputs, history, reservation settlement and the Turn claim (`queued` to `in_progress`) together. It requires the current leased execution writer and the retained native preparation; no database lock is held during preparation. Only the first successful, non-replay receipts authorize Start on that preparation. An admitted retry returns the original receipts without reclaiming execution; a read or an uncertain commit never authorizes another Start.
@@ -146,11 +162,17 @@ A Runtime `failed` result with `preparation_failed` and no Run settles the pendi
 
 Before a Turn exists, Session activity comes from the latest relevant reservation and the connection state. Pending input on an offline `self_hosted` Environment requests `environment_connection`; the connection arriving clears it to `idle`, while the Worker still owns native readiness and admission. An offline Environment without pending input requests nothing, and `openai_hosted` provisioning never requests a connection. A reservation or connection change commits immutable Session activity and usage snapshots in the same transaction; a newer or active Turn owns later activity. Settled non-initial reservations return the action to `idle` until newer work exists.
 
-### Expiry and scheduling
+### Expiry
+
+The Worker expires due reservations on its normal ticks and resumes after a restart. A failed Turn never stands in for a pre-Turn connection failure.
 
-The Worker expires at most 32 due reservations per tick, after checking its lease and before checking devices or execution slots. The sweep uses the leased Store connection with its transaction timeout, never a pooled writer. A partial deadline index and `SKIP LOCKED` Session locks let unrelated work proceed. The cutoff is statement time, and settlement rechecks the database clock after taking the Session lock. A restart resumes expiry on normal ticks; there is no separate scheduler. A failed Turn never stands in for a pre-Turn connection failure.
+## Hosted compute profiles
 
-When next-Turn input is pending on a completed managed allocation that is suspended or recovering, Core hints the managed Runtime maintenance loop. Initial input, cold creation, running or disabled compute, terminal receipts, cancellation and function results, history and file operations send no hint. Hints are best effort and coalesced without blocking; they add at most one scan per normal five-second cycle and never bypass capacity, a busy lifecycle gate or ownership checks. Persisted work and the normal ticker stay authoritative.
+A new `openai_hosted` Session may send `x_agents_core.environment.compute_profile`, a name matching `^[a-z][a-z0-9-]{0,47}$`. For example, `{"x_agents_core":{"environment":{"compute_profile":"memory-8g"}}}` selects the installation administrator’s configured choice. The name has no intrinsic CPU or memory meaning; administrators configure exact resources through [sandbox deployment](sandbox-deployment.md#compute-profiles). The field is not part of the official top-level `environment` union or an Environment template. Omission keeps the existing default placement behavior. Null, empty or malformed names, unsupported placement, and unavailable names are rejected; Core never substitutes the default.
+
+Creation resolves the name under the deployment lock and freezes its immutable generation in the same transaction as the Session. Caller intent includes the requested name, so an identical retry returns its original Session even after administrators remove or change the choice. Changed intent under the same idempotency key conflicts. Pending Sessions retain the generation before their first allocation; allocations, suspension, recovery and cleanup use that frozen generation. Existing Sessions and Sessions without a profile keep their existing behavior.
+
+Unavailable choices return HTTP 400 `invalid_request_error`, with parameter `x_agents_core.environment.compute_profile` and the safe message “The requested compute profile is not available for hosted execution.” Client requests cannot supply provider templates, credentials or resource overrides through this field.
 
 ## Runtime capability preparation
 
@@ -173,7 +195,7 @@ Core freezes resource versions, metadata and source selections at Session creati
 
 The runner uses only neutral Environment and Session identity and a Runtime peer, with no Provider, deployment or operating-system branch. Harness differences stay in the adapters.
 
-**Portable preparation input.** `self_hosted` input carries only `workspace_directory` and `capability_directories`. A Session with either workspace placement can also send `x_agents_core.environment`, a Core extension with `environment_template_id`, `files`, `env`, `packages`, `setup_commands`, `skills`, `plugins` and `capability_directories`. It uses the same parsers and inheritance rules as `openai_hosted` input. A field supplied both there and in `environment` is rejected, including an explicit null. A `self_hosted` Session names its Template only through this extension and cannot use a Template whose network is not `enabled` (400, param `x_agents_core.environment.environment_template_id`). Machine location, sizing and network policy are not extension fields.
+**Portable preparation input.** `self_hosted` input carries only `workspace_directory` and `capability_directories`. A Session with either workspace placement can also send `x_agents_core.environment`, a Core extension with `environment_template_id`, `files`, `env`, `packages`, `setup_commands`, `skills`, `plugins` and `capability_directories`. It uses the same parsers and inheritance rules as `openai_hosted` input. A field supplied both there and in `environment` is rejected, including an explicit null. A `self_hosted` Session names its Template only through this extension. Machine location, sizing and network policy are not extension fields. Hosted Sessions may additionally select an administrator-approved compute profile as described below.
 
 ```json
 {
@@ -217,7 +239,7 @@ The daemon runs as its launching account and never uses sudo or raises its permi
 
 Every command uses the launching user's permissions and the host network. Process ownership waits for exit and I/O settlement. Command output is discarded; a confirmed failure keeps only a bounded integer exit status.
 
-When hosted compute uses external workspace storage and is replaced, only the retained Environment filesystem and the qualified Harness's private native history persist. Setup commands are not replayed. Setup and tools can write other locations permitted to the launching user, but changes on the temporary system disk, process memory and background processes are not preserved by cold continuation. Store durable outputs in the workspace and use the declared package installation paths; the [Sandbox Provider lifecycle](../../docs/sandbox-provider.md#suspension) defines when compute can be replaced.
+When hosted compute uses external workspace storage and is replaced, only the retained Environment filesystem and the qualified Harness's private native history persist. Setup commands are not replayed. Setup and tools can write other locations permitted to the launching user, but changes on the temporary system disk, process memory and background processes are not preserved by cold continuation. Store durable outputs in the workspace and use the declared package installation paths; the [Sandbox Provider protocol](../../docs/sandbox-provider.md#cold-replacement-after-checkpoint-retention) defines when compute can be replaced.
 
 ### Explicit local tool environment
 
@@ -227,13 +249,22 @@ The installer's `--tool-env-file` (`OAC_RUNTIME_TOOL_ENV_FILE`) supplies the Run
 
 An Environment's initialization is `pending`, `running`, `complete` or `failed`, independent of any allocation and of authentication and connection publication.
 
+```mermaid
+stateDiagram-v2
+    [*] --> pending
+    pending --> running
+    running --> complete
+    pending --> failed
+    running --> failed
+```
+
 - The Worker's initialization scheduler scans 32 Environments at a time, wraps at the end and bounds concurrent preparations by execution concurrency, independently of Provider maintenance.
 - A missing socket does not consume a pending attempt. An unavailable Harness fails before installation. Each operation rechecks current authority and the original socket; completion rechecks the exact binding.
 - Each file, Skill or Plugin transfer has a two-minute staging budget. Configure, package installation, setup commands and snapshot finalization share the whole initialization’s 30-minute budget, whose remaining duration Core carries on each operation and the Runtime enforces. Initial input keeps its five-minute admission deadline, so large installations should start from an idle Session.
 - A running initialization whose owner is lost, including across a Core restart, fails as unconfirmed; nothing is replayed. A completed Environment never reinstalls on reconnect or native recovery, so later user changes survive.
 - Failure is terminal for the Session but destroys neither compute nor files.
 
-On failure, one transaction marks the Environment failed and records `agent.session.environment.failed`, an `error` event and one `agent.session.failed`. Session reads return `failed`, the reason as `error` and the failure time as `last_active_at`; live streams end after the failed event. Pending input settles as failed. The reason names only the step and its exit status:
+A failed initialization records the events and Session state that [Environment initialization failure](./sessions-events.md#environment-initialization-failure) defines. The reason names only the step and its exit status:
 
 | Failed step | Reason |
 | --- | --- |
@@ -293,11 +324,15 @@ The Session applies the Template first, then its own fields. Composition happens
 
 For comparison, an inline `openai_hosted` Session without a Template treats omitted and null `network` as enabled.
 
+### Preparation reuse
+
+Core may start a hosted Environment from the result of an earlier preparation in the same Project whose effective configuration, after Template composition, is identical, for up to 24 hours after that preparation. Each Session still gets its own copy. Setup commands and package installation then do not run again for this Session. Only `/environment` is reused (see the workspace filesystem scope); HOME and other compute-local changes are not. Setup must not create per-Session unique values, perform external side effects that must happen per Session, or fetch credentials that expire within 24 hours; configurations that need this must differ, for example in `env` or `files`. A Provider that does not declare the [preparation cache](../../docs/sandbox-provider.md#explicit-operation-contracts) always prepares in full.
+
 ### Restricted network
 
 `restricted` requires 1–100 exact ASCII hostnames in `allowed_domains`; subdomains and redirect targets need their own entries. Wildcards, URL or port syntax, IP literals, Unicode and trailing dots are rejected. Reads return the supplied spelling, order and duplicates; comparison uses a separate lowercase, deduplicated copy.
 
-The Runtime does not enforce `disabled` or `restricted`, and no Provider enforces them for it. Core therefore stores these policies in Templates but rejects any Session whose effective network is not `enabled`, before allocating compute. Initialization and tools use the host's existing network.
+Only `enabled` runs. Core stores the other policies in Templates but rejects any Session whose effective network is not `enabled`, before allocating compute. Initialization and tools use the host's existing network.
 
 ### Env and setup commands
 
@@ -357,19 +392,19 @@ Skills and their immutable versions are Project resources, independent of Sessio
 - Bundles are encrypted with the service cipher, bound to Project, Skill and version. Metadata reads never load or decrypt bundles. Deleting a Skill reclaims its versions without affecting frozen Sessions.
 - References resolve inside the Session creation transaction, after the upsert establishes ownership. Referenced resources are locked in a stable order, and the version, metadata and bytes freeze together. Public reference metadata, unresolved Template intent and the resolved Runtime bundle stay distinct; a reference is never reported as inline.
 
-Inline and referenced Skills use the same confidential snapshot and installer. The Runtime installs them under `skills/<name>` in its capability root before setup and native execution. Adapters register only the selected Skill roots: Codex as explicit extra roots, MiniMax Code through its native catalog, and Claude as one controlled envelope per package with real directories and immutable hard links. Automatic native MCP discovery stays disabled. Codex nested `SKILL.md` discovery, `agents/openai.yaml` dependency configuration and Claude inline shell preprocessing fail adapter preparation. Native Harness configuration is never passed through wholesale.
+Inline and referenced Skills use the same confidential snapshot and installer. The Runtime installs them under `skills/<name>` in its capability root before setup and native execution. Adapters register only the selected Skill roots: Codex as explicit extra roots, MiniMax Code through its native catalog, and Claude as user Skills under its private state path, so native lists the bare names a local `~/.claude/skills` gives. Claude rejects a Skill that contains `.claude-plugin`, because native would load it as a plugin with its hooks and MCP servers. Skill roots activate no MCP servers; only [Plugin MCP](#plugin-mcp) does. Codex scans each Skill root recursively as it does locally, so a nested `SKILL.md` registers another native Skill. Native Harness configuration is never passed through wholesale.
 
 ### Plugin MCP
 
 A Plugin declares MCP servers with `mcpServers: "./.mcp.json"` in `.codex-plugin/plugin.json`, or through a root `.mcp.json` when the path is omitted. The file holds `mcpServers` keyed by server name. Selecting a Plugin root as a capability directory activates its MCP declarations; selecting a parent directory discovers Skills without activating nested MCP servers.
 
-The shared parser accepts HTTP `url`, `bearer_token_env_var` and literal `http_headers`, and stdio `command`, `args`, selected `env_vars` and a package-relative `cwd`. Public `env_http_headers` is unsupported. The Runtime re-parses the frozen installed packages and resolves selected values only from the initialized env; a missing value fails instead of falling back to a model or daemon variable.
+The shared parser accepts HTTP `url`, `bearer_token_env_var` and literal `http_headers`, which are non-secret like public MCP headers, and stdio `command`, `args`, selected `env_vars` and a package-relative `cwd`. Public `env_http_headers` is unsupported. The Runtime re-parses the frozen installed packages and resolves selected values only from the initialized env; a missing value fails instead of falling back to a model or daemon variable.
 
 A stdio server starts through the daemon's stdio helper, which resolves the installed declaration and launches the command with the Harness's permissions. On Unix the helper replaces itself with the server; on Windows it forwards stdio inside the owned process tree. Initialized values override the declaration's variables. Process groups and Windows Jobs own cancellation and descendant cleanup, not isolation.
 
 [Harness capabilities](./harness-capabilities.md#environment-preparation) owns the supported Plugin transports and per-Harness limits.
 
-Environment MCP needs enabled network. Duplicate server identities are rejected. Claude rejects literal headers because the pinned client expands them again and forwards custom headers across origins. MiniMax ACP HTTP declarations stay in session-local native memory; tokens never enter native configuration files or process arguments. Required initialization and tool allowlists cannot be set through the Plugin manifest.
+Duplicate server identities are rejected. Claude rejects `${` in a URL or header value ([native differences](./index.md#differences-from-openai)). MiniMax ACP HTTP declarations stay in session-local native memory; tokens never enter native configuration files or process arguments. Required initialization and tool allowlists cannot be set through the Plugin manifest.
 
 ### Effective bindings
 
@@ -377,12 +412,12 @@ The Runtime resolves public HTTP declarations and installed Plugin MCP through `
 
 ### Public MCP connection origin
 
-An Agent's HTTP MCP tool ([declaration](./execution-tools.md#http-mcp)) has a `connection_origin`. Omitted or null means `service`, including on `self_hosted` Sessions. The origin is kept from saved configuration through the Session snapshot to the Runtime request, which requires the exact wire version; a `service` request never becomes an `environment` connection.
+An Agent's HTTP MCP tool ([declaration](./execution-tools.md#mcp)) has a `connection_origin`. Omitted or null means `service`, including on `self_hosted` Sessions, except for a `stdio` server, whose only origin is `environment`. The origin is kept from saved configuration through the Session snapshot to the Runtime request, which requires the exact wire version; a `service` request never becomes an `environment` connection.
 
 | Origin | Connects from | Allowed placements |
 | --- | --- | --- |
 | `service` | Core's service-side execution host | `none` only |
-| `environment` | The Environment's workspace | `openai_hosted` and `self_hosted` with enabled network |
+| `environment` | The Environment's workspace | `openai_hosted` and `self_hosted` |
 
 Core's Harness profile declares `MCPOrigins`; admission and dispatch check the origin against the placement and the Runtime's advertised HTTP, bearer and required-initialization capabilities, and the Runtime validates the origin again before invoking an adapter. No Harness-name or Provider branch selects a different path.
 
@@ -390,4 +425,4 @@ Core's Harness profile declares `MCPOrigins`; admission and dispatch check the o
 
 Both origins support anonymous HTTP and HTTPS bearer credentials. The attached-Vault selection freezes the credential identity, including a unique implicit URL match or an anonymous selection. Only that Project-authorized credential enters the transient Runtime request; Core defaults and unrelated Vaults are never searched. A decryption failure or missing credential fails execution without an anonymous fallback. Public Environment MCP keeps `project_vault` authority and Plugin credentials keep `environment_configuration` authority; neither overrides a duplicate server label. Bearers never enter persisted native configuration or process arguments.
 
-Tool allowlists and required initialization follow the [HTTP MCP contract](./execution-tools.md#http-mcp).
+Tool allowlists and required initialization follow the [HTTP MCP contract](./execution-tools.md#mcp).
diff --git a/contracts/agents-api/execution-tools.md b/contracts/agents-api/execution-tools.md
index 36ace1a5c..bc955df4e 100644
--- a/contracts/agents-api/execution-tools.md
+++ b/contracts/agents-api/execution-tools.md
@@ -7,25 +7,30 @@ An Agent declares application functions, controls and MCP servers in `tools`, an
 ## Admission
 
 - Saved Agents keep every pinned tool declaration as resource data. Saving never qualifies execution.
-- Session creation resolves saved references and inline declarations with the execution parser into the immutable Session snapshot, then checks the combination against the selected Harness's profile in `services/core/internal/engine`. An unsupported combination returns 400 `unsupported_or_invalid_configuration` before anything is written. Protocol errors, such as a repeated `web_search` or `tool_search` or a non-object schema root, use the official error fields ([validation](./wire-semantics.md#configuration-validation)).
+- Session creation resolves saved references and inline declarations with the execution parser into the immutable Session snapshot, then checks the combination against the selected Harness's declaration in `internal/harnessconfig`. An unsupported combination returns 400 `unsupported_or_invalid_configuration` before anything is written. Protocol errors, such as a repeated `web_search` or `tool_search` or a non-object schema root, use the official error fields ([validation](./wire-semantics.md#configuration-validation)).
 - Before dispatch, the selected Runtime must also advertise the operation's capability. An advertisement alone never enables an operation.
 - The native Harness runs the model and tool loop. Core adds no second loop, output repair, schema coercion or prompt wrapper, and selects no native tool names.
 
 ## Functions
 
-A function declaration requires `name`, `description` and a JSON Schema in `parameters`; `defer_loading` defaults to false and cannot be null. Names are nonblank, unique and at most 512 bytes; a Session holds at most 64 function definitions. Saved references resolve into the Session snapshot, and the definitions stay fixed through native preparation and continuation.
+A function declaration requires `name`, `description` and a JSON Schema in `parameters`; `defer_loading` defaults to false and cannot be null. Names are nonblank and unique. Saved references resolve into the Session snapshot, and the definitions stay fixed through native preparation and continuation.
 
 **Results.** A caller submits `agent.session.input.tool_result` events with `turn_id`, `call_id` and `success`, and optional nullable `error` and `output`. Output is a string or ordered text and image parts, subject to the Harness. Batches are atomic and keep field presence, original content and retry identity; public result Items and events always carry `output` and `error`, null when not submitted.
 
 | Case | Response |
 | --- | --- |
-| Identical retry, also after the Turn ends | Accepted |
+| Identical retry, also after the Turn ends or the call is abandoned | Accepted |
 | Different result for the same call | 409 `conflict_error` |
 | First result after the Turn was cancelled | 409 `conflict_error` |
+| First result for a call the native Harness abandoned | 409 `conflict_error` |
 | Unknown call, or a call of another Turn, in the caller's Session | 400 `invalid_request_error`; the pending action is unchanged |
 | Missing or foreign Session | 404 |
 
-[Session input conflicts](./sessions-events.md#input-errors) records the exact messages. Invalid or unsupported content cannot consume a pending call. Admission is separate from application: the adapter confirms a result only when the matching native tool result appears in the live root Turn ([receipt contract](./message-content.md#function-results)). A transport write alone confirms nothing, and a confirmation says nothing about provider consumption or exactly-once external effects. Core never replays a result automatically.
+[Session input conflicts](./sessions-events.md#input-errors) records the exact messages. Invalid or unsupported content cannot consume a pending call. Admission is separate from application: the adapter confirms a result only when the matching native tool result appears in the live Turn that made the call ([receipt contract](./message-content.md#function-results)). A transport write alone confirms nothing, and a confirmation says nothing about provider consumption or exactly-once external effects. Core never replays a result automatically.
+
+The native Harness can abandon a call before it applies a result, for example when the root Turn closes or interrupts the Subagent that made it, or when MiniMax Code's MCP client times the call out. The call then stops being a required action, the Turn continues and returns to `in_progress` when no required action is left, and a later `function_call_output` for it is rejected like a result after cancellation. An abandoned call has no application receipt.
+
+A function call made by a Subagent is a required action of the root Turn that runs the child. Its `turn_id` is that root Turn, and its `call_id` equals the `call_id` of the child's `function_call` Item on the [Subagent routes](./subagents.md#public-reads). Answer it with `function_call_output` / `tool_result` under that `call_id` and the root Turn ID; the child's Turn ID is not a Session Turn and gets the 400 for a call of another Turn. A Subagent's HTTP MCP calls are `mcp_call` Items in the child's history.
 
 ### Required actions and recovery
 
@@ -39,15 +44,17 @@ The Worker fails previously claimed work without replay after execution loss; qu
 
 `text.format` accepts `{type: "json_schema", schema: {...}}`, the Agents API form: it has no `name`, `strict` or other Responses API wrapper fields. The schema is saved, inherited through Agent and Session resolution and frozen in the Session snapshot. An explicit non-object root type is a protocol error on save and Session creation for every Harness. Claude requires an explicit `type: "object"` at the schema root. The Claude SDK reads JSON numbers as binary64, so Session admission rejects schemas whose numbers would change in that conversion; saved Agents keep them unchanged.
 
-Core carries the schema in `ExecutionControls.OutputFormat` and requires the profile's structured-output qualification plus the Runtime's `structured_output` and message-observation capabilities, only for requests that use the option. Frozen schemas reach preparation before input and apply to initial and resumed execution; Start cannot replace them.
+Core carries the schema in `ExecutionControls.OutputFormat` and requires structured-output support in the Harness declaration plus the Runtime's `structured_output` and message-observation capabilities, only for requests that use the option. Frozen schemas reach preparation before input and apply to initial and resumed execution; Start cannot replace them.
+
+The Claude adapter passes `outputFormat` to the pinned SDK and allows its native `StructuredOutput` terminal tool, which is internal and never an extra caller function. Natively the tool is added beside Subagents, Skills, MCP and ToolSearch; the adapter's inventory check leaves it and ToolSearch to native, and a missing structured call fails the result. A matching live root tool result and an attributed successful SDK result confirm the output. The adapter publishes the native `result.result` string unchanged as a completed `final_answer` message with the native tool-use ID; parent assistant prose keeps its own ID. Unvalidated retries and cancelled candidates never become the answer, and the adapter never serializes `structured_output` back to JSON. The stream follows the official message sequence with the whole text in one `output_text.delta`. The bridge advertises the operation only when it reports `structured_output`, and a workspace Runtime also needs `workspace_structured_output`.
 
-The Claude adapter passes `outputFormat` to the pinned SDK and allows its native `StructuredOutput` terminal tool, which is internal and never an extra caller function. A matching live root tool result and an attributed successful SDK result confirm the output. The adapter publishes the native `result.result` string unchanged as a completed `final_answer` message with the native tool-use ID; parent assistant prose keeps its own ID. Unvalidated retries and cancelled candidates never become the answer, and the adapter never serializes `structured_output` back to JSON. The stream follows the official message sequence with the whole text in one `output_text.delta`. The bridge advertises the operation only when it reports `structured_output`, and a workspace Runtime also needs `workspace_structured_output`.
+The Codex adapter sends the schema unchanged as the native `outputSchema` on every root Turn, including Turns after resume or recovery, and publishes the native final agent message text unchanged. Codex reads JSON numbers losslessly, so Session admission applies no number or root-type limit beyond the common rules. A steered input joins the running Turn under its schema, and Subagent threads do not receive the schema. Codex passes the schema to the model provider as a strict Responses `text.format`; a provider that cannot run it returns its own error unchanged, and a provider that ignores it can return text that does not match the schema.
 
 ## Deferred function discovery
 
 A `tool_search` tool has only `type`; Responses-only execution fields are rejected. Function `defer_loading` marks which definitions load lazily. Discovery requires both: `tool_search` without a deferred function, or deferred functions without `tool_search`, is rejected. The saved-Agent tool union keeps `tool_search`; the pinned Session response union omits it, so Session and SSE resources project it out while the frozen configuration keeps it. The pinned Items union has no tool-search Item, and Core invents none.
 
-Core sends `PromptRequestPayload.ToolSearch` and each `FunctionTool.DeferLoading`, and requires the profile's qualification plus the Runtime's `tool_search` capability. Native search and lazy schema loading belong to the adapter. The Claude adapter's MCP server marks eager definitions `anthropic/alwaysLoad:true` and deferred ones false, and enables native ToolSearch; the function profile allows only declared callbacks and ToolSearch besides the selected workspace tools. A workspace Runtime derives `tool_search` from the bridge's `workspace_tool_search` feature. The native Harness owns model and provider policy; known conflicting modes and beta settings reject in the adapter, and the SDK gives no reliable pre-input signal that deferral took effect after an opaque policy change.
+Core sends `PromptRequestPayload.ToolSearch` and each `FunctionTool.DeferLoading`, and requires `tool_search` support in both the Harness declaration and the Runtime. Native search and lazy schema loading belong to the adapter. The Claude adapter's MCP server marks eager definitions `anthropic/alwaysLoad:true` and deferred ones false, and sets `ENABLE_TOOL_SEARCH=true`; the `none` profile allows only declared callbacks, declared MCP tools and ToolSearch. A workspace Runtime derives `tool_search` from the bridge's `workspace_tool_search` feature. The native Harness owns model, provider and beta-setting policy; the adapter rejects none of them, and the SDK gives no reliable pre-input signal that deferral took effect.
 
 ## Web search and programmatic tool calling
 
@@ -60,17 +67,17 @@ Core sends `PromptRequestPayload.ToolSearch` and each `FunctionTool.DeferLoading
 
 Saved Agents keep every pinned `web_search` mode: omitted or null is saved as `live`, and `cached` and `live` as sent ([saved modes](./wire-semantics.md#saved-configuration)). Search settings are resource data: omitted or null `context_size` resolves to `medium`; omitted domains and location resolve to null; an empty domain list stays empty; a supplied location, including `{}`, has `city`, `country`, `region` and `timezone`, null where omitted.
 
-Execution admits only `mode: "disabled"` and `enabled: false`. Enabled or omitted-mode search and enabled or omitted-`enabled` programmatic calling are rejected at Session admission unless the Session replaces the saved tools. Omitting programmatic configuration keeps each Harness's native behavior, which differs from the official default-on behavior. Unrelated native utility tools are not removed.
+Execution carries the resolved values to the Harness and validates them against its declaration in `internal/harnessconfig` (`Execution`): the supported web search modes and whether search settings are accepted, reasoning efforts and summaries, service tiers, programmatic-tool-calling values and text verbosities. A value outside the declaration is rejected at Session admission with a message naming the field, unless the Session replaces the saved tools. Core sends an option only when the Agent sets it or the pinned default applies, so an omitted `web_search` or `programmatic_tool_calling` keeps each Harness's native behavior. For programmatic calling this differs from the official default-on behavior. Unrelated native utility tools are not removed. Claude Code on a workspace placement also keeps `WebSearch` and `WebFetch` when the control is omitted; [Turns and Items](./sessions-events.md#turns-and-items) gives their `web_search_call` actions.
 
-`DisableProgrammaticToolCalling` carries the disabled intent on initial execution and cold continuation and requires the Runtime capability only when present. Search uses the existing disabled control.
+`ExecutionControls` carries the options ([Runtime protocol](../../docs/runtime-protocol.md#capability-declarations)). The Runtime needs only the `execution_controls` capability.
 
-| Harness | Native enforcement |
-| --- | --- |
-| Codex | Disables code-mode features; checks native managed requirements before thread start or resume and rejects a forced conflicting feature |
-| Claude SDK | Keeps the restricted built-in inventory and verifies native initialization against it |
-| MiniMax Code | Keeps the restricted native tool profile, an empty text-execution inventory and disabled web search |
+| Harness | Web search | Programmatic tool calling |
+| --- | --- | --- |
+| Codex | `disabled`, `cached` and `live`, with `context_size`, `allowed_domains` and `location`, as native `web_search` and `tools.web_search` settings | `enabled: true` turns on native `code_mode`; `false` turns off `code_mode`, `code_mode_only` and `code_mode_prewarm` and checks native managed requirements before a thread starts or resumes |
+| Claude Code | `disabled` and `live`, with `context_size: "medium"` and no `allowed_domains` or `location`. On a workspace placement the native `claude_code` tool set runs without ask-user, scheduling, workflow, background and `ListAgents` tools; `disabled` removes `WebSearch` and `WebFetch`, and `live` keeps them. `environment: none` keeps no built-in tools, and `live` adds only `WebSearch`, a provider-side tool. `WebFetch` stays off there because it would fetch from the Runtime host without an Environment | `false` only: native REPL calls tools from model-written code, outside the tool records that function receipts and tool observations read |
+| MiniMax Code | `disabled` only, through the native `features.webSearch=false` because native search needs a MiniMax account credential. On a workspace placement the native tools run, and `disabled` also removes `web_fetch` while an omitted control keeps it. `environment: none` has no built-in tools | `false` only |
 
-## HTTP MCP
+## MCP
 
 ```json
 {
@@ -83,11 +90,18 @@ Execution admits only `mode: "disabled"` and `enabled: false`. Enabled or omitte
 }
 ```
 
-- `server_label` is nonempty and unique within the Session. Only the `http` transport is accepted; `server_url` is an absolute HTTP or HTTPS URL without credentials, query or fragment. Nonempty `headers` and `request_metadata` and an inline `authorization` are rejected.
+- `server_label` is nonempty and unique within the Session. The `http` and `stdio` transports are accepted; `server_url` is an absolute HTTP or HTTPS URL without credentials or fragment. Nonempty `request_metadata` is rejected with "Nonempty MCP request_metadata is not supported yet." and an inline `authorization` with "Inline MCP authorization is not supported; use credential_id.". `headers` are non-secret, need valid HTTP names and values with names unique ignoring case, and reach the native Harness unchanged beside any bearer; an `Authorization` header is rejected, because credentials enter only through a Vault credential. Claude rejects `${` in `server_url` or a header value ([native differences](./index.md#differences-from-openai)).
 - [Public MCP connection origin](./environments.md#public-mcp-connection-origin) owns origin defaults, placement and credential authority; [Harness capabilities](./harness-capabilities.md#tools) owns per-Harness support.
 - Omitted or null `allowed_tools` permits every server tool; `[]` permits none.
 - `required: true` makes native thread creation and cold resume wait for the server to initialize; a failure stops execution without replacing retained history. It needs the Runtime's `mcp_http_required` capability. Public work can be accepted or queued during the wait.
 - Bearer authentication uses an attached static or OAuth Vault credential. [Vault credentials](./vaults.md) owns selection, and [MCP credential authority](./environments.md#public-mcp-connection-origin) owns the frozen Runtime binding. Authenticated execution requires `mcp_http_bearer_auth`.
 - The Runtime must advertise `mcp_http_tools`. The native Harness owns discovery, calls and results; public `mcp_call` Items use the original server and tool names and keep the observed native result.
 
-Codex verifies the exact effective MCP configuration before starting or resuming a thread, excludes undeclared servers, disables native apps and plugins, and rejects reserved native labels and stored native MCP credentials. Claude accepts labels of ASCII letters, digits, underscore and hyphen except `functions`, tool names that may also contain dots, and requires connected servers with static inventories. Anonymous Claude requests send a blank Authorization header to suppress native OAuth injection. Native OAuth login is not supported.
+A `stdio` server carries `command`, `args`, `cwd` and `env_vars`, runs as a process of the Environment and needs a workspace placement (`openai_hosted` or `self_hosted`); on `environment: none` admission returns a 400. Its `connection_origin` defaults to and must be `environment`, and it takes no `credential_id`. A nonempty Session `env` is rejected with "Inline MCP env is not supported; declare env_vars and set the values in the Environment."; `command` is nonempty, `cwd` is an absolute path, `env_vars` holds variable names and no part contains NUL. `env_vars` names variables of the Environment, whose values never reach Core; as for [Plugin MCP](./environments.md#plugin-mcp), the start fails when the Environment does not set one. The Runtime must advertise `mcp_http_tools`, which covers every public MCP server.
+
+- Codex writes `command`, `args`, `cwd` and `env_vars` to its `[mcp_servers]` table and verifies them with the rest of the declared configuration before any native connection.
+- Claude Code starts the server with `command` and `args` in the directory of its own process, which is the workspace directory, so admission rejects any other `cwd` with "The configured engine starts MCP stdio servers in the workspace directory; set cwd to it." Core rejects non-null `allowed_tools` for a stdio server, because the adapter can hide unselected tools only on HTTP servers.
+- MiniMax Code starts session stdio servers in its private home directory, which no `cwd` can name, so admission rejects every stdio server with "The configured engine cannot start MCP stdio servers in the declared cwd."
+- Codex passes `env_vars` to its restricted native environment. Claude Code starts the server with its whole process environment, as it starts Bash, so the server also sees the model provider key and the Vault bearer tokens of other MCP servers, and a variable the adapter sets, such as `HOME`, keeps the adapter's value.
+
+Codex trusts the workspace natively, so its project configuration loads on start and cold resume, and undeclared servers, apps and plugins keep their native behavior. Before any native connection that carries a Core credential, it verifies that each declared server keeps its URL or command, bearer reference and headers, and fails the start or resume with an error otherwise. It rejects reserved native labels and stored native MCP credentials. Claude accepts labels of ASCII letters, digits, underscore and hyphen except `functions`, any tool name (the native client normalizes it, and the adapter rejects normalized collisions), and requires static inventories. As locally, Claude runs on without the tools of an optional server that did not connect; a required one fails the start. MiniMax Code serves public functions as the MCP server `functions`, so an Agent with functions cannot use that label for a public or Plugin server. Anonymous Claude requests send a blank Authorization header to suppress native OAuth injection. Native OAuth login is not supported.
diff --git a/contracts/agents-api/go-bindings.json b/contracts/agents-api/go-bindings.json
index 3e2178e08..edc891904 100644
--- a/contracts/agents-api/go-bindings.json
+++ b/contracts/agents-api/go-bindings.json
@@ -206,7 +206,7 @@
     "order": ["id", "turn_id", "type", "status", "role", "phase", "content", "command", "cwd", "duration_ms", "exit_code", "name", "call_id", "server_label", "arguments", "output", "error", "action", "agent_id", "sender_agent_id", "recipient_agent_id", "recipient_agent_ids", "model", "reasoning_effort", "summary"]
   },
   "ItemContent": {
-    "sources": ["#/components/schemas/MessageContentResource", "#/components/schemas/EncryptedContentResource"],
+    "sources": ["#/components/schemas/MessageContentResource", "#/components/schemas/EncryptedContentResource", "#/components/schemas/SummaryTextResource"],
     "fields": {
       "image_url": {"type": "string"}
     }
@@ -215,20 +215,26 @@
     "sources": ["#/components/schemas/SessionItemListResource"],
     "order": ["object", "first_id", "last_id", "data", "has_more"]
   },
-  "MCPHTTPTransport": {
-    "sources": ["#/components/schemas/PersistedMcpTransportConfigParamHttp"],
-    "fields": {
-      "headers": {"type": "*map[string]string"}
-    }
-  },
   "MCPTool": {
     "sources": ["#/components/schemas/AgentToolResourceMcp"],
     "fields": {
-      "transport": {"type": "MCPHTTPTransport"},
+      "transport": {"type": "MCPTransport"},
       "allowed_tools": {"type": "*[]string"}
     },
     "order": ["type", "server_label", "transport", "allowed_tools", "connection_origin", "credential_id", "request_metadata", "required"]
   },
+  "MCPTransport": {
+    "marshal_union": true,
+    "sources": ["#/components/schemas/PersistedMcpTransportConfigParam"],
+    "fields": {
+      "server_url": {"type": "string"},
+      "headers": {"type": "*map[string]string"},
+      "command": {"type": "string"},
+      "args": {"type": "*[]string"},
+      "cwd": {"type": "string"},
+      "env_vars": {"type": "*[]string"}
+    }
+  },
   "MCPToolInput": {
     "sources": ["#/components/schemas/AgentToolConfigParamMcp"]
   },
diff --git a/contracts/agents-api/harness-capabilities.md b/contracts/agents-api/harness-capabilities.md
index b5130ae51..9385052b6 100644
--- a/contracts/agents-api/harness-capabilities.md
+++ b/contracts/agents-api/harness-capabilities.md
@@ -2,7 +2,9 @@
 title: "Harness capabilities"
 ---
 
-This page lists what each Harness supports on each placement. Core decides admission from the Harness's engine profile in `services/core/internal/engine`, and the Runtime that runs the Session must also advertise the operation. The linked contracts define each operation; [Harness onboarding](./harness-onboarding.md#qualify-the-adapter) describes how a Harness is qualified.
+This page lists what each Harness supports on each placement. Core decides admission from the Harness's declaration in `internal/harnessconfig/<package>/declaration.go`, and the Runtime that runs the Session must also advertise the operation. The linked contracts define each operation; [Harness onboarding](./harness-onboarding.md#qualify-the-adapter) describes how a Harness is qualified.
+
+Anything this page does not list follows the Harness's native behavior with the selected model, as in a local run. Each adapter guide lists the native defaults it overrides for unattended cloud execution ([design rule](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#core-assembles-harnesses-run-natively)).
 
 | Status | Meaning |
 | --- | --- |
@@ -14,14 +16,15 @@ Placements are `none` (no Environment), hosted (`openai_hosted`) and self-hosted
 
 ## Execution and input
 
-| Operation | Codex | Claude SDK | MiniMax Code |
+| Operation | Codex | Claude Code | MiniMax Code |
 | --- | --- | --- | --- |
 | Text Turns, active input, cancellation, restart and continuation | Verified on all placements | Verified on all placements | Verified on all placements |
 | [Files and Artifacts](./environment-files.md) | Verified: hosted, self-hosted | Verified: hosted, self-hosted | Verified: hosted, self-hosted |
-| [Whitespace-only message text](./message-content.md) | Admitted; delivered unchanged | Rejected | Rejected |
-| [Inline PNG and JPEG message images](./message-content.md) | Verified on all placements | Verified on all placements | Rejected |
-| Remote image URLs | Rejected | Rejected | Rejected |
-| Explicit `reasoning`; `service_tier` other than `auto` | Rejected | Rejected | Rejected |
+| [Whitespace-only message text](./message-content.md) | Admitted; delivered unchanged | Admitted; native drops it, and an all-blank message becomes `(no content)` | Rejected |
+| [Message images](./message-content.md#images) | PNG and JPEG data URLs: verified on all placements; other data URLs: admitted; remote URLs: rejected | PNG and JPEG data URLs: verified on all placements; remote URLs and GIF and WebP data URLs: admitted | Rejected |
+| `reasoning.effort` | `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`: admitted | `low`, `medium`, `high`, `xhigh`, `max`: admitted | `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`: admitted |
+| `reasoning.summary` | `concise`, `detailed`, `auto`: admitted | `auto`: admitted | Rejected |
+| `service_tier` other than `auto` | `default`, `flex`, `priority`: admitted | Rejected | Rejected |
 | `text.verbosity` other than `medium` | Admitted; the native model decides | Rejected | Rejected |
 | [Public token usage](./sessions-events.md) | Measured counters | Null | Null |
 
@@ -29,28 +32,29 @@ Native model parameters and provider protocols per Harness are in [model executi
 
 ## Tools
 
-| Operation | Codex | Claude SDK | MiniMax Code |
+| Operation | Codex | Claude Code | MiniMax Code |
 | --- | --- | --- | --- |
-| [Public functions](./execution-tools.md#functions) with text results | Verified: `none`, hosted; admitted: self-hosted | Verified on all placements; object-root schemas only | Rejected |
-| [Function results with images](./message-content.md#function-results) | Verified: `none`, hosted; admitted: self-hosted | Verified on all placements; successful inline PNG or JPEG results only | Rejected |
-| [Structured output](./execution-tools.md#structured-output) | Rejected | Verified on all placements | Rejected |
+| [Public functions](./execution-tools.md#functions) with text results | Verified: `none`, hosted; admitted: self-hosted | Verified on all placements; object-root schemas only | Verified: `none`; admitted: hosted, self-hosted; object-root schemas only; a result must arrive within 120 s ([difference](./index.md#differences-from-openai)) |
+| [Function results with images](./message-content.md#function-results) | Verified: `none`, hosted; admitted: self-hosted; remote URLs: rejected | Successful results only; PNG and JPEG data URLs: verified on all placements; GIF and WebP: admitted | Rejected |
+| [Structured output](./execution-tools.md#structured-output) | Admitted on all placements | Verified on all placements | Rejected |
 | [Deferred function discovery](./execution-tools.md#deferred-function-discovery) | Rejected | Verified: `none`, self-hosted; admitted: hosted | Rejected |
 | [Disabled web search and programmatic tool calling](./execution-tools.md#web-search-and-programmatic-tool-calling) | Verified: `none`; admitted: hosted, self-hosted | Verified: `none`; admitted: hosted, self-hosted | Verified: `none`; admitted: hosted, self-hosted |
-| Enabled web search or programmatic tool calling | Rejected | Rejected | Rejected |
-| [Service-origin HTTP MCP](./environments.md#public-mcp-connection-origin) | Verified: `none`; rejected elsewhere | Verified: `none`; rejected elsewhere | Rejected |
+| Web search `cached` or `live` and programmatic tool calling `enabled` | Admitted on all placements | `live` admitted on all placements; `cached` and `enabled` rejected | Rejected |
+| [Service-origin HTTP MCP](./environments.md#public-mcp-connection-origin) | Verified: `none`; rejected elsewhere | Verified: `none`; rejected elsewhere | Verified: `none`, with `allowed_tools` null and `required` false only; rejected elsewhere |
 | [Environment-origin HTTP MCP](./environments.md#public-mcp-connection-origin) | Verified: hosted, self-hosted | Verified: hosted, self-hosted | Verified: hosted, self-hosted; `allowed_tools` null and `required` false only |
-| [HTTP MCP bearer credentials](./execution-tools.md#http-mcp) | Verified | Verified | Verified |
+| [Stdio MCP](./execution-tools.md#mcp) | Admitted: hosted, self-hosted | Admitted: hosted, self-hosted; `cwd` must be the workspace directory and `allowed_tools` null | Rejected |
+| [HTTP MCP bearer credentials](./execution-tools.md#mcp) | Verified | Verified | Verified |
 | Required MCP initialization | Verified | Verified | Rejected |
 | [Subagents](./subagents.md) | Verified: hosted; admitted: `none`, self-hosted | Verified: hosted; admitted: `none`, self-hosted | Verified: hosted; admitted: `none`, self-hosted |
-| Subagents together with functions or HTTP MCP | Rejected | Rejected | Rejected |
+| Subagents together with functions or HTTP MCP | Verified: `none`; admitted: hosted, self-hosted | Verified: functions on `none`; admitted: HTTP MCP, hosted, self-hosted | Admitted; children get none of the Session's functions or MCP servers |
 
-Claude structured output requires a single Agent, medium verbosity and no Skills, Plugins, capability directories, MCP or `tool_search`. Claude deferred discovery requires a single Agent, only function tools besides `tool_search` and the disabled controls, no Skills, Plugins or capability directories and no structured output. Claude on a workspace placement needs the packaged bridge features for each operation (`workspace_functions`, `workspace_structured_output`, `workspace_tool_search`, `workspace_mcp_http`).
+Claude structured output requires medium verbosity and combines with `multi_agent`, Skills, Plugins, capability directories, MCP and `tool_search`. Claude deferred discovery combines with MCP, Skills, Plugins, capability directories and structured output. Claude Subagents inherit the parent's tools, including deferred functions. Claude Code decides whether `tool_search` takes effect for the configured model, provider and beta settings. Claude on a workspace placement needs the packaged bridge features for each operation (`workspace_functions`, `workspace_structured_output`, `workspace_tool_search`, `workspace_mcp_http`).
 
 ## Environment preparation
 
 These operations need a workspace, so they apply to hosted and self-hosted placements only.
 
-| Operation | Codex | Claude SDK | MiniMax Code |
+| Operation | Codex | Claude Code | MiniMax Code |
 | --- | --- | --- | --- |
 | [Initial files, setup commands, Skills and Plugins](./environments.md#runtime-capability-preparation) | Verified: hosted, self-hosted | Verified: self-hosted; admitted: hosted | Verified: self-hosted; admitted: hosted |
 | Capability directories | Admitted | Admitted | Admitted |
@@ -58,6 +62,6 @@ These operations need a workspace, so they apply to hosted and self-hosted place
 | `packages.system` | Rejected | Rejected | Rejected |
 | Network `disabled` or `restricted` | Rejected | Rejected | Rejected |
 | [Plugin MCP over stdio](./environments.md#plugin-mcp) | Verified: hosted, self-hosted | Verified: self-hosted; admitted: hosted | Verified: self-hosted; admitted: hosted |
-| Plugin MCP over HTTP | Admitted, with literal headers or HTTPS bearer | Admitted, anonymous or HTTPS bearer | Verified: self-hosted; admitted: hosted; anonymous or HTTPS bearer |
+| Plugin MCP over HTTP | Admitted, with literal headers or HTTPS bearer | Admitted, with literal headers or HTTPS bearer | Verified: self-hosted; admitted: hosted; literal headers or HTTPS bearer |
 
-External workspace storage additionally requires the selected Harness profile and Runtime to support `retained_native_history`; owned workspace storage does not. The [Workspace Provider guide](../../docs/workspace-provider.md) owns storage combination admission.
+External workspace storage additionally requires the selected Harness declaration and Runtime to support `retained_native_history`; Docker and E2B, which keep their own disks, do not. microsandbox always uses external storage, so MiniMax Code, which does not declare the capability, cannot run on it. The [Workspace filesystem protocol](../../docs/workspace-provider.md) owns storage combination admission.
diff --git a/contracts/agents-api/harness-catalog.md b/contracts/agents-api/harness-catalog.md
index fd399a513..200ad4e8e 100644
--- a/contracts/agents-api/harness-catalog.md
+++ b/contracts/agents-api/harness-catalog.md
@@ -1,12 +1,16 @@
+---
+title: "Built-in Harness registrations"
+---
+
 [//]: # (Generated by scripts/generate-harness-catalog.py; DO NOT EDIT.)
 # Built-in Harness registrations
 
-The authored registration list is [`catalog.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/builtin/catalog.json). Change it and run `make generate-harness-catalog`; `make check-harness-catalog` checks the generated projections.
+Each Harness is the one `declaration.go` in its `internal/harnessconfig/<package>` directory. Adding a directory with a `declaration.go` registers the Harness; `make generate-harness-catalog` regenerates the registrations and this page, and `make check-harness-catalog` checks them.
 
-| Identifier | Display name | Model configuration declaration | Core qualification constructor |
-| --- | --- | --- | --- |
-| `claude_sdk` | Claude Code | `claudesdk.Configuration` | `claudeProfile` |
-| `codex` | Codex | `codex.Configuration` | `codexProfile` |
-| `mcode` | MiniMax Code | `mcode.Configuration` | `mcodeProfile` |
+| Identifier | Display name | Declaration |
+| --- | --- | --- |
+| `claude_sdk` | Claude Code | [`claudesdk/declaration.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/claudesdk/declaration.go) |
+| `codex` | Codex | [`codex/declaration.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/codex/declaration.go) |
+| `mcode` | MiniMax Code | [`mcode/declaration.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/mcode/declaration.go) |
 
-Configuration declarations live in `internal/harnessconfig/<package>` and qualification constructors in `services/core/internal/engine`. These registrations describe the build. Which Harnesses a deployment enables is the `OAC_HARNESSES` [process setting](../../docs/configuration.md#settings), [Harness capabilities](./harness-capabilities.md) lists what each Harness supports, and a connected Runtime reports its own availability. [Harness onboarding](./harness-onboarding.md) describes the adapter and packaging steps.
+These registrations describe the build. Which Harnesses a deployment enables is the `OAC_HARNESSES` [process setting](../../docs/configuration.md#settings), [Harness capabilities](./harness-capabilities.md) lists what each Harness supports, and a connected Runtime reports its own availability. [Harness protocol](./harness-onboarding.md) describes the adapter and packaging steps.
diff --git a/contracts/agents-api/harness-onboarding.md b/contracts/agents-api/harness-onboarding.md
index 93acd1c66..df391130f 100644
--- a/contracts/agents-api/harness-onboarding.md
+++ b/contracts/agents-api/harness-onboarding.md
@@ -1,59 +1,59 @@
 ---
-title: "Add a Harness"
+title: "Harness protocol"
 ---
 
-A **Harness** is a native agent engine (Codex, Claude Code, MiniMax Code) that runs the model and tool loop. A **Harness adapter** translates the Runtime's Executor and Turn contract into that engine's SDK or protocol. This document is the Runtime–Harness protocol: the adapter interfaces and their lifecycle obligations, registration, Core qualification and acceptance. [Harness capabilities](./harness-capabilities.md) records what each current Harness supports.
+A **Harness** is a native agent engine (Codex, Claude Code, MiniMax Code) that runs the model and tool loop; a **Harness adapter** translates the Runtime's Executor and Turn contract into that engine's SDK or protocol. The Harness protocol is the contract between the Runtime and the adapter: the adapter interfaces and their lifecycle obligations, the declaration, registration and acceptance. It is for developers who add or maintain a Harness.
 
-Start from two entry points:
-
-- [`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go): the shared model configuration contract (declarations and preparation).
-- [`agent/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/agent/harness.go): the execution lifecycle, the extension contracts and the registration methods.
+| Property | Value |
+| --- | --- |
+| Caller | The Runtime ([dispatch](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/apps/daemon/internal/dispatch)) |
+| Implementations | The Codex, Claude Code and MiniMax Code adapters ([Native references](#native-references)). [Harness capabilities](./harness-capabilities.md) records what each supports. |
+| Code | [`agent/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/agent/harness.go): the execution lifecycle, the extension contracts and the registration methods. [`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go): the `Declaration` every Harness provides, the registry of declarations and the shared model configuration contract. |
+| Transport | In-process Go interfaces. The Runtime speaks the [Core–Runtime protocol](../../docs/runtime-protocol.md) to Core. |
+| Version rule | A change to the interfaces edits this page and every adapter in one change. |
 
 ## Ownership
 
-```text
-Core: Session, Turn, immutable configuration, durable events
-                         |
-              common Runtime protocol
-                         |
-Runtime: Executor preparation, reuse, idle expiry, recovery
-                         |
-               Harness adapter package
-                         |
-          native SDK, process or connection
+```mermaid
+flowchart TB
+    Core["Core<br/>Session, Turn, immutable configuration, durable events"]
+    Runtime["Runtime<br/>Executor preparation, reuse, idle expiry, recovery"]
+    Adapter["Harness adapter package"]
+    Native["Native SDK, process or connection"]
+    Core -->|"Core-Runtime protocol"| Runtime
+    Runtime -->|"Executor and Turn interfaces"| Adapter
+    Adapter --> Native
 ```
 
 | Component | Responsibility | Location |
 | --- | --- | --- |
 | Core | Public API, authority, durable state, scheduling and configuration snapshots | `services/core` |
 | Runtime | Authenticated connection, shared capability preparation and the common Executor and Turn lifecycle | `apps/daemon/internal/dispatch` |
-| Adapter | Native configuration, resources, API calls, event translation and restrictions | `apps/daemon/internal/agent/<kind>` |
+| Adapter | Native configuration, resources, API calls, event translation and restrictions | `apps/daemon/internal/agent/<package>` |
 | Harness | Native model and tool loop and history | Pinned SDK or executable |
-| Service profile | Pure validation of qualified operations and placements | `services/core/internal/engine` |
-| Registration | Adapter declarations, installed factories and verified capabilities | `apps/daemon/internal/agent/<kind>/declaration.go`; static list in `apps/daemon/internal/cli/agent_discovery.go` |
+| Declaration | The Harness's maximum capabilities, placements, configuration and pure admission restrictions, read by Core admission and the Runtime | `internal/harnessconfig/<package>/declaration.go` |
+| Runtime binding | The declaration plus discovery, installed factories and verified capabilities | `apps/daemon/internal/agent/<package>/declaration.go` |
 
 An Environment supplies execution resources. Managed E2B, Docker and microsandbox machines and application-owned machines differ in provisioning and connection; the connected Runtime uses this same contract. The daemon runs on Linux, macOS and Windows, managed Providers are Linux-only, and each adapter qualifies its own platforms ([self-hosted platforms](../../docs/getting-started/self-hosted.md#platforms)). Native factories receive capabilities only after the Runtime has loaded the bound installed snapshot ([capability preparation](./environments.md#runtime-capability-preparation)). Model providers supply model communication settings, not Turn scheduling or native process ownership.
 
 ## Steps
 
 1. **Pin the native source.** Record the upstream package version and source revision and document the native entry point next to the adapter.
-2. **Implement the adapter** in `apps/daemon/internal/agent/<kind>`: an `ExecutorFactory`, an `Executor` and a `Turn` ([required interfaces](#required-adapter-interfaces), [lifetimes](#executor-and-turn-lifetimes)). Reuse the shared process, credential, configuration and local workspace helpers.
-3. **Declare the kind in the adapter** and add its declaration to the Runtime’s static list in `apps/daemon/internal/cli/agent_discovery.go` ([register the adapter](#register-the-adapter)).
-4. **Add the service profile and one catalog entry** ([add the engine to Core](#add-the-engine-to-core)).
-5. **Package native prerequisites.** Add a Runtime image under `services/core/deploy/<kind>` and, optionally, [native installer participation](#native-installer-participation).
-6. **Enable and select the engine** with the `OAC_HARNESSES` setting and [Harness selection](./model-execution.md#harness-selection).
-7. **Qualify it** ([qualify the adapter](#qualify-the-adapter)) and record the result in [Harness capabilities](./harness-capabilities.md).
+2. **Implement the adapter** in `apps/daemon/internal/agent/<package>`, where `<package>` is the kind without underscores: an `ExecutorFactory`, an `Executor` and a `Turn` ([required interfaces](#required-adapter-interfaces), [lifetimes](#executor-and-turn-lifetimes)). Reuse the shared process, credential, configuration and local workspace helpers.
+3. **Write the declaration** in `internal/harnessconfig/<package>/declaration.go` and bind it to the adapter's discovery ([declare the Harness](#declare-the-harness), [register the adapter](#register-the-adapter)). Run `make generate-harness-catalog` to register both.
+4. **Package native prerequisites.** Add a Runtime image under `services/core/deploy/<kind>` and, optionally, [native installer participation](#native-installer-participation).
+5. **Enable and select the engine** with the `OAC_HARNESSES` setting and [Harness selection](./model-execution.md#harness-selection).
+6. **Qualify it** ([qualify the adapter](#qualify-the-adapter)) and record the result in [Harness capabilities](./harness-capabilities.md).
 
 Implement the mandatory text lifecycle and handle every extension explicitly. Qualify supported extensions one at a time; an unqualified extension returns `agent.ErrUnsupportedOperation` without native effects. A native cancellation may require retirement instead of reuse: `Reusable=false` carries a reason and the caller must confirm `Executor.Close`. Do not force reuse to fit a test helper, and do not copy an adapter's native limitations into the shared Core protocol.
 
 ## Architecture rules
 
-- Codex, Claude Code and future Harnesses have equal standing. The common Runtime wire protocol and Executor and Turn interfaces own lifecycle, input receipts, cancellation, recovery and resource access; each adapter keeps its native implementation and model and tool loop.
-- A new engine supplies an adapter, a qualified profile, registration and an independently verified deployment. It adds no engine-name branches to API handlers, persistence, dispatch, scheduling or Environment providers, and no handler, store table, scheduler, event projector or model loop for capabilities the contract already represents.
+[Complexity stays in the adapter](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#complexity-stays-in-the-adapter) and [Core assembles, Harnesses run natively](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#core-assembles-harnesses-run-natively) apply to every Harness. These rules are Harness-specific:
 - Keep required lifecycle declarations, extension interfaces and registration methods in `agent/harness.go`. Result types, errors and Registry storage may stay in focused files.
 - Use the existing `proto.SupportedAgentKind` and `AgentKindCapabilities` schema. Do not add a second capability descriptor or a combined optional interface.
 - Onboarding does not require feature equality. Harnesses need not match each other's optional features, and MCP, functions, images or verbosity control are not required to register. Verify the common lifecycle obligations and use the same public assertions for each declared operation. An omitted declaration or a missing extension implementation blocks onboarding; a native difference does not.
-- The service profile catalog is the qualification boundary. Unknown profiles fail closed, and a Runtime heartbeat cannot authorize new public functionality. Schema validity, service qualification and the available Runtime are independent checks.
+- The declaration is the support boundary. An unregistered kind fails closed, and a Runtime heartbeat cannot authorize new public functionality or widen the declaration: discovery may only narrow it. Schema validity, declared support and the available Runtime are independent checks.
 - Never equate accepted parameters with applied native behavior.
 
 ## Required adapter interfaces
@@ -67,7 +67,6 @@ For example, the Codex adapter keeps its app-server and thread, the Claude adapt
 | `ExecutorFactory`, `Executor.StartTurn`, `Executor.Close` | Real implementation | Prepare without model input; keep ownership of failed or uncertain resources; confirm cleanup |
 | `Session`, `Turn`, `CancellationOutcome`, `AwaitSettlement` | Real implementation | Cancel the exact Turn, keep observed results and confirm settlement independently of cancellation requests |
 | `DurableSteerer` | Real implementation on every Turn | Distinguish a complete write from the native application receipt; keep retry identity |
-| `Steerer` | Explicit implementation or Unsupported | Additional non-durable active-Turn input |
 | `FunctionResultSubmitter` | Explicit implementation or Unsupported | Match native call and result identity and acknowledge application |
 | `WorkspaceReader`, `WorkspaceDirectoryLister`, `WorkspaceWriter` | Explicit on Turn and Executor owners | Use the authorized workspace, confirm access, commit or close, or return the operation's Unsupported error |
 | Neutral messages, images, MCP, structured output and Subagent observations | Explicit capability decisions | Keep each operation's protocol semantics; reject unsupported input before submission |
@@ -88,7 +87,7 @@ The wire request carries no working directory. The Runtime checks `local_environ
 
 Workspace capability describes the actual Runtime and resource-owner combination. The Codex and MiniMax resource objects reject native workspace access while the common authorized `localworkspace` owner provides it; Claude can expose native read and list access, and the common owner provides writes. Interface presence alone never selects a resource or advertises support.
 
-The service profile qualifies public combinations and the Runtime advertises the installed combination; neither replaces schema validation or Project authorization. Native behavior tests must agree with the declarations. An advertised operation that returns Unsupported is a contract violation, never success or grounds for replay.
+The declaration admits public combinations and the Runtime advertises the installed combination; neither replaces schema validation or Project authorization. Native behavior tests must agree with the declarations. An advertised operation that returns Unsupported is a contract violation, never success or grounds for replay.
 
 ## Executor and Turn lifetimes
 
@@ -102,6 +101,20 @@ The service profile qualifies public combinations and the Runtime advertises the
 
 A Session owns one reusable Executor in its connected Runtime; a Turn owns one input execution, its output stream and its cancellation. `agent.ExecutorFactory` prepares the fixed configuration without model input, and `Executor.StartTurn` creates a new `agent.Turn` without replacing healthy native resources. Normal completion settles only the Turn. `Executor.Close` releases native resources on idle expiry, Environment shutdown or confirmed invalidation; it releases neither the Environment allocation nor the workspace. Core keeps no second Executor cache. The same lifecycle applies to hosted, self-hosted and `none` placements.
 
+An Executor moves through these states. Each Turn runs between `StartTurn` and `AwaitSettlement`.
+
+```mermaid
+stateDiagram-v2
+    [*] --> Idle: prepared
+    Idle --> Running: StartTurn
+    Running --> Idle: reusable
+    Running --> Closing: not reusable or shutdown
+    Idle --> Closing: idle expiry, shutdown or invalidation
+    Closing --> Closing: Close failed, retry
+    Closing --> Closed: Close confirmed
+    Closed --> [*]
+```
+
 **Binding.** The Runtime binds its Executor record to the Session, Environment, connection and immutable execution configuration. Resume identity and prior-Turn recovery flags are continuity assertions, not configuration changes. A supplied native identity must match the retained owner, and when existing history is required, recovery never starts a new root. A configuration conflict is an error, not a hot switch. An ordinary lost connection retires its owners and handles; [planned suspension](../../docs/runtime-protocol.md#preparation-and-execution-order) retains settled idle owners through exact authenticated resume. Old timers, output and cancellation cannot affect replacement owners.
 
 **Per-Turn state.** Each Turn gets a fresh wrapper, output channel and receipt state. Steering and function interfaces belong to that Turn. Native callbacks capture the originating Turn before asynchronous work, so a late event is never attributed to whichever Turn is active. Native processes, query or transport connections, fixed capability configuration and native session identity belong to the Executor. Do not reset completed `sync.Once` values or reuse an old Turn object.
@@ -117,7 +130,7 @@ A Session owns one reusable Executor in its connected Runtime; a Turn owns one i
 - Every `Session` declares `CancellationOutcome`. `Turn` inherits it. The snapshot keeps observed native identity, Usage and output and remains readable after cancellation. Missing evidence stays unset; an empty `DonePayload` means nothing has been observed, not that cancellation succeeded or is unsupported. Reading the snapshot does not wait for settlement.
 - `Session.Cancel` requests cancellation; output closure signals teardown. Turn settlement still requires `AwaitSettlement` and any required `Executor.Close`; neither a successful cancellation request nor its snapshot replaces those waits.
 
-**What the Runtime does around a Turn.** One output consumer starts before native Start, drains the bounded 64-frame channel and keeps the terminal observation until Start publication, Turn settlement and admitted operation receipts finish. Natural completion never calls Cancel. Input and function admission close before settlement; operations already admitted hold their barrier through native receipts and outbound acknowledgement. The Runtime sends cancellation to the Turn before waiting on that barrier, because a written input may need a native interrupt to produce its receipt. It joins native settlement, any required confirmed Executor close, output drain and all admitted operations before an applied acknowledgement or reuse, and only then forwards Done or an applied cancellation receipt. A failed Close can report failure while keeping the same Run and outstanding operations for retry; a closed caller wait cannot manufacture an applied input receipt. The Runtime commits native continuity and releases the old Run's admission before publishing Done, since the receiver may start another Turn at once; a late terminal-send failure belongs to the old Run and cannot invalidate a successor that already owns the Executor. Connection shutdown owns transport-loss cleanup. The settlement wait is ten seconds and the receipt send budget five seconds; a timeout is not proof of quiescence.
+**What the Runtime does around a Turn.** One output consumer starts before native Start, drains the bounded output channel and keeps the terminal observation until Start publication, Turn settlement and admitted operation receipts finish. Natural completion never calls Cancel. Input and function admission close before settlement; operations already admitted hold their barrier through native receipts and outbound acknowledgement. The Runtime sends cancellation to the Turn before waiting on that barrier, because a written input may need a native interrupt to produce its receipt. It joins native settlement, any required confirmed Executor close, output drain and all admitted operations before an applied acknowledgement or reuse, and only then forwards Done or an applied cancellation receipt. A failed Close can report failure while keeping the same Run and outstanding operations for retry; a closed caller wait cannot manufacture an applied input receipt. The Runtime commits native continuity and releases the old Run's admission before publishing Done, since the receiver may start another Turn at once; a late terminal-send failure belongs to the old Run and cannot invalidate a successor that already owns the Executor. Connection shutdown owns transport-loss cleanup. The settlement wait and the receipt send budget are bounded ([Timeouts and limits](../../docs/runtime-protocol.md#timeouts-and-limits)); a timeout is not proof of quiescence.
 
 ## Events, inputs and optional capabilities
 
@@ -127,17 +140,17 @@ Initial input and steering use ordered `proto.MessageInput`. Keep user-message a
 
 ### Required and extension operations
 
-The public text path requires durable Turns, applied input receipts, ordered observations, cancellation and enforcement of disabled execution controls; `execution.Policy.engineCapabilities` holds the exact requirements. An engine without native tools can guarantee their absence; an engine with tools must actually disable them when asked. Accepting a configuration is not proof of enforcement.
+The public text path requires durable Turns, applied input receipts, ordered observations, cancellation and enforcement of disabled execution controls; `execution.Policy` holds the exact requirements. An engine without native tools can guarantee their absence; an engine with tools must actually disable them when asked. Accepting a configuration is not proof of enforcement.
 
 MCP, public functions, deferred function discovery, structured output, image input, verbosity controls and other optional operations need not match another engine. Reject an unqualified combination with Unsupported and record the gap; never advertise a capability to bypass selection.
 
-- Structured output: consume `ExecutionControls.OutputFormat` and publish confirmed native output through the Message contract ([execution tools](./execution-tools.md#structured-output)). Register the public qualification separately from the Runtime capability.
-- Images: register the Runtime's `MessageImages` and qualify the profile's `MessageImages` separately ([message input](./message-content.md)).
+- Structured output: consume `ExecutionControls.OutputFormat` and publish confirmed native output through the Message contract ([execution tools](./execution-tools.md#structured-output)). The declared `StructuredOutput` capability admits it; the Runtime advertises its installed capability separately.
+- Images: declare `MessageImages`; the Runtime advertises its installed capability separately ([message input](./message-content.md)).
 - Workspace placements additionally need verified preparation, workspace reads and output export and the dedicated Runtime binding with the shared Files helpers. Enable a placement only after its lifecycle behavior is demonstrated.
 
 ### MCP origin and native limits
 
-Declare supported public origins in the engine profile's `MCPOrigins` and bearer support in `MCPBearer`. The Runtime advertises its actual HTTP, bearer and required-initialization capabilities. Shared admission validates origin and placement; adapter validation keeps native label, allowlist and initialization limits.
+Declare supported public origins in the declaration's `MCPOrigins` and bearer support in the `MCPHTTPBearerAuth` capability. The Runtime advertises its actual HTTP, bearer and required-initialization capabilities. Shared admission validates origin and placement; adapter validation keeps native label, allowlist and initialization limits.
 
 Consume `agent.ResolveMCPBindings` for public and installed declarations, and keep origin, credential authority, null versus empty allowlists and required startup. Do not copy tokens into native profiles or reinterpret a service request as an Environment request. Reject unsupported native policies instead of dropping them. Follow the [MCP origin contract](./environments.md#public-mcp-connection-origin) and run public-client, failure, cancellation and cold-recovery qualification for each advertised combination. Model capability is separate from Harness transport support; never infer it from model names or silently degrade input.
 
@@ -147,7 +160,7 @@ A Harness that supports the Subagent reads implements the [neutral observation c
 
 ## Register the adapter
 
-Registration is static and requires a build. Export one `agent.Declaration` from `apps/daemon/internal/agent/<kind>/declaration.go`, then add it to `harnessDeclarations` in [`cli/agent_discovery.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/cli/agent_discovery.go). The declaration contains the kind and complete capability descriptor, the shared model `Configuration` and a `Discover` function. Discovery receives the profile, diagnostic writers and the Runtime-resolved `DiscoveryOptions.StateRoot` and instance-private `DiscoveryOptions.RuntimeRoot`, owns native configuration and availability checks, and returns the installed `agent.Runtime` with its descriptor and Executor factory. Return nil when the adapter is not configured; return an unavailable descriptor without a factory when configured prerequisites fail. Keep version gates and factory-selection conditions inside the adapter.
+Registration is static and requires a build. Export one `agent.Declaration` from `apps/daemon/internal/agent/<package>/declaration.go`, and run `make generate-harness-catalog`, which lists it in the generated `harnessDeclarations`. The binding is the shared `harnessconfig.Declaration` plus a `Discover` function. Discovery receives the profile, diagnostic writers and the Runtime-resolved `DiscoveryOptions.StateRoot` and instance-private `DiscoveryOptions.RuntimeRoot`, owns native configuration and availability checks, and returns the installed `agent.Runtime` with its descriptor and Executor factory. Return nil when the adapter is not configured; return an unavailable descriptor without a factory when configured prerequisites fail. Discovery only narrows the declared capabilities with `agent.Narrow`, never widens them, and an unavailable descriptor comes from `agent.Unavailable`. Keep version gates and factory-selection conditions inside the adapter.
 
 The Runtime resolves the [state directory](../../docs/configuration.md#runtime-resource-directories) once and passes it explicitly to every adapter. Adapters that support retained native history place it beneath that root with their own namespaced layout; they do not choose a fallback root from ambient environment or put history in the workspace. An adapter without this capability keeps instance-private native state and must not declare history portable merely because a state root is supplied. Private launch homes, scratch data and instance-private native state use the supplied `DiscoveryOptions.RuntimeRoot`. Device credentials and connection identity stay outside retained state. A state path alone does not qualify native continuation after compute replacement: the adapter must preserve native ownership, reject missing or foreign history before model input, and complete native shutdown before another writer attaches.
 
@@ -158,57 +171,72 @@ The Runtime resolves the [state directory](../../docs/configuration.md#runtime-r
 | 1 | `RegisterKind(proto.SupportedAgentKind, harnessconfig.Configuration)` | Kind, availability, version, `AgentKindCapabilities` and the model configuration declaration. It resets the other registrations, so call it first. |
 | 2 | `RegisterExecutor(kind, agent.ExecutorFactory)` | The Executor and Turn lifecycle used for execution; derives the `Preparation` capability |
 
-Every `proto.AgentKindCapabilities` field must be explicitly `proto.CapabilitySupported` or `proto.CapabilityUnsupported`, even for an unavailable Harness. `proto.CapabilityUnspecified` is invalid: zero values and omitted fields never mean Unsupported. An installation probe may set an individual field with `proto.CapabilityFromBool`; it must not populate unmentioned or future fields. Availability stays separate in `SupportedAgentKind.Available`. Registration validates the complete declaration before changing the registry, and the wire carries an explicit boolean for every field, so omitted and null fields are invalid. A new field requires a decision in every production declaration. Runtime consumers use `IsSupported()` and reject unsupported requests before native operations; an interface assertion verifies implementation, never support. Every declaration must match the behavior verified for that installation; the [Core–Runtime protocol](../../docs/runtime-protocol.md#capability-declarations) owns how declarations travel and are frozen.
+Fill every field of the declaration's `proto.AgentKindCapabilities` explicitly; [Capability declarations](../../docs/runtime-protocol.md#capability-declarations) defines how declarations are encoded, validated and frozen. An installation probe may withdraw a declared field with `agent.Narrow`; it never grants one, and `Registry.Register` rejects a discovery that does. Availability stays separate in `SupportedAgentKind.Available`. Code that reads a declaration uses `IsSupported()`; an interface assertion verifies implementation, never support. Every declaration must match the behavior verified for that installation.
 
-The admission mapping is explicit. `Steering` controls non-durable `Steerer` input. `DurableInputReceipts` controls `DurableSteerer` input and also requires the Turn settlement contract; neither implies the other, and Core's public text profile requires both. Workspace declarations describe the authorized resource owner, including the common Runtime workspace implementation. `WorkspaceReadPreparation` admits `execution_prepare` with `workspace_read_only`. The Runtime readies that preparation itself and serves its reads from the bound local workspace directory without calling the Executor factory, so an adapter declares it only when this kind's Environment workspace is that local directory. Registration does not derive it. Runtime registration does not grant Core qualification; the service profile does.
+The admission mapping is explicit. `DurableInputReceipts` controls `DurableSteerer` input and also requires the Turn settlement contract. Workspace declarations describe the authorized resource owner, including the common Runtime workspace implementation. `WorkspaceReadPreparation` admits `execution_prepare` with `workspace_read_only`. The Runtime readies that preparation itself and serves its reads from the bound local workspace directory without calling the Executor factory, so an adapter declares it only when this kind's Environment workspace is that local directory. Registration does not derive it. Runtime registration does not grant Core admission; the declaration does.
 
 The runnable test-only example [`testdata/onboarding/main.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/testdata/onboarding/main.go) registers a text-only synthetic Harness. It shows a Session-owned Executor, fresh Turns, durable steering, cancellation and history binding, and is never shipped.
 
-## Add the engine to Core
+## Declare the Harness
 
-Core recognizes the [built-in Harness registrations](./harness-catalog.md). Add one entry to `internal/harnessconfig/builtin/catalog.json` with:
+Each Harness is one `var Declaration = harnessconfig.Declaration{...}` in `internal/harnessconfig/<package>/declaration.go`. The package name is the kind without underscores. Creating the file registers the Harness: `make generate-harness-catalog` generates the Core registry, the Runtime's `harnessDeclarations`, the client identifiers and display names and the [registration reference](./harness-catalog.md), and `make check-harness-catalog` rejects stale projections. `make openapi` derives the Harness enums from the same declarations, so do not add handwritten enums to DTO tags or route annotations. There is no dynamic plugin loader, and a declaration cannot state a machine's availability.
 
-- the public `kind` and display `label`;
-- the model `configuration` package under `internal/harnessconfig`;
-- the `profile` constructor under `services/core/internal/engine`.
+The declaration holds:
 
-Implement the profile constructor, then run `make generate-harness-catalog`. It generates the model configuration registry, Core profile catalog, client identifiers and display names and the registration reference; public input validators read the generated registry. `make openapi` derives Harness enums from the same catalog, so do not add handwritten enums to DTO tags or route annotations. `make check-harness-catalog` rejects stale projections.
+- the public `Kind` and display `Label`;
+- the model `Configuration` ([native model configuration](#native-model-configuration));
+- `Capabilities`, a `proto.AgentKindCapabilities` that states the most the Harness can do on a capable host, with every field `Supported` or `Unsupported` and the zero value invalid ([Capability declarations](../../docs/runtime-protocol.md#capability-declarations));
+- the supported `Placements` and public `MCPOrigins`, and whether whitespace-only text is accepted;
+- `Execution`, the official execution option values the adapter maps to native settings: web search modes and whether search settings are accepted, reasoning efforts and summaries, service tiers, programmatic-tool-calling values and text verbosities. Core admission and the Runtime reject an undeclared value with the same check ([tool policy](./execution-tools.md#web-search-and-programmatic-tool-calling)). Core always sends the official default text verbosity, so `TextVerbosities` must include `medium`;
+- optional pure restrictions, `ValidateConfiguration`, `ValidateTools`, `ValidateMessageInput` and `ValidateFunctionResult`, that add native limits to the common checks. `ValidateMessageInput` runs only for messages that carry images, after the `MessageImages` capability check and before anything is stored, and decides which `image_url` values the Harness accepts; Core checks only that the reference is not blank. A nil validator means the common checks suffice. They cannot query business data, decrypt credentials or control native processes. Configuration restrictions run first, and a tool-decoding error precedes `ValidateTools`.
 
-Each Runtime declaration references the same `internal/harnessconfig/<kind>.Configuration()` used by the generated catalog and owns its native factories, probes and installed capability evidence. The catalog cannot declare a machine's availability, and there is no dynamic plugin loader.
+`harnessconfig.NewRegistry` validates every declaration and panics on an invalid or duplicate one: kinds and labels must be nonempty, placements must list at least one supported placement, MCP origins must be a non-nil list, unknown or duplicate choices and origins without a corresponding placement are rejected, and bearer support requires an MCP origin, and `Execution` must declare text verbosity `medium`. Shared dispatch checks capability combinations, never engine names.
 
-The profile is pure: it declares supported placements, public configuration and result limits and required Runtime controls, using existing public and protocol types. Profile callbacks cannot query business data, decrypt credentials or control native processes. Shared dispatch checks capability combinations, not a whitelist of engine names.
+The Runtime binding in `apps/daemon/internal/agent/<package>/declaration.go` embeds the same declaration and adds `Discover`, which owns native availability probes and factories and only narrows the declared capabilities to what the installation verified. The binding test `TestDiscoveryOnlyNarrowsDeclaration` checks that discovery never exceeds the declaration. `harnessconfig/harnesstest.Declaration` builds a synthetic declaration for tests.
 
-### Explicit service qualification
+Run the `harnessconfig` and `execution` tests for validation, combination and error precedence coverage, and the public onboarding tests in `services/core/tests/integration` for admission and Runtime dispatch.
 
-`engine.Profile` is the service's qualification declaration, separate from the Runtime's `AgentKindCapabilities`. Its capability fields reuse the small `proto.CapabilitySupport` value type: every field must explicitly select `CapabilitySupported` or `CapabilityUnsupported`. `CapabilityUnspecified`, including an omitted field, is rejected. Sharing this value type does not let a Runtime advertisement grant service authorization.
+`execution.Policy` supplies the registry to HTTP admission, Worker device selection and final dispatch. Custom composition gives the same Policy to `api.Dependencies.Policy` and the Core dispatcher's `Policy`. The zero value uses the built-in declarations; an explicitly empty registry authorizes none. There is no mutable global registration.
 
-Each of `ConfigurationValidation`, `ToolsValidation` and `FunctionResultValidation` chooses one of two strategies:
+## Native model configuration
 
-- `CommonValidationOnly`: common schema and admission checks are sufficient. The corresponding callback must be nil; no successful placeholder callback is needed.
-- `AdditionalValidation`: the matching `ValidateConfiguration`, `ValidateTools` or `ValidateFunctionResult` callback is mandatory and adds pure Harness restrictions.
+[`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go) owns the shared configuration declaration and pure preparation contract. Each declaration carries one `Configuration`, which Core's composition and the Runtime's `RegisterKind` both use. The Executor path validates through that declaration before native side effects. The wire object is `proto.HarnessConfig`. [Model execution](./model-execution.md#native-model-parameters) lists each Harness's accepted fields.
+
+A supplied `model` must be a nonempty string, and an explicit `model_provider` requires it. The native-owned connection path may omit both; explicit null is invalid. An explicitly empty declaration accepts no provider or nonempty native parameters and advertises no provider support. Unknown protocol formats and duplicate protocol declarations fail at registration.
+
+The declaration's ordered `protocols` list is the only source of accepted protocols and the default (the first entry); it also feeds Core's configuration-support descriptor, and Core and Runtime reject unsupported combinations through it. Adapters connect directly through native configuration; they never introduce a model API proxy or protocol converter, a second model capability registry, or capabilities inferred from model names. Claude's private bridge receives compiled native options and performs structural checks only, not a second copy of the declaration's rules.
 
-An omitted or unknown policy, missing required callback, or callback paired with common-only policy is invalid. Admission follows the declared policy, never method presence. Preserve existing error precedence: configuration restrictions run first; when additional configuration validation is selected, tool-decoding errors precede tool restrictions. With common-only configuration validation, additional tool restrictions retain their existing precedence over a decoding error. Common-only function-result validation adds no native result restriction.
+## Native installer participation
 
-`engine.NewCatalog` validates every entry before publishing its immutable snapshot and panics with `engine.ErrInvalidDeclaration` for invalid static registrations. Kinds must be nonempty without surrounding whitespace. Placements must explicitly list at least one supported placement; MCP origins must be a non-nil list (an empty list qualifies none). Unknown or duplicate choices, origins without a corresponding placement and bearer support without an MCP origin are rejected. Errors identify authored fields without echoing declaration values. Future profile fields must be classified by the completeness validator and explicitly decided by every profile; there is no production default-filling constructor.
+An adapter may supply `agent.Installation` from `installation.go` in its own package: registered kind, pinned version, supported platforms, activation environment and a bounded readiness probe. Register it in `cli/native_harness.go` and add its pinned component to the native distribution builder. This optional contract does not change Executor and Turn semantics. The Runtime owns checksums, copying, locks and additive installation; adapters own native layout and probes. Validate installation and execution on each advertised platform. Missing or incompatible native content fails; it never installs itself during a Turn.
 
-Run the `engine` and `execution` tests for omission, policy, combination and error precedence coverage, and the public onboarding tests in `services/core/tests/integration` for admission and Runtime dispatch. Test fixtures use `engine/enginetest`, whose exhaustive literal also requires a decision when a field is added; it is not a production profile.
+## Native process ownership
 
-`execution.Policy` supplies immutable service qualification to HTTP admission, Worker device selection and final dispatch. Custom composition gives the same Policy to `api.Dependencies.Policy` and the Core dispatcher's `Policy`. The zero value uses the built-in profiles; an explicitly empty catalog authorizes none. There is no mutable global registration.
+The daemon's `clirunner` starts every native child in its own Unix process group (a Job object on Windows); other hosts reject the launch. Explicit and parent-context cancellation share a TERM grace period and a bounded KILL escalation. An internal reaper also cleans remaining group members when the direct process exits, even if a descendant still holds stdout open; during cancellation, surviving descendants keep the remaining grace after the leader exits. The daemon's `stop` command waits within its limit for confirmed shutdown, which covers that grace period and the pipe and owner cleanup after it.
 
-## Native model configuration
+Owned output pipes stay readable after the leader exits. Consumers drain stdout and stderr before calling `Wait`, which joins the cached process result and closes the readers. `Done` reports leader reaping and group cleanup signals; it is not a native execution receipt or proof of persisted history. SDK adapters settle each Turn and drain its observations before publishing completion, and Executor close also closes the query and awaits the native child. Process groups are lifecycle supervision, not isolation or containment of descendants that leave the group.
 
-[`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go) owns the shared configuration declaration and pure preparation contract. Each adapter supplies one `Configuration`, in `internal/harnessconfig/<kind>`, to Core's composition and to the Runtime's `RegisterKind`. The Executor path validates through that declaration before native side effects. The wire object is `proto.HarnessConfig`. [Model execution](./model-execution.md#native-model-parameters) lists each Harness's accepted fields.
+Adapters run native tools unattended with the launching user's permissions, and a Harness never asks a human. Codex runs with approval policy `never`, under which it settles MCP elicitation itself without reaching the client, and with full access; the adapter also disables its blocking `request_user_input` tool. Claude runs through the adapter's tool callback, which allows or denies without asking. MiniMax runs with bypassed permissions; the adapter disables `askUser`, advertises no elicitation and answers `session/request_permission` with the ACP `cancelled` outcome, which MiniMax treats as a denial. No native permission or question request reaches Core: a human in the loop goes through a function tool, the Session reads [`requires_action`](./sessions-events.md#session-status) and the application submits the function result. Do not add permission profiles, bubblewrap wrappers or native sandbox settings; there is one execution path for every Environment origin. Resource paths are operator configuration, not a permission boundary.
 
-A supplied `model` must be a nonempty string, and an explicit `model_provider` requires it. The native-owned connection path may omit both; explicit null is invalid. An explicitly empty declaration accepts no provider or nonempty native parameters and advertises no provider support. Unknown protocol formats and duplicate protocol declarations fail at registration.
+An unreachable model host must not hold a Turn open. The adapter keeps the Harness's own connection retries bounded through native settings, and the Harness's final connection error becomes `connection_failed` when the Harness reports it as structured data ([native failure classification](../../docs/runtime-protocol.md#native-failure-classification)). Core adds no model timeout of its own. Each adapter guide states its Harness's bound.
 
-The declaration's ordered `protocols` list is the only source of accepted protocols and the default (the first entry); it also feeds Core's configuration-support descriptor, and Core and Runtime reject unsupported combinations through it. Adapters connect directly through native configuration; they never introduce a model API proxy or protocol converter, a second model capability registry, or capabilities inferred from model names. Claude's private bridge receives compiled native options and performs structural checks only, not a second copy of the declaration's rules.
+Network admission follows [Restricted network](./environments.md#restricted-network).
+
+## Timeouts and limits
+
+The Runtime's per-Turn limits (settlement wait, receipt send budget and output channel) are in the [Core–Runtime protocol](../../docs/runtime-protocol.md#timeouts-and-limits). The limits on native child processes are:
+
+| Value | Applies to | On expiry |
+| --- | --- | --- |
+| 3 seconds (default) | The TERM grace period of a native child process on explicit or parent-context cancellation | The Runtime escalates to a bounded KILL. |
+| 10 seconds | The daemon's `stop` command waiting for confirmed shutdown, which covers the grace period and the pipe and owner cleanup after it | Shutdown is not confirmed. |
 
 ## Qualify the adapter
 
 Before starting, record the operation set, expected results, exclusions and stopping conditions. A qualification ends when its declared operations pass; it does not expand to match another Harness's feature list.
 
 1. **Contract tests.** Call `agent/contracttest.TextLifecycle` from a test named `TestSharedTextLifecycle` with the adapter's prepared Executor and a deterministic native fixture; `claudesdk/executor_test.go` is the reference. It checks independent Turn streams, native owner and history continuity, durable write and application receipts, stale cancellation and healthy continuation after cancellation. `make check-runtime-contract` runs it together with the shared wire, gateway, transport and dispatcher tests, the declaration completeness check and each adapter's `TestUnsupportedExtensionsHaveNoNativeEffects`. Adapter tests also cover two ordinary Turns sharing one native process or connection and history, cancellation followed by another Turn, stale cancellation and late events, native exit, cleanup failure, input write and application receipts, unknown outcomes and fresh per-Turn usage, function, input and child-observation state. State whether a fixture is controlled or a real provider.
-2. **Shared integration.** `TestThirdHarnessPublicOnboarding` runs the synthetic Harness through public Session and input admission, Worker device selection, the real WebSocket gateway, the daemon Registry and Router, neutral events and durable terminal projection. It uses a custom immutable `engine.Catalog` in the same `execution.Policy` given to the API handler and the dispatcher, and checks applied input receipts, saved native identity, continuation, cancellation, unsupported optional requests and missing mandatory Runtime support. The fixture has no workspace, MCP or public functions, and its registration stays local to the test. It proves the integration path, not native execution.
+2. **Shared integration.** `TestThirdHarnessPublicOnboarding` runs the synthetic Harness through public Session and input admission, Worker device selection, the real WebSocket gateway, the daemon Registry and Router, neutral events and durable terminal projection. It uses a custom immutable registry in the same `execution.Policy` given to the API handler and the dispatcher, and checks applied input receipts, saved native identity, continuation, cancellation, unsupported optional requests and missing mandatory Runtime support. The fixture has no workspace, MCP or public functions, and its registration stays local to the test. It proves the integration path, not native execution.
 3. **Real acceptance.** Use the pinned official Python SDK and raw HTTP against Core, a real provider API, the native Harness and a dedicated database. Verify initial execution, a warm follow-up, cancellation and restart with continuation; record native owner identity and same-condition cold and warm timing. For workspace placements also verify Files and Artifacts, workspace identity, that no credentials appear in public responses and that foreign history is rejected. `services/core/tests/official_hosted_functions_native.py` holds the shared function assertions: success and error, native file output and public Artifact bytes, same-history continuation after restart, foreign result rejection and pending-call cancellation. Synthetic or failed runs never count. The opt-in tests below run the pinned-SDK fixtures in `services/core/tests` against a real daemon and model; each runs when `OAC_TEST_OFFICIAL_SDK_PYTHON`, `OAC_TEST_NATIVE_DAEMON_BIN`, `OAC_TEST_NATIVE_PROOF_DIR` and its private options file are set. The options file is a JSON object with exactly `model` and `model_provider` (the fields of `x_agents_core.model_provider`); the test sets it as the deployment default model provider, which the fixtures' `environment: none` Sessions freeze at creation.
 4. **Regression.** Existing Harnesses keep working. Run targeted tests, then `make check`; run `make openapi` after API changes and `make sqlc-generate` after query changes.
 5. **Review.** Follow the [blind review workflow](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#review).
@@ -236,22 +264,6 @@ Keep provider keys in private operator files, never in commits or logs. Existing
 | MiniMax native history binding | `mcode/session_test.go` |
 | Explicit refusals without native effects or fabricated results | Each adapter's `unsupported_test.go` |
 
-## Native installer participation
-
-An adapter may supply `agent.Installation` from `installation.go` in its own package: registered kind, pinned version, supported platforms, activation environment and a bounded readiness probe. Register it in `cli/native_harness.go` and add its pinned component to the native distribution builder. This optional contract does not change Executor and Turn semantics. The Runtime owns checksums, copying, locks and additive installation; adapters own native layout and probes. Validate installation and execution on each advertised platform. Missing or incompatible native content fails; it never installs itself during a Turn.
-
-## Native process ownership
-
-The daemon's `clirunner` starts every native child in its own Unix process group (a Job object on Windows); other hosts reject the launch. Explicit and parent-context cancellation share a TERM grace period (three seconds by default) and a bounded KILL escalation. An internal reaper also cleans remaining group members when the direct process exits, even if a descendant still holds stdout open; during cancellation, surviving descendants keep the remaining grace after the leader exits. The daemon's `stop` command waits up to ten seconds for confirmed shutdown, which covers that grace period and the pipe and owner cleanup after it.
-
-Owned output pipes stay readable after the leader exits. Consumers drain stdout and stderr before calling `Wait`, which joins the cached process result and closes the readers. `Done` reports leader reaping and group cleanup signals; it is not a native execution receipt or proof of persisted history. SDK adapters settle each Turn and drain its observations before publishing completion, and Executor close also closes the query and awaits the native child. Process groups are lifecycle supervision, not isolation or containment of descendants that leave the group.
-
-Adapters run native tools unattended with the launching user's permissions, and a Harness never asks a human. Codex runs with approval policy `never`, under which it settles MCP elicitation itself without reaching the client, and with full access; the adapter also disables its blocking `request_user_input` tool. Claude runs through the adapter's tool callback, which allows or denies without asking, in native `default` permission mode with the SDK sandbox disabled. MiniMax runs with bypassed permissions and its sandbox disabled; the adapter disables `askUser`, advertises no elicitation and answers `session/request_permission` with the ACP `cancelled` outcome, which MiniMax treats as a denial. No native permission or question request reaches Core: a human in the loop goes through a function tool, the Session reads [`requires_action`](./sessions-events.md#session-status) and the application submits the function result. Do not add permission profiles, bubblewrap wrappers or native sandbox settings; there is one execution path for every Environment origin. Resource paths are operator configuration, not a permission boundary.
-
-An unreachable model host must not hold a Turn open. The adapter keeps the Harness's own connection retries bounded through native settings, and the Harness's final connection error becomes `connection_failed` when the Harness reports it as structured data ([native failure classification](../../docs/runtime-protocol.md#native-failure-classification)). Core adds no model timeout of its own. Each adapter guide states its Harness's bound.
-
-Network admission follows [Restricted network](./environments.md#restricted-network).
-
 ## Native references
 
 | Harness | Adapter | Native transport | Runtime guide |
diff --git a/contracts/agents-api/index.md b/contracts/agents-api/index.md
index fab2c054d..d918a022b 100644
--- a/contracts/agents-api/index.md
+++ b/contracts/agents-api/index.md
@@ -1,8 +1,10 @@
 ---
-title: "Agents API coverage ledger"
+title: "OpenAI compatibility"
 ---
 
-Core targets the complete OpenAI Agents API as pinned below ([public API rule](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#public-api)). This ledger records how much of each resource Core implements and which contract holds its details, then every known difference from the OpenAI service and every open gap. [API namespaces and credentials](../../docs/api/index.md) says who calls which API; the [Agents API guide](../../docs/api/public-agent-api.md) shows how to use it.
+Core implements the OpenAI Agents API pinned below. This ledger lists each resource's coverage, every difference from the official service and the known gaps.
+
+The target is the complete API ([public API rule](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#public-api)). [API namespaces and credentials](../../docs/api/index.md) says who calls which API, and the [Agents API guide](../../docs/api/public-agent-api.md) shows how to use it.
 
 ## Pinned baseline
 
@@ -32,7 +34,7 @@ Evidence for a status comes from the pinned official SDK and raw HTTP against th
 | --- | --- | --- | --- |
 | Agents | create, retrieve, update, list, delete | Implemented. Every pinned setting is saved; Session admission runs a subset | [Agents](./wire-semantics.md#agents) |
 | Sessions | create (JSON or stream), retrieve, update, list, delete | Implemented. Update takes `metadata` only; deletion requires an idle or failed Session | [Sessions](./wire-semantics.md#sessions), [creation streaming](./sessions-events.md#creation-streaming) |
-| Session events | create, stream | Partial: messages with text and inline images, cancellation, function results; the stream is live only | [Sessions, events and history](./sessions-events.md), [message content](./message-content.md) |
+| Session events | create, stream | Partial: messages with text and images, cancellation, function results; the stream is live only | [Sessions, events and history](./sessions-events.md), [message content](./message-content.md) |
 | Turns | retrieve, list | Implemented; Session Turn routes hold root Turns only | [Turns and Items](./sessions-events.md#turns-and-items) |
 | Items | list | Partial: messages, commands, MCP calls, functions, web search, reasoning and Subagent coordination Items; other native variants are not projected | [Turns and Items](./sessions-events.md#turns-and-items) |
 | Artifacts | retrieve, list, delete, content | Implemented | [Environment files and Artifacts](./environment-files.md) |
@@ -45,15 +47,15 @@ Evidence for a status comes from the pinned official SDK and raw HTTP against th
 | Files | create, retrieve, list, delete, content | Implemented for `purpose=user_data`; content download is rejected | [Files and Skills](./source-files.md) |
 | Skills and Skill versions | create, retrieve, update, list, delete, content | Implemented | [Files and Skills](./source-files.md) |
 
-Which operation each Harness supports on each placement is in the [Harness capabilities](./harness-capabilities.md). [Core wire behavior](./wire-semantics.md) holds the rules that apply across resources: requests, errors and lists.
+Which operation each Harness supports on each placement is in the [Harness capabilities](./harness-capabilities.md). [API behavior](./wire-semantics.md) holds the rules that apply across resources: requests, errors and lists.
 
-Core's own fields sit inside `x_agents_core` ([Core extensions](../../docs/api/public-agent-api.md#core-extensions-x_agents_core)). The Core administration API (`/core/v1`) and the machine API (`/api/v1`) are not part of the Agents API.
+Core's own fields sit inside `x_agents_core` ([Core extensions](../../docs/api/public-agent-api.md#core-extensions)). The Core administration API (`/core/v1`) and the machine API (`/api/v1`) are not part of the Agents API.
 
 ## Differences from OpenAI
 
 Each item is Core's deliberate or native behavior where the official service behaves otherwise. The linked rule states the exact behavior.
 
-**Requests and errors** ([Core wire behavior](./wire-semantics.md))
+**Requests and errors** ([API behavior](./wire-semantics.md))
 
 - Core sends no `OpenAI-Organization` or `OpenAI-Project` response headers.
 - `HEAD` on the event stream, on content downloads and on the Environment files list returns 405.
@@ -73,20 +75,32 @@ Each item is Core's deliberate or native behavior where the official service beh
 
 - A repeated Session creation with the same `Idempotency-Key` returns the original Session; the official service creates a new one.
 - Omitted programmatic tool calling keeps the Harness's native behavior; the official default is on.
+- An Agent without a `web_search` tool keeps the Harness's [native search](./execution-tools.md#web-search-and-programmatic-tool-calling); the pinned contract does not define search without the tool.
+- Claude Code on a workspace placement appends the Agent's `instructions` to its native system prompt and runs its [native tool set](./execution-tools.md#web-search-and-programmatic-tool-calling). Its search has no cached mode and no domain, location or context-size settings.
+- Claude Code drops whitespace-only text blocks natively and sends `(no content)` for an all-blank message; Codex delivers whitespace-only text unchanged.
+- Claude Code runs a Skill's inline shell inside the Skill expansion, so the command produces no tool observation.
+- Claude Code with live search on `environment: none` has only `WebSearch`, so search yields `search` actions and no page opens ([web search](./execution-tools.md#web-search-and-programmatic-tool-calling)).
 - An omitted reasoning effort stays null instead of taking the model's default.
+- Codex maps programmatic tool calling to its native `code_mode`, whose model-written scripts call the other tools; the feature is under development upstream.
 - A Session's `agent.tools` omits `tool_search` declarations.
+- Core rejects an inline `authorization` on a Session MCP transport, an `Authorization` entry in `headers` and a nonempty stdio `env`: credentials come only from Vaults (`credential_id`) and environment values only from the Environment (`env_vars`) ([MCP](./execution-tools.md#mcp)).
+- A `stdio` MCP server needs a workspace placement and the origin `environment`. Claude Code starts the server in its workspace directory, so `cwd` must equal it, with its whole process environment, which also holds the model provider key and other servers' Vault bearer tokens, and it needs `allowed_tools` null. MiniMax Code starts the server in its private home directory, so it rejects every `stdio` server ([MCP](./execution-tools.md#mcp)).
+- Claude rejects an MCP `server_url` or `headers` value containing `${`, because the native client expands `${VAR}` in both from a process environment that holds Core-held credentials.
 - Deleting a Session right after an events 202 returns 409, because Core admits the Turn in the same transaction; the official service returned 200.
 
 **Input, events and history** ([Sessions, events and history](./sessions-events.md), [message content](./message-content.md))
 
 - Input to a `none` Session is admitted synchronously; Core does not emulate the official asynchronous admission window.
 - A function result that resumes a waiting Turn emits `turn.in_progress`, and cancelling a Turn that waits on a function result emits an interim `agent.session.in_progress`.
+- A function call the native Harness abandons, such as a Subagent call dropped when the root closes or interrupts the child or a MiniMax Code call past its 120 s timeout, is withdrawn: it stops being a required action and a later result for it returns 409 `conflict_error`. The official API has no withdrawal.
 - Attaching to the stream mid-Turn sends no catch-up Item snapshots.
 - The Items list includes in-progress and incomplete output Items, and keeps a failed function result's submitted `output`.
 - Error messages omit the call and executor IDs that official messages include.
 - An empty text part beside other text is accepted and stored.
 - Empty input returns 400 `invalid_request` with a generic message and a null param; the official response is `invalid_request_error` with param `input`.
 - Session usage is available as soon as every root Turn has settled; official reads lag by seconds.
+- U+0000 in Harness output, such as command output, reads as U+FFFD; the official service keeps it.
+- A `reasoning` Item carries what the Harness shows of its native reasoning: its native summary when it produces one, otherwise its native reasoning text, such as Codex raw reasoning or the thinking text the model API returns to Claude Code. Each native part is one `summary_text` part, and native reasoning without text is not reported, so Claude Code with the model provider's `thinking.display` `omitted` reports none. Codex streams the first native channel an item delivers, its summary or its raw reasoning text.
 
 **Files, Skills, Environment files and Artifacts** ([Files and Skills](./source-files.md), [Environment files and Artifacts](./environment-files.md))
 
@@ -98,6 +112,8 @@ Each item is Core's deliberate or native behavior where the official service beh
 
 **Vaults and Credentials** ([Vaults and Credentials](./vaults.md))
 
+- MiniMax Code runs public function calls one at a time, so the application sees one `function_call` at a time.
+- MiniMax Code serves public functions as a native MCP server whose client fails a call after 120 s with no way to change it. After 120 s native reports the failure to the model, the call is withdrawn and the Turn continues.
 - Vault and Credential status is stored privately and defaults to `active`; with no archive operation, lists without a filter include both statuses.
 - An unknown or foreign Vault in `vault_ids` returns 404 "Resource not found."; the official message names the ID.
 - An explicit `null` for OAuth `access_token`, `refresh` or `token_endpoint_auth` in an update keeps the stored value.
@@ -108,27 +124,28 @@ Each item is Core's deliberate or native behavior where the official service beh
 
 **Configuration and tools**
 
-- Explicit reasoning effort or summary, service tiers other than `auto`, enabled `web_search` and enabled programmatic tool calling are saved but rejected at Session admission.
-- Harness support for tools, structured output, deferred discovery, subagents and MCP differs by Harness and placement; see the [Harness capabilities](./harness-capabilities.md). MiniMax Code has no public functions, no service-origin MCP and no image input.
+- A `reasoning.effort`, `reasoning.summary`, `service_tier`, `web_search` mode or setting or `programmatic_tool_calling` value that the selected Harness does not declare is saved but rejected at Session admission ([Harness capabilities](./harness-capabilities.md#execution-and-input)).
+- Harness support for tools, structured output, deferred discovery, subagents and MCP differs by Harness and placement; see the [Harness capabilities](./harness-capabilities.md). MiniMax Code has no image input.
 - Model-derived reasoning defaults are not resolved.
-- MCP tools support the `http` transport only; `stdio` is rejected, and so is an inline `authorization` on a Session MCP transport ([HTTP MCP](./execution-tools.md#http-mcp)).
 
 **Execution and history**
 
-- The stream does not emit reasoning-summary events, Environment `pending` or `ready` events, or every pinned interim tool-output variant.
+- The stream does not emit Environment `pending` or `ready` events, or every pinned interim tool-output variant.
 - Native Item variants beyond those listed under [Turns and Items](./sessions-events.md#turns-and-items) are not projected, and Items cannot be modified.
 - A function result that cancellation prevents from being applied never appears as an Item.
 - Pinned Codex can lose command output emitted before its stream subscription.
 - Claude Code and MiniMax Code report no public usage.
+- MiniMax Code receives a message that starts with `/` with a trailing blank line, because ACP otherwise runs it as an operator command.
 - Core gives no crash-safe or exactly-once guarantee for native side effects; claimed work fails on restart without replay.
-- Images must be inline PNG or JPEG data URIs; remote URLs, `file_id` and `detail` are rejected.
+- `file_id` and `detail` on images are rejected; each Harness declares which `image_url` values it accepts ([message content](./message-content.md#images)).
 
 **Environments and Templates**
 
 - Hosted workspace admission is limited by the [tenant capacity policy](../../docs/configuration.md#tenant-capacity) and the existing [input reservation deadline](./environments.md#reservations).
-- Runtimes do not enforce `disabled` or `restricted` networks, so Sessions that need them are rejected ([restricted network policy](./environments.md#restricted-network)).
+- MiniMax Code does not declare `retained_native_history`, so it cannot run on microsandbox, which keeps every Environment on workspace storage; Core rejects the Session ([Harness capabilities](./harness-capabilities.md)).
+- Only `enabled` networking runs, so Sessions that need `disabled` or `restricted` are rejected ([restricted network policy](./environments.md#restricted-network)).
 - `packages.system` is rejected; system packages must be preinstalled.
-- Cold continuation does not restore process memory, background processes or temporary system-disk changes; completed setup is not replayed. See [Environment persistence](./environments.md#runtime-capability-preparation). Codex and Claude Code passed cross-node memory restoration on compatible microsandbox nodes with retained NFS storage under the [checkpoint transfer requirements](../../docs/sandbox-provider.md#checkpoint-transfer). Takeover of an unconfirmed old writer remains unqualified. On microsandbox with retained NFS storage, Codex and Claude Code passed [confirmed compute loss](../../docs/sandbox-provider.md#confirmed-compute-loss) continuation checks after idle and interrupted Turns and within two seconds of completion acknowledgement. Missing-history checks preserved the native identity and failed explicitly with generic `engine_failed` or `environment_unavailable` outcomes. Host-crash durability and completeness of arbitrary crash-damaged history remain unqualified.
+- Cold continuation does not restore process memory, background processes or temporary system-disk changes, and completed setup is not replayed ([Environment persistence](./environments.md#runtime-capability-preparation)). On compatible microsandbox nodes with retained NFS storage, Codex and Claude Code are qualified for [checkpoint transfer](../../docs/sandbox-provider.md#checkpoint-transfer) and for continuation after [confirmed compute loss](../../docs/sandbox-provider.md#confirmed-compute-loss). Takeover of an unconfirmed old writer, host-crash durability and arbitrary crash-damaged history are unqualified.
 
 **Files and Environment files**
 
@@ -150,10 +167,11 @@ Each item is Core's deliberate or native behavior where the official service beh
 ### Unverified against the official service
 
 - The order of errors when one request has several faults, and error, default and payload-limit parity in general.
+- A Subagent's function call: Core makes it a required action of the root Turn that runs the child, with `turn_id` set to that Turn. The Turn is `waiting` and the Session `requires_action` while root output may continue, and the `call_id` equals the `call_id` of the child's `function_call` Item. Claude Code publishes the child's Items when the root Turn settles, after the required action.
 - Whether Subagent child Turns and pending Environment file writes block Session deletion.
 - The official order between the pending-input error and an unknown result target.
 - Failure reasons for npm, initial-file and Skill installation have no official sample.
-- Codex behavior for an empty text part beside text, and for images in failed function results or as remote references; Claude behavior for a whitespace-only or empty text block inside a mixed message.
+- Codex behavior for an empty text part beside text, and for images in failed function results or as remote references.
 - Official `HEAD` behavior on the routes where Core returns 405.
 - Environment Template hostname forms beyond exact hosts, and `disabled` combined with domains.
 - Files purpose filtering and pagination while Files change; official Skill upload limits and error timing.
diff --git a/contracts/agents-api/machine-api.md b/contracts/agents-api/machine-api.md
index 05e1d665b..7c95e5c85 100644
--- a/contracts/agents-api/machine-api.md
+++ b/contracts/agents-api/machine-api.md
@@ -17,23 +17,22 @@ Machines call Core under `/api/v1`: sandbox nodes, Runtime daemons and the self-
 | `POST agent-daemon/enroll` | Self-hosted daemon | Executor credential | [Enroll a self-hosted daemon](#enroll-a-self-hosted-daemon) |
 | `GET agent-daemon/connection?environment_id=` | Self-hosted installer | Executor credential | [Private connection confirmation](./environment-executor-credentials.md#private-connection-confirmation) |
 | `POST agent-daemon/bootstrap` | Runtime daemon | Daemon credential | [Daemon bootstrap](#daemon-bootstrap) |
-| `GET agent-daemon/device-status?device_id=` | Runtime daemon | Daemon credential | [Device status](#device-status) |
 | WebSocket `GET agent-daemon/ws?device_id=&version=` | Runtime daemon | Daemon credential | [Core–Runtime protocol](../../docs/runtime-protocol.md) |
 
 Every credential travels in an `Authorization: Bearer` header, never in a URL.
 
-The generated [`runtime.openapi.yaml`](./runtime.openapi.yaml) describes only the sandbox-node configuration, enroll and identity routes and the two installation routes. The two WebSockets and the daemon bootstrap, device-status, enroll and connection routes are served outside the API router and have no generated schema; this document and the linked contracts are their only definition.
+The generated [`runtime.openapi.yaml`](./runtime.openapi.yaml) describes only the sandbox-node configuration, enroll and identity routes and the two installation routes. The two WebSockets and the daemon bootstrap, enroll and connection routes are served outside the API router and have no generated schema; this document and the linked contracts are their only definition.
 
 ## Credentials
 
 | Credential | Issued by | Accepted on |
 | --- | --- | --- |
-| Enrollment token | `POST /core/v1/sandbox/enrollment-tokens` (Web **Add node**), with the node's approved capacity. One use; it expires at the response's `expires_at` | `sandbox-node/configuration` without a node ID, `sandbox-node/enroll` |
+| Enrollment token | `POST /core/v1/sandbox/enrollment-tokens` (Web **Add node**), with optional node limits. One use; it expires at the response's `expires_at` | `sandbox-node/configuration` without a node ID, `sandbox-node/enroll` |
 | Node credential | The node itself: it generates a secret of 32 to 256 characters without whitespace and registers it at enrollment | `sandbox-node/configuration` with `X-OAC-Node-ID`, `sandbox-node/identity`, `sandbox-node/connect` |
 | Installation grant | The `x_agents_core.installation` command of a `self_hosted` Session; short-lived | `agent-daemon/installation` and its `claim` |
-| Executor credential | The installation claim, or the Core-key [executor credential routes](./environment-executor-credentials.md) | `agent-daemon/enroll` and `agent-daemon/connection`; after enrollment it is also the daemon credential of the bound device |
-| Daemon credential of a hosted sandbox | Core, for each managed allocation, delivered in the [bootstrap file](../../docs/runtime-bootstrap.md) | `agent-daemon/bootstrap`, `device-status` and `ws` |
-| Operator device profile | `oac-core-device`, run by an operator with database access | `agent-daemon/bootstrap`, `device-status` and `ws` |
+| Executor credential | The installation claim, or the Core-key routes in [Executor credentials](./environment-executor-credentials.md) | `agent-daemon/enroll` and `agent-daemon/connection`; after enrollment it is also the daemon credential of the bound device |
+| Daemon credential of a hosted sandbox | Core, for each managed allocation, delivered in the [bootstrap file](../../docs/runtime-bootstrap.md) | `agent-daemon/bootstrap` and `ws` |
+| Operator device profile | `oac-core-device`, run by an operator with database access | `agent-daemon/bootstrap` and `ws` |
 
 Core keeps only a SHA-256 digest of each token and credential it stores; installation grants are signed and not stored. Credentials are not interchangeable: each works only on its own routes.
 
@@ -59,7 +58,7 @@ oac-daemon connect --profile default
 - A new node sends its enrollment token without `X-OAC-Node-ID`. The token must be valid, unexpired, unconsumed and issued by this installation. An active reset refuses this read.
 - A registered node sends its node credential and its UUID in `X-OAC-Node-ID`. Without a query it reads the current target. `?generation=N` reads only a generation this node may still need: the current target, its serving pin, or one held by an unreleased allocation or placement on it; any other generation is refused. This read stays available during a reset, for owned recovery.
 
-The response has `installation_id`, `provider`, `core_url` (the installation public URL), `generation`, `specification`, `specification_digest`, `max_active` and `max_retained`. It never contains an administrator, Project or E2B credential, and exists only for node-backed providers. The [sandbox deployment contract](./sandbox-deployment.md#canonical-node-specification) defines the specification and its digest.
+The response has `installation_id`, `provider`, `core_url` (the installation public URL), `generation`, `specification` and `specification_digest`. It never contains an administrator, Project or E2B credential, and exists only for node-backed providers. The [sandbox deployment contract](./sandbox-deployment.md#canonical-node-specification) defines the specification and its digest.
 
 ### Enroll a node
 
@@ -74,8 +73,9 @@ The response has `installation_id`, `provider`, `core_url` (the installation pub
 | `backend_fingerprint` | The node's backend namespace digest |
 | `deployment_generation`, `specification_digest` | The configuration the node read |
 | `core_url` | The Core origin the node stores and connects to |
+| `cpu_count`, `effective_cpu_cores`, `total_memory_bytes`, `available_disk_bytes` | Optional host measurements, as the [node protocol](./node-generation-protocol.md#connection) defines |
 
-Core checks, in one transaction, that the token is valid, the deployment is initialized, node-backed and not resetting, the generation and digest match the current specification, `core_url` equals the installation public URL and the node ID is new. Only then does it register the node, with the capacity approved in the token, and consume the token. The 201 response is the node identity: `node_id`, `installation_id`, `provider`, `deployment_generation`, `specification_digest`, `max_active` and `max_retained`. The node cannot submit capacity; the enrolled generation and digest stay the node's immutable identity, and later generations use separate configurations.
+Core checks, in one transaction, that the token is valid, the deployment is initialized, node-backed and not resetting, the generation and digest match the current specification, `core_url` equals the installation public URL and the node ID is new. Only then does it register the node, with the limits the token sets and, for each it leaves unset, the [recommended capacity](./sandbox-deployment.md#recommended-capacity) of the reported host, and consume the token. The 201 response is the node identity: `node_id`, `installation_id`, `provider`, `deployment_generation`, `specification_digest`, `max_active` and `max_retained`. The node cannot submit limits, but a limit the token leaves unset follows the host measurements the node reports, bounded by 1 and 1000000; explicit values and later edits bind. The enrolled generation and digest stay the node's immutable identity, and later generations use separate configurations.
 
 ### Recover a node's identity
 
@@ -90,6 +90,7 @@ Core checks, in one transaction, that the token is valid, the deployment is init
 | 401 | `invalid_node_credential` | A missing, invalid, expired, consumed or foreign token or node credential |
 | 409 | `sandbox_specification_mismatch` | The node's generation or digest does not match |
 | 409 | `sandbox_node_address_mismatch` | `core_url` is not the installation public URL; the token stays unused |
+| 409 | `sandbox_node_host_unmeasured` | The token leaves a limit unset and the request lacks a CPU count or effective cores, or total memory; the token stays unused |
 | 409 | `idempotency_conflict` | The node ID is already registered |
 | 409 | `sandbox_reset_in_progress` | Enrollment or a new node's configuration read during a reset |
 | 503 | `runtime_node_unavailable` | The deployment is not initialized, or storage is unavailable |
@@ -102,11 +103,7 @@ The credential is checked before any deployment state, so a rejected credential,
 
 `POST /api/v1/agent-daemon/bootstrap` with the daemon credential and `{"device_id": "…"}` returns `device_id`, `workspace_id`, `ws_url` (derived from `OAC_PUBLIC_URL`, never from request headers), `heartbeat_seconds` and `protocol_version`. The daemon then dials `ws_url` as the [Core–Runtime protocol](../../docs/runtime-protocol.md#ownership-and-connection) describes.
 
-### Device status
-
-`GET /api/v1/agent-daemon/device-status?device_id=` with the daemon credential returns `device_id`, `online` and `owner`: the current connection owner's `owner_pod_id`, `owner_url`, `generation`, `status` and `lease_expires_at`, or null.
-
-The bootstrap, device-status and WebSocket routes share one error body, `{"error": code, "detail": text}`: 400 `missing_params`, `missing_device_id` or `bad_json`; 401 `missing_bearer`, `unknown_device` or `bad_credential`; 403 `wrong_runtime_type`; 500 `internal`; and on the WebSocket 426 `incompatible_version` when `version` is not Core's exact Runtime protocol version.
+The bootstrap and WebSocket routes share one error body, `{"error": code, "detail": text}`: 400 `missing_params`, `missing_device_id` or `bad_json`; 401 `missing_bearer`, `unknown_device` or `bad_credential`; 403 `wrong_runtime_type`; 500 `internal`; and on the WebSocket 426 `incompatible_version` when `version` is not Core's exact Runtime protocol version.
 
 ### Enroll a self-hosted daemon
 
diff --git a/contracts/agents-api/message-content.md b/contracts/agents-api/message-content.md
index 62f0853f6..aa9206cce 100644
--- a/contracts/agents-api/message-content.md
+++ b/contracts/agents-api/message-content.md
@@ -17,27 +17,27 @@ An empty text part beside other content, such as `["", "text"]`, is accepted and
 
 ## Images
 
-An `input_image` part carries `image_url` as an inline data URI: `data:image/png;base64,…` or `data:image/jpeg;base64,…`. The base64 must be canonical and the decoded image must match the declared type. Core accepts no remote URL, `file_id` or `detail`.
+An `input_image` part carries a nonblank `image_url`, a remote URL or a base64 data URL as the official API allows. Core accepts no `file_id` or `detail` and otherwise checks only the Harness's declared rule below; it never downloads or rewrites an image, and the model provider's own error for an image it cannot read returns unchanged.
 
 | Harness | Message images |
 | --- | --- |
-| Codex | Accepted on every placement the Harness supports: `none`, `openai_hosted` and `self_hosted` |
-| Claude Code | Accepted on `none`, `openai_hosted` and `self_hosted` |
+| Codex | Any URL other than `http` or `https`, passed unchanged, on `none`, `openai_hosted` and `self_hosted`. An `http` or `https` URL returns 400, because native Codex rejects remote image URLs in a turn |
+| Claude Code | A reference that is not a data URL becomes a native URL source; a data URL must be canonical base64 of `image/png`, `image/jpeg`, `image/gif` or `image/webp`, and any other returns 400. On `none`, `openai_hosted` and `self_hosted` |
 | MiniMax Code | Rejected |
 
 Admission checks the Harness before anything is written; an image the Harness cannot take returns 400. The Runtime must also report message image support: Core binds a Session whose input carries images only to such a Runtime, and delivery to a Runtime without it fails. Use a model that accepts images.
 
 ## Whitespace-only text
 
-Whitespace-only text such as `"   "` or `"\n\t"` is valid content and is stored and returned verbatim. Whether a Harness can run it is declared in its engine profile:
+Whitespace-only text such as `"   "` or `"\n\t"` is valid content and is stored and returned verbatim. Whether a Harness can run it is stated in its [declaration](harness-onboarding.md#declare-the-harness):
 
 | Harness | A message with no image and no non-whitespace text |
 | --- | --- |
 | Codex | Admitted and delivered unchanged |
-| Claude Code | 400 `unsupported_or_invalid_configuration` |
+| Claude Code | Admitted; native drops whitespace-only text blocks, and an all-blank message becomes `(no content)` |
 | MiniMax Code | 400 `unsupported_or_invalid_configuration` |
 
-The rejection applies to Session creation (including streaming and `self_hosted` creation) and to `events.create`, before any write, reservation or Turn, so a running Turn is never disturbed. Whitespace beside non-whitespace text in the same message is admitted for every Harness. Whitespace is the union of Go `unicode.IsSpace` and ECMAScript `String.prototype.trim`, for example U+0085 and U+FEFF; Core admission and the Claude bridge use the same set.
+The rejection applies to Session creation (including streaming and `self_hosted` creation) and to `events.create`, before any write, reservation or Turn, so a running Turn is never disturbed. Whitespace beside non-whitespace text in the same message is admitted for every Harness. Whitespace is Go `unicode.IsSpace` plus U+FEFF.
 
 ## Function results
 
@@ -49,18 +49,19 @@ An `agent.session.input.tool_result` event carries `success`, an optional nullab
 
 | Harness | Function results |
 | --- | --- |
-| Codex | Text and ordered text/image output. Core checks only that each part is well formed and passes image references to the Harness unchanged |
-| Claude Code | Text output. Images only in successful results and only as inline PNG or JPEG; an image in a failed result or a remote reference returns 400 before anything is stored, and the pending call stays open. The Harness may resize or re-encode images in its own history; public Items keep the submitted bytes |
-| MiniMax Code | No public functions |
+| Codex | Text and ordered text/image output, passed to the Harness unchanged. An `http` or `https` image URL returns 400, because native Codex replaces a dynamic tool result that carries one with a failure |
+| Claude Code | Text output. Images only in successful results and only as canonical base64 data URLs of `image/png`, `image/jpeg`, `image/gif` or `image/webp`, because a native tool result carries no URL; an image in a failed result or a remote reference returns 400 before anything is stored, and the pending call stays open. The Harness may resize or re-encode an image, or replace one it cannot process with a text note, in its own history; public Items keep the submitted bytes |
+| MiniMax Code | Text output. An image returns 400, because native MCP image content is not qualified to reach the model |
 
 ### Application receipts
 
 Admission (202) does not mean the Harness used the result. The pending call clears when the adapter confirms native application:
 
-- **Claude Code** confirms with a live root native tool result that matches the Session, call ID, success flag, exact text, block count and order, with a native image at every image position. Replayed, synthetic and Subagent records do not confirm it.
-- **Codex** confirms with the live root dynamic-tool `item/completed` observation that matches thread, Turn, call, function name, status, success flag and the exact ordered content. A write to the Harness alone does not confirm it.
+- **Claude Code** confirms with a live root native tool result that matches the Session, call ID, success flag, exact text, block count and order, with a native image at every image position. Replayed and synthetic records do not confirm it. A Subagent call is confirmed only by that child's own live result.
+- **Codex** confirms with the live dynamic-tool `item/completed` observation on the thread and Turn that made the call, which must match the call, function name, status, success flag and the exact ordered content. A write to the Harness alone does not confirm it.
+- **MiniMax Code** confirms with the live native tool update for the `functions` MCP call whose echoed result carries the call ID. A native failure of the call, such as its 120 s timeout, abandons it.
 
-Both adapters wait at most 10 seconds for a receipt. A timeout or native release without confirmation leaves application uncertain. Confirmation means the Harness recorded the result, not that the model provider consumed it. Core never replays a result automatically; the submission stays stored for recovery reads.
+Each adapter waits at most 10 seconds for a receipt. A timeout or native release without confirmation leaves application uncertain. Confirmation means the Harness recorded the result, not that the model provider consumed it. Core never replays a result automatically; the submission stays stored for recovery reads. A call the native Harness abandons gets no receipt and is withdrawn ([Functions](./execution-tools.md#functions)).
 
 ## Runtime boundary
 
diff --git a/contracts/agents-api/model-execution.md b/contracts/agents-api/model-execution.md
index 745ee17cf..068b2adb8 100644
--- a/contracts/agents-api/model-execution.md
+++ b/contracts/agents-api/model-execution.md
@@ -4,6 +4,29 @@ title: "Model execution"
 
 Each Session runs one Harness with one model provider. Core selects them through three Core extensions that the pinned upstream protocol does not define: `x_agents_core.harness` chooses the Harness, `x_agents_core.model_provider` supplies the endpoint and key, and `x_agents_core.harness_config` carries native model parameters. Core has no provider catalog, model alias resolution or product permission model; besides Session and saved-Agent bundles, the only stored bundle is one [deployment default](#deployment-defaults) per Harness. This document is the Harness–model provider protocol: [`internal/modelprovider/config.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/modelprovider/config.go) validates the frozen provider connection, and each Harness declares its protocols and native parameters through [`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go).
 
+## Model provider bundle
+
+A Harness receives one frozen model provider bundle, defined by [`modelprovider.Provider`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/modelprovider/config.go). Core validates it at Session creation and the Harness uses it unchanged.
+
+| Field | Meaning |
+| --- | --- |
+| `protocol` | The upstream API: `anthropic`, `responses` or `chat_completions`, not an engine. The selected Harness must support it natively |
+| `base_url` | An HTTPS URL with a valid host, without credentials, query or fragment |
+| `api_key` | Nonempty, at most 16 KiB, without NUL, CR or LF |
+| `context_window`, `max_output_tokens` | Optional nonnegative integers, with output no larger than context. Use the real model's limits |
+
+Supported protocols and native token limits by Harness:
+
+| Harness | Supported protocols, default first | Native token limits |
+| --- | --- | --- |
+| Codex | `responses` | `model_context_window`; no output limit |
+| Claude Code | `anthropic` | `CLAUDE_CODE_MAX_CONTEXT_TOKENS`, which native uses only for a model it does not know, and `CLAUDE_CODE_MAX_OUTPUT_TOKENS`, which native caps at the model's limit |
+| MiniMax Code | `anthropic`, `responses`, `chat_completions` | The custom model's `limit.context` and `limit.output` |
+
+A set limit with no native setting returns `model_provider_token_limits_invalid`.
+
+Core validates the resolved combination before writing the Session. Core and Runtime read the same ordered `protocols` declaration in `internal/harnessconfig`. There is no model API proxy, passthrough gateway or cross-protocol conversion, including inside a Harness. Unsupported saved configurations and Session snapshots fail when used; they are never rewritten, aliased or migrated.
+
 ## Harness selection
 
 ```json
@@ -26,15 +49,7 @@ A saved Agent is editable configuration, not a bound runtime. Create or update i
 
 Session creation resolves each explicit model or Harness override before saved defaults; without a selected Harness, the deployment default applies. Saved Agents require a model. An inline `openai_hosted` or `none` Session may omit its model to use the deployment model of the resolved Harness; `self_hosted` never uses deployment model settings. Core never infers a model from its name.
 
-Provider precedence is: a complete Session bundle, then a complete saved bundle, then the deployment default for the resolved Harness. Core never merges a replacement endpoint with an inherited key; a model-only override reuses the whole inherited bundle. Each Harness connects only through its native protocols:
-
-| Harness | Supported protocols, default first |
-| --- | --- |
-| Codex | `responses` |
-| Claude SDK | `anthropic` |
-| MiniMax Code | `anthropic`, `responses`, `chat_completions` |
-
-MiniMax Code requires positive context and output limits. Core validates the resolved combination before writing the Session. Core and Runtime read the same ordered `protocols` declaration in `internal/harnessconfig`. There is no model API proxy, passthrough gateway or cross-protocol conversion, including inside a Harness. Unsupported saved configurations and Session snapshots fail when used; they are never rewritten, aliased or migrated.
+Provider precedence is: a complete Session bundle, then a complete saved bundle, then the deployment default for the resolved Harness. Core never merges a replacement endpoint with an inherited key; a model-only override reuses the whole inherited bundle. Each Harness connects only through its native protocols ([Model provider bundle](#model-provider-bundle)).
 
 Which sources apply depends on who owns the compute that receives the key:
 
@@ -79,10 +94,6 @@ New hosted requests, and requests that omit the inline model, record caller inte
 }
 ```
 
-- `protocol` names the upstream API (`anthropic`, `responses` or `chat_completions`), not an engine. The selected Harness must support it natively.
-- `base_url` uses HTTPS with a valid host, without credentials, query or fragment.
-- `api_key` is nonempty, at most 16 KiB and contains no NUL, CR or LF.
-- `context_window` and `max_output_tokens` are optional nonnegative integers, with output no larger than context; both must be positive for MiniMax Code. Use the real model's limits.
 - `agent.model` is the exact provider model ID; a supplied value always replaces the deployment model.
 - The Session's `x_agents_core` accepts `model_provider`, `harness_config` and `environment` ([Environments](./environments.md#preparation-order)); any other member, such as `sandbox_node_id`, is rejected with 400. Hosted node placement is automatic.
 
@@ -90,7 +101,7 @@ Unsupported protocol, Harness or Environment combinations are rejected before th
 
 The resolved provider configuration is frozen and encrypted in the Session creation transaction, with its own encryption purpose and Project and Session binding. Creation retries include it in their request hash, so a changed key or endpoint under the same Idempotency-Key conflicts; a key enters any stored hash only as a fingerprint keyed by the deployment credential key. No public Session, Agent, Environment, event or ordinary configuration contains the key. The top-level extension is write-only and cannot be updated.
 
-At dispatch, Core sends the snapshot as one confidential provider bundle over the daemon connection bound to the Session, and the adapter applies it natively and connects directly to the provider. Core never falls back to other credentials when a snapshot is missing or cannot be decrypted. For `self_hosted`, the receiving daemon is the executor enrolled for the Session's own Environment with a current executor credential of the Session creator's principal; rotation or revocation closes the socket before further dispatch. The executor host stores the bundle in its native Harness home, as hosted Runtimes do. Native tools run with the starting account's permissions and can read what that account can read, and revocation does not erase a bundle already delivered.
+At dispatch, Core sends the snapshot as one confidential provider bundle over the daemon connection bound to the Session, and the adapter applies it natively and connects directly to the provider. Core never falls back to other credentials when a snapshot is missing or cannot be decrypted. For `self_hosted`, the receiving daemon is the executor enrolled for the Session's own Environment with a current executor credential of the Session creator's principal; rotation or revocation closes the socket before further dispatch. The executor host stores the bundle in its native Harness home, as hosted Runtimes do. Native tools run with the starting account's permissions and can read what that account can read. The workspace's native configuration, such as Claude Code project settings and hooks, applies as it does locally and can use the provider key, so attach only repositories trusted with that key. Revocation does not erase a bundle already delivered.
 
 ## Native model parameters
 
@@ -98,13 +109,13 @@ At dispatch, Core sends the snapshot as one confidential provider bundle over th
 
 | Harness | Accepted fields | Applied as |
 | --- | --- | --- |
-| Codex | `model_reasoning_effort`: `none`, `minimal`, `low`, `medium`, `high`, `xhigh` | App-server `-c model_reasoning_effort=...` and each Turn's `collaborationMode.settings.reasoning_effort` |
-| Claude SDK | `effort`: `low`, `medium`, `high`, `xhigh`, `max`; `thinking`: the SDK's `adaptive`, `enabled` or `disabled` object | SDK `Options.effort` and `Options.thinking` |
-| MiniMax Code | Empty object only | Provider token limits remain required |
+| Codex | Empty object only | Reasoning effort belongs to the public `reasoning.effort` |
+| Claude Code | `thinking`: the SDK's `adaptive`, `enabled` or `disabled` object | SDK `Options.thinking`; the public `reasoning.effort` becomes `Options.effort` |
+| MiniMax Code | Empty object only | The public `reasoning.effort` becomes the custom model's thinking effort |
 
 Claude `thinking` accepts `display` (`summarized` or `omitted`) for `adaptive` and `enabled`, and a positive integer `budgetTokens` only for `enabled`; `maxThinkingTokens` is rejected. These are native settings, not a shared reasoning vocabulary; model availability and provider support are the Harness's responsibility.
 
-A supplied object replaces the whole object; `{}` clears it and null is invalid. A Session that selects a model or provider without supplying native parameters uses `{}` instead of inheriting another model's parameters. Otherwise a saved Agent supplies its object, and an inline Session using the deployment model uses the deployment object. Changing the Harness clears inherited parameters, and so does an Agent update of model, provider or Harness that does not supply `harness_config`. There is no deep merge. An inline extension that sets only native parameters keeps the saved Harness. Neither this object nor a deployment default enables public `reasoning` options.
+A supplied object replaces the whole object; `{}` clears it and null is invalid. A Session that selects a model or provider without supplying native parameters uses `{}` instead of inheriting another model's parameters. Otherwise a saved Agent supplies its object, and an inline Session using the deployment model uses the deployment object. Changing the Harness clears inherited parameters, and so does an Agent update of model, provider or Harness that does not supply `harness_config`. There is no deep merge. An inline extension that sets only native parameters keeps the saved Harness.
 
 Core validates the resolved configuration before writing the Session and freezes it in the Session's Agent configuration; the administrator execution-configuration read shows its value and source. Native parameters are not confidential; provider keys stay in the separate encrypted bundle. Reconnection uses the frozen configuration and cannot change the provider, protocol or parameters; an incompatible frozen configuration fails. Protocol support does not qualify structured output, tool discovery, web search, verbosity or image input by itself, and a supported connection does not prove that the remote model accepts a parameter.
 
@@ -123,7 +134,7 @@ PUT requires `model` and a complete `model_provider`; `harness_config` defaults
 
 Session creation decrypts the default of the resolved Harness and freezes it in the Session's encrypted snapshot like any other bundle, so changing or removing the default never reaches existing Sessions. The execution-configuration read shows the frozen safe view with source `deployment`. A missing or invalid provider snapshot fails closed, with no fallback to another model or provider.
 
-`model_configuration_support` derives from the adapter declaration that Core and Runtime share: `protocols` lists the selectable native protocols with the default first, `accepts_harness_config` says whether native parameters are accepted and `token_limits_required` whether provider token limits are required. It describes the build, not a live Runtime or a remote model.
+`model_configuration_support` derives from the adapter declaration that Core and Runtime share: `protocols` lists the selectable native protocols with the default first, `accepts_harness_config` says whether native parameters are accepted, and `accepts_max_output_tokens` whether `max_output_tokens` has a native setting. It describes the build, not a live Runtime or a remote model.
 
 ### Deployment default observations
 
diff --git a/contracts/agents-api/node-generation-protocol.md b/contracts/agents-api/node-generation-protocol.md
index 74e338367..316a6c239 100644
--- a/contracts/agents-api/node-generation-protocol.md
+++ b/contracts/agents-api/node-generation-protocol.md
@@ -2,22 +2,57 @@
 title: "Sandbox node protocol"
 ---
 
-A sandbox node runs the Docker or microsandbox Provider on its host and connects to Core over one WebSocket. Core sends Provider operations over that connection; the node runs them against its local provider and reports readiness, host measurements and the deployment generations it holds. Core stays the only lifecycle owner: the node never retries a mutation or schedules work. The frames and validators live in [`services/core/internal/sandbox/node`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/sandbox/node) (`wire.go`, `generation_wire.go`); the HTTP routes a node uses to enroll and read its configuration are in the [machine connection API](./machine-api.md#node-routes).
+The sandbox node protocol connects Core to a Docker or microsandbox host, which runs Provider operations against its local provider and reports readiness, host measurements and the deployment generations it holds.
+
+| | |
+| --- | --- |
+| Caller | Core, the only lifecycle owner; the node never retries a mutation or schedules work |
+| Implementations | The sandbox node program with the Docker and microsandbox Providers |
+| Code | [`services/core/internal/sandbox/node`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/sandbox/node) (`wire.go`, `generation_wire.go`) |
+| Transport | One WebSocket, `GET /api/v1/sandbox-node/connect`; the HTTP routes a node uses to enroll and read its configuration are in the [machine connection API](./machine-api.md#node-routes) |
+| Version rule | Exact match on `node.ProtocolVersion`, see [Frames and version](#frames-and-version) |
+
+Node-local storage, generation leases and recovery are not part of the wire protocol; the [Node installer](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md#generation-storage-and-recovery) owns them.
+
+## Roles
+
+| Party | Owns |
+| --- | --- |
+| Core | Node identity and presence, the owner epoch, the target generation, every request and its sequence, and every retention decision |
+| Node | Its local provider, the generations it prepares and serves, health and host measurements, and the execution of each request against the provider |
 
 ## Frames and version
 
 Every frame is one JSON text message whose `version` equals `node.ProtocolVersion`; both peers reject any other version, and there is no fallback decoder. Member names are exact and unique: unknown members, case aliases, duplicates and unexpected nulls are rejected. Control frames (`hello`, `welcome`, `heartbeat`, `heartbeat_ack`, `retention`, `retention_ack`) are at most 32 KiB; `request` and `response` frames at most 72 MiB. An invalid frame closes the connection.
 
+The current node wire version is 9. Core and nodes require matching peers; no previous-version decoder is provided.
+
 ## Connection
 
+```mermaid
+sequenceDiagram
+    participant N as Node
+    participant C as Core
+    N->>C: dial /sandbox-node/connect with Bearer credential
+    Note over C: 401 rejected credential (permanent), 409 duplicate connection
+    N->>C: hello (identity, health, generation observations)
+    C->>N: welcome (connection_id, owner_epoch, deployment)
+    loop every 10 s
+        N->>C: heartbeat (connection_id, owner_epoch, health)
+        C->>N: heartbeat_ack (deployment)
+    end
+    C->>N: request (id, sequence, operation)
+    N->>C: response (id, result or error_code)
+```
+
 1. The node dials `/api/v1/sandbox-node/connect?node_id=<uuid>` on its stored Core origin (`wss` for `https`) with its node credential as a Bearer header. Core answers 401 to a rejected credential, which the node treats as permanent; any other failure, including a 403 from a proxy, is retried with bounded backoff. Core refuses a second connection for a node identity while one is opening, live or closing, with 409.
-2. Within 15 seconds the node sends `hello` with its identity (`node_id`, `installation_id`, `provider`, `backend_fingerprint`, the enrolled `deployment_generation` and `specification_digest`, `max_active`, `max_retained`), its first health report and, when it can prepare and retain several deployment generations, `generation_management: true`. Core closes the connection unless the identity matches the authenticated node.
-3. Core records the node's presence, then replies `welcome` with a new `connection_id`, the current `owner_epoch` and, for a generation-managing node, `deployment`: the target `generation`, its `specification_digest` and a nullable `serving_generation`. The node stores a higher owner epoch and refuses a lower one.
-4. Every 10 seconds the node sends `heartbeat` with `connection_id`, `owner_epoch` and health. On each heartbeat Core authenticates the node credential again and checks the owner epoch, records the health and replies `heartbeat_ack`, with `deployment` for a generation-managing node. Either peer closes the connection after 35 seconds without a frame.
+2. Within 15 seconds the node sends `hello` with its identity (`node_id`, `installation_id`, `provider`, `backend_fingerprint`, the enrolled `deployment_generation` and `specification_digest`, `max_active`, `max_retained`), and its first health report. Core closes the connection unless the identity matches the authenticated node.
+3. Core records the node's presence, then replies `welcome` with a new `connection_id`, the current `owner_epoch` and `deployment`: the target `generation`, its `specification_digest` and a nullable `serving_generation`. The node stores a higher owner epoch and refuses a lower one.
+4. Every 10 seconds the node sends `heartbeat` with `connection_id`, `owner_epoch` and health. On each heartbeat Core authenticates the node credential again and checks the owner epoch, records the health and replies `heartbeat_ack` with `deployment`. Either peer closes the connection after 35 seconds without a frame.
 
-Core counts a node as online while it is connected under the current owner epoch and its last heartbeat is less than 45 seconds old. A heartbeat establishes provider readiness and the last host measurements, never Session activity.
+Core counts a node as online while it is connected under the current owner epoch and its last heartbeat is less than 45 seconds old. A heartbeat establishes provider readiness and the last host measurements, never Session activity. [Timeouts and limits](#timeouts-and-limits) lists every timer.
 
-Health carries `provider_ready`, an optional fixed `diagnostic`, `observed_at`, `active_operations` (at most 32) and the host measurements that the [Runtime telemetry API](./runtime-observability-api.md#node-host-observations-and-history) reports. A node without generation management probes its provider for every report; an unready provider reports the Provider-neutral readiness class of its first failed check, from the class error the probe wraps, and the probe text, vendor detail and host paths stay on the node. A `diagnostic` in node or generation health that is not a declared class makes the frame invalid. The [nodes guide](../../docs/getting-started/nodes.md#readiness-codes) lists the classes and their causes. A generation-managing node reports readiness per generation instead, as described below.
+Health carries `observed_at`, `active_operations` (at most 32) and the host measurements that the [Runtime telemetry API](./runtime-observability-api.md#node-host-observations-and-history) reports. The enrollment request carries the same measurements that the node takes for health, `cpu_count`, `effective_cpu_cores`, `total_memory_bytes` and `available_disk_bytes`, each omitted when the node cannot measure it and validated like a health report. Core derives from them every limit the enrollment token leaves unset, as [Recommended capacity](./sandbox-deployment.md#recommended-capacity) defines. A node reports readiness per generation, as described below. A `diagnostic` in a generation observation that is not a declared class makes the frame invalid. The [nodes guide](../../docs/getting-started/nodes.md#readiness-codes) lists the classes and their causes.
 
 ## Provider requests
 
@@ -53,17 +88,20 @@ Each operation carries its own arguments and returns the following result on suc
 | `suspend` | `Suspend` | `suspend` | `state` |
 | `resume` | `Resume` | `resume` | `state` |
 | `delete_retained` | `DeleteRetained` | `retained` | None |
+| `restore_preparation` | `RestorePreparation` | `key` | `restored` |
+| `save_preparation` | `SavePreparation` | `key` | None |
 
-A request whose `connection_id`, `owner_epoch` or `sequence` does not match closes the connection. A malformed request gets an `invalid` response. A node without generation management accepts only its enrolled `deployment_generation`; a generation-managing node runs the request on that generation's provider and answers `unconfirmed` when it cannot. Core sends `create` and a `resume` that is not reconciliation-only only to a generation that is ready on that node, and keeps at most 32 requests pending per connection.
+A request whose `connection_id`, `owner_epoch` or `sequence` does not match closes the connection. A malformed request gets an `invalid` response. The node runs the request on the provider of the named `deployment_generation` and answers `unconfirmed` when it cannot. Core sends `create` and a `resume` that is not reconciliation-only only to a generation that is ready on that node, and keeps at most 32 requests pending per connection.
 
 The budget is relative: the node anchors `timeout_ms` to its own clock on receipt and consumes it while the request waits in its queue, so the hosts' clocks need not agree. Core still bounds its own wait. A full node queue closes the connection.
 
-The `response` frame carries `id` and `connection_id`. A successful response carries the result named in the operation table, with no result field for `kill`, `kill_compute` or `delete_retained`. A failed response carries an `error_code`:
+The `response` frame carries `id` and `connection_id`. A successful response carries the result named in the operation table, with no result field for `kill`, `kill_compute`, `delete_retained` or `save_preparation`. A failed response carries an `error_code`:
 
 | `error_code` | Meaning |
 | --- | --- |
 | `invalid`, `ownership`, `exists`, `not_found` | `ErrInvalid`, `ErrOwnership`, `ErrExists`, `ErrNotFound` |
 | `command_unconfirmed` | `ErrCommandUnconfirmed` |
+| `checkpoint_unusable` | `ErrCheckpointUnusable`, a `resume` outcome |
 | `observation_unavailable`, `runtime_not_running` | The observation outcomes |
 | `unsupported` | The operation is declared unsupported; see below |
 | `unconfirmed`, or any other value | The outcome is unknown |
@@ -72,58 +110,57 @@ A failed response carries no result except an exact-provenance Resume target for
 
 Node startup and generation loading validate complete Provider operation declarations before accepting work, and the Core proxy uses the same registered declaration, so an unsupported operation rejects before node resolution or native I/O. The [operation contract](../../docs/sandbox-provider.md#explicit-operation-contracts) owns the inventory. An `unsupported` response carries an `unsupported` object with the exact method `operation` and an authored safe `reason`; the proxy checks both against the request. Missing, malformed or mismatched evidence is an unconfirmed result, never proof that a mutation was rejected. Unsupported stays distinct from observation unavailability and unknown compute or command results, and it neither settles resource ownership nor authorizes a replay.
 
-## Generation control
-
-A node without generation management serves only its enrolled generation, with fixed configuration, and receives no preparation or retention frames. It can report that exact generation in `Health.Generations`; a checkpoint-capable provider must do so, including its verified checkpoint qualification. `provider_ready` and the reported state must agree. A generation-managing node prepares the target generation Core announces in `welcome` and `heartbeat_ack` and keeps serving its durable serving generation while it does; target preparation is independent of the serving provider's readiness.
-
-Its `hello` and heartbeats carry at most eight generation observations. Each names a positive signed-64-bit generation, its lowercase SHA-256 specification digest, a `ready`, `preparing` or `failed` state and an optional fixed diagnostic. The target and serving generations come first; other records rotate fairly. Eight bounds one message, not the number of generations a node may keep. An omitted observation never authorizes deletion or implies absence. A ready checkpoint-capable generation includes `checkpoint` with nonempty opaque `artifact_domain` and `execution_class` tokens, each at most 256 bytes. Unsupported providers omit it; preparing or failed generations never advertise it. Core persists the declaration with the authenticated connection and generation, and uses it only while that generation is ready on the current online connection. The [Provider contract](../../docs/sandbox-provider.md#checkpoint-transfer) defines archive and execution compatibility.
-
-Retention uses its own bounded exchange. A `retention` request names at most eight local `(generation, specification_digest)` references, a UUID, a sequence that increases by one, the current `connection_id` and the owner epoch. The `retention_ack` must match the complete pending request, entry order and identity included, and give an explicit boolean `keep` for every entry. One exchange is pending per connection, and a disconnect discards it. An unsolicited, replayed, stale, partial or mixed acknowledgement deletes nothing. Retention traffic never uses the Provider request queue.
-
-## Local retention and helper lifetime
+Create bootstrap and Resume requests may carry an optional workspace filesystem binding. The node validates its tenant and Environment against the allocation reference, its immutable ObjectID, and its attachment configuration ID against the supplied configuration before forwarding it. The filesystem resolver validates adapter-native ownership. A Provider whose policy declares workspace storage rejects a missing binding; a Provider without it rejects a present one. Neither falls back. Error responses may retain a Resume target only when its nonempty native ID, name, generation and retained-state provenance match the requested target; this is cleanup evidence, never successful restore.
 
-A Core drop grant is necessary but not sufficient for collection. Queued and running provider calls, preparation, the local target and the serving pin all keep references; collection rechecks them and refuses on an already canceled connection. A canceled provider caller does not prove that its native helper stopped: the node counts a helper until its actual `Wait` returns.
-
-Every generation owns a permanent private lease file, `state/node/generations/<generation>.lease`. Before starting a native helper, the node takes a shared flock on it, validates the durable lease identity under that lock, and requires the published final provider configuration and no preparing, collecting or dropped journal. The helper inherits the descriptor; the node closes its own copy only after `Wait` and never unlocks the shared open-file description, so a canceled caller or a node exit does not release a live helper's reference. Native helpers set the descriptor close-on-exec before calling the SDK, so VM and daemon descendants do not inherit it.
-
-Collection takes the exclusive nonblocking flock before it inspects references, removes shared images or release files, or publishes the dropped marker, and holds it through those changes. Lease files belong to stable node state and are never removed or replaced during collection; symlinks, multiply linked files, foreign ownership, unsafe permissions and replaced lock paths are refused. Before the first helper can start, the installer creates the lease exclusively and fsyncs it, then atomically persists and fsyncs a private `.lease-identity` record and its directory. The record binds installation, generation, specification digest, device and inode. The Python collector and the Go helper opener validate the same record on every open, including after a restart; neither adopts a missing identity, replaces its inode or erases it after collection. An installation interrupted before the identity is durable refuses re-adoption and is kept for inspection. A removed identity or a replaced lease refuses even when its current metadata agree.
-
-A dropped generation can never be prepared or used again. A helper's exit is evidence about local files only, not proof that a remote mutation or an uncertain provider receipt has been released; Core's durable allocation and placement retention stays independent.
-
-## Matched fresh installation
-
-The host program release and Core's selected Runtime release are independent. A fresh node gets its executable and private preparer from the console's current release, and reads the exact Runtime source, image identities and native runtime and firmware digests from its authenticated configuration. When that Runtime is older, the console still serves its immutable `releases/<source>/` manifest, checksums and allowlisted artifacts: the Runtime helper, firmware, seccomp profile and image bytes come from the selected release, and artifact URLs stay pinned to their verified manifest even if the console's current release changes during a download.
-
-A missing retained release refuses the installation rather than substituting the current Runtime, and so does a local bundle that holds only a different Runtime. These refusals happen before the installer writes the node identity, imports the Runtime, registers the node or starts its service.
-
-A published console release keeps its metadata and artifact bytes. Publishing it again first validates all metadata and every existing declared artifact, then may atomically add only missing, checksum-matched declared artifacts; any conflict prevents every addition, and nothing is overwritten.
-
-## Restart recovery
-
-Missing Runtime bytes never move a pinned placement to the current Runtime. The node keeps the original generation and specification digest as unready and asks Core's authenticated configuration route for that exact generation before recovery. Missing seccomp bytes may leave an unready provider placeholder; missing image or native artifacts found by a provider probe queue a repair without advertising readiness.
+## Generation control
 
-Preparation and repair are serialized. Target and serving generations come first, with bounded progress on the others. Each attempt has a 30-minute deadline, and failures back off for 1, 2, 5 and 10 minutes, then at most 30. Nothing is prepared before the connection has delivered deployment facts. Repair keeps existing configurations and paths, verifies the selected release and every existing sibling checksum, and downloads only missing immutable files. Conflicting bytes or a different retained specification refuse repair, and a missing provider configuration without an exact preparation plan is refused rather than reconstructed.
+The node prepares the target generation Core announces in `welcome` and `heartbeat_ack` and keeps serving its durable serving generation while it does; target preparation is independent of the serving provider's readiness.
 
-Repair takes the same exclusive generation lease and installation lock as collection, so a live helper or a running collector keeps ownership and repair retries later. After the bytes are restored, the node still runs the provider's readiness probe; file presence and executable capability never establish readiness.
+The node's `hello` and heartbeats carry at most eight generation observations. Each names a positive signed-64-bit generation, its lowercase SHA-256 specification digest, a `ready`, `preparing` or `failed` state and an optional fixed diagnostic. The target and serving generations come first; other records rotate fairly. Eight bounds one message, not the number of generations a node may keep. An omitted observation never authorizes deletion or implies absence. A ready checkpoint-capable generation includes `checkpoint` with nonempty opaque `artifact_domain` and `execution_class` tokens, each at most 256 bytes. Unsupported providers omit it; preparing or failed generations never advertise it. Core persists the declaration with the authenticated connection and generation, and uses it only while that generation is ready on the current online connection. The [Provider contract](../../docs/sandbox-provider.md#checkpoint-transfer) defines archive and execution compatibility.
 
-## Preparation and collection records
+```mermaid
+stateDiagram-v2
+    [*] --> preparing
+    preparing --> ready
+    preparing --> failed
+    failed --> preparing: repair
+    ready --> [*]: dropped
+    failed --> [*]: dropped
+```
 
-New preparation writes two distinct records. Before downloads, `.preparing` holds the installation, generation and specification identity, the private provider paths and `import_started: false`; it is a recovery and collection plan, not a provider. Before the importer runs, the plan records `import_started: true`. Python retention discovery and Go restart recovery both recognize pending-only plans but never build, probe or acquire a provider from them, and recovery or collection still needs authorization on the current connection.
+A generation is the target, the serving generation, both or neither. The node reports each held generation as `preparing`, `ready` or `failed`; a dropped generation is never prepared or used again. Local collection of a dropped generation is described in the [Node installer](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md#generation-storage-and-recovery).
 
-Only a successful preparation publishes the final `.json` provider configuration, which is write-once. Docker records the immutable local image ID its resolver returns; either the builder's config identity or the manifest identity can be valid for the same specification. Publication is durable before the preparation journal is cleared. An interruption between the two revalidates the same plan and final identity; plan, specification or path drift refuses. A canceled or failed import stays visible to Core's retention exchange without becoming a serving generation.
+Retention uses its own bounded exchange: the node asks and Core decides. The node's `retention` request names at most eight local `(generation, specification_digest)` references, a UUID, a sequence that increases by one, the current `connection_id` and the owner epoch. Core's `retention_ack` must match the complete pending request, entry order and identity included, and give an explicit boolean `keep` for every entry. One exchange is pending per connection, and a disconnect discards it. An unsolicited, replayed, stale, partial or mixed acknowledgement deletes nothing. Retention traffic never uses the Provider request queue.
 
-Before any native or release deletion, the node persists a private collection journal bound to its installation, generation and specification digest. After a restart an unfinished journal is only a retention-exchange candidate: it cannot prepare, probe, acquire or advertise that generation, and a fresh correlated Core drop grant is needed to resume. Native completion is persisted before release files are removed, so a retry can finish a partly removed release without running an already removed helper. The digest-bound dropped marker follows durable file cleanup and prevents re-adoption; the small configuration and ownership journals stay as local identity records.
+```mermaid
+sequenceDiagram
+    participant N as Node
+    participant C as Core
+    N->>C: retention (id, sequence, up to 8 references)
+    C->>N: retention_ack (keep for every entry, same order)
+    Note over C,N: One exchange is pending per connection
+```
 
-For the installation-private microsandbox store, a successful, complete native image inventory distinguishes absence from a CLI failure; a failed query, malformed inventory, native in-use refusal or unknown ownership keeps the bytes. Shared microsandbox images and private releases stay until their last local reference. Docker images belong to the host's shared daemon: automatic collection never removes or prunes them, and only the host administrator can remove them after confirming that no installation on the host needs them.
+## Readiness diagnostics
 
-A fresh installation also records the verified checksums of its Runtime files separately from the host program. Collecting the original generation removes only the exact private Runtime helper, executable, firmware, seccomp and import-cache files that no retained configuration references. Every remaining file is checked before the first deletion; an unknown hash, changed bytes, links or missing ownership metadata refuse cleanup. The node executable, preparer, identity, base provider configuration and manifests stay, so a restarted node can still read its enrolled identity and construct a newer retained provider. Shared native paths are compared across all retained configurations before removal.
+The readiness classes, one exported error and one code each, are authored in `services/core/internal/sandbox/node_diagnostic.go`. The shared `services/core/internal/sandbox/testdata/node-diagnostics.json` fixture checks the Go mapping, OpenAPI source annotations and generated enums, and the TypeScript client declaration. Web uses the client normalizer and checks localized messages for every declared code. Update these projections with a code change; clients read an unknown code as `provider_unavailable`.
 
-An interrupted download repairs only missing bytes at the original paths. When collection comes before any import attempt, the preparation journal proves that the generation has no imported native image. A generation whose native executable is missing and whose import may have started stays retained: missing files never prove native absence, and an empty native inventory never erases receipt or store history.
+Preparation diagnostics keep fixed typed causes. Provider, ownership, cancellation and unclassified failures keep their typed code or `provider_unavailable`. No raw provider text crosses the protocol.
 
-The readiness classes, one exported error and one code each, are authored in `services/core/internal/sandbox/node_diagnostic.go`. The shared `services/core/internal/sandbox/testdata/node-diagnostics.json` fixture checks the Go mapping, OpenAPI source annotations and generated enums, and the TypeScript client declaration. Web uses the client normalizer and checks localized messages for every declared code. Update these projections with a code change; clients read an unknown code as `provider_unavailable`.
+## Timeouts and limits
 
-Preparation diagnostics keep fixed typed causes. Only artifact transfer, checksum or release-provenance failures report `runtime_download_failed`; the private preparer signals that class through its exit category, without Core or the node parsing stderr. Provider, ownership, cancellation and unclassified failures keep their typed code or `provider_unavailable`. No raw provider text crosses the protocol.
+| Value | Applies to | On expiry or excess |
+| --- | --- | --- |
+| 15 s | `hello` after the connection opens | The connection closes |
+| 10 s | Heartbeat interval; also the write deadline of each frame | A failed write ends the connection |
+| 35 s | Any frame on an open connection | Either peer closes the connection |
+| 45 s | Age of the last heartbeat for an online node | Core counts the node as offline |
+| 1 to 120000 ms | Request `timeout_ms` | The request fails as unavailable or uncertain |
+| 32 | Pending requests per connection; `active_operations` in health | A full node queue closes the connection |
+| 32 KiB | Control frames | The connection closes |
+| 72 MiB | `request` and `response` frames | The connection closes |
+| 8 | Generation observations per message; references per `retention` request | An omitted observation implies nothing |
 
-Creation carries the Session-selected `Bootstrap.Harness` into Runtime bootstrap version 2. Core and nodes use protocol version 8 and require a coordinated upgrade. `Bootstrap.Harness` is required. All ten suspension operations belong to the same `SandboxProvider` and are declared supported or unsupported together; dispatch uses no optional interface. `Observe` reads one allocation per request.
+## Conformance
 
-The current wire version is 8. Create bootstrap and Resume requests may carry an optional workspace filesystem binding. The node validates its tenant and Environment against the allocation reference, its immutable ObjectID, and its attachment configuration ID against the supplied configuration before forwarding it. The filesystem resolver validates adapter-native ownership. A missing binding selects owned storage; a present binding cannot fall back. Error responses may retain a Resume target only when its nonempty native ID, name, generation and retained-state provenance match the requested target; this is cleanup evidence, never successful restore.
+The Go tests in [`services/core/internal/sandbox/node`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/sandbox/node) cover frames, connection ordering and fencing, request budgets, generation control and Provider operations. `make check-core` runs them. The Python node installer tests in `deploy/node` cover the node side of generation preparation and collection.
diff --git a/contracts/agents-api/openapi.yaml b/contracts/agents-api/openapi.yaml
index b0921a45c..9ea57a48e 100644
--- a/contracts/agents-api/openapi.yaml
+++ b/contracts/agents-api/openapi.yaml
@@ -18265,7 +18265,7 @@
       "v1.SessionExecutionInput": {
         "properties": {
           "environment": {
-            "description": "Environment supplies placement-independent preparation through the Core extension.",
+            "description": "Environment supplies portable preparation fields. For openai_hosted only, compute_profile selects an administrator-approved immutable compute choice; its name must match ^[a-z][a-z0-9-]{0,47}$. Omission retains default compute. Unknown names fail with invalid_request_error and param x_agents_core.environment.compute_profile; no fallback is performed.",
             "type": "object"
           },
           "harness_config": {
diff --git a/contracts/agents-api/runtime.openapi.yaml b/contracts/agents-api/runtime.openapi.yaml
index 01fe6edeb..1f8718377 100644
--- a/contracts/agents-api/runtime.openapi.yaml
+++ b/contracts/agents-api/runtime.openapi.yaml
@@ -38,15 +38,22 @@ definitions:
     type: object
   deployment.Enrollment:
     properties:
+      available_disk_bytes:
+        type: integer
       backend_fingerprint:
         type: string
       core_url:
         description: The Core origin this node stores and connects to, such as https://core.example. It must equal the installation public URL; otherwise enrollment gets 409 sandbox_node_address_mismatch and the token stays unused.
         type: string
+      cpu_count:
+        description: Host measurements as in the node's health reports. Core derives a limit the enrollment token leaves unset from them.
+        type: integer
       credential:
         type: string
       deployment_generation:
         type: integer
+      effective_cpu_cores:
+        type: number
       name:
         type: string
       node_id:
@@ -55,6 +62,8 @@ definitions:
         type: string
       specification_digest:
         type: string
+      total_memory_bytes:
+        type: integer
     type: object
   deployment.NodeConfiguration:
     properties:
@@ -64,10 +73,6 @@ definitions:
         type: integer
       installation_id:
         type: string
-      max_active:
-        type: integer
-      max_retained:
-        type: integer
       provider:
         type: string
       specification:
@@ -117,8 +122,6 @@ definitions:
     properties:
       resources:
         $ref: '#/definitions/sandbox.Resources'
-      runtime:
-        $ref: '#/definitions/sandbox.RuntimeRelease'
       workspace:
         allOf:
           - $ref: '#/definitions/workspacefs.Declaration'
@@ -141,28 +144,6 @@ definitions:
       - cpus
       - memory_mib
     type: object
-  sandbox.RuntimeRelease:
-    properties:
-      firmware_sha256:
-        type: string
-      image_id:
-        type: string
-      image_manifest_digest:
-        type: string
-      microsandbox_ref:
-        type: string
-      runtime_sha256:
-        type: string
-      source_commit:
-        type: string
-    required:
-      - firmware_sha256
-      - image_id
-      - image_manifest_digest
-      - microsandbox_ref
-      - runtime_sha256
-      - source_commit
-    type: object
   v1.APIError:
     properties:
       code:
diff --git a/contracts/agents-api/sandbox-deployment.md b/contracts/agents-api/sandbox-deployment.md
index c4eb01db8..b7a33e902 100644
--- a/contracts/agents-api/sandbox-deployment.md
+++ b/contracts/agents-api/sandbox-deployment.md
@@ -2,16 +2,10 @@
 title: "Sandbox deployment"
 ---
 
-The sandbox deployment selects the Sandbox Provider, the per-sandbox resources and the immutable Runtime release for Core-managed `openai_hosted` execution. PostgreSQL holds one active selection per installation; Web and the Core API write the same configuration. A node's files hold an installed copy of it plus host-specific paths and cannot override its resources or Runtime. The selection is independent of the Harness. A deployment can stay unconfigured, with no nodes; it then refuses hosted admission.
+The sandbox deployment selects the Sandbox Provider and the per-sandbox resources for Core-managed `openai_hosted` execution. PostgreSQL holds one active selection per installation; Web and the Core API write the same configuration. A node's files hold an installed copy of it plus host-specific paths and cannot override its resources. The Runtime is not part of the selection: each node runs the Runtime its own installation verified. The selection is independent of the Harness. A deployment can stay unconfigured, with no nodes; it then refuses hosted admission.
 
 This contract owns the Core API routes below and their semantics. The [nodes guide](../../docs/getting-started/nodes.md) owns the operator workflow, the [machine connection API](./machine-api.md#node-routes) the routes nodes call, and the [sandbox node protocol](./node-generation-protocol.md) the node connection.
 
-## Suspension policy
-
-`PATCH /core/v1/sandbox/deployment` accepts `{"idle_seconds": 300}`. `idle_seconds` is a required integer from 30 to 86400 seconds, defaulting to 300, stored in Core's database. Only configured Providers declaring suspension support accept this change; unconfigured, unsupported or resetting deployments reject it. Success returns the deployment view with the saved `suspension.idle_seconds`.
-
-Changes apply to existing and new running allocations on the next lifecycle pass, without a Core restart, generation change or node rollout. Suspension already in progress is not cancelled; existing snapshots and the 24-hour retention period are unchanged. [Capacity-pressure reclamation](../../docs/sandbox-provider.md#suspension) can still suspend after 15 seconds of inactivity. Web manages this deployment-wide policy in **Settings** → **Sandbox and scheduling** → **Automatic suspension**; each node's capacity limits stay node-owned and are edited on **Nodes** with **Edit node**.
-
 ## Routes
 
 Every route requires the Core key. [Web's console server](../../docs/web/console-server.md) adds it on the server side for signed-in requests.
@@ -20,12 +14,12 @@ Every route requires the Core key. [Web's console server](../../docs/web/console
 | --- | --- |
 | `GET /core/v1/sandbox/deployment` | Read the safe active configuration, rollout, reset and resource counts |
 | `PATCH /core/v1/sandbox/deployment` | Update deployment-wide idle suspension without changing the configuration generation |
-| `POST /core/v1/sandbox/deployment` | Select the initial provider, resources and Runtime |
+| `POST /core/v1/sandbox/deployment` | Select the initial provider and resources |
 | `PUT /core/v1/sandbox/deployment` | Change the same provider's target online |
 | `POST /core/v1/sandbox/deployment/reset` | Start or escalate a durable clear of hosted resources |
 | `DELETE /core/v1/sandbox/deployment/reset?expected_generation=N` | Cancel the remaining clear |
 | `POST /core/v1/sandbox/providers/{provider}/discovery` | Query a provider's configuration catalog with a transient credential |
-| `POST /core/v1/sandbox/enrollment-tokens` | Issue a one-use node enrollment token with approved capacity |
+| `POST /core/v1/sandbox/enrollment-tokens` | Issue a one-use node enrollment token with optional node limits |
 | `GET /core/v1/sandbox/nodes` | List registered nodes |
 | `GET /core/v1/sandbox/nodes/{node_id}` | Read one node with its [host observations and history](./runtime-observability-api.md#node-host-observations-and-history) |
 | `PATCH /core/v1/sandbox/nodes/{node_id}` | Change a node's name and capacity |
@@ -42,8 +36,8 @@ POST and PUT take the same complete selection and require `expected_generation`
 | `expected_generation` | Required nonnegative integer from GET; never refresh and replay it automatically |
 | `provider` | Exactly one of `docker`, `microsandbox`, `e2b` |
 | `resources` | Per-sandbox limits, below; required for Docker and microsandbox, optional for E2B |
-| `runtime` | The immutable [Runtime release](#runtime-release); required for Docker and microsandbox, absent for E2B |
 | `configuration` | The provider's public selectors. E2B: the immutable `template` build and the optional paired `api_url` and `domain`. Docker and microsandbox accept only `{}` or omission |
+| `compute_profiles` | Optional map of up to eight named immutable resource choices, described below; omission or `{}` replaces the map with no choices |
 | `credential` | The provider's write-only credential. E2B: `{api_key}`, required at first setup and omitted on PUT to keep the current key; a null or empty key is invalid. Docker and microsandbox reject it |
 
 The request has no Core address. Core derives the deployment's `core_url` from the installation public URL (`public_url` in `config.json`, `OAC_PUBLIC_URL` for Core): the origin nodes and sandbox guests use to reach Core. A request that contains `core_url` is rejected with 400 `invalid_request` like any other unknown member. E2B guests reach Core from E2B's cloud, so an E2B selection is rejected with 409 `sandbox_configuration_error` while the public URL is loopback. Docker and microsandbox selections accept a loopback public URL, which serves only local development because a guest's loopback address does not reach its host. Changing the public URL is an installation change: nodes enrolled with the old address receive no new sandboxes and must be removed and added again.
@@ -55,32 +49,32 @@ The request has no Core address. Core derives the deployment's `core_url` from t
 | `cpus` | Integer, 1 through 255 |
 | `memory_mib` | Integer, 512 through 1048576 MiB |
 | `root_disk_mib` | microsandbox: at least 1024 MiB; Docker and E2B: omitted or zero |
-| `environment_disk_mib` | microsandbox owned disk: at least 1024 MiB; external filesystem: each new workspace's admitted capacity, where zero requests no quota and a positive value must be at least 1024 MiB and requires enforced quotas; Docker and E2B: omitted or zero |
+| `environment_disk_mib` | microsandbox: each new workspace's admitted capacity on workspace storage, where zero (the default) requests no quota and a positive value must be at least 1024 MiB and requires enforced quotas; Docker and E2B: omitted or zero |
 
-These limits describe each sandbox. A node's `max_active` and `max_retained` are separate reservation limits, and host measurements never permit exceeding either. Native providers may reject values that pass these bounds.
+These limits describe each sandbox. A node's `max_active` and `max_retained` are separate reservation limits, set as [Node capacity](#nodes-and-allocations) describes; no host measurement permits exceeding either once set. Native providers may reject values that pass these bounds.
 
 Docker applies the CPU and memory limits and checks the running container's limits and exact image; it has no hard root or workspace disk quota. E2B CPU and memory must equal the exact ready template build, which Core validates through the pinned SDK before saving; disk capacity stays part of the template. Neither provider accepts a disk quota it cannot enforce. An E2B selection may omit `resources`: Core then stores the build's CPU count and memory as `cpus` and `memory_mib`, returned in `specification.resources` without disk fields. On restart Core loads the committed E2B selection without validating the template build again, so an E2B outage never blocks inspection or cleanup; new selections still require validation.
 
-microsandbox configures the CPUs, memory, a managed root disk and a separate owned disk at `/environment`. The [microsandbox helper](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/tools/microsandbox-provider/README.md) describes how restore handles these limits.
+microsandbox configures the CPUs, memory and a managed root disk. It runs every Environment on [workspace storage](../../docs/workspace-provider.md) mounted at `/environment`. The [microsandbox helper](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/tools/microsandbox-provider/README.md) describes how restore handles these limits.
 
-The optional response `specification.workspace` is an immutable capability receipt derived from the selected [workspace filesystem](../../docs/workspace-provider.md), not an independently writable setting. It contains only `attachment`, `user_xattr` and `capacity_quota`; filesystem configuration, paths and credentials stay outside the sandbox specification. Core validates the combined declarations before saving, and retained generation validation and node construction use this receipt. Missing `workspace` preserves owned disk mode, including its existing disk bounds. Create and Resume must provide a binding exactly when the frozen generation selects external storage.
+The optional response `specification.workspace` is an immutable capability receipt derived from the selected [workspace filesystem](../../docs/workspace-provider.md), not an independently writable setting. It contains only `attachment`, `user_xattr` and `capacity_quota`; filesystem configuration, paths and credentials stay outside the sandbox specification. Core validates the combined declarations before saving, and retained generation validation and node construction use this receipt. microsandbox always has the receipt, and a deployment saved before workspace storage is selected returns `workspace_storage_required`. Docker and E2B have no receipt and keep their own disks. Create and Resume provide a binding exactly when the frozen generation has the receipt.
 
-To enable external storage for an existing owned deployment, select the filesystem configuration first, then update the sandbox deployment with compatible resources (`environment_disk_mib: 0` for a filesystem without quotas). Selecting the filesystem does not alter existing generations or allocations. The next sandbox update derives the external receipt; old owned allocations keep their owned disks. A filesystem selection must support the provider's declared requirements. An already external deployment requires the same `attachment` and `user_xattr`; the selection may change `capacity_quota`, after which new workspaces are refused until a sandbox update sets a matching `environment_disk_mib`. Existing workspaces keep the capacity they were admitted with.
+Select the filesystem configuration before the microsandbox deployment. Selecting the filesystem does not alter existing generations or allocations; the next sandbox update derives the receipt. A filesystem selection must support the provider's declared requirements. An existing deployment requires the same `attachment` and `user_xattr`; the selection may change `capacity_quota`, after which new workspaces are refused until a sandbox update sets a matching `environment_disk_mib`. Existing workspaces keep the capacity they were admitted with.
 
-### Runtime release
+### Compute profiles
 
-Docker and microsandbox use every field of one verified distribution:
+A direct-mode deployment can configure up to eight additional choices in the same POST or PUT selection. Names match `^[a-z][a-z0-9-]{0,47}$`. Each value contains exactly `resources` and `configuration`; CPU and memory are explicit. The choice shares the deployment’s provider, Runtime and credential, and cannot select another credential endpoint. Node-mode deployments reject nonempty choices. Every choice is normalized and its immutable build validated before the deployment mutation commits; an unsupported or invalid choice rejects the whole update.
 
-| Field | Identity |
-| --- | --- |
-| `source_commit` | Lowercase 40-character commit SHA |
-| `image_id` | Docker image configuration ID: `sha256:` and 64 lowercase hex characters |
-| `image_manifest_digest` | OCI image manifest digest, in the same form |
-| `microsandbox_ref` | `oac-runtime@sha256:` and 64 lowercase hex characters |
-| `runtime_sha256` | SHA-256 of the native microsandbox runtime binary |
-| `firmware_sha256` | SHA-256 of the matching firmware |
+```json
+{"compute_profiles":{"memory-8g":{"resources":{"cpus":4,"memory_mib":8192},"configuration":{"template":"template-id:build-uuid"}}}}
+```
+
+Supply this field alongside the existing complete deployment selection and `expected_generation`. The example is a fragment: use a real ready immutable build whose measured resources equal the requested resources. There is no automatic fallback from 4 CPUs to 2 CPUs. The default `resources` and `configuration` remain independent of these choices. Removing a choice blocks new selection by name; existing Sessions retain their frozen choice. GET returns each choice’s generation, specification, safe configuration and metadata, never credentials.
+
+The deployment stores only name-to-generation references. Each choice’s configuration lives in one immutable generation record. The default selection advances beyond those reserved generations, so generation numbers may skip. Collection retains active choices and live Sessions that selected them even before compute exists. Credential rotation continues using the current deployment credential across retained generations. Reset clears the choice map through the existing hosted-resource reset workflow.
+
+Migration `000004_session_compute_profiles.sql` adds the deployment reference map and Session binding table with empty defaults. It needs no manual data backfill and does not change existing default resources. Apply the normal migration before configuring choices.
 
-Copy these identities from the matching distribution manifest. An image configuration ID and an OCI manifest digest identify different objects and never substitute for each other. The node installer verifies the saved release against its payload before registration and keeps the exact local image identity it imports.
 
 ### E2B configuration
 
@@ -101,9 +95,9 @@ GET and successful writes return `installation_id`, `provider`, `core_url` (read
 - Request `resources` and response `specification.resources` are per-sandbox limits. Response `resources.allocations` and `resources.pending` count unreleased allocations and pending hosted Environments without an allocation.
 - An unconfigured deployment has an empty provider and no specification. Docker and microsandbox use `mode: nodes`; E2B uses `mode: direct`, without a synthetic node.
 - `generation` identifies the saved selection. `owner_epoch` fences the execution owner and node connections; it does not replace `expected_generation`.
-- `specification_digest` is the server's identity of the provider, limits, Runtime release and derived workspace capability receipt; enrollment echoes it unchanged.
+- `specification_digest` is the server's identity of the provider, limits and derived workspace capability receipt; enrollment echoes it unchanged.
 
-The typed `SandboxAdminClient` in `packages/agents-client` checks the deployment, node list, node detail and allocation responses against exactly these shapes. An unknown or missing member, or a wrong type, rejects the whole response with a 502 `invalid_admin_response` error. A node's `diagnostic` is absent or a code, never empty, and the client reads an unknown code as `provider_unavailable`.
+The typed `SandboxAdminClient` in `packages/agents-client` checks the deployment, node list, node detail and allocation responses against exactly these shapes. An unknown or missing member, or a wrong type, rejects the whole response with a 502 `invalid_admin_response` error. A node's `rollout.diagnostic` is absent or a code, never empty, and the client reads an unknown code as `provider_unavailable`.
 
 ## Initial setup and same-provider changes
 
@@ -129,6 +123,12 @@ No provider text or credential is returned. The write and its `change` or `repla
 
 Credential verification failures emit a structured `sandbox credential verification failed` log with fixed `phase` and `error_class` values, numeric `generation`, and `refs_count`. The phases distinguish loading the current selection, checking the committed ownership anchor, checking the candidate key against the current selection, checking the candidate selection, reading retained generations, checking a retained generation, reading allocations, and checking allocation references. Generation is zero when a read has not selected a generation; the candidate selection reports its supplied generation, not a newly committed one. Logs contain no provider error text, configuration, template, endpoint or credential.
 
+## Suspension policy
+
+`PATCH /core/v1/sandbox/deployment` accepts `{"idle_seconds": 300}`. `idle_seconds` is a required integer from 30 to 86400 seconds, defaulting to 300, stored in Core's database. Only configured Providers declaring suspension support accept this change; unconfigured, unsupported or resetting deployments reject it. Success returns the deployment view with the saved `suspension.idle_seconds`.
+
+Changes apply to existing and new running allocations on the next lifecycle pass, without a Core restart, generation change or node rollout. Suspension already in progress is not cancelled; existing snapshots and the 24-hour retention period are unchanged. [Capacity-pressure reclamation](../../docs/sandbox-provider.md#suspension) can still suspend an idle allocation earlier and, when retained slots are full, [end an eligible checkpoint's retention early](../../docs/sandbox-provider.md#cold-replacement-after-checkpoint-retention). Web manages this deployment-wide policy in **Settings** → **Sandbox and scheduling** → **Automatic suspension**; each node's capacity limits stay node-owned and are edited on **Nodes** with **Edit node**.
+
 ## Generation ownership and rollout
 
 `runtime_deployment` holds the current specification. Superseded rows keep only immutable specification, build and endpoint metadata, never another E2B key. An E2B allocation binds its generation at reservation; a node placement binds when the scheduler reserves compatible capacity, and its allocation copies that generation, even across later updates. Inspection, renewal, commands and cleanup use the allocation's original specification and endpoint with the current key; a missing generation never falls back to the current specification. Released generation identifiers stay reserved.
@@ -141,15 +141,24 @@ Every deployment response includes `rollout`:
 "rollout": {"state": "settled", "previous_generation_sandboxes": 3, "nodes": null}
 ```
 
-`previous_generation_sandboxes` counts, from the same snapshot as the resource totals, unreleased allocations and allocation-less pending placements of older generations, never one resource twice. E2B and unconfigured deployments return null `nodes`. A node deployment returns `nodes` as counts `{ready, preparing, failed, update_required, unknown}`, and every node that is not removed falls in exactly one bucket:
+`previous_generation_sandboxes` counts, from the same snapshot as the resource totals, unreleased allocations and allocation-less pending placements of older generations, never one resource twice. E2B and unconfigured deployments return null `nodes`. A node deployment returns `nodes` as counts `{ready, preparing, failed, unknown}`, and every node that is not removed falls in exactly one bucket:
 
 - a node that is offline on its current connection is `unknown`;
-- an online node without generation management that enrolled at an older target is `update_required`;
 - otherwise the exact target observation on the current connection and owner epoch gives `ready`, `preparing` or `failed`, and a missing observation gives `unknown`.
 
-A node is online while it is connected under the current owner epoch with a heartbeat in the last 45 seconds. Target rollout is independent of serving readiness: `unknown`, `preparing`, `failed` or `update_required` does not remove an independently confirmed older serving generation. `provider_ready` requires online presence and an exact observation of the serving generation on that connection and epoch; a node without generation management qualifies only its enrolled generation. Pins alone never imply readiness.
+```mermaid
+flowchart TD
+    A{"Online on its current connection?"} -- no --> U["unknown"]
+    A -- yes --> C{"Target observation on this connection and epoch"}
+    C -- ready --> R["ready"]
+    C -- preparing --> P["preparing"]
+    C -- failed --> F["failed"]
+    C -- missing --> U
+```
+
+A node is [online](./node-generation-protocol.md#connection) when it is connected under the current owner epoch with a fresh heartbeat. Target rollout is independent of serving readiness: `unknown`, `preparing` or `failed` does not remove an independently confirmed older serving generation. `provider_ready` requires online presence and an exact observation of the serving generation on that connection and epoch. Pins alone never imply readiness.
 
-Each node adds `rollout: {state, ready_generation, diagnostic?}`, where `ready_generation` is the nullable durable serving pin and `diagnostic` a fixed code for the target generation; allocation items add `deployment_generation`. Poll every five seconds only while `rollout.state` is `preparing` or `reset` is not null; old Sessions and failed, update-required or offline nodes alone do not keep polling active.
+Each node adds `rollout: {state, ready_generation, diagnostic?}`, where `ready_generation` is the nullable durable serving pin and `diagnostic` a fixed code for the target generation; allocation items add `deployment_generation`. Poll every five seconds only while `rollout.state` is `preparing` or `reset` is not null; old Sessions and failed or offline nodes alone do not keep polling active.
 
 Node-backed creation validates the target deployment and commits the Session, pending Environment and any initial input without reserving compute. A full, offline or preparing fleet leaves that accepted work waiting; an unconfigured deployment, reset or unsupported combination still rejects admission. The common scheduler uses bounded rotating scans of unplaced demand, with pages ordered by recorded time and Environment ID and a fixed time boundary for each scan so continuous arrivals cannot prevent it from revisiting older work. It checks online presence, exact serving-generation readiness, address, shared capacity and the selected generation's Harness/filesystem compatibility, then prefers the newest qualifying pin. Placement is immutable once reserved until confirmed release or a settled checkpoint transfer. A bounded scan skips temporarily unavailable demand and resumes after a restart. If preparation fails before a new allocation is reserved, Core releases only that attempt’s node reservation, retaining any filesystem identity. Its next placement demand is ordered no earlier than release time, behind already-waiting work; successful retries use the newly selected generation’s specification. An allocation with an unknown compute outcome keeps its reservation. Existing suspended allocations reserve eligible checkpoint capacity through the same lock under the [checkpoint transfer contract](../../docs/sandbox-provider.md#checkpoint-transfer); this is not a global fairness guarantee across hot restores and unplaced work. Input retains its [original five-minute deadline](./environments.md#reservations), including time waiting for capacity.
 
@@ -163,6 +172,19 @@ To change backend, start a reset:
 
 `clear` is required: `auto` or `force`. `deadline_seconds` applies to `auto`, defaults to 3600 and accepts 300 to 86400; `force` must omit it. Core persists an absolute deadline and the requester's audit provenance before it closes fresh hosted admission, and the execution owner advances the clear after the request ends and across restarts. `auto` archives idle hosted Sessions, including queued or pending work and suspended sandboxes, and waits for root and Subagent Turns that are in progress or waiting and for pending file writes, rechecking under the Session lock. At the persisted deadline it escalates to `force` durably. `force` uses the ordinary archive cancellation and cleanup path for every eligible hosted Session. Self-hosted Sessions are never touched.
 
+```mermaid
+stateDiagram-v2
+    direction LR
+    [*] --> inactive
+    inactive --> auto: POST auto
+    inactive --> force: POST force
+    auto --> force: deadline or POST force
+    auto --> inactive: DELETE
+    force --> inactive: DELETE
+    auto --> unconfigured: no held resources
+    force --> unconfigured: no held resources
+```
+
 Starting again at the same generation and mode keeps the original deadline. `auto` can escalate to `force`, never the reverse. DELETE with the current `expected_generation` cancels the remaining work and reopens admission; it does not undo archives, revive expired Environments or cancel cleanup already requested. DELETE without an active reset is a no-op, and a stale request returns 409.
 
 `reset` is null when inactive, otherwise:
@@ -174,7 +196,7 @@ Starting again at the same generation and mode keeps the original deadline. `aut
                "offline_nodes": [{"node_id": "node-uuid", "name": "worker", "resources": 2}]}}
 ```
 
-One database snapshot partitions every unreleased allocation and every pending hosted Environment without an allocation into `cleanup` first, then `busy` or `idle`, so `busy + idle + cleanup == resources.allocations + resources.pending`. Deleted or expired Sessions with unreleased receipts count as cleanup. `offline_nodes` is the complete, ID-sorted list of offline nodes that hold resources by allocation or active placement, and its sum equals `on_offline_nodes`; presence uses the current owner epoch, connection and a heartbeat within 45 seconds, not provider readiness. Direct E2B resources have no node. Offline resources stay blockers until cleanup confirms their release.
+One database snapshot partitions every unreleased allocation and every pending hosted Environment without an allocation into `cleanup` first, then `busy` or `idle`, so `busy + idle + cleanup == resources.allocations + resources.pending`. Deleted or expired Sessions with unreleased receipts count as cleanup. `offline_nodes` is the complete, ID-sorted list of offline nodes that hold resources by allocation or active placement, and its sum equals `on_offline_nodes`; presence is the [online](./node-generation-protocol.md#connection) test, not provider readiness. Direct E2B resources have no node. Offline resources stay blockers until cleanup confirms their release.
 
 When both held counts reach zero, the owner drains and atomically clears the provider, mode, specification, provider configuration, credential and metadata and provider policy, retires nodes and unused enrollment tokens, increments the generation and owner epoch, and records `reset_complete`. The installation identity and history remain. Core immediately publishes the unconfigured state and keeps the new generation even with no provider, so a delayed load cannot revive the old one. Configure again with POST and the returned generation; no restart is needed.
 
@@ -186,29 +208,37 @@ One mutation gate serializes setup, PUT, reset, cancellation and finalization. A
 
 ## Nodes and allocations
 
-Node capacity is approved by the administrator, separately from the deployment specification. `POST /core/v1/sandbox/enrollment-tokens` accepts optional `max_active` and `max_retained`, default 2 and 8, and returns `{token, expires_at, enrollment_id}`; `enrollment_id` is a public handle of that command, never a credential. microsandbox uses both limits. Docker never suspends, so Core replaces its `max_retained` with `max_active`, here and in PATCH. E2B has no nodes and answers 409 `sandbox_deployment_conflict`. Core stores the approval with the token and copies it to the node it registers; a node cannot submit capacity, and its local checks may refuse a deployment it cannot run but never raise the limits. [Node capacity](../../docs/configuration.md#node-capacity) explains the limits for operators.
+Node capacity is set separately from the deployment specification. `POST /core/v1/sandbox/enrollment-tokens` accepts optional `max_active` and `max_retained` and returns `{token, expires_at, enrollment_id}`; `enrollment_id` is a public handle of that command, never a credential. Core stores the token with the limits as sent, and an omitted limit stays unset. When the node enrolls, Core copies each explicit limit to it unchanged and sets each unset limit to the [recommended capacity](#recommended-capacity) of the host measurements in the enrollment request and the current specification; an unset limit with no host measurements fails with 409 `sandbox_node_host_unmeasured` and leaves the token unused. When only `max_retained` is set, the derived `max_active` never exceeds it; when only `max_active` is set, the derived `max_retained` is raised to at least `max_active`. microsandbox uses both limits. Docker never suspends, so Core replaces its `max_retained` with `max_active`, here and in PATCH. E2B has no nodes and answers 409 `sandbox_deployment_conflict`. A node cannot submit limits, but an unset limit follows the host measurements the node reports at enrollment, bounded by 1 and 1000000. Its local checks may refuse a deployment it cannot run but never raise the limits. Explicit values and later PATCH edits bind: once a node is enrolled, Core derives nothing again. [Node capacity](../../docs/configuration.md#node-capacity) explains the limits for operators.
 
-`GET /core/v1/sandbox/nodes` returns `{data: [...]}` with, for each node: `id`, `name`, `provider`, `online`, `last_seen_at`, `created_at`, `max_active`, `max_retained`, the counts `active`, `reserved`, `running`, `retained`, `snapshots` and `cleanup_pending`, `provider_ready`, `diagnostic`, the host measurements `cpu_count`, `available_memory_bytes` and `available_disk_bytes`, `rollout`, `enrollment_id` and `core_url`. `enrollment_id` is the handle of the command that registered the node, or null when Core has none. `core_url` is the installation public URL at enrollment; a node whose `core_url` differs from the current public URL receives no new placements. Work already placed on it finishes there, including a placed Environment that has no allocation yet, and its retained sandboxes can still resume while the old address reaches Core. Remove it and add it again.
+`GET /core/v1/sandbox/nodes` returns `{data: [...]}` with, for each node: `id`, `name`, `provider`, `online`, `last_seen_at`, `created_at`, `max_active`, `max_retained`, the counts `active`, `reserved`, `running`, `retained`, `snapshots` and `cleanup_pending`, `provider_ready`, the host measurements `cpu_count`, `available_memory_bytes` and `available_disk_bytes`, `rollout`, `recommended_capacity`, `enrollment_id` and `core_url`. `recommended_capacity` is `{max_active, max_retained}`, the [recommended capacity](#recommended-capacity) of the node's latest health and the current specification, or null until the node has reported a CPU count or effective cores and its total memory, and while the current specification does not validate. `enrollment_id` is the handle of the command that registered the node, or null when Core has none. `core_url` is the installation public URL at enrollment; a node whose `core_url` differs from the current public URL receives no new placements. Work already placed on it finishes there, including a placed Environment that has no allocation yet, and its retained sandboxes can still resume while the old address reaches Core. Remove it and add it again.
 
-A node without generation management reports its provider's readiness itself: `provider_ready`, and when it is unready one fixed `diagnostic` code. A node added with Web's command manages generations, so its readiness follows its serving generation and its fixed code for the target generation appears in `rollout.diagnostic`. The node classifies the first failed readiness check and sends only its code; a frame with any other value is invalid, and Core never stores or returns probe text or host paths. The codes are Provider-neutral classes: `provider_unavailable`, `host_unsupported`, `artifacts_unavailable`, `runtime_download_failed`, `runtime_image_unavailable` and `capacity_insufficient`. `runtime_download_failed` means the exact Runtime artifacts could not be transferred or verified; it never contains artifact URLs, credentials or transport output. [Readiness codes](../../docs/getting-started/nodes.md#readiness-codes) gives causes and operator actions. Core and nodes must come from the same distribution.
+A node manages generations, so its `provider_ready` follows its serving generation and its fixed code for the target generation appears in `rollout.diagnostic`. The node classifies the first failed readiness check and sends only its code; a frame with any other value is invalid, and Core never stores or returns probe text or host paths. The codes are Provider-neutral classes: `provider_unavailable`, `host_unsupported`, `artifacts_unavailable`, `runtime_image_unavailable` and `capacity_insufficient`. [Readiness codes](../../docs/getting-started/nodes.md#readiness-codes) gives causes and operator actions. Core and nodes must come from the same distribution.
 
 `PATCH /core/v1/sandbox/nodes/{node_id}` takes `{name, max_active, max_retained}`; lowering a limit stops no running sandbox. `DELETE /core/v1/sandbox/nodes/{node_id}` refuses with 409 `runtime_node_in_use` while the node holds allocations, snapshots, reservations or pending cleanup, including while it is offline. Removal deletes no compute and retires the node's identity; the host can come back only as a new node. There is no node drain.
 
 `GET /core/v1/sandbox/nodes/{node_id}/allocations` lists the node's unreleased allocations. Each item's `compute_phase_changed_at` is when the allocation entered its current `compute_phase`, or null when unknown. This is a phase transition time, not a snapshot expiry. The snapshot deadline is not exposed by this response and must not be inferred from `suspension.retention_seconds`.
 
+### Recommended capacity
+
+Core derives the recommendation from the node's host and the size of one sandbox, in one rule. `cpus` is `effective_cpu_cores` when the node reports it, otherwise `cpu_count`.
+
+- `max_active` is the smaller of `floor(2 × cpus / specification cpus)` and `floor((total_memory − 2 GiB) / specification memory)`, at least 1 and at most 1000000. CPU is committed at twice the cores because agent sandboxes mostly wait on the model. Memory is never overcommitted, and 2 GiB stays for the host and the node service.
+- `max_retained` is `max_active` for a provider without checkpoint support. Otherwise it is the larger of `max_active` and `floor(available_disk / 2 / root_disk)`, at most 1000000: suspended sandboxes keep their root disk checkpoints on the node, and half the free disk is for them.
+
+The recommendation is absent unless the host reports a CPU count or effective cores and its total memory. Core applies it only when an enrollment token leaves a limit unset; Web shows it on **Edit node** and never applies it on its own.
+
 ## What each field means per sandbox provider
 
 Some fields keep one name across providers but differ in meaning, or do not apply. Deployment fields come from `GET /core/v1/sandbox/deployment`, node and allocation fields from the node routes, and Runtime fields from the [Runtime telemetry API](./runtime-observability-api.md), where `disk` appears only in the observation list and history is described under [Session Runtime history](./runtime-observability-api.md#session-runtime-history).
 
 | Field | microsandbox | E2B | Docker |
 | --- | --- | --- | --- |
-| Independent workspace filesystem | [Kernel NFS adapter](../../docs/workspace-provider.md#kernel-nfs-adapter); configured separately from compute | Unsupported | Unsupported |
-| Deployment `specification.resources` | `cpus`, `memory_mib`, `root_disk_mib` and `environment_disk_mib` | `cpus` and `memory_mib`, equal to the ready template build's and taken from it when omitted; no disk fields | `cpus` and `memory_mib`; no disk quota |
-| Deployment `specification.runtime` | The full [release](#runtime-release); nodes match `microsandbox_ref`, `runtime_sha256` and `firmware_sha256` | Absent; `configuration.template` selects the build | The full [release](#runtime-release); nodes match `image_id` or `image_manifest_digest` |
+| Independent workspace filesystem | Required: [Kernel NFS adapter](../../docs/workspace-provider.md#kernel-nfs-adapter), configured separately from compute | Unsupported | Unsupported |
+| Deployment `specification.resources` | `cpus`, `memory_mib`, `root_disk_mib` and, as a quota request, `environment_disk_mib` | `cpus` and `memory_mib`, equal to the ready template build's and taken from it when omitted; no disk fields | `cpus` and `memory_mib`; no disk quota |
 | Deployment `metadata.template_build` | Absent: `metadata` is empty | The build as Core read it when the selection was saved | Absent: `metadata` is empty |
 | Deployment `suspension` | `{idle_seconds, retention_seconds}` | `{idle_seconds, retention_seconds}` | `null` |
 | Deployment `resources.allocations`, `resources.pending` | Totals across all nodes | Core's unreleased E2B sandboxes, and hosted Environments waiting for one | Totals across all nodes |
-| Enrollment-token `max_active`, `max_retained` | Both limits apply | 409 `sandbox_deployment_conflict`, after the 400 capacity checks; E2B has no nodes | `max_retained` always equals `max_active` |
+| Enrollment-token `max_active`, `max_retained` | Both limits apply; an omitted limit is derived at enrollment | 409 `sandbox_deployment_conflict`, after the 400 capacity checks; E2B has no nodes | `max_retained` always equals `max_active` |
 | Node list and detail | Enrolled nodes | Empty list; detail returns 404 | Enrolled nodes |
 | Node `retained`, `snapshots`, `max_retained` | Suspended sandboxes are `retained` minus `active`; `snapshots` also includes retained snapshots during restore or cleanup | Not applicable | Docker never suspends: `retained` equals `active`, `snapshots` is 0 and `max_retained` equals `max_active` |
 | Node `host.available_disk_bytes` | Free space on the filesystem of the node state directory; sandbox disks have their own quotas | Not applicable | Free space on the filesystem of the node state directory, not a container's disk |
@@ -224,6 +254,7 @@ Some fields keep one name across providers but differ in meaning, or do not appl
 | --- | --- | --- |
 | 400 | `invalid_request_error` or `invalid_request` | A malformed request |
 | 400 | `invalid_sandbox_configuration` | A validated configuration diagnostic |
+| 409 | `workspace_storage_required` | The provider runs every Environment on workspace storage and none is selected |
 | 409 | `sandbox_generation_stale` | `expected_generation` is not current; `current_generation` gives the current one |
 | 409 | `sandbox_reset_required` | A different backend; the details name the current and requested providers |
 | 409 | `sandbox_not_configured` | A change to an unconfigured deployment |
@@ -236,6 +267,6 @@ Storage and credential failures stay errors: an empty or failed read never prove
 
 ## Canonical node specification
 
-`sandbox/deployment_contract.go` owns the resource bounds, release patterns and canonical field order, and each registered Provider's `sandbox.DeploymentPolicy` declares its requirements; `sandbox/deployment.go` applies them in Core. The installer consumes the generated declaration in `deploy/node/node_spec.py`, and the TypeScript client and Web the generated bounds, patterns and Provider declarations in `packages/agents-client/src/deployment-contract.ts`, so there is no second set of limits, patterns or providers. Regenerate both from the repository root with `go run ./services/core/cmd/specification-contract -write`; the sandbox Go tests, part of `make check`, reject a stale projection.
+`sandbox/deployment_contract.go` owns the resource bounds and canonical field order, and each registered Provider's `sandbox.DeploymentPolicy` declares its requirements; `sandbox/deployment.go` applies them in Core. The installer consumes the generated declaration in `deploy/node/node_spec.py`, and the TypeScript client and Web the generated bounds and Provider declarations in `packages/agents-client/src/deployment-contract.ts`, so there is no second set of limits or providers. Regenerate both from the repository root with `go run ./services/core/cmd/specification-contract -write`; the sandbox Go tests, part of `make check`, reject a stale projection.
 
-The specification digest is the SHA-256 of compact UTF-8 JSON with `provider` first, then `resources`, then `runtime` when the provider requires it, then `workspace` when external storage is selected. Workspace fields follow the filesystem declaration order (`attachment`, `user_xattr`, `capacity_quota`); its Boolean fields remain present. Resource and Runtime fields follow the contract's declaration order; zero optional disk fields are omitted and required fields stay present. Release identities are lowercase ASCII, and the digest never depends on the incoming field order or whitespace. `services/core/internal/sandbox/testdata/deployment-contract.json` holds shared acceptance cases, exact canonical bytes and digests that both the Go and Python tests consume.
+The specification digest is the SHA-256 of compact UTF-8 JSON with `provider` first, then `resources`, then `workspace` when external storage is selected. Workspace fields follow the filesystem declaration order (`attachment`, `user_xattr`, `capacity_quota`); its Boolean fields remain present. Resource fields follow the contract's declaration order; zero optional disk fields are omitted and required fields stay present. The digest never depends on the incoming field order or whitespace. `services/core/internal/sandbox/testdata/deployment-contract.json` holds shared acceptance cases, exact canonical bytes and digests that both the Go and Python tests consume.
diff --git a/contracts/agents-api/session-diagnostics.md b/contracts/agents-api/session-diagnostics.md
index 9885af5eb..d345e0380 100644
--- a/contracts/agents-api/session-diagnostics.md
+++ b/contracts/agents-api/session-diagnostics.md
@@ -1,7 +1,9 @@
 ---
-title: "Root Session and Turn diagnostics"
+title: "Session diagnostics"
 ---
 
+Administrators read why a Session or Turn failed through two Core-key routes that report failure categories and Item receipt timing.
+
 These read-only routes require the Core key. The Project ID selects the target Project and does not authenticate. Both return `Cache-Control: no-store`:
 
 - `GET /core/v1/projects/{project_id}/sessions/{session_id}/diagnostics`
diff --git a/contracts/agents-api/sessions-events.md b/contracts/agents-api/sessions-events.md
index e5fdfef37..f287b8f15 100644
--- a/contracts/agents-api/sessions-events.md
+++ b/contracts/agents-api/sessions-events.md
@@ -2,7 +2,7 @@
 title: "Sessions, events and history"
 ---
 
-This contract covers what happens inside a Session: sending input, the live event stream, and reading the durable history of Turns, Items and usage. The Session resource itself (creation configuration, retry identity, update, list and deletion) is in [Core wire behavior](./wire-semantics.md). Message and function-result content is in [message content](./message-content.md). The [Agents API guide](../../docs/api/public-agent-api.md) shows the calls with the SDK and HTTP.
+This contract covers what happens inside a Session: sending input, the live event stream, and reading the durable history of Turns, Items and usage. The Session resource itself (creation configuration, retry identity, update, list and deletion) is in [API behavior](./wire-semantics.md). Message and function-result content is in [message content](./message-content.md). The [Agents API guide](../../docs/api/public-agent-api.md) shows the calls with the SDK and HTTP.
 
 ## Recovery model
 
@@ -25,6 +25,20 @@ A Session's `status` and `last_active_at` derive from its latest root Turn and f
 | `requires_action` | The latest Turn waits for a function result and no cancellation was requested, or input waits for a `self_hosted` machine to connect. `required_actions` lists `function_call` or `environment_connection` entries |
 | `failed` | The latest Turn failed (`error` is "The execution could not complete."), input reserved for the Environment failed, initial input expired before admission, or the Environment failed to initialize (see [Environment initialization failure](#environment-initialization-failure)) |
 
+```mermaid
+stateDiagram-v2
+    [*] --> idle
+    idle --> in_progress: Turn queued
+    in_progress --> idle: completed or cancelled
+    in_progress --> requires_action: awaits function result
+    idle --> requires_action: awaits self_hosted machine
+    requires_action --> in_progress: result or machine
+    requires_action --> idle: cancelled
+    in_progress --> failed: Turn failed
+    idle --> failed: input expired or Environment failed
+    failed --> in_progress: new input
+```
+
 A Session stays usable after a Turn fails: new input starts a new Turn. Later reserved input that expires leaves the Session idle. An Environment initialization failure or expiry prevents new work.
 
 ## Send input
@@ -64,9 +78,7 @@ A typed `absent` response on an authorized Session also confirms that the deploy
 
 ### Sessions with an Environment
 
-On `openai_hosted` and `self_hosted` Sessions, messages sent while a Turn runs join it at once. Messages sent to an idle Session reserve the batch for the Environment: the request waits until a Turn starts, for at most five minutes from the reservation. While the reservation waits for a `self_hosted` machine, the Session reads `requires_action` with an `environment_connection` action. A batch that carries messages on these placements may contain only messages. Cancellation-only and result-only batches are admitted at once and create no Turn.
-
-The waiting request ends with 202 when the Turn starts, or with 409 `environment_input_expired` when the deadline passes, 409 `environment_input_cancelled` when an administrator archives the Session or resets its deployment and cancels the reservation, or 409 `environment_unavailable` when the Environment fails or expires. Disconnecting the waiting request does not cancel the reservation or restart its deadline.
+On `openai_hosted` and `self_hosted` Sessions, messages sent while a Turn runs join it at once. Messages sent to an idle Session reserve the batch for the Environment: the request waits until a Turn starts, for at most five minutes from the reservation, and ends with 202 when the Turn starts or with one of the [input errors](#input-errors). While the reservation waits for a `self_hosted` machine, the Session reads `requires_action` with an `environment_connection` action. A batch that carries messages on these placements may contain only messages. Cancellation-only and result-only batches are admitted at once and create no Turn. Disconnecting the waiting request does not cancel the reservation or restart its deadline.
 
 ### Input errors
 
@@ -81,9 +93,11 @@ Checks run in this order: request validation, Session lookup, retry lookup, the
 | A result whose `call_id` names no function call of this Session | 400 `invalid_request_error`, param null | "Unknown pending tool call." |
 | A result for a call of this Session whose `turn_id` names another Turn, an unknown Turn ID or a value that is not a Turn ID | 400 `invalid_request_error`, param null | "The tool call belongs to a different Turn." |
 | A missing, malformed or foreign Session | 404 `not_found_error` | "Resource not found." |
+| A reserved batch whose five-minute deadline passed before a Turn started | 409 `environment_input_expired` | "The environment input deadline elapsed before admission." |
+| A reserved batch cancelled because an administrator archived the Session or reset its deployment | 409 `environment_input_cancelled` | "The environment input was cancelled before admission." |
 | New input after an `openai_hosted` Environment failed to provision | 409 `conflict_error` | "the hosted environment failed to provision" |
 | New input after a `self_hosted` Environment failed, input already waiting when the Environment failed, or an expired Environment | 409 `environment_unavailable` | "The environment is no longer available for new input." |
-| A message the Session's Harness cannot take, such as whitespace-only text on Claude Code | 400 `unsupported_or_invalid_configuration` | See [whitespace-only text](./message-content.md#whitespace-only-text) |
+| A message the Session's Harness cannot take, such as whitespace-only text on MiniMax Code | 400 `unsupported_or_invalid_configuration` | See [whitespace-only text](./message-content.md#whitespace-only-text) |
 
 An empty `turn_id` or blank `call_id` is the generic 400 `invalid_request`. Error messages never repeat caller input or internal identifiers.
 
@@ -126,6 +140,7 @@ A retry with the same `Idempotency-Key` and `stream: true` returns 201 with only
 - `item.added` and `item.done` always carry `output_index`, null for input Items. Function results emit `item.added` only; `item.done` is for agent output.
 - An assistant message follows one sequence: `item.added` in progress with empty `content`, `content_part.added` with empty text, `output_text.delta` events, `output_text.done`, `content_part.done` and `item.done`. A message first observed complete, such as structured output, sends its whole text in one `output_text.delta`, byte for byte. The completed text replaces the accumulated deltas.
 - Codex command output streams as `agent.output.command_execution_output.delta` with the command's Item ID and output index. Native output quotas and text conversion apply, so the deltas are not a byte-exact capture; the completed Item is authoritative.
+- A reasoning Item follows one sequence: `item.added` in progress with an empty `summary`; for each `summary_text` part in order, `reasoning_summary_part.added` with empty text, `reasoning_summary_text.delta` events, then `reasoning_summary_text.done` and `reasoning_summary_part.done` once the next part starts or the Item ends; then `item.done`. `reasoning_summary_part.done` has `status` `incomplete` for a part a cancelled or failed Turn cut off, otherwise null. A child Turn snapshot that rewrites earlier text reports it only in the done events.
 - A cancelled or failed Turn marks its unfinished Items `incomplete` and keeps their partial content.
 - A function call stays in `required_actions` until the Harness applies its result, or cancellation or the Turn's end removes it. A repeated notification emits no new state.
 
@@ -143,11 +158,14 @@ Turn and Item lists take `after`, `limit` and `order` ([list rules](./wire-seman
 | `command_execution` | Command, reported output, exit code, duration and working directory |
 | `mcp_call` | Server and tool identity, arguments, structured result or error |
 | `function_call`, `function_call_output` | A linked call and its result. The result always carries `output` and `error`, null when the submission omitted them; stored results keep the submitted field presence. Native file changes appear as an `apply_patch` function call with the changes as arguments and no invented result |
-| `web_search_call` | The supported action fields (`search`, `open_page`, `find_in_page`, `other`) |
-| `reasoning`, `agent_message` and the Subagent coordination calls | See [Subagents](./subagents.md). `agent_message` has no status; reasoning status can be null |
+| `web_search_call` | The supported action fields (`search`, `open_page`, `find_in_page`, `other`); Claude Code reports `search` for `WebSearch` and `open_page` for `WebFetch` |
+| `reasoning` | One native reasoning item, each native part one `summary_text` part, present only when the Agent sets `reasoning.summary`; with it null (the default) no `reasoning` Items or reasoning events appear for any Turn, root or child. [OpenAI compatibility](./index.md#differences-from-openai) describes the text. Status can be null on a child Turn's Item |
+| `agent_message` and the Subagent coordination calls | See [Subagents](./subagents.md). `agent_message` has no status |
 
 A failed tool does not fail its Turn. Tool output is readable by the Session's Project and can contain the tool's own diagnostic text.
 
+PostgreSQL cannot store U+0000, so Harness output that contains it, such as a command's output, is stored, streamed and listed with U+FFFD in its place, and the Turn continues.
+
 ## Usage
 
 Turn and Session `usage` uses the pinned `TokenUsage` fields: input, cached input, output, reasoning output and total tokens. Null means unknown, never zero.
diff --git a/contracts/agents-api/source-files.md b/contracts/agents-api/source-files.md
index 6a3b563f3..4ce6d05e3 100644
--- a/contracts/agents-api/source-files.md
+++ b/contracts/agents-api/source-files.md
@@ -55,8 +55,6 @@ A missing or foreign File returns 404 with type `invalid_request_error`, a null
 
 Core stores File bytes as PostgreSQL large objects in its own database. An upload and a deletion each commit in one transaction, so a failure leaves neither partial bytes nor metadata. [Back up](../../docs/getting-started/operations.md#back-up) the database with its large objects; deleting a File does not remove it from write-ahead logs or earlier backups.
 
-The source Files schema refuses a downgrade while File rows remain. Delete Files through the API first so their large objects are removed.
-
 A copy into a workspace reads a consistent snapshot of the File and can finish after the File is deleted; later lookups fail. Deleting a File never changes a workspace copy.
 
 ## Skills
diff --git a/contracts/agents-api/subagents.md b/contracts/agents-api/subagents.md
index d0a7a39bb..7fb2bd8e4 100644
--- a/contracts/agents-api/subagents.md
+++ b/contracts/agents-api/subagents.md
@@ -50,12 +50,12 @@ An adapter freezes root output before child settlement, keeps its native owner a
 
 ## Native profiles
 
-[Harness capabilities](./harness-capabilities.md#tools) lists rejected tool combinations.
+A Subagent uses the Agent's function and HTTP MCP tools as the Harness would in a local run; [Functions](./execution-tools.md#functions) describes how its calls surface, and [Harness capabilities](./harness-capabilities.md#tools) lists each combination. Codex children inherit the Agent's HTTP MCP servers, and a forked child inherits its functions while a child with fresh history has none. Claude Code children inherit the parent's tools, so they call the Agent's functions as `mcp__functions__<name>` and its HTTP MCP tools natively.
 
-**Codex.** The adapter enables the native `multi_agent` feature with a nesting depth of 64 and maps the concurrency limit to `agents.max_threads`. It disables native hooks, plugins, code mode and `multi_agent_v2`, and refuses to start if the native hook list is not empty or managed requirements force a conflicting feature. Close and reopen facts come from direct tool output correlated with the same call's persisted completion, so they need native persisted receipts. Native Turn times have second precision. Child file work can finish under the same owner after the root Turn finishes. Cancellation continues under the same owner after a caller deadline; a later call can confirm settlement without repeating the native interrupt.
+**Codex.** The adapter enables the native `multi_agent` feature and maps the concurrency limit to `agents.max_threads`; nesting depth and other native features keep their Codex defaults. It refuses to start if managed requirements force code mode or `multi_agent_v2`, whose collaboration calls leave no persisted receipt. Child Items without a neutral Item type, such as image views and context compaction, are not projected. Close and reopen facts come from direct tool output correlated with the same call's persisted completion, so they need native persisted receipts. Native Turn times have second precision. Child file work can finish under the same owner after the root Turn finishes. Cancellation continues under the same owner after a caller deadline; a later call can confirm settlement without repeating the native interrupt.
 
-**Claude SDK.** The pinned SDK's native Agent and SendMessage calls run the single child type `oac_worker`, which inherits the model and has workspace Bash, Agent and SendMessage; the bridge's `subagent_resources` feature gates it. Children use native Bash with the parent's launching-user permissions. Private child records establish parentage, the first own input time and later own Turns; inherited parent context is excluded. The query owner admits children before start and keeps their history through settlement. Confirmed cancellation writes an immutable effect receipt because a native abort can leave no terminal record. There is no close operation: completed or cancelled children stay active. Messages to running children, background work, other child profiles and per-call model overrides are rejected. The [Claude SDK adapter](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/packages/claude-sdk-adapter/README.md#subagents) documents the details.
+**Claude Code.** The pinned SDK's native Agent and SendMessage calls run the native agent types with their native prompts, per-call `model`, `name` and worktree isolation; a child inherits the parent's tools, which on `none` are Agent and SendMessage. The bridge's `subagent_resources` feature gates it. Children use native Bash with the parent's launching-user permissions. Private child records establish parentage, the first own input time and later own Turns; inherited parent context is excluded. The query owner admits children before start and keeps their history through settlement. Before a child's function call, the bridge sends the child's identity and open Turn from its live record, and cancelling the root Turn aborts the child's pending call, which is then withdrawn. Child function calls are `function_call` Items with their `function_call_output`, and MCP calls are `mcp_call` Items. Confirmed cancellation writes an immutable effect receipt because a native abort can leave no terminal record. There is no close operation: completed or cancelled children stay active. A SendMessage `to` is a child ID or the `name` given at spawn. Messages to running children and remote isolation are rejected, and the native setting `CLAUDE_CODE_DISABLE_BACKGROUND_TASKS` removes background work. The [Claude SDK adapter](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/packages/claude-sdk-adapter/README.md#subagents) documents the details.
 
-**MiniMax Code.** Native ACP delegation (`task`, `task_append`, `task_stop`) creates children. Session-private SQLite records supply child identity, accepted inputs, terminal times and own messages. The native task-create transaction enforces the concurrency limit before start, and native preparation must acknowledge that limit and the restricted tool profile before any model input. There is no close or reopen, and native workers do not delegate nested work.
+**MiniMax Code.** Native ACP delegation (`task`, `task_append`, `task_stop`) creates children. Session-private SQLite records supply child identity, accepted inputs, terminal times and own messages. The native task-create transaction enforces the concurrency limit before start, and native preparation must acknowledge that limit and that background Bash is off before any model input. There is no close or reopen, and native workers do not delegate nested work. Children get none of the Session's functions or MCP servers, because native ACP session servers stay with the root session.
 
 Claude and MiniMax publish verified child history at settlement, not as continuous child progress. Root-completion propagation to children, complete child-delta ordering and unbounded background work across root Turns are not established.
diff --git a/contracts/agents-api/v1/events.go b/contracts/agents-api/v1/events.go
index 03205874d..b51d75375 100644
--- a/contracts/agents-api/v1/events.go
+++ b/contracts/agents-api/v1/events.go
@@ -21,8 +21,9 @@ func itemEvent(eventType string) bool {
 
 // MarshalJSON keeps the nullable top-level usage on terminal Turn events only,
 // a nullable output_index on every Item event (EVT-09), a nullable error param
-// on error events and a nullable turn_id on Environment events. Subagent events
-// carry no session_id; their Subagent names the Session.
+// on error events, a nullable status on reasoning summary part completions and
+// a nullable turn_id on Environment events. Subagent events carry no
+// session_id; their Subagent names the Session.
 func (e SessionEvent) MarshalJSON() ([]byte, error) {
 	type wire SessionEvent
 	switch {
@@ -43,6 +44,12 @@ func (e SessionEvent) MarshalJSON() ([]byte, error) {
 			wire
 			OutputIndex *int32 `json:"output_index"`
 		}{wire(e), e.OutputIndex})
+	case e.Type == "agent.session.turn.reasoning_summary_part.done":
+		e.Usage = nil
+		return json.Marshal(struct {
+			wire
+			Status *string `json:"status"`
+		}{wire(e), e.Status})
 	case strings.HasPrefix(e.Type, "agent.session.environment."):
 		e.Usage = nil
 		var turn *string
diff --git a/contracts/agents-api/v1/events_test.go b/contracts/agents-api/v1/events_test.go
index 5ede7e496..fa6508730 100644
--- a/contracts/agents-api/v1/events_test.go
+++ b/contracts/agents-api/v1/events_test.go
@@ -60,6 +60,8 @@ func TestSessionEventWireFields(t *testing.T) {
 		{SessionEvent{Type: "agent.session.environment.failed", EventID: "event", Environment: &SessionEnvironmentState{ID: "environment", Type: "openai_hosted", Status: "failed",
 			Error: &StreamError{Type: "environment_error", Code: "environment_connection_failed", Message: "The environment failed to connect."}}},
 			`{"type":"agent.session.environment.failed","event_id":"event","environment":{"id":"environment","type":"openai_hosted","status":"failed","error":{"code":"environment_connection_failed","type":"environment_error","message":"The environment failed to connect."}},"turn_id":null}`},
+		{SessionEvent{Type: "agent.session.turn.reasoning_summary_part.done", EventID: "event", SessionID: "session", TurnID: "turn", ItemID: "item", OutputIndex: new(int32), SummaryIndex: new(int64), Part: &ItemContent{Type: "summary_text", Text: new(string)}},
+			`{"type":"agent.session.turn.reasoning_summary_part.done","event_id":"event","session_id":"session","turn_id":"turn","item_id":"item","output_index":0,"part":{"type":"summary_text","text":""},"summary_index":0,"status":null}`},
 		{SessionEvent{Type: "agent.session.subagent.closed", EventID: "event", SessionID: "session", Subagent: &Subagent{ID: "subagent", Object: "agent.session.subagent", SessionID: "session", ParentAgentID: "root", Status: "closed"}},
 			`{"subagent":{"id":"subagent","object":"agent.session.subagent","session_id":"session","parent_agent_id":"root","opened_at":0,"closed_at":null,"name":null,"instructions":null,"status":"closed"},"type":"agent.session.subagent.closed","event_id":"event"}`},
 	} {
diff --git a/contracts/agents-api/v1/model_configuration.go b/contracts/agents-api/v1/model_configuration.go
index 001285756..d5c5d5f4c 100644
--- a/contracts/agents-api/v1/model_configuration.go
+++ b/contracts/agents-api/v1/model_configuration.go
@@ -59,7 +59,8 @@ func ValidateNativeModelConfiguration(harness, model string, raw json.RawMessage
 type ModelConfigurationSupport struct {
 	Protocols            []string `json:"protocols" binding:"required"`
 	AcceptsHarnessConfig bool     `json:"accepts_harness_config" binding:"required"`
-	TokenLimitsRequired  bool     `json:"token_limits_required" binding:"required"`
+	// AcceptsMaxOutputTokens reports that the Harness maps max_output_tokens natively.
+	AcceptsMaxOutputTokens bool `json:"accepts_max_output_tokens" binding:"required"`
 }
 
 func (p *ModelProviderInput) ValidateConfiguration(harness string, native json.RawMessage) error {
diff --git a/contracts/agents-api/v1/model_execution.go b/contracts/agents-api/v1/model_execution.go
index 4bc93dd6e..58a8d0e45 100644
--- a/contracts/agents-api/v1/model_execution.go
+++ b/contracts/agents-api/v1/model_execution.go
@@ -20,7 +20,7 @@ func (e *ModelProviderError) Error() string { return e.message }
 
 // SessionExecutionInput is a write-only execution extension, not a provider resource.
 type SessionExecutionInput struct {
-	// Environment supplies placement-independent preparation through the Core extension.
+	// Environment supplies portable preparation fields. For openai_hosted only, compute_profile selects an administrator-approved immutable compute choice; its name must match ^[a-z][a-z0-9-]{0,47}$. Omission retains default compute. Unknown names fail with invalid_request_error and param x_agents_core.environment.compute_profile; no fallback is performed.
 	Environment   json.RawMessage     `json:"environment,omitempty" swaggertype:"object"`
 	ModelProvider *ModelProviderInput `json:"model_provider,omitempty"`
 	HarnessConfig json.RawMessage     `json:"harness_config,omitempty" swaggertype:"object"`
@@ -56,7 +56,7 @@ func (p *ModelProviderInput) validate(registry harnessconfig.Registry) error {
 	if modelprovider.ValidateHeaders(p.Headers) != nil {
 		return &ModelProviderError{Code: "model_provider_headers_invalid", Param: "headers", message: "invalid model provider headers"}
 	}
-	if p.ContextWindow < 0 || p.MaxOutputTokens < 0 || (p.MaxOutputTokens > p.ContextWindow) {
+	if !modelprovider.TokenLimitsValid(p.ContextWindow, p.MaxOutputTokens) {
 		param := "max_output_tokens"
 		if p.ContextWindow < 0 {
 			param = "context_window"
@@ -83,12 +83,8 @@ func (p *ModelProviderInput) ValidateHarnessWithRegistry(harness string, registr
 	if err := configuration.ValidateProtocol(string(p.Protocol)); err != nil {
 		return &ModelProviderError{Code: "model_provider_protocol_unsupported", Param: "protocol", message: err.Error()}
 	}
-	if err := configuration.Validate(string(p.Protocol), p.ContextWindow, p.MaxOutputTokens); err != nil {
-		param := "max_output_tokens"
-		if p.ContextWindow <= 0 {
-			param = "context_window"
-		}
-		return &ModelProviderError{Code: "model_provider_token_limits_invalid", Param: param, message: err.Error()}
+	if err := configuration.ValidateMaxOutputTokens(p.MaxOutputTokens); err != nil {
+		return &ModelProviderError{Code: "model_provider_token_limits_invalid", Param: "max_output_tokens", message: err.Error()}
 	}
 	return nil
 }
diff --git a/contracts/agents-api/v1/model_execution_test.go b/contracts/agents-api/v1/model_execution_test.go
index 8e7bce603..b6ddb0526 100644
--- a/contracts/agents-api/v1/model_execution_test.go
+++ b/contracts/agents-api/v1/model_execution_test.go
@@ -1,6 +1,7 @@
 package v1
 
 import (
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/modelprovider"
@@ -12,11 +13,11 @@ func TestModelExecutionValidation(t *testing.T) {
 			t.Run(harness+"/"+protocol, func(t *testing.T) {
 				p := ModelProviderInput{Protocol: modelprovider.Protocol(protocol), BaseURL: "https://example.com/v1", APIKey: "secret", ContextWindow: 200000, MaxOutputTokens: 8000}
 				native := harness == "mcode" || (harness == "codex" && protocol == "responses") || (harness == "claude_sdk" && protocol == "anthropic")
-				if err := p.ValidateHarness(harness); (err == nil) != native {
+				if err := p.ValidateHarness(harness); (err == nil) != (native && harness != "codex") {
 					t.Fatalf("wrong native protocol admission: %v", err)
 				}
 				p.ContextWindow, p.MaxOutputTokens = 0, 0
-				if err := p.ValidateHarness(harness); (err == nil) != (native && harness != "mcode") {
+				if err := p.ValidateHarness(harness); (err == nil) != native {
 					t.Fatalf("incorrect optional token-limit admission: %v", err)
 				}
 			})
@@ -42,7 +43,29 @@ func TestModelExecutionValidation(t *testing.T) {
 			t.Fatal("valid provider URL rejected", url, err)
 		}
 	}
-	if (&ModelProviderInput{Protocol: "anthropic", BaseURL: "https://example.com", APIKey: "secret"}).ValidateHarness("mcode") == nil {
-		t.Fatal("MiniMax Code accepted unknown model limits")
+}
+
+func TestProviderDeclarationsAgreeWithAdmission(t *testing.T) {
+	for _, kind := range builtin.Kinds() {
+		t.Run(kind, func(t *testing.T) {
+			declared, ok := builtin.Registry().Lookup(kind)
+			if !ok {
+				t.Fatal("registered harness has no declaration")
+			}
+			for _, protocol := range []string{"responses", "anthropic", "unknown"} {
+				_, supported := declared.Provider(protocol)
+				input := ModelProviderInput{Protocol: modelprovider.Protocol(protocol), BaseURL: "https://example.test", APIKey: "private-fixture", ContextWindow: 100, MaxOutputTokens: 20}
+				if (input.ValidateHarness(kind) == nil) != (supported && declared.MaxOutputTokens) {
+					t.Fatalf("protocol %q disagrees with validation", protocol)
+				}
+				if !supported {
+					continue
+				}
+				input.ContextWindow, input.MaxOutputTokens = 0, 0
+				if input.ValidateHarness(kind) != nil {
+					t.Fatalf("provider without token limits rejected for %q", protocol)
+				}
+			}
+		})
 	}
 }
diff --git a/contracts/agents-api/v1/model_provider_error_test.go b/contracts/agents-api/v1/model_provider_error_test.go
index 70c6fa937..3315b7745 100644
--- a/contracts/agents-api/v1/model_provider_error_test.go
+++ b/contracts/agents-api/v1/model_provider_error_test.go
@@ -21,9 +21,8 @@ func TestModelProviderErrorMessagesAndPrecedence(t *testing.T) {
 		{"protocol before key", "codex", "model_provider_protocol_unsupported", "protocol", "unsupported model provider protocol", func(p *ModelProviderInput) { p.Protocol = "private"; p.APIKey = "" }},
 		{"key", "claude_sdk", "model_provider_api_key_invalid", "api_key", "invalid model provider API key", func(p *ModelProviderInput) { p.Protocol = "anthropic"; p.APIKey = "" }},
 		{"context before output", "codex", "model_provider_token_limits_invalid", "context_window", "invalid model token limits", func(p *ModelProviderInput) { p.ContextWindow = -1; p.MaxOutputTokens = -2 }},
-		{"output", "codex", "model_provider_token_limits_invalid", "max_output_tokens", "invalid model token limits", func(p *ModelProviderInput) { p.MaxOutputTokens = 1 }},
-		{"required context", "mcode", "model_provider_token_limits_invalid", "context_window", "selected harness requires positive model context_window and max_output_tokens", func(p *ModelProviderInput) { p.Protocol = "anthropic" }},
-		{"required output", "mcode", "model_provider_token_limits_invalid", "max_output_tokens", "selected harness requires positive model context_window and max_output_tokens", func(p *ModelProviderInput) { p.Protocol = "anthropic"; p.ContextWindow = 10 }},
+		{"output", "codex", "model_provider_token_limits_invalid", "max_output_tokens", "invalid model token limits", func(p *ModelProviderInput) { p.ContextWindow = 1; p.MaxOutputTokens = 2 }},
+		{"no native output limit", "codex", "model_provider_token_limits_invalid", "max_output_tokens", "The selected harness has no native max_output_tokens setting.", func(p *ModelProviderInput) { p.ContextWindow = 10; p.MaxOutputTokens = 1 }},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			p := valid
@@ -40,6 +39,11 @@ func TestModelProviderErrorMessagesAndPrecedence(t *testing.T) {
 	if err := missing.Validate(); !errors.As(err, &field) || field.Code != "invalid_model_provider" || field.Param != "" || err.Error() != "model_provider is required" {
 		t.Fatal(err)
 	}
+	outputOnly := valid
+	outputOnly.MaxOutputTokens = 32000
+	if err := outputOnly.ValidateHarness("mcode"); err != nil {
+		t.Fatal(err) // An omitted context window keeps the native default.
+	}
 	if err := valid.ValidateHarness("codex"); err != nil {
 		t.Fatal(err)
 	}
diff --git a/contracts/agents-api/v1/official.gen.go b/contracts/agents-api/v1/official.gen.go
index d74771d9c..f46878b35 100644
--- a/contracts/agents-api/v1/official.gen.go
+++ b/contracts/agents-api/v1/official.gen.go
@@ -339,9 +339,9 @@ type Item struct {
 	Summary           []SummaryText    `json:"summary,omitempty"`
 }
 
-// ItemContent projects MessageContentResource, EncryptedContentResource.
+// ItemContent projects MessageContentResource, EncryptedContentResource, SummaryTextResource.
 type ItemContent struct {
-	Type             string  `json:"type" binding:"required" enums:"input_text,input_image,output_text,encrypted_content"`
+	Type             string  `json:"type" binding:"required" enums:"input_text,input_image,output_text,encrypted_content,summary_text"`
 	Text             *string `json:"text,omitempty"`
 	ImageURL         string  `json:"image_url,omitempty"`
 	EncryptedContent *string `json:"encrypted_content,omitempty"`
@@ -356,18 +356,11 @@ type ItemList struct {
 	HasMore bool    `json:"has_more" binding:"required"`
 }
 
-// MCPHTTPTransport projects PersistedMcpTransportConfigParamHttp.
-type MCPHTTPTransport struct {
-	Type      string             `json:"type" binding:"required" enums:"http"`
-	ServerURL string             `json:"server_url" binding:"required"`
-	Headers   *map[string]string `json:"headers,omitempty" extensions:"x-nullable"`
-}
-
 // MCPTool projects AgentToolResourceMcp.
 type MCPTool struct {
 	Type             string                     `json:"type" binding:"required" enums:"mcp"`
 	ServerLabel      string                     `json:"server_label" binding:"required"`
-	Transport        MCPHTTPTransport           `json:"transport" binding:"required"`
+	Transport        MCPTransport               `json:"transport" binding:"required"`
 	AllowedTools     *[]string                  `json:"allowed_tools" binding:"required" extensions:"x-nullable"`
 	ConnectionOrigin string                     `json:"connection_origin" binding:"required" enums:"service,environment"`
 	CredentialID     *string                    `json:"credential_id" binding:"required" extensions:"x-nullable"`
@@ -387,6 +380,48 @@ type MCPToolInput struct {
 	ConnectionOrigin *string                    `json:"connection_origin,omitempty" extensions:"x-nullable" enums:"service,environment"`
 }
 
+// MCPTransport projects PersistedMcpTransportConfigParam.
+type MCPTransport struct {
+	Type      string             `json:"type" binding:"required" enums:"http,stdio"`
+	ServerURL string             `json:"server_url,omitempty"`
+	Headers   *map[string]string `json:"headers,omitempty" extensions:"x-nullable"`
+	Command   string             `json:"command,omitempty"`
+	Args      *[]string          `json:"args,omitempty" extensions:"x-nullable"`
+	Cwd       string             `json:"cwd,omitempty"`
+	EnvVars   *[]string          `json:"env_vars,omitempty" extensions:"x-nullable"`
+}
+
+func (value MCPTransport) MarshalJSON() ([]byte, error) {
+	switch value.Type {
+	case "http":
+		return json.Marshal(struct {
+			Type      string             `json:"type"`
+			ServerURL string             `json:"server_url"`
+			Headers   *map[string]string `json:"headers,omitempty"`
+		}{
+			Type:      value.Type,
+			ServerURL: value.ServerURL,
+			Headers:   value.Headers,
+		})
+	case "stdio":
+		return json.Marshal(struct {
+			Type    string    `json:"type"`
+			Command string    `json:"command"`
+			Args    *[]string `json:"args,omitempty"`
+			Cwd     string    `json:"cwd"`
+			EnvVars *[]string `json:"env_vars,omitempty"`
+		}{
+			Type:    value.Type,
+			Command: value.Command,
+			Args:    value.Args,
+			Cwd:     value.Cwd,
+			EnvVars: value.EnvVars,
+		})
+	default:
+		return nil, fmt.Errorf("invalid MCPTransport type %q", value.Type)
+	}
+}
+
 // MultiAgentConfig projects MultiAgentConfigResource.
 type MultiAgentConfig struct {
 	Enabled                bool `json:"enabled" binding:"required"`
diff --git a/contracts/agents-api/v1/saved_core_extension.go b/contracts/agents-api/v1/saved_core_extension.go
index 6f2fc2733..d5977ba6f 100644
--- a/contracts/agents-api/v1/saved_core_extension.go
+++ b/contracts/agents-api/v1/saved_core_extension.go
@@ -79,5 +79,9 @@ func (p *ModelProviderView) ValidateHarnessWithRegistry(harness string, registry
 	if p == nil {
 		return errors.New("model_provider is required")
 	}
-	return registry.Validate(harness, string(p.Protocol), p.ContextWindow, p.MaxOutputTokens)
+	if err := registry.ValidateProtocol(harness, string(p.Protocol)); err != nil {
+		return err
+	}
+	configuration, _ := registry.Lookup(harness)
+	return configuration.ValidateMaxOutputTokens(p.MaxOutputTokens)
 }
diff --git a/contracts/agents-api/v1/saved_core_extension_test.go b/contracts/agents-api/v1/saved_core_extension_test.go
index e253998e1..bf823c5df 100644
--- a/contracts/agents-api/v1/saved_core_extension_test.go
+++ b/contracts/agents-api/v1/saved_core_extension_test.go
@@ -11,7 +11,7 @@ import (
 func TestSavedProviderSafeView(t *testing.T) {
 	input := &SavedAgentCoreInput{Harness: "codex", ModelProvider: &ModelProviderInput{
 		Protocol: "responses", BaseURL: "https://example.test/v1", APIKey: "write-only-fixture",
-		ContextWindow: 200000, MaxOutputTokens: 8000,
+		ContextWindow: 200000,
 	}}
 	if err := input.Validate(); err != nil {
 		t.Fatal(err)
@@ -34,7 +34,7 @@ func TestSavedProviderExplicitHarnessCompatibility(t *testing.T) {
 		for _, protocol := range []string{"anthropic", "responses", "chat_completions"} {
 			t.Run(harness+"/"+protocol, func(t *testing.T) {
 				x := &SavedAgentCoreInput{Harness: harness, ModelProvider: &ModelProviderInput{
-					Protocol: modelprovider.Protocol(protocol), BaseURL: "https://example.test", APIKey: "fixture", ContextWindow: 100, MaxOutputTokens: 20,
+					Protocol: modelprovider.Protocol(protocol), BaseURL: "https://example.test", APIKey: "fixture", ContextWindow: 100,
 				}}
 				native := harness == "" || harness == "mcode" || (harness == "codex" && protocol == "responses") || (harness == "claude_sdk" && protocol == "anthropic")
 				if err := x.Validate(); (err == nil) != native {
@@ -49,12 +49,12 @@ func TestSavedProviderExplicitHarnessCompatibility(t *testing.T) {
 		}
 	}
 	for _, protocol := range []string{"anthropic", "responses", "chat_completions"} {
-		for _, limits := range [][2]int32{{0, 0}, {100, 0}, {0, 20}} {
+		for _, limits := range [][2]int32{{0, 0}, {100, 0}} {
 			x := &SavedAgentCoreInput{Harness: "mcode", ModelProvider: &ModelProviderInput{
 				Protocol: modelprovider.Protocol(protocol), BaseURL: "https://example.test", APIKey: "fixture", ContextWindow: limits[0], MaxOutputTokens: limits[1],
 			}}
-			if x.Validate() == nil || x.SafeView().ModelProvider.ValidateHarness("mcode") == nil {
-				t.Fatal("MiniMax limits must be complete for every upstream protocol")
+			if x.Validate() != nil || x.SafeView().ModelProvider.ValidateHarness("mcode") != nil {
+				t.Fatal("MiniMax Code must accept omitted token limits for every upstream protocol")
 			}
 		}
 	}
diff --git a/contracts/agents-api/wire-semantics.md b/contracts/agents-api/wire-semantics.md
index aca69c414..1520547ee 100644
--- a/contracts/agents-api/wire-semantics.md
+++ b/contracts/agents-api/wire-semantics.md
@@ -1,8 +1,8 @@
 ---
-title: "Core wire behavior"
+title: "API behavior"
 ---
 
-The pinned OpenAI Python SDK ([upstream.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/upstream.json)) defines the `/v1` routes, fields and types. This page states what Core does where those types are silent, such as status codes, error fields, defaults and list bounds, and where Core behaves differently from the official service. The [coverage ledger](./index.md) lists the differences and open gaps; [Sessions, events and history](./sessions-events.md), [message content](./message-content.md), [Vaults](./vaults.md), [source Files and Skills](./source-files.md) and [Environment files and Artifacts](./environment-files.md) own the rules of their resources.
+The pinned OpenAI Python SDK ([upstream.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/upstream.json)) defines the `/v1` routes, fields and types. This page states what Core does where those types are silent, such as status codes, error fields, defaults and list bounds, and where Core behaves differently from the official service. The [OpenAI compatibility](./index.md) lists the differences and open gaps; [Sessions, events and history](./sessions-events.md), [message content](./message-content.md), [Vaults](./vaults.md), [source Files and Skills](./source-files.md) and [Environment files and Artifacts](./environment-files.md) own the rules of their resources.
 
 "Beta routes" below are the routes under `/v1/agents` and `/v1/vaults`. "Files and Skills" are the routes under `/v1/files` and `/v1/skills`, which ignore `OpenAI-Beta`.
 
@@ -156,7 +156,7 @@ Agent create requires `model`. Core saves and returns these values for omitted f
 | Function `defer_loading` | `false` |
 | `programmatic_tool_calling.enabled` | `true` |
 | `web_search` | Every pinned mode is saved; see [tool policy](./execution-tools.md#web-search-and-programmatic-tool-calling) |
-| HTTP MCP transport | Saved with `headers: {}`; nonempty headers are rejected. Origin and allowlist defaults are in [public MCP connection origin](./environments.md#public-mcp-connection-origin) |
+| HTTP MCP transport | Saved with `headers: {}`; nonempty headers are stored as given and an `Authorization` header is rejected. Origin and allowlist defaults are in [public MCP connection origin](./environments.md#public-mcp-connection-origin) |
 
 Saving a value does not make it executable. Session creation admits a smaller set; see [Session admission](#session-admission).
 
@@ -177,7 +177,7 @@ Agent create and update bodies and the inline `agent` of Session create are chec
 
 Within one object Core reports a union's `type` first, then unknown members, then member values in document order, then missing members in the pinned schema's order; tools before `text`, and the whole object before the duplicate and schema-root checks. Schemas without a string root `type` are not checked. Function and output schemas, `request_metadata` and `x_agents_core` keep their own parsers. Update bodies and the inline Session agent are validated before the Agent lookup, so owned, foreign, missing and malformed Agent IDs give the same response.
 
-Core saves values the pinned shapes allow even when it cannot run them: function names of any length, enabled programmatic tool calling, reasoning effort `max` and service tier `flex`.
+Core saves values the pinned shapes allow even when the selected Harness cannot run them: function names of any length and the reasoning, service tier, web search and programmatic tool calling values a Harness does not declare.
 
 ### Session admission
 
@@ -185,15 +185,14 @@ A Session's effective configuration must also pass execution admission, which ap
 
 | Configuration | Message |
 | --- | --- |
-| Explicit `reasoning.effort` or `reasoning.summary` | "Explicit reasoning execution options are not supported by this service yet." |
-| `service_tier` other than `auto` | "Execution currently supports service_tier=auto only." |
-| Enabled or omitted-mode `web_search`, enabled `programmatic_tool_calling` | See [tool policy](./execution-tools.md#web-search-and-programmatic-tool-calling) |
-| More than 64 functions, or a function name that is blank or longer than 512 bytes | "This service supports at most 64 function tools." or "Function names must be nonempty, unique and at most 512 bytes." |
-| Two `programmatic_tool_calling` declarations, two MCP servers with one label | "Execution requires distinct tool controls.", "Execution requires distinct MCP server labels." |
+| A `reasoning.effort`, `reasoning.summary`, `service_tier`, `web_search` mode or setting, `programmatic_tool_calling` value or `text.verbosity` the Harness does not declare | A message naming the field, such as `reasoning.effort "max" is not supported by this Harness.`; see [tool policy](./execution-tools.md#web-search-and-programmatic-tool-calling) and [Harness capabilities](./harness-capabilities.md#execution-and-input) |
+| A function name that is blank or repeated | "Function names must be nonempty and unique." |
+| Two MCP servers with one label | "Execution requires distinct MCP server labels." |
+| A Harness that does not declare `retained_native_history`, on a sandbox provider that keeps every Environment on workspace storage ([Harness capabilities](./harness-capabilities.md)) | "This Session's harness does not retain its native history, which the sandbox provider's workspace storage requires. Use a harness that supports retained_native_history, or a sandbox provider with its own disk." |
 
 A per-Session `tools` replacement admits a Session whose saved tools would be rejected. Support for each tool and Harness is in [execution and tools](./execution-tools.md).
 
-Omitted, null and explicit `medium` text verbosity give the same Session configuration. For a model whose native catalog declares no verbosity support, the Codex adapter drops a `medium` setting and uses the model's default, and rejects `low` or `high`.
+Omitted, null and explicit `medium` text verbosity give the same Session configuration.
 
 ### Update, delete and list
 
@@ -246,4 +245,4 @@ Subagent child Turns and pending Environment file writes do not block deletion.
 
 ### Response fields
 
-A Session's `agent.tools` omits `tool_search` declarations, which the pinned Session tool union does not include; the frozen configuration keeps them. On `self_hosted` Sessions, `environment.remote_url` is Core's daemon WebSocket URL, `/api/v1/agent-daemon/ws` under the public URL, which only OpenAgentCore's Runtime daemon speaks; requests cannot set it. Other Session fields follow the pinned types; `x_agents_core` is described in the [Agents API guide](../../docs/api/public-agent-api.md#core-extensions-x_agents_core).
+A Session's `agent.tools` omits `tool_search` declarations, which the pinned Session tool union does not include; the frozen configuration keeps them. On `self_hosted` Sessions, `environment.remote_url` is Core's daemon WebSocket URL, `/api/v1/agent-daemon/ws` under the public URL, which only OpenAgentCore's Runtime daemon speaks; requests cannot set it. Other Session fields follow the pinned types; `x_agents_core` is described in the [Agents API guide](../../docs/api/public-agent-api.md#core-extensions).
diff --git a/contracts/agents-api/zh/admin-api.md b/contracts/agents-api/zh/admin-api.md
index 594eb9bc0..9e550d491 100644
--- a/contracts/agents-api/zh/admin-api.md
+++ b/contracts/agents-api/zh/admin-api.md
@@ -1,7 +1,7 @@
 ---
 title: "Core 管理 API"
 source: contracts/agents-api/admin-api.md
-source_hash: 9c83e8b192408ea96e8614dfa5ffe4bdd65931954bc0359928c1985291b97962
+source_hash: da7f631aea81c3b934e61e8749de577f2dc458d5b45ede3f5492a3f184affe08
 ---
 
 Core 管理 API（`/core/v1`）用于管理安装实例：项目及其 API 密钥、项目资源的读取和删除、执行器凭据、部署默认模型、沙箱部署及其节点、监控和审计。Web 的[控制台服务器](../../../docs/zh/web/console-server.md#forwarding-to-core)会为已登录的管理员调用它；运维人员则从 Core 主机上的脚本调用它（[编写 Core API 脚本](../../../docs/zh/getting-started/operations.md#script-the-core-api)）。生成的架构是 [core.openapi.yaml](../core.openapi.yaml)，所有错误都使用 [Core 错误封装](core-errors.md)。
@@ -12,7 +12,7 @@ Core 管理 API（`/core/v1`）用于管理安装实例：项目及其 API 密
 
 每个 `/core/v1` 请求，包括针对未知路径的请求，都必须发送 `Authorization: Bearer <Core key>`。缺少该请求头时，Core 会返回 401 `invalid_admin_key` 和 `WWW-Authenticate: Bearer`；只有在身份验证通过后，未知路径才会返回 404 `not_found`。
 
-- Core 将 bearer 凭据的 SHA-256 与启动时从 `generated/core-key-digests.json` 读取的 Core 密钥摘要进行比较；该摘要由 `oac apply` 根据 `secrets/core.key` 派生（[Core 密钥](../../../docs/zh/getting-started/operations.md#core-key)）。轮换 Core 密钥后，需要重启 Core 才会生效。未配置任何摘要时，Core 不提供 `/core/v1` 路由。
+- Core 将 bearer 凭据的 SHA-256 与启动时读取的 [Core 密钥](../../../docs/zh/getting-started/operations.md#core-key)摘要进行比较。轮换 Core 密钥后，需要重启 Core 才会生效。未配置任何摘要时，Core 不提供 `/core/v1` 路由。
 - Core 密钥仅用于 `/core/v1` 身份验证。项目 API 密钥和机器凭据在此处会收到 401，而 Core 密钥在 `/v1` 和 `/api/v1` 上会收到 401（[API 命名空间和凭据](../../../docs/zh/api/index.md)）。
 - `X-Core-Console-Actor` 是由调用方声明的标签。Core 会将其记录为审计 `actor_label`，但不会验证。控制台服务器发送 `console`；脚本通常不发送该值，因此会记录空标签。切勿将其用于授权或作为来源证明。
 - 路径中的 `{project_id}` 用于选择目标项目，包括已归档的项目；它不会授予任何权限。
@@ -23,37 +23,51 @@ Core 管理 API（`/core/v1`）用于管理安装实例：项目及其 API 密
 
 | 路由 | 用途 | 契约 |
 | --- | --- | --- |
-| `installation` | 公共 URL、API 基础 URL、源代码提交、安装器的进程设置，以及绑定到公共 URL 的内容 | [安装信息](#installation-facts) |
+| `installation` | 公共 URL、API 基础 URL、源代码提交、安装程序的进程设置，以及绑定到公共 URL 的内容 | [安装信息](#installation-facts) |
 | `workspace-storage` | 读取或选择独立工作区文件系统配置 | [工作区存储](#workspace-storage) |
 | `projects`、`projects/{project_id}`、`projects/{project_id}/archive`、`projects/{project_id}/keys[/{key_id}]` | 项目及其 API 密钥 | [项目与密钥](#projects-and-keys) |
 | `projects/{project_id}/{agents,environment-templates,skills,files,vaults,sessions}/**` | 资源读取和删除、Session 历史及 Artifact | [资源读取和删除](#resource-reads-and-deletion) |
 | `projects/{project_id}/sessions/{session_id}/archive` | 归档一个托管 Session | [Session 归档](#session-archive) |
 | `projects/{project_id}/sessions/{session_id}/execution-configuration` | Session 创建时冻结的模型、Harness 和提供商选择 | [执行配置](#execution-configuration) |
 | `projects/{project_id}/sessions/{session_id}/diagnostics`、`…/turns/{turn_id}/diagnostics` | 失败类别和 Item 接收时序 | [Session 诊断](session-diagnostics.md) |
-| `projects/{project_id}/sessions/{session_id}/runtime-observation`、`sandbox/runtime-observations` | 当前 Runtime 观测值 | [Runtime 观测](runtime-observability-api.md)、[列表中的磁盘字段](#runtime-observations) |
+| `projects/{project_id}/sessions/{session_id}/runtime-observation`、`sandbox/runtime-observations` | 当前 Runtime 观测值 | [Runtime 观测](runtime-observability-api.md)、[列表中的磁盘字段](runtime-observability-api.md#disk) |
 | `projects/{project_id}/sessions/{session_id}/runtime-history` | 已存储的 Runtime 历史 | [Runtime 历史](runtime-observability-api.md#session-runtime-history) |
 | `projects/{project_id}/environments/{environment_id}/installation` | `self_hosted` Environment 的安装命令 | [安装授权](environment-executor-credentials.md#installation-grant) |
 | `projects/{project_id}/environments/{environment_id}/executor-credentials[/{key_id}]` | `self_hosted` Environment 的执行器凭据 | [执行器凭据](environment-executor-credentials.md#core-key-routes) |
 | `projects/{project_id}/resource-owners`、`projects/{project_id}/write-operations` | 创建资源的 API 密钥以及每个密钥执行的写入 | [写入溯源](#write-provenance) |
 | `harnesses`、`harnesses/{harness}/model-configuration` | 已启用的 Harness 及各 Harness 的部署默认模型 | [部署默认值](model-execution.md#deployment-defaults) |
 | `sandbox/deployment`、`sandbox/deployment/reset`、`sandbox/providers/{provider}/discovery` | 沙箱提供商、资源和 Runtime、空闲挂起策略、重置，以及提供商配置发现，例如 E2B 模板 | [沙箱部署](sandbox-deployment.md#routes) |
-| `sandbox/enrollment-tokens`、`sandbox/nodes[/{node_id}[/allocations]]` | 节点注册令牌、节点及其分配和主机历史 | [节点指南](../../../docs/zh/getting-started/nodes.md)、[沙箱部署](sandbox-deployment.md)、[节点主机历史](runtime-observability-api.md#node-host-observations-and-history) |
+| `sandbox/enrollment-tokens`、`sandbox/nodes[/{node_id}[/allocations]]` | 节点注册令牌、节点及其分配和主机历史 | [添加和管理节点](../../../docs/zh/getting-started/nodes.md)、[沙箱部署](sandbox-deployment.md)、[节点主机历史](runtime-observability-api.md#node-host-observations-and-history) |
 | `summary` | 按项目、Agent 或密钥统计的 Session 数量和使用情况 | [汇总](#summary) |
 | `metrics` | Core 自身的进程、执行、数据库和作业指标 | [Core 指标](core-metrics.md) |
 | `request-logs` | 近期应用或管理 HTTP 请求及其响应元数据 | [请求日志](#request-log) |
 | `audit-log` | 管理员写入 | [审计日志](#audit-log) |
 
-## 请求日志 {#request-log}
+## 安装信息 {#installation-facts}
 
-`GET /core/v1/request-logs` 是仅供 Core 密钥调用的诊断读取，由 Web 的 **请求日志** 和运维脚本使用。它观察到达 Core `/v1` 与 `/core/v1` API 的 HTTP 请求，包括认证拒绝和失败响应。日志读取本身、健康检查与文档端点、到达 Core 前的 Web 登录或代理失败、机器传输和后台执行不在此视图中。它不是审计档案或分布式执行追踪。
+`GET /installation` 报告管理员调用和更改此安装实例所需的信息。即使尚未创建任何沙箱部署，该接口也会响应，并且不会调用任何提供商或模型。
 
-每个 API 实例按入口分别保留最近开始的 1,000 个请求：`public` 对应 `/v1`，`admin` 对应 `/core/v1`。管理页面轮询不会挤掉应用请求。各自容量用尽后覆盖较旧条目，包括长连接请求；重启清空记录。`instance_id` 和 `instance_started_at` 标识提供响应的 API 实例；负载均衡可能返回另一个实例的窗口。Core 同时通过现有结构化日志输出请求结束时的元数据，其保留由运维日志系统负责，不属于本端点。
+| 字段 | 含义 |
+| --- | --- |
+| `object` | `core.installation` |
+| `installation_id` | `OAC_INSTALLATION_ID_FILE` 中的安装 ID（[Compose 安装](../../../docs/zh/configuration.md#compose-installations)） |
+| `public_url` | `public_url` 设置（[设置](../../../docs/zh/configuration.md#settings)）：应用程序、节点、沙箱和自托管执行器使用的源地址 |
+| `api_base_url` | 在 `public_url` 后附加 `/v1`，即项目 API 密钥使用的 `OPENAI_BASE_URL` |
+| `local_only` | 当 `public_url` 指向回环主机时为 True，该主机只能由 Core 主机访问 |
+| `source_commit` | Core 构建所依据的完整源代码提交；开发构建为 null |
+| `configuration` | Core 从环境加载的进程设置，位于 `settings` 中 |
+| `address_bindings` | 更改 `public_url` 所影响的内容，每次读取都会重新统计 |
 
-查询参数包括 `surface=public|admin`（默认 `public`）、`limit`（1–200，默认 100）、可选的精确 `request_id`、`outcome=all|errors|active`（默认 `all`）及可选 `method`。支持的方法值为 `GET`、`HEAD`、`POST`、`PUT`、`PATCH`、`DELETE`、`OPTIONS`、`CONNECT`、`TRACE` 和 `OTHER`；其他入站方法记为 `OTHER`。不支持、重复或格式错误的查询参数返回 400。`errors` 包括 HTTP 状态为 400 及以上的请求和已中断的请求。筛选仅扫描保留窗口，按开始时间从新到旧返回。`retained_count` 表示该入口的保留条目数，`total_matching` 是保留条目中匹配的数量，`has_more` 表示响应条数限制省略了匹配项，不代表仍能读取已被覆盖的历史。
+`configuration.settings` 为 Core 加载的每项设置一条记录，包含 `key`（设置它的环境变量，例如 `OAC_LOG_LEVEL`）、生效的 `value`、`default`、是否 `sensitive`，以及会 `restarts` 的服务（`core`、`web`）。
 
-响应包含 `object: "core.request_log.list"`、实例标识、`surface`、`capacity`、覆盖数量及 `data`。每条记录包含 `request_id`、`trace_id`、`started_at`、`method`、`route`、`state`、`status`、`duration_ms`、`response_bytes` 和可为空的 `error_code`。`route` 是注册路由模板、认证时部分匹配的前缀或 `(unmatched)`，不会包含原始资源路径或查询。最终响应头提交前，`status` 为 null。`state` 区分 `active`、`completed` 和 `aborted`；活跃请求的耗时和字节数是读取时的观测值。`response_bytes` 统计响应写入器接受的字节数，不包括响应头和传输封装，不是网络传输量测量。SSE 响应在处理函数结束前保持活跃。HTTP 状态及结束不代表异步 Agent Turn 的执行结果；执行结果以 [Session 诊断](./session-diagnostics.md)和该 Session 已记录的历史为准。
+敏感设置的 `value` 和 `default` 为 null，并改为包含一个布尔值 `configured`；只有敏感设置具有 `configured`。`oac-core check-config` 校验同一组环境变量，然后退出，不启动 Core，也不打印值。[配置参考](../../../docs/zh/configuration.md)会说明每个设置。
 
-不采集正文、请求头值、凭据、提示词、文件内容、原始路径、查询值或错误消息，只保留 API 的安全错误码。返回的请求 ID 对应 `X-Request-Id`，可用于查找已有进程日志的关联条目。Trace ID 仅供关联，不表示完整组件链路已经被追踪。
+| `address_bindings` 字段 | 含义 |
+| --- | --- |
+| `nodes` | 已注册且未移除的节点 |
+| `nodes_on_other_address` | 使用了 `public_url` 以外地址注册的节点。它们不会获得新的沙箱；请移除后重新添加。最多为 `nodes` 个 |
+| `hosted_sandboxes` | 保留的待处理托管沙箱；它们启动时使用当时有效的地址运行 |
+| `self_hosted_executors` | 未吊销的执行器凭据；对应执行器安装时使用的是当时公布的 `remote_url` |
 
 ## 工作区存储 {#workspace-storage}
 
@@ -130,7 +144,7 @@ GET 返回所选配置和租户容量策略；尚未配置时返回 404 `workspa
   "session_id": "013773a9-44b9-4f84-baca-b51c04a01201",
   "model": {"value": "requested-model", "source": "session"},
   "harness": {"value": "codex", "source": "agent"},
-  "harness_config": {"value": {"model_reasoning_effort": "high"}, "source": "agent"},
+  "harness_config": {"value": {"thinking": {"type": "adaptive"}}, "source": "agent"},
   "model_provider": {
     "source": "agent",
     "status": "available",
@@ -149,32 +163,6 @@ GET 返回所选配置和租户容量策略；尚未配置时返回 404 `workspa
 
 Core 会在创建 Session 的同一事务中写入此记录。之后的 Agent 编辑或删除、部署默认模型更改、重启以及使用同一密钥重试创建都不会改变该记录。没有该记录的 Session 会报告其已存储的模型和 Harness，来源均为 `unknown`；未存储任何值时对应字段为 null；提供商为 `unavailable`。Session 不存在和 Session 属于另一个项目时返回相同的 404。响应绝不会包含密钥、密文、机密引用、原生标头或查询参数。
 
-## 安装信息 {#installation-facts}
-
-`GET /installation` 报告管理员调用和更改此安装实例所需的信息。即使尚未创建任何沙箱部署，该接口也会响应，并且不会调用任何提供商或模型。
-
-| 字段 | 含义 |
-| --- | --- |
-| `object` | `core.installation` |
-| `installation_id` | `OAC_INSTALLATION_ID_FILE` 中的安装 ID（[Compose 安装](../../../docs/zh/configuration.md#compose-installations)） |
-| `public_url` | `public_url` 设置（[设置](../../../docs/zh/configuration.md#settings)）：应用程序、节点、沙箱和自托管执行器使用的源地址 |
-| `api_base_url` | 在 `public_url` 后附加 `/v1`，即项目 API 密钥使用的 `OPENAI_BASE_URL` |
-| `local_only` | 当 `public_url` 指向回环主机时为 True，该主机只能由 Core 主机访问 |
-| `source_commit` | Core 构建所依据的完整源代码提交；开发构建为 null |
-| `configuration` | Core 从环境加载的进程设置，位于 `settings` 中 |
-| `address_bindings` | 更改 `public_url` 所影响的内容，每次读取都会重新统计 |
-
-`configuration.settings` 为 Core 加载的每项设置一条记录，包含 `key`（设置它的环境变量，例如 `OAC_LOG_LEVEL`）、生效的 `value`、`default`、是否 `sensitive`，以及会 `restarts` 的服务（`core`、`web`）。
-
-敏感设置的 `value` 和 `default` 为 null，并改为包含一个布尔值 `configured`；只有敏感设置具有 `configured`。`oac-core check-config` 校验同一组环境变量，然后退出，不启动 Core，也不打印值。[配置](../../../docs/zh/configuration.md)会说明每个设置。
-
-| `address_bindings` 字段 | 含义 |
-| --- | --- |
-| `nodes` | 已注册且未移除的节点 |
-| `nodes_on_other_address` | 使用了 `public_url` 以外地址注册的节点。它们不会获得新的沙箱；请移除后重新添加。最多为 `nodes` 个 |
-| `hosted_sandboxes` | 保留的待处理托管沙箱；它们启动时使用当时有效的地址运行 |
-| `self_hosted_executors` | 未吊销的执行器凭据；对应执行器安装时使用的是当时公布的 `remote_url` |
-
 ## 写入溯源 {#write-provenance}
 
 Core 会记录是哪个项目 API 密钥完成了每次成功的公共写入；该记录与写入在同一事务中完成，如果记录失败，写入也会失败。读取、被拒绝的请求以及 Core 自身的维护操作（例如 OAuth 令牌刷新和清理）不会被记录。
@@ -233,9 +221,17 @@ Core 会记录是哪个项目 API 密钥完成了每次成功的公共写入；
 - 公共用量为 null 的 Session 不会增加 token 数量，但仍会计入覆盖率分母。
 - 每个项目都在单个数据库快照中读取；一页数据并不是整个部署的单一快照。总计属于运营计数，不是计费记录。
 
-## Runtime 观测 {#runtime-observations}
+## 请求日志 {#request-log}
+
+`GET /core/v1/request-logs` 是仅供 Core 密钥调用的诊断读取，由 Web 的 **请求日志** 和运维脚本使用。它观察到达 Core `/v1` 与 `/core/v1` API 的 HTTP 请求，包括认证拒绝和失败响应。日志读取本身、健康检查与文档端点、到达 Core 前的 Web 登录或代理失败、机器传输和后台执行不在此视图中。它不是审计档案或分布式执行追踪。
 
-[Runtime 遥测 API](runtime-observability-api.md)负责当前观测值、[仅列表可用的磁盘字段](runtime-observability-api.md#disk)、Session 历史以及节点主机观测值和历史。
+每个 API 实例按入口分别保留最近开始的 1,000 个请求：`public` 对应 `/v1`，`admin` 对应 `/core/v1`。管理页面轮询不会挤掉应用请求。各自容量用尽后覆盖较旧条目，包括长连接请求；重启清空记录。`instance_id` 和 `instance_started_at` 标识提供响应的 API 实例；负载均衡可能返回另一个实例的窗口。Core 同时通过现有结构化日志输出请求结束时的元数据，其保留由运维日志系统负责，不属于本端点。
+
+查询参数包括 `surface=public|admin`（默认 `public`）、`limit`（1–200，默认 100）、可选的精确 `request_id`、`outcome=all|errors|active`（默认 `all`）及可选 `method`。支持的方法值为 `GET`、`HEAD`、`POST`、`PUT`、`PATCH`、`DELETE`、`OPTIONS`、`CONNECT`、`TRACE` 和 `OTHER`；其他入站方法记为 `OTHER`。不支持、重复或格式错误的查询参数返回 400。`errors` 包括 HTTP 状态为 400 及以上的请求和已中断的请求。筛选仅扫描保留窗口，按开始时间从新到旧返回。`retained_count` 表示该入口的保留条目数，`total_matching` 是保留条目中匹配的数量，`has_more` 表示响应条数限制省略了匹配项，不代表仍能读取已被覆盖的历史。
+
+响应包含 `object: "core.request_log.list"`、实例标识、`surface`、`capacity`、覆盖数量及 `data`。每条记录包含 `request_id`、`trace_id`、`started_at`、`method`、`route`、`state`、`status`、`duration_ms`、`response_bytes` 和可为空的 `error_code`。`route` 是注册路由模板、认证时部分匹配的前缀或 `(unmatched)`，不会包含原始资源路径或查询。最终响应头提交前，`status` 为 null。`state` 区分 `active`、`completed` 和 `aborted`；活跃请求的耗时和字节数是读取时的观测值。`response_bytes` 统计响应写入器接受的字节数，不包括响应头和传输封装，不是网络传输量测量。SSE 响应在处理函数结束前保持活跃。HTTP 状态及结束不代表异步 Agent Turn 的执行结果；执行结果以 [Session 诊断](./session-diagnostics.md)和该 Session 已记录的历史为准。
+
+不采集正文、请求头值、凭据、提示词、文件内容、原始路径、查询值或错误消息，只保留 API 的安全错误码。返回的请求 ID 对应 `X-Request-Id`，可用于查找已有进程日志的关联条目。Trace ID 仅供关联，不表示完整组件链路已经被追踪。
 
 ## 审计日志 {#audit-log}
 
diff --git a/contracts/agents-api/zh/core-errors.md b/contracts/agents-api/zh/core-errors.md
index 6616fbed4..ecff9f952 100644
--- a/contracts/agents-api/zh/core-errors.md
+++ b/contracts/agents-api/zh/core-errors.md
@@ -1,7 +1,7 @@
 ---
 title: "Core 管理错误"
 source: contracts/agents-api/core-errors.md
-source_hash: 35ab3bfb8cec674766bbcc9dc2f0342045539ed4bf443c532c9a1271e7ec8c3e
+source_hash: ec6628f2355533d2746a12ca60ca1f800f01338157e280bb7ee91ec61106283f
 ---
 
 `/core/v1` 上的错误使用此封装结构。`message` 是安全的英文文本；`code` 和 `param` 可以为 null。客户端依据稳定的 `code` 和可选的 `param` 进行处理，对未知代码显示 `message`，绝不解析消息，也绝不自动重试被拒绝的写操作。
@@ -63,15 +63,14 @@ Web 的控制台服务器在 `/core` 路径上发生自身故障时使用此封
 | `model_provider_base_url_invalid` | `base_url` | 省略 | 必须使用 HTTPS，且不得包含凭据、查询或片段 |
 | `model_provider_protocol_unsupported` | `protocol` | `harness` 和 `allowed_protocols`，来自该构建的适配器目录 | 协议未知，或所选 Harness 不支持该协议 |
 | `model_provider_api_key_invalid` | `api_key` | `max_length`：16384 | 密钥为空、过长或包含禁止字符 |
-| `model_provider_token_limits_invalid` | `context_window` 或 `max_output_tokens` | 省略 | 限制无效，或 Harness 要求的正数限制缺失 |
+| `model_provider_token_limits_invalid` | `context_window` 或 `max_output_tokens` | 省略 | 限制为负数、`max_output_tokens` 超过已设置的 `context_window`，或 Harness 没有已设置限制的原生设置 |
 | `model_configuration_model_invalid` | `model` | 省略 | 部署默认配置的 model 不是非空模型标识符 |
 | `harness_config_invalid` | `harness_config` | 省略 | 部署默认配置的原生参数不受支持或无效 |
 | `invalid_sandbox_configuration` | `resources.cpus` | `min`：1，`max`：255 | CPU 数量超出支持范围 |
 | `invalid_sandbox_configuration` | `resources.memory_mib` | `min`：512，`max`：1048576 | 内存超出支持范围 |
-| `invalid_sandbox_configuration` | `resources.root_disk_mib` 或 `resources.environment_disk_mib` | `min`：microsandbox 为 1024；Docker 和 E2B 的 `min`：0，`max`：0 | 磁盘容量缺失或提供商不支持 |
-| `invalid_sandbox_configuration` | `runtime` | 省略 | Runtime 版本缺失、可变、无效或 E2B 不允许 |
+| `invalid_sandbox_configuration` | `resources.root_disk_mib` 或 `resources.environment_disk_mib` | `min`：microsandbox 为 1024（`environment_disk_mib` 也接受 0）；Docker 和 E2B 的 `min`：0，`max`：0 | 磁盘容量缺失或提供商不支持 |
 
-这些边界是验证常量，绝不是提交的值。节点名称按字节数限制；项目名称和键名称按去除首尾空白后的 Unicode 字符数限制，且不得包含控制字符。系统仅按以下顺序报告第一个失败项：模型提供商 URL、协议、密钥、常规限制、Harness 协议，然后是 Harness 的必需限制；沙箱资源依次为 CPU、内存、磁盘，然后是 Runtime。`model_provider` 对象内的模型提供商字段错误仍以该对象的相应字段作为 `param`。未知的沙箱提供商返回一个不含这些字段的错误。
+这些边界是验证常量，绝不是提交的值。节点名称按字节数限制；项目名称和键名称按去除首尾空白后的 Unicode 字符数限制，且不得包含控制字符。系统仅按以下顺序报告第一个失败项：模型提供商 URL、协议、密钥、限制，然后是 Harness 协议；沙箱资源依次为 CPU、内存，然后是磁盘。`model_provider` 对象内的模型提供商字段错误仍以该对象的相应字段作为 `param`。未知的沙箱提供商返回一个不含这些字段的错误。
 
 ## 其他管理错误 {#other-administration-errors}
 
@@ -83,6 +82,7 @@ Web 的控制台服务器在 `/core` 路径上发生自身故障时使用此封
 | 400 | `workspace_operation_unsupported` | 所选工作区存储不支持该操作或沙箱组合 |
 | 404 | `workspace_storage_not_found` | 尚未配置工作区存储或请求的对象不存在 |
 | 409 | `workspace_storage_conflict` | 工作区存储归属或配置与当前状态冲突 |
+| 409 | `workspace_storage_required` | 沙箱提供方在工作区存储上运行每个 Environment，但尚未选择存储 |
 | 503 | `workspace_storage_unavailable` | 工作区存储不可用或操作尚未确认 |
 | 400 | `sandbox_operation_unsupported` | 所选沙箱提供商不支持该操作 |
 | 401 | `invalid_admin_key` | Bearer 凭据不是有效的 Core 密钥 |
@@ -108,7 +108,7 @@ Web 的控制台服务器在 `/core` 路径上发生自身故障时使用此封
 
 ## 诊断失败类别 {#diagnostic-failure-categories}
 
-[Session and Turn diagnostics reads](session-diagnostics.md) 会在成功的 200 快照内返回以下类别，而不是以错误封装的形式返回。公开 `/v1` 的 Turn 错误保持不变。除非表格另有说明，否则 `params` 为 `{}`。
+[Session 诊断](session-diagnostics.md)接口会在成功的 200 快照内返回以下类别，而不是以错误封装的形式返回。公开 `/v1` 的 Turn 错误保持不变。除非表格另有说明，否则 `params` 为 `{}`。
 
 | 代码 | 存储原因或安全含义 |
 | --- | --- |
diff --git a/contracts/agents-api/zh/core-metrics.md b/contracts/agents-api/zh/core-metrics.md
index 3b85b5f75..3d4b342a3 100644
--- a/contracts/agents-api/zh/core-metrics.md
+++ b/contracts/agents-api/zh/core-metrics.md
@@ -1,7 +1,7 @@
 ---
-title: "Core 运行指标"
+title: "Core 指标"
 source: contracts/agents-api/core-metrics.md
-source_hash: 374ee416587e20da2acc0a28912e9d85bacd158a926256fab2e1316c63d97ac4
+source_hash: 473bc65daa5613717bc88f9f12d2fcd7653fc5eac563f8fff599c1fe70f3be88
 ---
 
 `GET /core/v1/metrics?range=1h|6h|24h|7d` 报告 Core 自身的健康状况：进程、执行队列与槽位、PostgreSQL 和后台任务。它要求 Core 密钥（[Core 管理 API](admin-api.md)）。
diff --git a/contracts/agents-api/zh/environment-executor-credentials.md b/contracts/agents-api/zh/environment-executor-credentials.md
index 26d245fb9..b711a247f 100644
--- a/contracts/agents-api/zh/environment-executor-credentials.md
+++ b/contracts/agents-api/zh/environment-executor-credentials.md
@@ -1,14 +1,14 @@
 ---
-title: "Environment 执行器凭据"
+title: "执行器凭据"
 source: contracts/agents-api/environment-executor-credentials.md
-source_hash: 5615fb412652ebcf34a1378a81128e0cd153b08932c443c02c6a59d2326718ec
+source_hash: bd7758cbe88d35995dcdffafc381f4a1d6b36ef70f9d0932f88d4d3b67ec1ab6
 ---
 
 执行器凭据允许 `oac-daemon` 为一个 `self_hosted` Environment 注册并连接。它只授权该 Environment 的私有 daemon 传输（`/api/v1/agent-daemon/*`），不授权 `/v1`、`/core/v1`、sandbox node 注册或项目资源。项目的 principal 是其执行 principal。Core 只保存密钥摘要。
 
 凭据有两个来源：
 
-- **安装授权。** `self_hosted` Session 返回安装命令。安装器使用命令中的短期 grant 领取一个凭据，不需要 Web 或 Core 密钥。[自托管指南](../../../docs/zh/getting-started/self-hosted.md)介绍操作步骤。
+- **安装授权。** `self_hosted` Session 返回安装命令。安装程序使用命令中的短期 grant 领取一个凭据，不需要 Web 或 Core 密钥。[自托管指南](../../../docs/zh/getting-started/self-hosted.md)介绍操作步骤。
 - **Core-key 路由。** 管理员通过 Web 或 `/core/v1` 签发、轮换和撤销凭据。
 
 Core 不创建、停止或回收机器。断开连接、撤销凭据或删除 Session 都不能证明所有原生进程已停止；机器所有者负责停止并清理自己的计算资源。
@@ -19,25 +19,25 @@ Core 不创建、停止或回收机器。断开连接、撤销凭据或删除 Se
 
 | 字段 | 含义 |
 | --- | --- |
-| `status` | `available`；当 Core 没有匹配的原生安装器时为 `unavailable`，此时 `message` 说明原因 |
+| `status` | `available`；当 Core 没有匹配的原生安装程序时为 `unavailable`，此时 `message` 说明原因 |
 | `version` | 命令安装的 Core 构建版本 |
 | `expires_at` | grant 到期的 Unix 时间，为响应生成后 30 分钟 |
 | `commands.posix`, `commands.powershell` | Linux/macOS 和 Windows PowerShell 的安装命令 |
 
-grant 绑定 Environment、Session 创建者的 principal 和 Core 构建版本。在到期、Session 被删除、项目被归档或 Core 运行另一构建版本时失效。重新读取 Session 会获得新 grant。Core 不存储 grant：每个响应重新签名，存储的事件从不包含它。命令通过环境变量 `OAC_INSTALL_GRANT` 传递 grant，从不放在进程参数中。引导脚本只把它交给安装器，安装器在启动守护进程或任何 Harness 之前先从自身环境中移除该变量。将命令视为临时秘密：它能领取凭据，但不能执行工作或读取文件。
+grant 绑定 Environment、Session 创建者的 principal 和 Core 构建版本。在到期、Session 被删除、项目被归档或 Core 运行另一构建版本时失效。重新读取 Session 会获得新 grant。Core 不存储 grant：每个响应重新签名，存储的事件从不包含它。命令通过环境变量 `OAC_INSTALL_GRANT` 传递 grant，从不放在进程参数中。引导脚本只把它交给安装程序，安装程序在启动守护进程或任何 Harness 之前先从自身环境中移除该变量。将命令视为临时秘密：它能领取凭据，但不能执行工作或读取文件。
 
-安装器生成密钥，在领取前将其私密保存到安装目录的 `daemon/executor-credential.json`。Core 将摘要保存在 key ID 等于 Environment ID 的记录中。响应丢失后可以安全重试，但必须提交同一个密钥。grant 不替换或恢复凭据。如果 Environment 已有不同、已轮换或已撤销的凭据，领取返回 409 `executor_credential_exists`。
+安装程序生成密钥，在领取前将其私密保存到安装目录的 `daemon/executor-credential.json`。Core 将摘要保存在 key ID 等于 Environment ID 的记录中。响应丢失后可以安全重试，但必须提交同一个密钥。grant 不替换或恢复凭据。如果 Environment 已有不同、已轮换或已撤销的凭据，领取返回 409 `executor_credential_exists`。
 
-安装器调用 Core 的以下机器路由：
+安装程序调用 Core 的以下机器路由：
 
 | 路由 | 授权 | 用途 |
 | --- | --- | --- |
 | `GET /api/v1/agent-daemon/install/{version}/bootstrap.sh`, `bootstrap.ps1` | 无 | 平台 bootstrap 脚本 |
-| `GET /api/v1/agent-daemon/install/{version}/{os}-{arch}.sha256`, `{os}-{arch}.tar.gz` | 无 | 安装器校验和与归档；Core 提供本地副本，或以 307 重定向到目录中的版本化发布 URL |
+| `GET /api/v1/agent-daemon/install/{version}/{os}-{arch}[-{component}].sha256`, `{os}-{arch}[-{component}].tar.gz` | 无 | 平台基础安装程序或其某个组件（在其 `bundle.json` 中列出）的校验和与归档；安装程序只下载所需的组件。Core 提供本地副本，或以 307 重定向到目录中的版本化发布 URL |
 | `POST /api/v1/agent-daemon/installation` | Grant | 固定绑定：`version`、`protocol_version`、`environment_id`、`remote_url`、`workspace_directory`、`harness` |
 | `POST /api/v1/agent-daemon/installation/claim` | Grant | `{"executor_token":"SECRET"}`；204 |
 
-无效或过期的 grant 返回 401 `installation_authorization_invalid`。没有匹配安装器时，grant 路由返回 503 `installation_unavailable`。Core 用安装的 [`secrets/core/credential.key`](../../../docs/zh/configuration.md#compose-installations) 签名每个 grant。格式错误的密钥返回 400。产物路由不携带凭据，grant 只发送给 Core，不发送给产物主机。
+无效或过期的 grant 返回 401 `installation_authorization_invalid`。没有匹配安装程序时，grant 路由返回 503 `installation_unavailable`。Core 用安装的 [`secrets/core/credential.key`](../../../docs/zh/configuration.md#compose-installations) 签名每个 grant。格式错误的密钥返回 400。产物路由不携带凭据，grant 只发送给 Core，不发送给产物主机。
 
 ## Core-key 路由 {#core-key-routes}
 
@@ -87,7 +87,7 @@ Connected 表示 Environment 已连接，其设备和执行器凭据仍有当前
 
 无效、已撤销、其他范围或已删除 Session 的权限返回 401；已绑定 Environment 使用不同凭据返回 409。响应不暴露实际绑定或数据库诊断。
 
-安装器从返回的 `remote_url` 推导此路由，不跟随重定向。启动 daemon 后，每秒轮询一次，最多 45 秒。401 或 409 立即失败。超时后打印 daemon 的 `connect.log` 路径，请求重新执行同一命令；daemon 继续重连，安装、凭据和历史保留。连接确认只证明认证成功，不证明模型访问、Harness 能力或执行完成。
+安装程序从返回的 `remote_url` 推导此路由，不跟随重定向。启动 daemon 后，每秒轮询一次，最多 45 秒。401 或 409 立即失败。超时后打印 daemon 的 `connect.log` 路径，请求重新执行同一命令；daemon 继续重连，安装、凭据和历史保留。连接确认只证明认证成功，不证明模型访问、Harness 能力或执行完成。
 
 ## 已撤销或轮换的凭据 {#revoked-or-rotated-credential}
 
diff --git a/contracts/agents-api/zh/environments.md b/contracts/agents-api/zh/environments.md
index 9021bc8d5..043909185 100644
--- a/contracts/agents-api/zh/environments.md
+++ b/contracts/agents-api/zh/environments.md
@@ -1,7 +1,7 @@
 ---
 title: "Environment 与模板"
 source: contracts/agents-api/environments.md
-source_hash: 9007be1099cf50f5ba376d2de4a060d039b6ee0b1c13c78a94665c28c2fc3fc6
+source_hash: d45daace6c0a0172832793f8cea9f32423542d60c62cb6e1b572320b42d264cd
 ---
 
 Environment 是 Session 的执行资源，包括 Harness 运行所在的机器、工作区以及已完成准备的能力。Session 通过其 `environment` 配置创建 Environment；不存在独立的 create 调用。Environment 模板是 Session 创建时解析的可复用准备配置。本契约涵盖这两类资源、两种放置方式、输入接纳、能力准备、Skills、Plugins 和 MCP 连接来源。
@@ -37,7 +37,23 @@ Environment 是 Session 的执行资源，包括 Harness 运行所在的机器
 | [Environment resource](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/agents/environment_info.py) | `pending`、`connected`、`disconnected`、`expired`、`failed` |
 | [Session environment event](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/agent_session_environment_state.py) | `pending`、`ready`、`connected`、`disconnected`、`failed`，并带可为 null 的 error |
 
-这两套词汇彼此独立；绝不要将其中一套转换为另一套。Session environment 事件携带 Session 和 Environment 的身份标识以及可选的 Turn 身份标识，绝不携带配置、凭据、注册 ID 或修订号。Session 的 `required_actions` 可以包含 `{type: "environment_connection", environment_id}`，这与函数调用相互独立。Environment 连接、Session 状态和 Turn 状态相互独立。
+这两套词汇彼此独立；绝不要将其中一套转换为另一套。资源状态按下图变化，失败或过期的 Environment 不再改变：
+
+```mermaid
+stateDiagram-v2
+    [*] --> pending
+    pending --> connected
+    connected --> disconnected
+    disconnected --> connected
+    pending --> failed
+    connected --> failed
+    disconnected --> failed
+    pending --> expired
+    connected --> expired
+    disconnected --> expired
+```
+
+Session environment 事件携带 Session 和 Environment 的身份标识以及可选的 Turn 身份标识，绝不携带配置、凭据、注册 ID 或修订号。Session 的 `required_actions` 可以包含 `{type: "environment_connection", environment_id}`，这与函数调用相互独立。Environment 连接、Session 状态和 Turn 状态相互独立。
 
 Core 在 Session 创建事务中创建 Environment 记录；Session upsert 会选出重试的胜者，而重试绝不创建或修复 Environment。Environment 从所属 Session 派生其项目和不可变配置。其首个状态为 `pending`。Session 删除后，读取会隐藏 Environment，而 Core 仍保留该记录，用于结算和清理。Session 为 `none` 时没有 Environment。
 
@@ -119,21 +135,21 @@ Session 输入通过 `POST /agents/sessions/{id}/events` 以每次 1–64 个事
 
 Core 仅在批次已持久接纳后返回 202。对于取消，202 确认的是接纳，而非原生完成或进程退出。在 Session 锁内，重试会先恢复其原始预留或回执，然后由 Core 在活动 Turn 与新预留之间选择，并在后续工作中保持该目标。未加锁的读取或冲突后的重试绝不会选择不同路径。
 
-等待请求使用有界的池化操作，位于事务和执行租约之外；它绝不会准备或启动原生工作。只有此路由会将其响应写入期限延长至六分钟，以涵盖五分钟的数据库期限及响应时间。断开连接会停止等待，但不会取消预留。错误如下：
-
-| 条件 | 响应 |
-| --- | --- |
-| 预留已过期 | 409 `environment_input_expired` |
-| 预留已取消 | 409 `environment_input_cancelled` |
-| 向失败的 `openai_hosted` Environment 提交新输入 | 409 `conflict_error`，"the hosted environment failed to provision" |
-| 向失败或过期的 `self_hosted` Environment 提交新输入，或 Environment 失败时仍在等待的输入 | 409 `environment_unavailable` |
-| 执行所有权丧失 | 503 `execution_unavailable` |
-| Session 已删除 | 404 |
+等待请求使用有界的池化操作，位于事务和执行租约之外；它绝不会准备或启动原生工作。只有此路由会将其响应写入期限延长至六分钟，以涵盖五分钟的数据库期限及响应时间。断开连接会停止等待，但不会取消预留。该请求的全部结果见[输入错误](sessions-events.md#input-errors)。
 
 ### 预留 {#reservations}
 
 预留会在 Turn 接纳之前存储一个规范消息批次，截止时间依据数据库时钟设置为五分钟。
 
+```mermaid
+stateDiagram-v2
+    [*] --> pending
+    pending --> admitted: Turn claim
+    pending --> expired: deadline
+    pending --> cancelled: cancellation, archive or reset
+    pending --> failed: preparation failure
+```
+
 - 它要求 Session 带有 Environment，且没有活动工作。预留和直接输入共享 Session 锁和重试标识；pending 或 settled 的 key 不能通过直接接纳绕过其预留。
 - pending 预留会阻止新的直接批次，包括取消；较早成功的重试仍保持可读。
 - 提升操作会将原始输入、历史、预留结算和 Turn 认领（`queued` 到 `in_progress`）一并提交。它要求当前持有租约的执行写入方和保留的原生准备状态；准备期间不持有数据库锁。只有首次成功且非重放的回执授权在该准备状态上执行 Start。已接纳的重试会返回原始回执，而不重新获取执行权；读取或不确定的提交绝不复授权另一次 Start。
@@ -148,11 +164,17 @@ Core 仅在批次已持久接纳后返回 202。对于取消，202 确认的是
 
 在 Turn 存在之前，Session 活动来自最近相关的预留和连接状态。离线 `self_hosted` Environment 上的待处理输入会请求 `environment_connection`；连接到达后会将其清除并设为 `idle`，同时 Worker 仍负责原生就绪性和接纳。没有待处理输入的离线 Environment 不会请求任何操作，而 `openai_hosted` 置备也绝不会请求连接。预留或连接变更会在同一事务中提交不可变的 Session 活动和使用量快照；较新的预留或活动 Turn 负责后续活动。已结算的非初始预留会将操作恢复为 `idle`，直至出现较新的工作。
 
-### 过期与调度 {#expiry-and-scheduling}
+### 过期 {#expiry}
+
+Worker 在正常 tick 中处理到期的预留，重启后继续。失败的 Turn 绝不能代替 Turn 之前的连接失败。
 
-Worker 在每个 tick 中最多处理 32 个到期预留，处理顺序是在检查其租约之后、检查设备或执行槽位之前。该扫描使用带事务超时的租约 Store 连接，绝不使用池化写入方。部分截止时间索引和 `SKIP LOCKED` Session 锁使无关工作得以继续。截止点采用语句时间，而结算会在取得 Session 锁后重新检查数据库时钟。重启会在正常 tick 中继续处理过期；不存在单独的调度器。失败的 Turn 绝不能代替 Turn 之前的连接失败。
+## 托管计算规格 {#hosted-compute-profiles}
 
-当已完成的托管分配处于暂停或恢复状态且有下一 Turn 输入处于 pending 时，Core 会向托管 Runtime 维护循环发出提示。初始输入、冷创建、运行中或已禁用的计算资源、终止回执、取消和函数结果、历史及文件操作均不会发送提示。提示采用尽力而为的方式合并且不会阻塞；它们在正常的五秒周期中最多增加一次扫描，绝不会绕过容量、繁忙的生命周期门控或所有权检查。持久化工作和正常 ticker 始终具有权威性。
+新的 `openai_hosted` Session 可以传入 `x_agents_core.environment.compute_profile`，名称必须匹配 `^[a-z][a-z0-9-]{0,47}$`。例如 `{"x_agents_core":{"environment":{"compute_profile":"memory-8g"}}}` 选择管理员配置的档位。名称本身不规定 CPU 或内存；管理员通过[沙箱部署](sandbox-deployment.md#compute-profiles)配置精确资源。该字段不属于官方顶层 `environment` 联合类型或 Environment 模板。省略时保持现有默认行为；null、空串、格式错误、不支持的放置方式和不可用名称均拒绝，绝不退回默认档位。
+
+创建在部署锁内解析名称，并在创建 Session 的同一事务中冻结不可变 generation。调用方意图包含名称；即使管理员随后修改或删除该档位，相同幂等键的相同请求仍返回原 Session，改变意图则冲突。尚未首次分配计算资源的 Session 也保留该 generation。分配、挂起、恢复和清理均使用冻结选择；已有 Session 及未指定档位的 Session 保持原行为。
+
+不可用档位返回 HTTP 400 `invalid_request_error`，参数为 `x_agents_core.environment.compute_profile`，安全消息为 “The requested compute profile is not available for hosted execution.”。客户端不能通过该字段传入提供商模板、凭据或资源覆盖。
 
 ## Runtime 能力准备 {#runtime-capability-preparation}
 
@@ -175,7 +197,7 @@ Core 会在 Session 创建时冻结资源版本、元数据和源选择。随后
 
 运行器仅使用中立的 Environment 和 Session 身份以及一个 Runtime 对端，不包含提供商、部署或操作系统分支。Harness 差异保留在适配器中。
 
-**可移植的准备输入。** `self_hosted` 输入仅携带 `workspace_directory` 和 `capability_directories`。无论 Session 采用哪种工作区放置方式，还可以发送 `x_agents_core.environment`，这是 Core 扩展，包含 `environment_template_id`、`files`、`env`、`packages`、`setup_commands`、`skills`、`plugins` 和 `capability_directories`。它使用与 `openai_hosted` 输入相同的解析器和继承规则。若同一字段同时在 `x_agents_core.environment` 和顶层 `environment` 中提供，则会被拒绝，包括显式 null。`self_hosted` Session 只能通过此扩展指定模板，并且不能使用 network 不是 `enabled` 的模板（400，param `x_agents_core.environment.environment_template_id`）。机器位置、规格大小和网络策略不是此扩展的字段。
+**可移植的准备输入。** `self_hosted` 输入仅携带 `workspace_directory` 和 `capability_directories`。无论 Session 采用哪种工作区放置方式，还可以发送 `x_agents_core.environment`，这是 Core 扩展，包含 `environment_template_id`、`files`、`env`、`packages`、`setup_commands`、`skills`、`plugins` 和 `capability_directories`。它使用与 `openai_hosted` 输入相同的解析器和继承规则。若同一字段同时在 `x_agents_core.environment` 和顶层 `environment` 中提供，则会被拒绝，包括显式 null。`self_hosted` Session 只能通过此扩展指定模板。机器位置、规格大小和网络策略不是此扩展的字段。 托管 Session 还可按下文选择管理员批准的计算规格。
 
 ```json
 {
@@ -219,23 +241,32 @@ daemon 以启动它的账户身份运行，绝不使用 sudo 或提升权限。
 
 每条命令都使用启动用户的权限和主机网络。进程所有权会等待退出及 I/O 结算完成。命令输出会被丢弃；确认失败时只保留一个有界整数退出状态。
 
-使用外部工作区存储的托管计算替换后，仅持久 Environment 文件系统和已通过资格验证的 Harness 私有原生历史会保留。Setup 命令不会重放。Setup 和工具可以写入启动用户有权访问的其他位置，但冷续接不保留临时系统盘上的修改、进程内存或后台进程。持久输出应写入工作区，软件包应使用已声明的安装路径；[沙箱提供商生命周期](../../../docs/zh/sandbox-provider.md#suspension)定义何时可以替换计算。
+使用外部工作区存储的托管计算替换后，仅持久 Environment 文件系统和已通过资格验证的 Harness 私有原生历史会保留。Setup 命令不会重放。Setup 和工具可以写入启动用户有权访问的其他位置，但冷续接不保留临时系统盘上的修改、进程内存或后台进程。持久输出应写入工作区，软件包应使用已声明的安装路径；[沙箱提供商协议](../../../docs/zh/sandbox-provider.md#cold-replacement-after-checkpoint-retention)定义何时可以替换计算。
 
 ### 显式本地工具环境 {#explicit-local-tool-environment}
 
-安装器的 `--tool-env-file`（`OAC_RUNTIME_TOOL_ENV_FILE`）提供 Runtime 操作者的基础工具变量。准备过程会将这些值复制到其私有初始化快照中，并由 Session 的 `env` 键覆盖。Runtime 绝不会重写源文件，也不会继承无关的环境凭据。设置、能力解析和 Harness 执行都会读取同一份已准备快照。即使操作者编辑了文件，重连仍会保留该快照；新 Session 会读取当前文件。Harness profile 可以引用由 Runtime 所有的文件，但不得持久保存其值的副本。配置的文件缺失或无效时，准备过程会失败。
+安装程序的 `--tool-env-file`（`OAC_RUNTIME_TOOL_ENV_FILE`）提供 Runtime 操作者的基础工具变量。准备过程会将这些值复制到其私有初始化快照中，并由 Session 的 `env` 键覆盖。Runtime 绝不会重写源文件，也不会继承无关的环境凭据。设置、能力解析和 Harness 执行都会读取同一份已准备快照。即使操作者编辑了文件，重连仍会保留该快照；新 Session 会读取当前文件。Harness profile 可以引用由 Runtime 所有的文件，但不得持久保存其值的副本。配置的文件缺失或无效时，准备过程会失败。
 
 ### 初始化状态与失败 {#initialization-state-and-failure}
 
 Environment 的初始化状态为 `pending`、`running`、`complete` 或 `failed`，且独立于任何分配、身份验证和连接发布。
 
+```mermaid
+stateDiagram-v2
+    [*] --> pending
+    pending --> running
+    running --> complete
+    pending --> failed
+    running --> failed
+```
+
 - Worker 的初始化调度器每次扫描 32 个 Environment，在末尾循环回绕，并依据执行并发度限制并发准备，且独立于提供商维护。
 - 缺少套接字不会消耗一次 pending 尝试。Harness 不可用时，会在安装前失败。每个操作都会重新检查当前权限和原始套接字；完成时还会重新检查精确绑定。
 - 每个文件、Skill 或 Plugin 传输的暂存预算为两分钟。configure、软件包安装、设置命令和快照最终确定共享整个初始化过程的 30 分钟预算，Core 在每项操作中携带剩余时长，由 Runtime 执行。初始输入仍保留其五分钟接纳期限，因此大型安装应从空闲 Session 开始。
 - 正在运行且所有权丧失的初始化，包括跨 Core 重启丧失所有权，会作为未确认而失败；不会重播任何内容。已完成的 Environment 在重连或原生恢复时绝不会重新安装，因此用户后续更改会保留下来。
 - 失败对 Session 而言是终止状态，但不会销毁计算资源或文件。
 
-失败时，一个事务会将 Environment 标记为失败，并记录 `agent.session.environment.failed`、一个 `error` 事件和一个 `agent.session.failed`。Session 读取会返回 `failed`、作为 `error` 的原因以及作为 `last_active_at` 的失败时间；实时流会在失败事件后结束。待处理输入以失败状态结算。原因只指明步骤及其退出状态：
+初始化失败时记录的事件和 Session 状态由 [Environment 初始化失败](sessions-events.md#environment-initialization-failure)定义。原因只指明步骤及其退出状态：
 
 | 失败步骤 | 原因 |
 | --- | --- |
@@ -295,11 +326,15 @@ Session 会先应用模板，然后应用自身字段。组合仅在加密 Sessi
 
 作为比较，不带模板的内联 `openai_hosted` Session 会将省略或为 null 的 `network` 视为启用。
 
+### 准备复用 {#preparation-reuse}
+
+Core 可以用同一 Project 中较早一次准备的结果启动托管 Environment，前提是两者在 Template 组合之后的有效配置完全相同，且距该次准备不超过 24 小时。每个 Session 仍然得到自己的副本。此时设置命令和包安装不会为该 Session 再次运行。只复用 `/environment`（见工作区文件系统范围），HOME 和其他与计算实例本地相关的改动不会复用。设置过程不得产生每个 Session 唯一的值，不得执行必须按 Session 发生的外部副作用，也不得获取 24 小时内就会过期的凭据；需要这些行为的配置必须有所不同，例如在 `env` 或 `files` 上。未声明[准备缓存](../../../docs/zh/sandbox-provider.md#explicit-operation-contracts)的提供商始终完整准备。
+
 ### 受限网络 {#restricted-network}
 
 `restricted` 要求在 `allowed_domains` 中提供 1–100 个精确 ASCII 主机名；子域名和重定向目标需要各自的条目。通配符、URL 或端口语法、IP 字面量、Unicode 和尾随点都会被拒绝。读取操作会返回提供的拼写、顺序和重复项；比较操作使用单独的小写去重副本。
 
-Runtime 不会强制执行 `disabled` 或 `restricted`，也没有提供商代为强制执行。因此，Core 会在模板中存储这些策略，但会在分配计算资源之前拒绝任何有效 network 不是 `enabled` 的 Session。初始化和工具使用主机现有的网络。
+只有 `enabled` 可以运行。Core 会在模板中存储其他策略，但会在分配计算资源之前拒绝任何有效 network 不是 `enabled` 的 Session。初始化和工具使用主机现有的网络。
 
 ### Env 与设置命令 {#env-and-setup-commands}
 
@@ -359,19 +394,19 @@ Skills 及其不可变版本是项目资源，独立于 Session 和原生安装
 - Bundle 使用服务密码进行加密，并绑定到项目、Skill 和版本。元数据读取绝不会加载或解密 Bundle。删除 Skill 会回收其版本，但不会影响已冻结的 Session。
 - 引用会在 Session 创建事务中、upsert 建立所有权之后解析。被引用的资源按稳定顺序锁定，版本、元数据和字节会一并冻结。公开引用元数据、未解析的模板意图和已解析的 Runtime Bundle 始终彼此独立；引用绝不会报告为内联内容。
 
-内联和引用的 Skills 使用相同的机密快照与安装器。Runtime 会在设置和原生执行之前，将它们安装到能力根目录下的 `skills/<name>`。适配器只注册所选的 Skill 根目录：Codex 将其注册为显式额外根目录，MiniMax Code 通过其原生目录进行注册，Claude 则为每个包使用一个受控封装，其中包含实际目录和不可变硬链接。自动原生 MCP 发现保持禁用。Codex 的嵌套 `SKILL.md` 发现、`agents/openai.yaml` 依赖项配置以及 Claude 内联 shell 预处理都会导致适配器准备失败。原生 Harness 配置绝不会整体透传。
+内联和引用的 Skills 使用相同的机密快照与安装程序。Runtime 会在设置和原生执行之前，将它们安装到能力根目录下的 `skills/<name>`。适配器只注册所选的 Skill 根目录：Codex 将其注册为显式额外根目录，MiniMax Code 通过其原生目录进行注册，Claude 则将其作为私有状态路径下的用户 Skills，使原生列出与本地 `~/.claude/skills` 相同的裸名称。Claude 拒绝包含 `.claude-plugin` 的 Skill，因为原生会将其作为插件加载，连同其 hooks 和 MCP 服务器。Skill 根目录不会启用 MCP 服务器，只有 [Plugin MCP](#plugin-mcp) 会启用。Codex 与本地运行一样递归扫描每个 Skill 根目录，因此嵌套的 `SKILL.md` 会注册另一个原生 Skill。原生 Harness 配置绝不会整体透传。
 
 ### Plugin MCP {#plugin-mcp}
 
 Plugin 可以在 `.codex-plugin/plugin.json` 中通过 `mcpServers: "./.mcp.json"` 声明 MCP 服务器，也可以在省略路径时使用根目录下的 `.mcp.json`。该文件包含以服务器名称为键的 `mcpServers`。将 Plugin 根目录选为能力目录会激活其 MCP 声明；选择父目录则会发现 Skills，但不会激活嵌套 MCP 服务器。
 
-共享解析器接受 HTTP `url`、`bearer_token_env_var` 和字面量 `http_headers`，以及 stdio `command`、`args`、选定的 `env_vars` 和包相对路径 `cwd`。不支持公开的 `env_http_headers`。Runtime 会重新解析已冻结的已安装包，并且只从已初始化的 env 中解析选定值；缺少值时会失败，而不会回退到模型或 daemon 变量。
+共享解析器接受 HTTP `url`、`bearer_token_env_var` 和字面量 `http_headers`（与公开 MCP 标头一样为非机密），以及 stdio `command`、`args`、选定的 `env_vars` 和包相对路径 `cwd`。不支持公开的 `env_http_headers`。Runtime 会重新解析已冻结的已安装包，并且只从已初始化的 env 中解析选定值；缺少值时会失败，而不会回退到模型或 daemon 变量。
 
 stdio 服务器通过 daemon 的 stdio helper 启动；该 helper 会解析已安装的声明，并以 Harness 的权限启动命令。在 Unix 上，helper 会将自身替换为服务器；在 Windows 上，它会在所属进程树内部转发 stdio。已初始化的值会覆盖声明中的变量。进程组和 Windows Jobs 负责取消及后代进程清理，而不负责隔离。
 
 [Harness capabilities](harness-capabilities.md#environment-preparation) 负责受支持的 Plugin 传输及每个 Harness 的限制。
 
-Environment MCP 需要启用的网络。重复的服务器身份会被拒绝。Claude 会拒绝字面量标头，因为固定版本客户端会再次展开这些标头，并将自定义标头跨来源转发。MiniMax ACP HTTP 声明会保留在 Session 本地的原生内存中；令牌绝不会进入原生配置文件或进程参数。无法通过 Plugin 清单设置必需初始化和工具允许列表。
+重复的服务器身份会被拒绝。Claude 会拒绝 URL 或标头值中的 `${`（[原生差异](index.md#differences-from-openai)）。MiniMax ACP HTTP 声明会保留在 Session 本地的原生内存中；令牌绝不会进入原生配置文件或进程参数。无法通过 Plugin 清单设置必需初始化和工具允许列表。
 
 ### 有效绑定 {#effective-bindings}
 
@@ -379,12 +414,12 @@ Runtime 会在适配器投影之前，通过 `agent.ResolveMCPBindings` 解析
 
 ### 公开 MCP 连接来源 {#public-mcp-connection-origin}
 
-Agent 的 HTTP MCP 工具（[declaration](execution-tools.md#http-mcp)）具有 `connection_origin`。省略或传入 null 表示 `service`，在 `self_hosted` Session 中也是如此。该来源会从已保存配置经过 Session 快照一直保留到 Runtime 请求，后者要求精确的线上版本；`service` 请求绝不会变为 `environment` 连接。
+Agent 的 HTTP MCP 工具（[declaration](execution-tools.md#mcp)）具有 `connection_origin`。省略或传入 null 表示 `service`，在 `self_hosted` Session 中也是如此，`stdio` 服务器除外，其唯一来源是 `environment`。该来源会从已保存配置经过 Session 快照一直保留到 Runtime 请求，后者要求精确的线上版本；`service` 请求绝不会变为 `environment` 连接。
 
 | 来源 | 连接发起位置 | 允许的放置方式 |
 | --- | --- | --- |
 | `service` | Core 的服务端执行主机 | 仅 `none` |
-| `environment` | Environment 的工作区 | `openai_hosted` 和启用网络的 `self_hosted` |
+| `environment` | Environment 的工作区 | `openai_hosted` 和 `self_hosted` |
 
 Core 的 Harness profile 会声明 `MCPOrigins`；接纳和分派会将来源与放置方式以及 Runtime 公布的 HTTP、bearer 和必需初始化能力进行核对，Runtime 会在调用适配器之前再次验证来源。不存在按 Harness 名称或提供商分支选择不同路径的逻辑。
 
@@ -392,4 +427,4 @@ Core 的 Harness profile 会声明 `MCPOrigins`；接纳和分派会将来源与
 
 两种来源都支持匿名 HTTP 和 HTTPS bearer 凭据。所附加 Vault 的选择会冻结凭据身份，包括唯一的隐式 URL 匹配或匿名选择。只有该凭据经项目授权后，才会进入瞬时 Runtime 请求；绝不会搜索 Core 默认值或无关 Vault。解密失败或凭据缺失时，执行会失败且不会回退到匿名。公开 Environment MCP 保留 `project_vault` 权限，Plugin 凭据保留 `environment_configuration` 权限；两者都不会覆盖重复的服务器标签。Bearer 令牌绝不会进入持久化的原生配置或进程参数。
 
-工具允许列表和必需初始化遵循 [HTTP MCP contract](execution-tools.md#http-mcp)。
+工具允许列表和必需初始化遵循 [HTTP MCP contract](execution-tools.md#mcp)。
diff --git a/contracts/agents-api/zh/execution-tools.md b/contracts/agents-api/zh/execution-tools.md
index b3bf710a0..8b5430064 100644
--- a/contracts/agents-api/zh/execution-tools.md
+++ b/contracts/agents-api/zh/execution-tools.md
@@ -1,7 +1,7 @@
 ---
 title: "执行工具"
 source: contracts/agents-api/execution-tools.md
-source_hash: eacb0d566f9d787f393c1d462351023a1ca6fe97ffb32773c8f23139833f5762
+source_hash: d88acdb94153f3974e66adbdb9443706ae47adef280cae71b03fdf896bdfe579
 ---
 
 Agent 在 `tools` 中声明应用函数、控制项和 MCP 服务器，并可在 `text.format` 中声明输出 schema。本契约说明 Core 如何验证声明、哪些内容跨越 Runtime 边界，以及调用方如何恢复待执行操作。[Harness 能力](harness-capabilities.md)列出各 Harness 在不同部署位置支持的操作。原生工作区工具和 Environment Plugin MCP 属于 [Environment](environments.md#skills-plugins-and-environment-mcp)。
@@ -9,25 +9,30 @@ Agent 在 `tools` 中声明应用函数、控制项和 MCP 服务器，并可在
 ## 准入 {#admission}
 
 - 已保存的 Agent 将所有固定版本工具声明保留为资源数据。保存不代表通过执行资格验证。
-- 创建 Session 时，执行解析器将保存的引用与内联声明解析为不可变 Session 快照，再根据 `services/core/internal/engine` 中所选 Harness 的配置检查组合。不支持的组合在任何写入之前返回 400 `unsupported_or_invalid_configuration`。重复 `web_search` 或 `tool_search`、非对象 schema 根等协议错误使用官方错误字段（[验证](wire-semantics.md#configuration-validation)）。
+- 创建 Session 时，执行解析器将保存的引用与内联声明解析为不可变 Session 快照，再根据 `internal/harnessconfig` 中所选 Harness 的声明检查组合。不支持的组合在任何写入之前返回 400 `unsupported_or_invalid_configuration`。重复 `web_search` 或 `tool_search`、非对象 schema 根等协议错误使用官方错误字段（[验证](wire-semantics.md#configuration-validation)）。
 - 分发之前，所选 Runtime 也必须声明该操作的能力。仅有能力声明不会启用操作。
 - 原生 Harness 运行模型与工具循环。Core 不添加第二个循环、输出修复、schema 强制转换或提示词包装，也不选择原生工具名称。
 
 ## 函数 {#functions}
 
-函数声明要求 `name`、`description` 和 `parameters` 中的 JSON Schema；`defer_loading` 默认为 false，不能为 null。名称必须非空白、唯一且最多 512 字节；每个 Session 最多有 64 个函数定义。保存的引用解析到 Session 快照，定义在原生准备和继续执行期间保持固定。
+函数声明要求 `name`、`description` 和 `parameters` 中的 JSON Schema；`defer_loading` 默认为 false，不能为 null。名称必须非空白且唯一。保存的引用解析到 Session 快照，定义在原生准备和继续执行期间保持固定。
 
 **结果。** 调用方提交 `agent.session.input.tool_result` 事件，包含 `turn_id`、`call_id`、`success`，以及可选且可空的 `error` 和 `output`。输出为字符串或有序文本与图像部分，受 Harness 支持范围约束。批次原子处理并保留字段存在性、原始内容和重试身份；公开结果 Item 与事件始终包含 `output` 和 `error`，未提交时为 null。
 
 | 情况 | 响应 |
 | --- | --- |
-| 相同重试，包括 Turn 结束之后 | 接受 |
+| 相同重试，包括 Turn 结束或调用被放弃之后 | 接受 |
 | 同一调用提交不同结果 | 409 `conflict_error` |
 | Turn 取消后首次提交结果 | 409 `conflict_error` |
+| 为原生 Harness 已放弃的调用首次提交结果 | 409 `conflict_error` |
 | 调用方 Session 内未知调用或其他 Turn 的调用 | 400 `invalid_request_error`；待执行操作不变 |
 | Session 不存在或属于其他范围 | 404 |
 
-[Session 输入冲突](sessions-events.md#input-errors)记录准确消息。无效或不支持的内容不能消耗待处理调用。准入与应用结果分离：只有匹配的原生工具结果出现在实时根 Turn 中，适配器才确认结果（[回执契约](message-content.md#function-results)）。传输写入本身不确认任何事实，确认也不代表提供商已消费结果或外部副作用恰好发生一次。Core 不自动重放结果。
+[Session 输入冲突](sessions-events.md#input-errors)记录准确消息。无效或不支持的内容不能消耗待处理调用。准入与应用结果分离：只有匹配的原生工具结果出现在发起调用的实时 Turn 中，适配器才确认结果（[回执契约](message-content.md#function-results)）。传输写入本身不确认任何事实，确认也不代表提供商已消费结果或外部副作用恰好发生一次。Core 不自动重放结果。
+
+原生 Harness 可能在应用结果之前放弃调用，例如根 Turn 关闭或中断了发起该调用的 Subagent，或 MiniMax Code 的 MCP 客户端使该调用超时。该调用随即不再是待执行操作，Turn 继续运行，并在没有待执行操作时回到 `in_progress`；之后为它提交的 `function_call_output` 会像取消后的结果一样被拒绝。被放弃的调用没有应用回执。
+
+Subagent 发起的函数调用是运行该子级的根 Turn 的待执行操作：`turn_id` 是该根 Turn，`call_id` 等于 [Subagent 路由](subagents.md#public-reads)上该子级 `function_call` Item 的 `call_id`。使用该 `call_id` 和根 Turn ID，以 `function_call_output` / `tool_result` 作答；子级的 Turn ID 不是 Session Turn，会得到“另一个 Turn 的调用”的 400。Subagent 的 HTTP MCP 调用是该子级历史中的 `mcp_call` Item。
 
 ### 待执行操作与恢复 {#required-actions-and-recovery}
 
@@ -41,15 +46,17 @@ SSE 仅提供实时事件。重启或流丢失后，读取 Session 的 `required
 
 `text.format` 接受 `{type: "json_schema", schema: {...}}`，即 Agents API 形式：不包含 `name`、`strict` 或其他 Responses API 包装字段。schema 被保存，经 Agent 和 Session 解析继承，并冻结于 Session 快照。对所有 Harness，显式非对象根类型在保存和 Session 创建时均为协议错误。Claude 要求 schema 根显式为 `type: "object"`。Claude SDK 将 JSON 数字读为 binary64，因此 Session 准入拒绝数字在转换中会变化的 schema；已保存 Agent 保留原值。
 
-Core 在 `ExecutionControls.OutputFormat` 中携带 schema，仅对使用该选项的请求要求配置通过结构化输出资格验证，并要求 Runtime 具有 `structured_output` 和消息观察能力。冻结的 schema 在输入之前送达准备阶段，适用于初次和恢复执行；Start 不能替换它。
+Core 在 `ExecutionControls.OutputFormat` 中携带 schema，仅对使用该选项的请求要求 Harness 声明支持结构化输出，并要求 Runtime 具有 `structured_output` 和消息观察能力。冻结的 schema 在输入之前送达准备阶段，适用于初次和恢复执行；Start 不能替换它。
+
+Claude 适配器将 `outputFormat` 传给固定版本 SDK，并允许原生 `StructuredOutput` 终态工具；该工具属于内部，不是额外的调用方函数。原生会在 Subagent、Skill、MCP 和 ToolSearch 之外添加该工具；适配器的清单检查将它和 ToolSearch 交给原生决定，缺少结构化调用会使结果失败。匹配的实时根工具结果和已归属的成功 SDK 结果确认输出。适配器将原生 `result.result` 字符串原样发布为已完成的 `final_answer` 消息，使用原生 tool-use ID；父 assistant 文本保留自己的 ID。未验证重试和已取消候选不会成为答案，适配器不会把 `structured_output` 重新序列化为 JSON。流遵循官方消息顺序，将整段文本放入一个 `output_text.delta`。桥接层仅在报告 `structured_output` 时声明该操作，工作区 Runtime 还需要 `workspace_structured_output`。
 
-Claude 适配器将 `outputFormat` 传给固定版本 SDK，并允许原生 `StructuredOutput` 终态工具；该工具属于内部，不是额外的调用方函数。匹配的实时根工具结果和已归属的成功 SDK 结果确认输出。适配器将原生 `result.result` 字符串原样发布为已完成的 `final_answer` 消息，使用原生 tool-use ID；父 assistant 文本保留自己的 ID。未验证重试和已取消候选不会成为答案，适配器不会把 `structured_output` 重新序列化为 JSON。流遵循官方消息顺序，将整段文本放入一个 `output_text.delta`。桥接层仅在报告 `structured_output` 时声明该操作，工作区 Runtime 还需要 `workspace_structured_output`。
+Codex 适配器在每个根 Turn（包括 resume 或恢复后的 Turn）上将 schema 原样作为原生 `outputSchema` 发送，并原样发布原生最终 agent 消息文本。Codex 无损读取 JSON 数字，因此 Session 准入除通用规则外不附加数字或根类型限制。引导（steer）输入并入正在运行的 Turn 并沿用其 schema，Subagent 线程不接收该 schema。Codex 将 schema 作为 strict 的 Responses `text.format` 传给模型提供商；无法运行它的提供商原样返回自己的错误，忽略它的提供商可能返回与 schema 不符的文本。
 
 ## 延迟函数发现 {#deferred-function-discovery}
 
 `tool_search` 工具仅包含 `type`；仅适用于 Responses 的执行字段被拒绝。函数 `defer_loading` 标记延迟加载的定义。发现要求两者同时存在：没有延迟函数的 `tool_search`，或没有 `tool_search` 的延迟函数均被拒绝。已保存 Agent 的工具联合类型保留 `tool_search`；固定版本 Session 响应联合类型省略它，因此 Session 与 SSE 资源投影移除它，冻结配置仍保留它。固定版本 Item 联合类型没有 tool-search Item，Core 不自行创建。
 
-Core 发送 `PromptRequestPayload.ToolSearch` 和每个 `FunctionTool.DeferLoading`，并要求配置通过资格验证、Runtime 具备 `tool_search` 能力。原生搜索与 schema 延迟加载属于适配器。Claude 适配器的 MCP 服务器将立即加载定义标记为 `anthropic/alwaysLoad:true`，延迟定义标记为 false，并启用原生 ToolSearch；函数配置仅允许所声明回调、ToolSearch 与选定的工作区工具。工作区 Runtime 从桥接层的 `workspace_tool_search` 功能推导 `tool_search`。原生 Harness 管理模型与提供商策略；已知冲突模式和 beta 设置在适配器中拒绝，不透明策略改变后，SDK 不提供可靠的输入前信号来确认延迟加载是否生效。
+Core 发送 `PromptRequestPayload.ToolSearch` 和每个 `FunctionTool.DeferLoading`，并要求 Harness 声明和 Runtime 均支持 `tool_search`。原生搜索与 schema 延迟加载属于适配器。Claude 适配器的 MCP 服务器将立即加载定义标记为 `anthropic/alwaysLoad:true`，延迟定义标记为 false，并设置 `ENABLE_TOOL_SEARCH=true`；`none` 配置只允许所声明回调、所声明 MCP 工具和 ToolSearch。工作区 Runtime 从桥接层的 `workspace_tool_search` 功能推导 `tool_search`。原生 Harness 管理模型、提供商与 beta 设置策略；适配器不拒绝其中任何一项，SDK 也不提供可靠的输入前信号来确认延迟加载是否生效。
 
 ## Web 搜索与程序化工具调用 {#web-search-and-programmatic-tool-calling}
 
@@ -62,17 +69,17 @@ Core 发送 `PromptRequestPayload.ToolSearch` 和每个 `FunctionTool.DeferLoadi
 
 已保存 Agent 保留固定版本的所有 `web_search` 模式：省略或 null 保存为 `live`，`cached` 和 `live` 原样保存（[保存模式](wire-semantics.md#saved-configuration)）。搜索设置是资源数据：省略或 null 的 `context_size` 解析为 `medium`；省略域名和位置解析为 null；空域名列表保持为空；提供的位置（包括 `{}`）包含 `city`、`country`、`region` 和 `timezone`，省略字段为 null。
 
-执行仅允许 `mode: "disabled"` 和 `enabled: false`。启用或省略模式的搜索、启用或省略 `enabled` 的程序化调用，在 Session 准入时被拒绝，除非 Session 替换了保存的工具。省略程序化配置会保留各 Harness 原生行为，这与官方默认启用行为不同。无关的原生实用工具不会被移除。
+执行把解析后的值交给 Harness，并按 `internal/harnessconfig` 中的声明（`Execution`）校验：支持的 Web 搜索模式以及是否接受搜索设置、reasoning effort 与 summary、service tier、程序化工具调用的取值和 text verbosity。声明之外的值会在 Session 准入时被拒绝，消息会指出字段，除非 Session 替换了保存的工具。Core 仅在 Agent 设置了选项或适用固定版本的默认值时才发送该选项，因此省略 `web_search` 或 `programmatic_tool_calling` 会保留各 Harness 的原生行为。对程序化调用而言，这与官方默认启用的行为不同。无关的原生实用工具不会被移除。省略该控制项时，工作区位置上的 Claude Code 也保留 `WebSearch` 和 `WebFetch`；其 `web_search_call` 操作见 [Turn 与 Item](./sessions-events.md#turns-and-items)。
 
-`DisableProgrammaticToolCalling` 在初次执行和冷继续执行中携带禁用意图，仅在存在时要求 Runtime 能力。搜索使用已有禁用控制项。
+`ExecutionControls` 携带这些选项（[Runtime 协议](../../../docs/zh/runtime-protocol.md#capability-declarations)）。Runtime 只需要 `execution_controls` 能力。
 
-| Harness | 原生执行约束 |
-| --- | --- |
-| Codex | 禁用 code-mode 功能；在启动或恢复线程前检查原生受管要求，拒绝被强制启用的冲突功能 |
-| Claude SDK | 保留受限内置工具清单，并据此验证原生初始化 |
-| MiniMax Code | 保留受限原生工具配置、空文本执行工具清单和禁用的 Web 搜索 |
+| Harness | Web 搜索 | 程序化工具调用 |
+| --- | --- | --- |
+| Codex | `disabled`、`cached` 和 `live`，以及 `context_size`、`allowed_domains` 和 `location`，对应原生 `web_search` 与 `tools.web_search` 设置 | `enabled: true` 开启原生 `code_mode`；`false` 关闭 `code_mode`、`code_mode_only` 和 `code_mode_prewarm`，并在启动或恢复线程前检查原生受管要求 |
+| Claude Code | `disabled` 和 `live`，需使用 `context_size: "medium"`，且不支持 `allowed_domains` 或 `location`。在工作区位置运行原生 `claude_code` 工具集，但移除向用户提问、定时、工作流、后台和 `ListAgents` 工具；`disabled` 会移除 `WebSearch` 和 `WebFetch`，`live` 保留它们。`environment: none` 不保留内置工具，`live` 只增加提供方侧工具 `WebSearch`。`WebFetch` 在此保持关闭，因为没有 Environment 时它会从 Runtime 主机发起抓取 | 仅 `false`：原生 REPL 在模型编写的代码中调用工具，不经过函数回执和工具观察所读取的工具记录 |
+| MiniMax Code | 仅 `disabled`，通过原生 `features.webSearch=false` 实现，因为原生搜索需要 MiniMax 账号凭据。在工作区位置上运行原生工具，`disabled` 还会移除 `web_fetch`，省略该控制项则保留。`environment: none` 没有内置工具 | 仅 `false` |
 
-## HTTP MCP {#http-mcp}
+## MCP {#mcp}
 
 ```json
 {
@@ -85,11 +92,18 @@ Core 发送 `PromptRequestPayload.ToolSearch` 和每个 `FunctionTool.DeferLoadi
 }
 ```
 
-- `server_label` 非空且在 Session 中唯一。仅接受 `http` 传输；`server_url` 为不带凭据、查询或片段的绝对 HTTP 或 HTTPS URL。非空 `headers`、`request_metadata` 和内联 `authorization` 被拒绝。
+- `server_label` 非空且在 Session 中唯一。接受 `http` 和 `stdio` 传输；`server_url` 为不带凭据或片段的绝对 HTTP 或 HTTPS URL。非空 `request_metadata` 被拒绝，消息为 "Nonempty MCP request_metadata is not supported yet."；内联 `authorization` 被拒绝，消息为 "Inline MCP authorization is not supported; use credential_id."。`headers` 为非机密标头，名称和值须为有效的 HTTP 名称和值，且名称不区分大小写唯一，会与 bearer 一同原样传给原生 Harness；`Authorization` 标头被拒绝，因为凭据只通过 Vault 凭据进入。Claude 会拒绝 `server_url` 或标头值中的 `${`（[原生差异](index.md#differences-from-openai)）。
 - [公开 MCP 连接来源](environments.md#public-mcp-connection-origin)定义来源默认值、部署位置和凭据权限；[Harness 能力](harness-capabilities.md#tools)定义各 Harness 支持范围。
 - 省略或 null 的 `allowed_tools` 允许所有服务器工具；`[]` 不允许任何工具。
 - `required: true` 使原生线程创建和冷恢复等待服务器初始化；失败会停止执行，不替换保留历史。它要求 Runtime 的 `mcp_http_required` 能力。等待期间公开工作可被接受或排队。
 - Bearer 认证使用附加的静态或 OAuth Vault 凭据。[Vault 凭据](vaults.md)定义选择规则，[MCP 凭据权限](environments.md#public-mcp-connection-origin)定义冻结的 Runtime 绑定。认证执行要求 `mcp_http_bearer_auth`。
 - Runtime 必须声明 `mcp_http_tools`。原生 Harness 管理发现、调用和结果；公开 `mcp_call` Item 使用原始服务器与工具名称，保留观察到的原生结果。
 
-Codex 在启动或恢复线程之前验证准确的有效 MCP 配置，排除未声明服务器，禁用原生 apps 和 plugins，拒绝原生保留标签和已存储原生 MCP 凭据。Claude 接受 ASCII 字母、数字、下划线和连字符组成的标签，但不允许 `functions`；工具名称还可包含点，并要求已连接服务器具有静态工具清单。匿名 Claude 请求发送空 Authorization 头以阻止原生 OAuth 注入。不支持原生 OAuth 登录。
+`stdio` 服务器携带 `command`、`args`、`cwd` 和 `env_vars`，作为 Environment 的进程运行，需要工作区部署位置（`openai_hosted` 或 `self_hosted`）；在 `environment: none` 上，准入返回 400。其 `connection_origin` 默认且只能为 `environment`，不带 `credential_id`。非空的 Session `env` 被拒绝，消息为 "Inline MCP env is not supported; declare env_vars and set the values in the Environment."；`command` 非空，`cwd` 为绝对路径，`env_vars` 只含变量名，且任何部分都不含 NUL。`env_vars` 指定 Environment 中的变量名，其值不会到达 Core；与 [Plugin MCP](environments.md#plugin-mcp) 相同，Environment 未设置其中某个变量时启动失败。Runtime 必须声明 `mcp_http_tools`，它涵盖所有公开 MCP 服务器。
+
+- Codex 把 `command`、`args`、`cwd` 和 `env_vars` 写入其 `[mcp_servers]` 表，并在任何原生连接之前与其余已声明配置一并验证。
+- Claude Code 以 `command` 和 `args` 在其自身进程所在目录（即工作区目录）启动服务器，因此准入以 "The configured engine starts MCP stdio servers in the workspace directory; set cwd to it." 拒绝其他 `cwd`。Core 拒绝 stdio 服务器的非 null `allowed_tools`，因为适配器只能在 HTTP 服务器上隐藏未选工具。
+- MiniMax Code 在其私有主目录中启动会话 stdio 服务器，任何 `cwd` 都无法指向该目录，因此准入拒绝所有 stdio 服务器，消息为 "The configured engine cannot start MCP stdio servers in the declared cwd."。
+- Codex 把 `env_vars` 交给其受限的原生环境。Claude Code 像启动 Bash 一样以整个进程环境启动服务器，因此服务器也能读到模型提供方密钥和其他 MCP 服务器的 Vault bearer 令牌，适配器设置的变量（如 `HOME`）保持适配器的值。
+
+Codex 以原生方式信任工作区，因此工作区的项目配置在启动和冷恢复时加载，未声明的服务器、apps 和 plugins 保持原生行为。在任何携带 Core 凭据的原生连接之前，它验证每个已声明服务器保持其 URL 或命令、bearer 引用和请求头，否则启动或恢复以错误失败。它拒绝原生保留标签和已存储原生 MCP 凭据。Claude 接受 ASCII 字母、数字、下划线和连字符组成的标签，但不允许 `functions`；接受任意工具名称（原生客户端会将其规范化，适配器拒绝规范化后的冲突），并要求静态工具清单。与本地一致，可选服务器未连接时 Claude 不带其工具继续运行；必需服务器未连接则启动失败。MiniMax Code 以 MCP 服务器 `functions` 提供公共函数，因此声明了函数的 Agent 不能让公共或 Plugin 服务器使用该标签。匿名 Claude 请求发送空 Authorization 头以阻止原生 OAuth 注入。不支持原生 OAuth 登录。
diff --git a/contracts/agents-api/zh/harness-capabilities.md b/contracts/agents-api/zh/harness-capabilities.md
index e8cf6f8fd..2cb49062e 100644
--- a/contracts/agents-api/zh/harness-capabilities.md
+++ b/contracts/agents-api/zh/harness-capabilities.md
@@ -1,10 +1,12 @@
 ---
 title: "Harness 能力"
 source: contracts/agents-api/harness-capabilities.md
-source_hash: a88b7238811707dd7fecae6ee8e509572677b49958e36ddabf8b783e97382c13
+source_hash: d79690e618d82c6b858dc40342198fc5b091ee56505816f551da80d100ef2c2e
 ---
 
-本页列出每个 Harness 在每种部署位置支持的能力。Core 根据 `services/core/internal/engine` 中 Harness 的引擎配置决定准入，运行 Session 的 Runtime 也必须声明操作。所链接契约定义各操作；[Harness 接入](harness-onboarding.md#qualify-the-adapter)说明资格验证方法。
+本页列出每个 Harness 在每种部署位置支持的能力。Core 根据 `internal/harnessconfig/<package>/declaration.go` 中 Harness 的声明决定准入，运行 Session 的 Runtime 也必须声明操作。所链接契约定义各操作；[Harness 接入](harness-onboarding.md#qualify-the-adapter)说明资格验证方法。
+
+本页未列出的行为遵循 Harness 在所选模型下的原生行为，与本地运行一致。每个适配器指南列出它为云端无人值守执行而覆盖的原生默认值（[设计规则](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#core-assembles-harnesses-run-natively)）。
 
 | 状态 | 含义 |
 | --- | --- |
@@ -16,14 +18,15 @@ source_hash: a88b7238811707dd7fecae6ee8e509572677b49958e36ddabf8b783e97382c13
 
 ## 执行与输入 {#execution-and-input}
 
-| 操作 | Codex | Claude SDK | MiniMax Code |
+| 操作 | Codex | Claude Code | MiniMax Code |
 | --- | --- | --- | --- |
 | 文本 Turn、活动输入、取消、重启与继续 | 所有位置已验证 | 所有位置已验证 | 所有位置已验证 |
 | [文件与 Artifact](environment-files.md) | 已验证：托管、自托管 | 已验证：托管、自托管 | 已验证：托管、自托管 |
-| [仅空白消息文本](message-content.md) | 已准入；原样交付 | 已拒绝 | 已拒绝 |
-| [内联 PNG、JPEG 消息图像](message-content.md) | 所有位置已验证 | 所有位置已验证 | 已拒绝 |
-| 远程图像 URL | 已拒绝 | 已拒绝 | 已拒绝 |
-| 显式 `reasoning`；非 `auto` 的 `service_tier` | 已拒绝 | 已拒绝 | 已拒绝 |
+| [仅空白消息文本](message-content.md) | 已准入；原样交付 | 已准入；原生会丢弃它，全空白消息变为 `(no content)` | 已拒绝 |
+| [消息图像](message-content.md#images) | PNG、JPEG data URL：所有位置已验证；其他 data URL：已准入；远程 URL：已拒绝 | PNG、JPEG data URL：所有位置已验证；远程 URL 及 GIF、WebP data URL：已准入 | 已拒绝 |
+| `reasoning.effort` | `none`、`minimal`、`low`、`medium`、`high`、`xhigh`、`max`：已准入 | `low`、`medium`、`high`、`xhigh`、`max`：已准入 | `none`、`minimal`、`low`、`medium`、`high`、`xhigh`、`max`：已准入 |
+| `reasoning.summary` | `concise`、`detailed`、`auto`：已准入 | `auto`：已准入 | 已拒绝 |
+| 非 `auto` 的 `service_tier` | `default`、`flex`、`priority`：已准入 | 已拒绝 | 已拒绝 |
 | 非 `medium` 的 `text.verbosity` | 已准入；由原生模型决定 | 已拒绝 | 已拒绝 |
 | [公开 token 用量](sessions-events.md) | 测量计数器 | Null | Null |
 
@@ -31,28 +34,29 @@ source_hash: a88b7238811707dd7fecae6ee8e509572677b49958e36ddabf8b783e97382c13
 
 ## 工具 {#tools}
 
-| 操作 | Codex | Claude SDK | MiniMax Code |
+| 操作 | Codex | Claude Code | MiniMax Code |
 | --- | --- | --- | --- |
-| 文本结果的[公开函数](execution-tools.md#functions) | 已验证：`none`、托管；已准入：自托管 | 所有位置已验证；仅对象根 schema | 已拒绝 |
-| [含图像函数结果](message-content.md#function-results) | 已验证：`none`、托管；已准入：自托管 | 所有位置已验证；仅成功结果中的内联 PNG 或 JPEG | 已拒绝 |
-| [结构化输出](execution-tools.md#structured-output) | 已拒绝 | 所有位置已验证 | 已拒绝 |
+| 文本结果的[公开函数](execution-tools.md#functions) | 已验证：`none`、托管；已准入：自托管 | 所有位置已验证；仅对象根 schema | 已验证：`none`；已准入：托管、自托管；仅对象根 schema；结果须在 120 秒内到达（[差异](index.md#differences-from-openai)） |
+| [含图像函数结果](message-content.md#function-results) | 已验证：`none`、托管；已准入：自托管；远程 URL：已拒绝 | 仅成功结果；PNG、JPEG data URL：所有位置已验证；GIF、WebP：已准入 | 已拒绝 |
+| [结构化输出](execution-tools.md#structured-output) | 所有位置已准入 | 所有位置已验证 | 已拒绝 |
 | [延迟函数发现](execution-tools.md#deferred-function-discovery) | 已拒绝 | 已验证：`none`、自托管；已准入：托管 | 已拒绝 |
 | [禁用 Web 搜索与程序化工具调用](execution-tools.md#web-search-and-programmatic-tool-calling) | 已验证：`none`；已准入：托管、自托管 | 已验证：`none`；已准入：托管、自托管 | 已验证：`none`；已准入：托管、自托管 |
-| 启用 Web 搜索或程序化工具调用 | 已拒绝 | 已拒绝 | 已拒绝 |
-| [服务端来源 HTTP MCP](environments.md#public-mcp-connection-origin) | 已验证：`none`；其他位置拒绝 | 已验证：`none`；其他位置拒绝 | 已拒绝 |
+| Web 搜索 `cached` 或 `live`，以及程序化工具调用 `enabled` | 所有位置已准入 | `live` 在所有位置已准入；`cached` 和 `enabled` 已拒绝 | 已拒绝 |
+| [服务端来源 HTTP MCP](environments.md#public-mcp-connection-origin) | 已验证：`none`；其他位置拒绝 | 已验证：`none`；其他位置拒绝 | 已验证：`none`，仅 `allowed_tools` null、`required` false；其他位置拒绝 |
 | [Environment 来源 HTTP MCP](environments.md#public-mcp-connection-origin) | 已验证：托管、自托管 | 已验证：托管、自托管 | 已验证：托管、自托管；仅 `allowed_tools` null、`required` false |
-| [HTTP MCP bearer 凭据](execution-tools.md#http-mcp) | 已验证 | 已验证 | 已验证 |
+| [stdio MCP](execution-tools.md#mcp) | 已准入：托管、自托管 | 已准入：托管、自托管；`cwd` 须为工作区目录，`allowed_tools` 须为 null | 已拒绝 |
+| [HTTP MCP bearer 凭据](execution-tools.md#mcp) | 已验证 | 已验证 | 已验证 |
 | 必需 MCP 初始化 | 已验证 | 已验证 | 已拒绝 |
 | [Subagent](subagents.md) | 已验证：托管；已准入：`none`、自托管 | 已验证：托管；已准入：`none`、自托管 | 已验证：托管；已准入：`none`、自托管 |
-| Subagent 与函数或 HTTP MCP 同时使用 | 已拒绝 | 已拒绝 | 已拒绝 |
+| Subagent 与函数或 HTTP MCP 同时使用 | 已验证：`none`；已准入：托管、自托管 | 已验证：`none` 上的函数；已准入：HTTP MCP、托管、自托管 | 已准入；子级不获得 Session 的函数和 MCP 服务器 |
 
-Claude 结构化输出要求单 Agent、medium verbosity，且无 Skill、Plugin、能力目录、MCP 或 `tool_search`。Claude 延迟发现要求单 Agent，除 `tool_search` 与禁用控制项外仅函数工具，无 Skill、Plugin 或能力目录，也无结构化输出。Claude 在工作区位置需要每种操作的打包桥接功能（`workspace_functions`、`workspace_structured_output`、`workspace_tool_search`、`workspace_mcp_http`）。
+Claude 结构化输出要求 medium verbosity，可与 `multi_agent`、Skill、Plugin、能力目录、MCP 和 `tool_search` 组合。Claude 延迟发现可与 MCP、Skill、Plugin、能力目录和结构化输出组合。Claude Subagent 继承父级的工具，包括延迟加载的函数。`tool_search` 是否对所配置的模型、提供商和 beta 设置生效，由 Claude Code 决定。Claude 在工作区位置需要每种操作的打包桥接功能（`workspace_functions`、`workspace_structured_output`、`workspace_tool_search`、`workspace_mcp_http`）。
 
 ## Environment 准备 {#environment-preparation}
 
 这些操作要求工作区，因此仅适用于托管与自托管位置。
 
-| 操作 | Codex | Claude SDK | MiniMax Code |
+| 操作 | Codex | Claude Code | MiniMax Code |
 | --- | --- | --- | --- |
 | [初始文件、设置命令、Skill 与 Plugin](environments.md#runtime-capability-preparation) | 已验证：托管、自托管 | 已验证：自托管；已准入：托管 | 已验证：自托管；已准入：托管 |
 | 能力目录 | 已准入 | 已准入 | 已准入 |
@@ -60,6 +64,6 @@ Claude 结构化输出要求单 Agent、medium verbosity，且无 Skill、Plugin
 | `packages.system` | 已拒绝 | 已拒绝 | 已拒绝 |
 | 网络 `disabled` 或 `restricted` | 已拒绝 | 已拒绝 | 已拒绝 |
 | [stdio Plugin MCP](environments.md#plugin-mcp) | 已验证：托管、自托管 | 已验证：自托管；已准入：托管 | 已验证：自托管；已准入：托管 |
-| HTTP Plugin MCP | 已准入，字面值头或 HTTPS bearer | 已准入，匿名或 HTTPS bearer | 已验证：自托管；已准入：托管；匿名或 HTTPS bearer |
+| HTTP Plugin MCP | 已准入，字面值头或 HTTPS bearer | 已准入，字面值头或 HTTPS bearer | 已验证：自托管；已准入：托管；字面值头或 HTTPS bearer |
 
-外部工作区存储还要求所选 Harness profile 和 Runtime 支持 `retained_native_history`；自带工作区存储不要求此能力。[工作区提供商指南](../../../docs/zh/workspace-provider.md)定义存储组合准入规则。
+外部工作区存储还要求所选 Harness 声明和 Runtime 支持 `retained_native_history`；使用自有磁盘的 Docker 和 E2B 不要求此能力。microsandbox 始终使用外部存储，因此未声明该能力的 MiniMax Code 无法在其上运行。[工作区文件系统协议](../../../docs/zh/workspace-provider.md)定义存储组合准入规则。
diff --git a/contracts/agents-api/zh/harness-catalog.md b/contracts/agents-api/zh/harness-catalog.md
index 8ba21349d..198b215fc 100644
--- a/contracts/agents-api/zh/harness-catalog.md
+++ b/contracts/agents-api/zh/harness-catalog.md
@@ -1,12 +1,16 @@
+---
+title: "内置 Harness 注册"
+---
+
 [//]: # (Generated by scripts/generate-harness-catalog.py; DO NOT EDIT.)
 # 内置 Harness 注册 {#built-in-harness-registrations}
 
-注册列表的源文件是 [`catalog.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/builtin/catalog.json)。修改后运行 `make generate-harness-catalog`；`make check-harness-catalog` 检查生成结果。
+每个 Harness 对应 `internal/harnessconfig/<package>` 目录中唯一的 `declaration.go`。新增包含 `declaration.go` 的目录即注册该 Harness；`make generate-harness-catalog` 重新生成注册代码和本页，`make check-harness-catalog` 检查生成结果。
 
-| 标识符 | 显示名称 | 模型配置声明 | Core 验收构造函数 |
-| --- | --- | --- | --- |
-| `claude_sdk` | Claude Code | `claudesdk.Configuration` | `claudeProfile` |
-| `codex` | Codex | `codex.Configuration` | `codexProfile` |
-| `mcode` | MiniMax Code | `mcode.Configuration` | `mcodeProfile` |
+| 标识符 | 显示名称 | 声明 |
+| --- | --- | --- |
+| `claude_sdk` | Claude Code | [`claudesdk/declaration.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/claudesdk/declaration.go) |
+| `codex` | Codex | [`codex/declaration.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/codex/declaration.go) |
+| `mcode` | MiniMax Code | [`mcode/declaration.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/mcode/declaration.go) |
 
-配置声明位于 `internal/harnessconfig/<package>`，验收构造函数位于 `services/core/internal/engine`。这些注册描述当前构建。部署启用的 Harness 由 `OAC_HARNESSES` [进程设置](../../../docs/zh/configuration.md#settings)决定；[Harness 能力](./harness-capabilities.md)列出各 Harness 的支持范围，连接的 Runtime 报告自身可用性。[Harness 接入](./harness-onboarding.md)介绍适配器和打包步骤。
+这些注册描述当前构建。部署启用的 Harness 由 `OAC_HARNESSES` [进程设置](../../../docs/zh/configuration.md#settings)决定；[Harness 能力](./harness-capabilities.md)列出各 Harness 的支持范围，连接的 Runtime 报告自身可用性。[Harness protocol](./harness-onboarding.md)介绍适配器和打包步骤。
diff --git a/contracts/agents-api/zh/harness-onboarding.md b/contracts/agents-api/zh/harness-onboarding.md
index 7dd671a16..3d7db2da5 100644
--- a/contracts/agents-api/zh/harness-onboarding.md
+++ b/contracts/agents-api/zh/harness-onboarding.md
@@ -1,61 +1,61 @@
 ---
-title: "添加 Harness"
+title: "Harness 协议"
 source: contracts/agents-api/harness-onboarding.md
-source_hash: a1db7d464a42cc82bbe285b12a3290d76d0535c5a6a8fb2563586631c6b9136c
+source_hash: 8beb6af27e99a4bf25a2e828d1b2c1c51adcd7b597f3cd64a211396a506a09c0
 ---
 
-**Harness** 是一种运行模型和工具循环的原生代理引擎（Codex、Claude Code、MiniMax Code）。**Harness 适配器**将 Runtime 的 Executor 和 Turn 契约转换到该引擎的 SDK 或协议。本文档定义 Runtime–Harness 协议：适配器接口及其生命周期义务、注册、Core 资格认定和验收。[Harness capabilities](harness-capabilities.md) 记录了当前每个 Harness 支持的功能。
+**Harness** 是一种运行模型和工具循环的原生代理引擎（Codex、Claude Code、MiniMax Code）；**Harness 适配器**将 Runtime 的 Executor 和 Turn 契约转换到该引擎的 SDK 或协议。Harness 协议是 Runtime 与适配器之间的契约：适配器接口及其生命周期义务、声明、注册和验收。本文面向添加或维护 Harness 的开发者。
 
-从两个入口开始：
-
-- [`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go)：共享模型配置契约（声明和准备）。
-- [`agent/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/agent/harness.go)：执行生命周期、扩展契约和注册方法。
+| 属性 | 内容 |
+| --- | --- |
+| 调用方 | Runtime（[dispatch](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/apps/daemon/internal/dispatch)） |
+| 实现方 | Codex、Claude Code 和 MiniMax Code 适配器（[原生参考](#native-references)）。[Harness capabilities](harness-capabilities.md) 记录了每个 Harness 支持的功能。 |
+| 代码 | [`agent/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/agent/harness.go)：执行生命周期、扩展契约和注册方法。[`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go)：每个 Harness 提供的 `Declaration`、声明注册表以及共享模型配置契约。 |
+| 传输 | 进程内 Go 接口。Runtime 通过 [Core–Runtime 协议](../../../docs/zh/runtime-protocol.md)与 Core 通信。 |
+| 版本规则 | 接口变更须在同一次变更中修改本文和每个适配器。 |
 
 ## 所有权 {#ownership}
 
-```text
-Core: Session, Turn, immutable configuration, durable events
-                         |
-              common Runtime protocol
-                         |
-Runtime: Executor preparation, reuse, idle expiry, recovery
-                         |
-               Harness adapter package
-                         |
-          native SDK, process or connection
+```mermaid
+flowchart TB
+    Core["Core<br/>Session, Turn, immutable configuration, durable events"]
+    Runtime["Runtime<br/>Executor preparation, reuse, idle expiry, recovery"]
+    Adapter["Harness adapter package"]
+    Native["Native SDK, process or connection"]
+    Core -->|"Core-Runtime protocol"| Runtime
+    Runtime -->|"Executor and Turn interfaces"| Adapter
+    Adapter --> Native
 ```
 
 | 组件 | 职责 | 位置 |
 | --- | --- | --- |
 | Core | 公共 API、控制权、持久状态、调度和配置快照 | `services/core` |
 | Runtime | 经身份验证的连接、共享能力准备以及通用 Executor 和 Turn 生命周期 | `apps/daemon/internal/dispatch` |
-| Adapter | 原生配置、资源、API 调用、事件转换和限制 | `apps/daemon/internal/agent/<kind>` |
+| Adapter | 原生配置、资源、API 调用、事件转换和限制 | `apps/daemon/internal/agent/<package>` |
 | Harness | 原生模型和工具循环以及历史记录 | 锁定版本的 SDK 或可执行文件 |
-| 服务 profile | 对已认定合格的操作和放置位置进行纯验证 | `services/core/internal/engine` |
-| 注册 | 适配器声明、已安装工厂和已验证能力 | `apps/daemon/internal/agent/<kind>/declaration.go`；`apps/daemon/internal/cli/agent_discovery.go` 中的静态列表 |
+| 声明 | Harness 的最大能力、放置位置、配置和纯准入限制，由 Core 准入和 Runtime 共同读取 | `internal/harnessconfig/<package>/declaration.go` |
+| Runtime 绑定 | 声明加上发现、已安装工厂和已验证能力 | `apps/daemon/internal/agent/<package>/declaration.go` |
 
 Environment 提供执行资源。受管 E2B、Docker 和 microsandbox 机器以及应用自有机器在预配和连接方式上有所不同；已连接的 Runtime 使用同一契约。daemon 运行于 Linux、macOS 和 Windows，受管提供商仅支持 Linux，并且每个适配器自行认定其支持的平台（[self-hosted platforms](../../../docs/zh/getting-started/self-hosted.md#platforms)）。只有在 Runtime 加载绑定的已安装快照后，原生工厂才会收到能力（[capability preparation](environments.md#runtime-capability-preparation)）。模型提供商负责模型通信设置，而不负责 Turn 调度或原生进程所有权。
 
 ## 步骤 {#steps}
 
 1. **锁定原生来源。** 记录上游包版本和源修订版本，并在适配器旁记录原生入口点。
-2. **实现适配器**，位置为 `apps/daemon/internal/agent/<kind>`：实现 `ExecutorFactory`、`Executor` 和 `Turn`（[required interfaces](#required-adapter-interfaces)、[lifetimes](#executor-and-turn-lifetimes)）。复用共享的进程、凭据、配置和本地工作区辅助函数。
-3. **在适配器中声明 kind**，并将其声明添加到 `apps/daemon/internal/cli/agent_discovery.go` 中 Runtime 的静态列表（[register the adapter](#register-the-adapter)）。
-4. **添加服务 profile 和一个目录条目**（[add the engine to Core](#add-the-engine-to-core)）。
-5. **打包原生先决条件。** 在 `services/core/deploy/<kind>` 下添加 Runtime 镜像，并可选添加 [native installer participation](#native-installer-participation)。
-6. **启用并选择引擎**，通过 `OAC_HARNESSES` 设置和 [Harness selection](model-execution.md#harness-selection) 完成。
-7. **认定其资格**（[qualify the adapter](#qualify-the-adapter)），并将结果记录到 [Harness capabilities](harness-capabilities.md)。
+2. **实现适配器**，位置为 `apps/daemon/internal/agent/<package>`，其中 `<package>` 是去掉下划线的 kind：实现 `ExecutorFactory`、`Executor` 和 `Turn`（[required interfaces](#required-adapter-interfaces)、[lifetimes](#executor-and-turn-lifetimes)）。复用共享的进程、凭据、配置和本地工作区辅助函数。
+3. **编写声明**：在 `internal/harnessconfig/<package>/declaration.go` 中编写声明，并将其绑定到适配器的发现函数（[declare the Harness](#declare-the-harness)、[register the adapter](#register-the-adapter)）。运行 `make generate-harness-catalog` 完成两处注册。
+4. **打包原生先决条件。** 在 `services/core/deploy/<kind>` 下添加 Runtime 镜像，并可选添加 [native installer participation](#native-installer-participation)。
+5. **启用并选择引擎**，通过 `OAC_HARNESSES` 设置和 [Harness selection](model-execution.md#harness-selection) 完成。
+6. **认定其资格**（[qualify the adapter](#qualify-the-adapter)），并将结果记录到 [Harness capabilities](harness-capabilities.md)。
 
 实现强制的文本生命周期，并明确处理每一种扩展。逐个认定受支持扩展的资格；未认定资格的扩展返回 `agent.ErrUnsupportedOperation`，且不会产生原生副作用。原生取消可能要求退役而非复用：`Reusable=false` 会携带原因，调用方必须确认 `Executor.Close`。不要为了适配测试辅助函数而强制复用，也不要将适配器的原生限制复制到共享 Core 协议中。
 
 ## 架构规则 {#architecture-rules}
 
-- Codex、Claude Code 和未来的 Harness 地位平等。通用 Runtime 线协议以及 Executor 和 Turn 接口负责生命周期、输入回执、取消、恢复和资源访问；每个适配器保留其原生实现以及模型和工具循环。
-- 新引擎需要提供适配器、已认定合格的 profile、注册以及经过独立验证的部署。它不得在 API 处理程序、持久化、调度、调度器或 Environment 提供商中添加按引擎名称分支的实现，也不得为契约已经涵盖的能力添加处理程序、存储表、调度器、事件投影器或模型循环。
+[Complexity stays in the adapter](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#complexity-stays-in-the-adapter) 和 [Core assembles, Harnesses run natively](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#core-assembles-harnesses-run-natively) 适用于每个 Harness。以下规则为 Harness 专有：
 - 将必需的生命周期声明、扩展接口和注册方法保留在 `agent/harness.go` 中。结果类型、错误和 Registry 存储可以保留在聚焦的文件中。
 - 使用现有的 `proto.SupportedAgentKind` 和 `AgentKindCapabilities` schema。不要添加第二套能力描述符或组合式可选接口。
 - 接入不要求功能完全一致。Harness 不必匹配彼此的可选功能，并且注册时不强制要求 MCP、函数、图像或详细程度控制。验证通用生命周期义务，并对每个声明的操作使用相同的公共断言。缺少声明或扩展实现会阻止接入；原生差异不会。
-- 服务 profile 目录是资格认定边界。未知 profile 以关闭方式失败，并且 Runtime 心跳无法授权新的公共功能。Schema 有效性、服务资格认定和可用 Runtime 是相互独立的检查。
+- 声明是支持边界。未注册的 kind 以关闭方式失败，Runtime 心跳无法授权新的公共功能，也无法扩大声明：发现过程只能收窄。Schema 有效性、声明的支持范围和可用 Runtime 是相互独立的检查。
 - 绝不能将已接受的参数等同于已实际应用的原生行为。
 
 ## 必需的适配器接口 {#required-adapter-interfaces}
@@ -69,7 +69,6 @@ Environment 提供执行资源。受管 E2B、Docker 和 microsandbox 机器以
 | `ExecutorFactory`、`Executor.StartTurn`、`Executor.Close` | 真实实现 | 在没有模型输入的情况下准备；保留失败或不确定资源的所有权；确认清理 |
 | `Session`、`Turn`、`CancellationOutcome`、`AwaitSettlement` | 真实实现 | 取消精确的 Turn，保留已观察结果，并独立于取消请求确认结算 |
 | `DurableSteerer` | 每个 Turn 上真实实现 | 区分完整写入与原生应用回执；保留重试身份 |
-| `Steerer` | 明确实现或 Unsupported | 额外的非持久化活动 Turn 输入 |
 | `FunctionResultSubmitter` | 明确实现或 Unsupported | 匹配原生调用和结果身份，并确认应用 |
 | `WorkspaceReader`、`WorkspaceDirectoryLister`、`WorkspaceWriter` | 在 Turn 和 Executor 所有者上明确实现 | 使用授权工作区，确认访问，提交或关闭，或者返回该操作的 Unsupported 错误 |
 | 中立消息、图像、MCP、结构化输出和 Subagent 观察 | 明确作出能力决策 | 保持每项操作的协议语义；在提交前拒绝不受支持的输入 |
@@ -90,7 +89,7 @@ func (s *Session) SubmitFunctionResult(context.Context, proto.FunctionResultPayl
 
 工作区能力描述实际 Runtime 与资源所有者的组合。Codex 和 MiniMax 资源对象拒绝原生工作区访问，而通用的授权 `localworkspace` 所有者提供该访问；Claude 可以公开原生读取和列举访问，通用所有者提供写入。仅仅存在相应接口绝不会选择某个资源或宣称支持。
 
-服务 profile 对公共组合进行资格认定，Runtime 宣称已安装的组合；二者都不能替代 schema 验证或项目授权。原生行为测试必须与声明一致。已宣称但返回 Unsupported 的操作属于契约违规，既不是成功，也不能作为重放的依据。
+声明对公共组合进行准入，Runtime 宣称已安装的组合；二者都不能替代 schema 验证或项目授权。原生行为测试必须与声明一致。已宣称但返回 Unsupported 的操作属于契约违规，既不是成功，也不能作为重放的依据。
 
 ## Executor 和 Turn 生命周期 {#executor-and-turn-lifetimes}
 
@@ -104,6 +103,20 @@ func (s *Session) SubmitFunctionResult(context.Context, proto.FunctionResultPayl
 
 Session 在其已连接的 Runtime 中拥有一个可复用的 Executor；Turn 拥有一次输入执行、其输出流和其取消操作。`agent.ExecutorFactory` 在没有模型输入的情况下准备固定配置，而 `Executor.StartTurn` 创建新的 `agent.Turn`，不替换健康的原生资源。正常完成仅结算 Turn。`Executor.Close` 在空闲过期、Environment 关闭或确认失效时释放原生资源；它既不释放 Environment 分配，也不释放工作区。Core 不保留第二套 Executor 缓存。相同的生命周期适用于托管、自托管和 `none` 放置方式。
 
+Executor 按下列状态转移。每个 Turn 在 `StartTurn` 与 `AwaitSettlement` 之间运行。
+
+```mermaid
+stateDiagram-v2
+    [*] --> Idle: prepared
+    Idle --> Running: StartTurn
+    Running --> Idle: reusable
+    Running --> Closing: not reusable or shutdown
+    Idle --> Closing: idle expiry, shutdown or invalidation
+    Closing --> Closing: Close failed, retry
+    Closing --> Closed: Close confirmed
+    Closed --> [*]
+```
+
 **绑定。** Runtime 将其 Executor 记录绑定到 Session、Environment、连接和不可变执行配置。恢复身份和先前 Turn 恢复标志是连续性断言，而不是配置更改。提供的原生身份必须与保留的所有者匹配；当需要现有历史时，恢复绝不能启动新的根。配置冲突属于错误，而不是热切换。普通连接丢失会让其所有者和句柄退役；[计划性挂起](../../../docs/zh/runtime-protocol.md#preparation-and-execution-order) 则保留已结算的空闲所有者，直至精确匹配且已认证的恢复完成。旧计时器、输出和取消操作不能影响替代所有者。
 
 **每 Turn 状态。** 每个 Turn 都会获得全新的包装器、输出通道和回执状态。引导和函数接口均属于该 Turn。原生回调必须在异步工作开始前捕获来源 Turn，因此迟到事件绝不会被归到当前活动的 Turn 上。原生进程、query 或传输连接、固定能力配置和原生 session 身份均属于 Executor。不要重置已完成的 `sync.Once` 值，也不要复用旧 Turn 对象。
@@ -119,7 +132,7 @@ Session 在其已连接的 Runtime 中拥有一个可复用的 Executor；Turn 
 - 每个 `Session` 都要声明 `CancellationOutcome`。`Turn` 继承该声明。快照保留已观察到的原生身份、Usage 和输出，并在取消后仍可读取。缺失的证据保持未设置；空的 `DonePayload` 表示未观察到任何内容，而不是表示取消成功或不受支持。读取快照不会等待结算。
 - `Session.Cancel` 请求取消；输出关闭表示拆卸开始。Turn 结算仍需要 `AwaitSettlement` 和所需的任何 `Executor.Close`；取消请求成功或其快照都不能替代这些等待。
 
-**Runtime 在 Turn 前后执行的工作。** 一个输出消费者会在原生 Start 之前启动，耗尽有界的 64 帧通道，并将终态观察保留到 Start 发布、Turn 结算和已准入操作回执完成为止。正常完成绝不调用 Cancel。输入和函数准入会在结算前关闭；已准入的操作会持有其屏障，直至原生回执和出站确认完成。Runtime 会在等待该屏障之前向 Turn 发送取消，因为已写入的输入可能需要原生中断才能生成回执。Runtime 会汇合原生结算、所需的已确认 Executor 关闭、输出耗尽和所有已准入操作，然后应用确认或执行复用，之后才会转发 Done 或已应用的取消回执。Close 失败可以报告失败，同时保留同一 Run 和未完成操作以供重试；已关闭的调用方等待无法凭空生成已应用输入回执。Runtime 会在发布 Done 前提交原生连续性状态并释放旧 Run 的准入，因为接收方可能立即启动另一个 Turn；迟到的终态发送失败属于旧 Run，不能使已拥有 Executor 的后继对象失效。连接关闭负责传输丢失清理。结算等待时间为十秒，回执发送预算为五秒；超时不能证明已达到静默状态。
+**Runtime 在 Turn 前后执行的工作。** 一个输出消费者会在原生 Start 之前启动，耗尽有界的输出通道，并将终态观察保留到 Start 发布、Turn 结算和已准入操作回执完成为止。正常完成绝不调用 Cancel。输入和函数准入会在结算前关闭；已准入的操作会持有其屏障，直至原生回执和出站确认完成。Runtime 会在等待该屏障之前向 Turn 发送取消，因为已写入的输入可能需要原生中断才能生成回执。Runtime 会汇合原生结算、所需的已确认 Executor 关闭、输出耗尽和所有已准入操作，然后应用确认或执行复用，之后才会转发 Done 或已应用的取消回执。Close 失败可以报告失败，同时保留同一 Run 和未完成操作以供重试；已关闭的调用方等待无法凭空生成已应用输入回执。Runtime 会在发布 Done 前提交原生连续性状态并释放旧 Run 的准入，因为接收方可能立即启动另一个 Turn；迟到的终态发送失败属于旧 Run，不能使已拥有 Executor 的后继对象失效。连接关闭负责传输丢失清理。结算等待时间和回执发送预算均有上限（见[超时与限制](../../../docs/zh/runtime-protocol.md#timeouts-and-limits)）；超时不能证明已达到静默状态。
 
 ## 事件、输入和可选能力 {#events-inputs-and-optional-capabilities}
 
@@ -129,17 +142,17 @@ Session 在其已连接的 Runtime 中拥有一个可复用的 Executor；Turn 
 
 ### 必需操作和扩展操作 {#required-and-extension-operations}
 
-公共文本路径要求持久化 Turn、已应用输入回执、有序观察、取消，以及执行已禁用的执行控制；`execution.Policy.engineCapabilities` 保存精确要求。没有原生工具的引擎可以保证这些工具不存在；具有工具的引擎在收到要求时必须实际禁用它们。接受某项配置不能证明其已得到执行。
+公共文本路径要求持久化 Turn、已应用输入回执、有序观察、取消，以及执行已禁用的执行控制；`execution.Policy` 保存精确要求。没有原生工具的引擎可以保证这些工具不存在；具有工具的引擎在收到要求时必须实际禁用它们。接受某项配置不能证明其已得到执行。
 
 MCP、公共函数、延迟函数发现、结构化输出、图像输入、详细程度控制和其他可选操作不必匹配另一个引擎。使用 Unsupported 拒绝未认定资格的组合并记录差距；绝不能宣称某项能力来绕过选择。
 
-- 结构化输出：读取 `ExecutionControls.OutputFormat`，并通过 Message 契约发布已确认的原生输出（[execution tools](execution-tools.md#structured-output)）。公共资格认定与 Runtime 能力分别注册。
-- 图像：分别注册 Runtime 的 `MessageImages` 并认定 profile 的 `MessageImages` 资格（[message input](message-content.md)）。
+- 结构化输出：读取 `ExecutionControls.OutputFormat`，并通过 Message 契约发布已确认的原生输出（[execution tools](execution-tools.md#structured-output)）。声明的 `StructuredOutput` 能力负责准入；Runtime 单独宣称其已安装的能力。
+- 图像：声明 `MessageImages`；Runtime 单独宣称其已安装的能力（[message input](message-content.md)）。
 - 工作区放置方式还需要经过验证的准备过程、工作区读取和输出导出，以及使用共享 Files 辅助函数的专用 Runtime 绑定。只有在展示其生命周期行为后才能启用放置方式。
 
 ### MCP 来源和原生限制 {#mcp-origin-and-native-limits}
 
-在引擎 profile 的 `MCPOrigins` 中声明受支持的公共来源，并在 `MCPBearer` 中声明 bearer 支持。Runtime 宣称其实际 HTTP、bearer 和必需初始化能力。共享准入负责验证来源和放置位置；适配器验证负责保留原生标签、允许列表和初始化限制。
+在声明的 `MCPOrigins` 中声明受支持的公共来源，并在 `MCPHTTPBearerAuth` 能力中声明 bearer 支持。Runtime 宣称其实际 HTTP、bearer 和必需初始化能力。共享准入负责验证来源和放置位置；适配器验证负责保留原生标签、允许列表和初始化限制。
 
 使用 `agent.ResolveMCPBindings` 处理公共声明和已安装声明，并保留来源、凭据权限、`null` 与空允许列表之间的区别以及必需启动过程。不要将令牌复制到原生 profile 中，也不要将服务请求重新解释为 Environment 请求。拒绝不受支持的原生策略，而不是将其丢弃。遵循 [MCP origin contract](environments.md#public-mcp-connection-origin)，并对每个宣称的组合执行公共客户端、失败、取消和冷恢复资格认定。模型能力与 Harness 传输支持相互独立；绝不能从模型名称推断模型能力，也绝不能静默降低输入质量。
 
@@ -149,7 +162,7 @@ MCP、公共函数、延迟函数发现、结构化输出、图像输入、详
 
 ## 注册适配器 {#register-the-adapter}
 
-注册是静态的，并且需要构建。从 `apps/daemon/internal/agent/<kind>/declaration.go` 导出一个 `agent.Declaration`，然后将其添加到 [`cli/agent_discovery.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/cli/agent_discovery.go) 的 `harnessDeclarations` 中。声明包含 kind、完整能力描述符、共享模型 `Configuration` 和 `Discover` 函数。发现过程接收 profile、诊断写入器以及 Runtime 解析后的 `DiscoveryOptions.StateRoot` 和实例私有的 `DiscoveryOptions.RuntimeRoot`，负责原生配置和可用性检查，并返回已安装的 `agent.Runtime` 及其描述符和 Executor 工厂。未配置适配器时返回 nil；已配置的前置条件失败时，返回不带工厂的不可用描述符。将版本门控和工厂选择条件保留在适配器内部。
+注册是静态的，并且需要构建。从 `apps/daemon/internal/agent/<package>/declaration.go` 导出一个 `agent.Declaration`，然后运行 `make generate-harness-catalog`，它会把该声明列入生成的 `harnessDeclarations`。绑定由共享的 `harnessconfig.Declaration` 加上 `Discover` 函数组成。发现过程接收 profile、诊断写入器以及 Runtime 解析后的 `DiscoveryOptions.StateRoot` 和实例私有的 `DiscoveryOptions.RuntimeRoot`，负责原生配置和可用性检查，并返回已安装的 `agent.Runtime` 及其描述符和 Executor 工厂。未配置适配器时返回 nil；已配置的前置条件失败时，返回不带工厂的不可用描述符。发现过程只用 `agent.Narrow` 收窄声明的能力，绝不扩大；不可用的描述符来自 `agent.Unavailable`。将版本门控和工厂选择条件保留在适配器内部。
 
 Runtime 统一解析[状态目录](../../../docs/zh/configuration.md#runtime-resource-directories)，并显式传给每个适配器。支持保留原生历史的适配器在该根目录下按各自的命名空间布局存放历史，不从环境变量选择回退根目录，也不把历史放进工作区。不支持该能力的适配器将原生状态保持为实例私有，不能仅因收到状态根目录就宣称历史可迁移。私有启动主目录、临时数据及实例私有原生状态使用传入的 `DiscoveryOptions.RuntimeRoot`。设备凭据和连接身份必须留在保留状态之外。仅有状态路径并不意味着计算资源替换后的原生续接已通过资格验证：适配器必须保持原生所有权，在提交模型输入之前拒绝缺失或外来历史，并在另一个写入者挂载前完成原生关闭。
 
@@ -160,57 +173,72 @@ Runtime 统一解析[状态目录](../../../docs/zh/configuration.md#runtime-res
 | 1 | `RegisterKind(proto.SupportedAgentKind, harnessconfig.Configuration)` | Kind、可用性、版本、`AgentKindCapabilities` 和模型配置声明。它会重置其他注册项，因此必须首先调用。 |
 | 2 | `RegisterExecutor(kind, agent.ExecutorFactory)` | 执行所用的 Executor 和 Turn 生命周期；据此派生 `Preparation` 能力 |
 
-每个 `proto.AgentKindCapabilities` 字段都必须显式设为 `proto.CapabilitySupported` 或 `proto.CapabilityUnsupported`，即使 Harness 不可用也是如此。`proto.CapabilityUnspecified` 无效：零值和省略字段绝不表示 Unsupported。安装探测可以使用 `proto.CapabilityFromBool` 设置单个字段；但不得填充未提及字段或未来字段。可用性通过 `SupportedAgentKind.Available` 单独表示。注册会在更改 registry 之前验证完整声明；线协议会为每个字段携带显式布尔值，因此省略字段和 null 字段均无效。添加新字段时，每个生产声明都必须作出决定。Runtime 使用者应调用 `IsSupported()`，并在原生操作前拒绝不受支持的请求；接口断言用于验证实现，绝不表示支持。每个声明都必须与针对该安装验证的行为一致；[Core–Runtime protocol](../../../docs/zh/runtime-protocol.md#capability-declarations) 负责声明的传输方式和冻结方式。
+显式填写声明中 `proto.AgentKindCapabilities` 的每个字段；[能力声明](../../../docs/zh/runtime-protocol.md#capability-declarations)定义声明的编码、验证和冻结方式。安装探测可以使用 `agent.Narrow` 撤回已声明的字段，但绝不授予新字段；`Registry.Register` 会拒绝授予了新字段的探测结果。可用性通过 `SupportedAgentKind.Available` 单独表示。读取声明的代码应调用 `IsSupported()`；接口断言用于验证实现，绝不表示支持。每个声明都必须与针对该安装验证的行为一致。
 
-准入映射是显式的。`Steering` 控制非持久化 `Steerer` 输入。`DurableInputReceipts` 控制 `DurableSteerer` 输入，并且还要求 Turn 结算契约；二者互不隐含，而且 Core 的公共文本 profile 要求同时具备二者。工作区声明描述授权资源所有者，包括通用 Runtime 工作区实现。`WorkspaceReadPreparation` 准入带 `workspace_read_only` 的 `execution_prepare`。Runtime 自行就绪该 preparation，并从绑定的本地工作区目录提供读取，不调用 Executor 工厂；因此仅当该 kind 的 Environment 工作区就是该本地目录时，adapter 才声明它。注册过程不会派生它。Runtime 注册不会授予 Core 资格；服务 profile 才会授予。
+准入映射是显式的。`DurableInputReceipts` 控制 `DurableSteerer` 输入，并且还要求 Turn 结算契约。工作区声明描述授权资源所有者，包括通用 Runtime 工作区实现。`WorkspaceReadPreparation` 准入带 `workspace_read_only` 的 `execution_prepare`。Runtime 自行就绪该 preparation，并从绑定的本地工作区目录提供读取，不调用 Executor 工厂；因此仅当该 kind 的 Environment 工作区就是该本地目录时，adapter 才声明它。注册过程不会派生它。Runtime 注册不会授予 Core 准入；声明才会授予。
 
 可运行的仅测试示例 [`testdata/onboarding/main.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/testdata/onboarding/main.go) 会注册一个仅支持文本的合成 Harness。它展示 Session 所有的 Executor、全新的 Turn、持久化引导、取消和历史绑定，并且绝不会发布。
 
-## 将引擎添加到 Core {#add-the-engine-to-core}
+## 声明 Harness {#declare-the-harness}
 
-Core 会识别[内置 Harness 注册项](harness-catalog.md)。向 `internal/harnessconfig/builtin/catalog.json` 添加一个条目，其中包含：
+每个 Harness 是 `internal/harnessconfig/<package>/declaration.go` 中的一个 `var Declaration = harnessconfig.Declaration{...}`。包名是去掉下划线的 kind。创建该文件即注册 Harness：`make generate-harness-catalog` 生成 Core 注册表、Runtime 的 `harnessDeclarations`、客户端标识符和显示名称以及[注册参考](harness-catalog.md)，`make check-harness-catalog` 拒绝过期的投影。`make openapi` 从同一批声明派生 Harness 枚举，因此不要在 DTO 标签或路由注解中手写枚举。没有动态插件加载器，声明也不能表示机器的可用性。
 
-- 公共 `kind` 和显示 `label`；
-- `internal/harnessconfig` 下的模型 `configuration` 包；
-- `services/core/internal/engine` 下的 `profile` 构造函数。
+声明包含：
 
-实现 profile 构造函数，然后运行 `make generate-harness-catalog`。它会生成模型配置 registry、Core profile 目录、客户端标识符和显示名称以及注册参考；公共输入验证器读取生成的 registry。`make openapi` 从同一目录派生 Harness 枚举，因此不要在 DTO 标签或路由注解中添加手写枚举。`make check-harness-catalog` 会拒绝过时的投影。
+- 公共 `Kind` 和显示用的 `Label`；
+- 模型 `Configuration`（[原生模型配置](#native-model-configuration)）；
+- `Capabilities`，即 `proto.AgentKindCapabilities`，表示 Harness 在能力完备的主机上最多能做什么；每个字段都是 `Supported` 或 `Unsupported`，零值无效（[能力声明](../../../docs/zh/runtime-protocol.md#capability-declarations)）；
+- 受支持的 `Placements` 和公共 `MCPOrigins`，以及是否接受仅含空白的文本；
+- `Execution`，即适配器映射到原生设置的官方执行选项取值：web search 模式及是否接受搜索设置、推理强度和摘要、服务层级、程序化工具调用取值和文本详细程度。Core 准入和 Runtime 用同一检查拒绝未声明的取值（[工具策略](execution-tools.md#web-search-and-programmatic-tool-calling)）。Core 总会发送官方默认文本详细程度，因此 `TextVerbosities` 必须包含 `medium`；
+- 可选的纯限制 `ValidateConfiguration`、`ValidateTools`、`ValidateMessageInput` 和 `ValidateFunctionResult`，在通用检查之外添加原生限制。`ValidateMessageInput` 仅对携带图像的消息运行，在 `MessageImages` 能力检查之后、任何存储之前执行，决定 Harness 接受哪些 `image_url`；Core 只检查引用不为空白。验证函数为 nil 表示通用检查已足够。它们不能查询业务数据、解密凭据或控制原生进程。配置限制最先执行，工具解码错误先于 `ValidateTools`。
 
-每个 Runtime 声明都引用生成的目录所使用的同一个 `internal/harnessconfig/<kind>.Configuration()`，并负责其原生工厂、探测和已安装能力证据。目录不能声明某台机器的可用性，也不存在动态插件加载器。
+`harnessconfig.NewRegistry` 会验证每个声明，对无效或重复的声明触发 panic：kind 和 label 必须非空，放置位置必须至少列出一个受支持的位置，MCP 来源必须是非 nil 列表，未知或重复的选项以及没有对应放置位置的来源会被拒绝，bearer 支持要求存在 MCP 来源，`Execution` 必须声明文本详细程度 `medium`。共享调度检查能力组合，绝不检查引擎名称。
 
-profile 是纯逻辑：它使用现有的公共类型和协议类型，声明受支持的放置方式、公共配置、结果限制和必需的 Runtime 控制。Profile 回调不能查询业务数据、解密凭据或控制原生进程。共享调度检查能力组合，而不是引擎名称允许列表。
+`apps/daemon/internal/agent/<package>/declaration.go` 中的 Runtime 绑定内嵌同一份声明并添加 `Discover`；它负责原生可用性探测和工厂，并且只把声明的能力收窄到该安装已验证的范围。绑定测试 `TestDiscoveryOnlyNarrowsDeclaration` 检查发现结果不超出声明。`harnessconfig/harnesstest.Declaration` 为测试构造合成声明。
 
-### 显式服务资格认定 {#explicit-service-qualification}
+运行 `harnessconfig` 和 `execution` 测试以覆盖验证、组合和错误优先级，并运行 `services/core/tests/integration` 中的公共接入测试以覆盖准入和 Runtime 调度。
 
-`engine.Profile` 是服务的资格声明，独立于 Runtime 的 `AgentKindCapabilities`。其能力字段复用小型 `proto.CapabilitySupport` 值类型：每个字段都必须显式选择 `CapabilitySupported` 或 `CapabilityUnsupported`。`CapabilityUnspecified`（包括省略字段）会被拒绝。复用此值类型并不意味着 Runtime 的宣称可以授予服务授权。
+`execution.Policy` 向 HTTP 准入、Worker 设备选择和最终调度提供注册表。自定义组合把同一个 Policy 交给 `api.Dependencies.Policy` 和 Core 调度器的 `Policy`。零值使用内置声明；显式的空注册表不授权任何 Harness。没有可变的全局注册。
 
-`ConfigurationValidation`、`ToolsValidation` 和 `FunctionResultValidation` 分别选择以下两种策略之一：
+## 原生模型配置 {#native-model-configuration}
 
-- `CommonValidationOnly`：通用 schema 和准入检查已足够。相应回调必须为 nil；不需要提供成功的占位回调。
-- `AdditionalValidation`：相应的 `ValidateConfiguration`、`ValidateTools` 或 `ValidateFunctionResult` 回调为必需项，并添加纯 Harness 限制。
+[`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go) 负责共享配置声明和纯准备契约。每个声明携带一个 `Configuration`，Core 组合和 Runtime 的 `RegisterKind` 都使用它。Executor 路径会在产生原生副作用之前通过该声明进行验证。线协议对象是 `proto.HarnessConfig`。[Model execution](model-execution.md#native-model-parameters) 列出了每个 Harness 接受的字段。
 
-省略或未知策略、缺少必需回调，或者将回调与仅通用策略搭配，均无效。准入遵循声明的策略，而不依据方法是否存在。保留现有错误优先级：配置限制最先执行；选择额外配置验证时，工具解码错误先于工具限制。对于仅通用的配置验证，额外工具限制仍保持其相对于解码错误的现有优先级。仅通用的函数结果验证不会添加原生结果限制。
+提供的 `model` 必须是非空字符串，并且显式指定 `model_provider` 时必须提供它。原生所有权连接路径可以省略二者；显式 null 无效。显式为空的声明不接受任何提供商或非空原生参数，也不宣称支持提供商。未知协议格式和重复协议声明会导致注册失败。
 
-`engine.NewCatalog` 会在发布不可变快照之前验证每个条目，并对无效静态注册触发 `engine.ErrInvalidDeclaration` panic。Kind 必须非空且前后不得包含空白字符。放置方式必须显式列出至少一个受支持的放置方式；MCP 来源必须是非 nil 列表（空列表表示不认定任何来源合格）。未知或重复选项、没有对应放置方式的来源，以及没有 MCP 来源的 bearer 支持均会被拒绝。错误应标识已编写的字段，但不回显声明值。未来 profile 字段必须由完整性验证器分类，并由每个 profile 显式决定；不存在生产用默认填充构造函数。
+声明中的有序 `protocols` 列表是接受协议及默认协议（第一个条目）的唯一来源；它还为 Core 的配置支持描述符提供数据，Core 和 Runtime 通过它拒绝不受支持的组合。适配器通过原生配置直接连接；它们绝不引入模型 API 代理或协议转换器、第二套模型能力 registry，也不会从模型名称推断能力。Claude 的私有 bridge 接收编译后的原生选项，并且只执行结构检查，而不是声明规则的第二份副本。
 
-运行 `engine` 和 `execution` 测试以覆盖遗漏、策略、组合和错误优先级，并运行 `services/core/tests/integration` 中的公共接入测试以覆盖准入和 Runtime 调度。测试夹具使用 `engine/enginetest`，其穷尽式字面量在添加字段时也要求作出决定；它不是生产 profile。
+## 原生安装程序参与 {#native-installer-participation}
 
-`execution.Policy` 向 HTTP 准入、Worker 设备选择和最终调度提供不可变服务资格认定。自定义组合将同一个 Policy 提供给 `api.Dependencies.Policy` 和 Core 调度器的 `Policy`。零值使用内置 profile；显式空目录不授权任何内容。不存在可变全局注册。
+适配器可以从自身包中的 `installation.go` 提供 `agent.Installation`：已注册 kind、锁定版本、受支持平台、激活环境和有界就绪探测。在 `cli/native_harness.go` 中注册它，并将其锁定组件添加到原生分发构建器。此可选契约不会改变 Executor 和 Turn 语义。Runtime 负责校验和、复制、锁和增量安装；适配器负责原生布局和探测。必须在每个宣称的平台上验证安装和执行。原生内容缺失或不兼容时必须失败；绝不会在 Turn 期间自行安装。
 
-## 原生模型配置 {#native-model-configuration}
+## 原生进程所有权 {#native-process-ownership}
 
-[`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go) 负责共享配置声明和纯准备契约。每个适配器在 `internal/harnessconfig/<kind>` 中提供一个 `Configuration`，供 Core 组合和 Runtime 的 `RegisterKind` 使用。Executor 路径会在产生原生副作用之前通过该声明进行验证。线协议对象是 `proto.HarnessConfig`。[Model execution](model-execution.md#native-model-parameters) 列出了每个 Harness 接受的字段。
+daemon 的 `clirunner` 让每个原生子进程在自己的 Unix 进程组中启动（Windows 上为 Job 对象）；其他主机会拒绝启动。显式取消和父上下文取消共享 TERM 宽限期以及有界的 KILL 升级过程。当直接进程退出时，内部回收器也会清理进程组的剩余成员，即使某个后代进程仍保持 stdout 打开；在取消过程中，主进程退出后，存活的后代进程仍会保留剩余宽限时间。daemon 的 `stop` 命令在限定时间内等待确认关闭，该时间涵盖该宽限期以及之后的管道和所有者清理。
 
-提供的 `model` 必须是非空字符串，并且显式指定 `model_provider` 时必须提供它。原生所有权连接路径可以省略二者；显式 null 无效。显式为空的声明不接受任何提供商或非空原生参数，也不宣称支持提供商。未知协议格式和重复协议声明会导致注册失败。
+所属输出管道在主进程退出后仍可读取。消费者在调用 `Wait` 之前耗尽 stdout 和 stderr；`Wait` 会汇合缓存的进程结果并关闭读取器。`Done` 报告主进程回收和进程组清理信号；它不是原生执行回执，也不是历史已持久化的证据。SDK 适配器会结算每个 Turn，并在发布完成状态前耗尽其观察结果；Executor 关闭还会关闭 Query 并等待原生子进程。进程组用于生命周期监管，而不是隔离或遏制离开进程组的后代进程。
 
-声明中的有序 `protocols` 列表是接受协议及默认协议（第一个条目）的唯一来源；它还为 Core 的配置支持描述符提供数据，Core 和 Runtime 通过它拒绝不受支持的组合。适配器通过原生配置直接连接；它们绝不引入模型 API 代理或协议转换器、第二套模型能力 registry，也不会从模型名称推断能力。Claude 的私有 bridge 接收编译后的原生选项，并且只执行结构检查，而不是声明规则的第二份副本。
+适配器以启动用户的权限无人值守运行原生工具，Harness 从不询问人类。Codex 使用批准策略 `never` 和完全访问权限，在该策略下 Codex 自行处理 MCP elicitation，不会发给客户端；适配器还禁用其阻塞式 `request_user_input` 工具。Claude 通过适配器的工具回调运行，回调直接允许或拒绝、不会询问。MiniMax 绕过权限；适配器禁用 `askUser`、不声明 elicitation，并以 ACP `cancelled` 结果答复 `session/request_permission`，MiniMax 将其视为拒绝。原生权限或问题请求都不会到达 Core：需要人工介入时通过 function 工具完成，Session 读取 [`requires_action`](./sessions-events.md#session-status)，由应用提交 function 结果。不要添加权限 profile、bubblewrap 包装器或原生 sandbox 设置；每种 Environment 来源都只有一条执行路径。资源路径属于操作员配置，而不是权限边界。
+
+模型主机不可达时不能让 Turn 一直挂起。适配器通过原生设置让 Harness 自身的连接重试保持有界；Harness 以结构化数据报告最终连接错误时，该错误归为 `connection_failed`（[原生失败分类](../../../docs/zh/runtime-protocol.md#native-failure-classification)）。Core 不另设模型超时。各适配器指南写明其 Harness 的上限。
+
+网络准入遵循 [Restricted network](environments.md#restricted-network)。
+
+## 超时与限制 {#timeouts-and-limits}
+
+Runtime 对每个 Turn 的限制（结算等待、回执发送预算和输出通道）见 [Core–Runtime 协议](../../../docs/zh/runtime-protocol.md#timeouts-and-limits)。原生子进程的限制如下：
+
+| 数值 | 适用对象 | 到期时 |
+| --- | --- | --- |
+| 3 秒（默认） | 显式取消或父上下文取消时，原生子进程的 TERM 宽限期 | Runtime 升级为有界的 KILL。 |
+| 10 秒 | daemon 的 `stop` 命令等待确认关闭，涵盖该宽限期及之后的管道和所有者清理 | 关闭未得到确认。 |
 
 ## 认定适配器资格 {#qualify-the-adapter}
 
 开始前，记录操作集、预期结果、排除项和停止条件。当其声明的操作通过时，资格认定即结束；它不会扩展为匹配另一个 Harness 的功能列表。
 
 1. **契约测试。** 在名为 `TestSharedTextLifecycle` 的测试中，使用适配器准备好的 Executor 和确定性的原生夹具调用 `agent/contracttest.TextLifecycle`；`claudesdk/executor_test.go` 是参考实现。它检查独立的 Turn 流、原生所有者和历史连续性、持久化写入与应用回执、过期取消，以及取消后的健康继续执行。`make check-runtime-contract` 会将它与共享线协议、gateway、传输层和调度器测试、声明完整性检查以及每个适配器的 `TestUnsupportedExtensionsHaveNoNativeEffects` 一起运行。适配器测试还覆盖两个普通 Turn 共享一个原生进程或连接和历史、取消后执行另一个 Turn、过期取消和迟到事件、原生退出、清理失败、输入写入与应用回执、未知结果，以及每 Turn 新鲜的 usage、函数、输入和子项观察状态。必须说明夹具是受控夹具还是真实提供商。
-2. **共享集成。** `TestThirdHarnessPublicOnboarding` 让合成 Harness 通过公共 Session 和输入准入、Worker 设备选择、真实 WebSocket gateway、daemon Registry 和 Router、中立事件以及持久化终态投影运行。它在与 API 处理程序和调度器相同的 `execution.Policy` 中使用自定义不可变 `engine.Catalog`，并检查已应用输入回执、已保存原生身份、继续执行、取消、不受支持的可选请求以及缺少强制 Runtime 支持。该夹具没有工作区、MCP 或公共函数，其注册仅保留在测试本地。它证明的是集成路径，而不是原生执行。
+2. **共享集成。** `TestThirdHarnessPublicOnboarding` 让合成 Harness 通过公共 Session 和输入准入、Worker 设备选择、真实 WebSocket gateway、daemon Registry 和 Router、中立事件以及持久化终态投影运行。它在与 API 处理程序和调度器相同的 `execution.Policy` 中使用自定义不可变注册表，并检查已应用输入回执、已保存原生身份、继续执行、取消、不受支持的可选请求以及缺少强制 Runtime 支持。该夹具没有工作区、MCP 或公共函数，其注册仅保留在测试本地。它证明的是集成路径，而不是原生执行。
 3. **真实验收。** 使用锁定的官方 Python SDK 和针对 Core 的原始 HTTP、真实提供商 API、原生 Harness 以及专用数据库。验证初始执行、热后续执行、取消以及带继续执行的重启；记录原生所有者身份以及相同条件下的冷启动和热运行时间。对于工作区放置方式，还要验证 Files 和 Artifacts、工作区身份、公开响应中未出现凭据，以及外部历史会被拒绝。`services/core/tests/official_hosted_functions_native.py` 保存共享函数断言：成功和错误、原生文件输出和公共 Artifact 字节、重启后的同历史继续执行、外部结果拒绝以及待处理调用取消。合成运行或失败运行绝不计入。下面的选择性测试会在 `services/core/tests` 中针对真实 daemon 和模型运行锁定 SDK 夹具；设置 `OAC_TEST_OFFICIAL_SDK_PYTHON`、`OAC_TEST_NATIVE_DAEMON_BIN`、`OAC_TEST_NATIVE_PROOF_DIR` 及其私有选项文件后，每项测试才会运行。选项文件是一个 JSON 对象，恰好包含 `model` 和 `model_provider`（即 `x_agents_core.model_provider` 的字段）；测试会将其设置为部署默认模型提供商，而夹具的 `environment: none` Session 会在创建时将其冻结。
 4. **回归。** 现有 Harness 必须继续正常工作。先运行定向测试，然后运行 `make check`；API 更改后运行 `make openapi`，查询更改后运行 `make sqlc-generate`。
 5. **审查。** 遵循 [blind review workflow](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#review)。
@@ -238,22 +266,6 @@ Environment 验收使用 `services/core/tests/official_environment_{templates,se
 | MiniMax 原生历史绑定 | `mcode/session_test.go` |
 | 无原生副作用或伪造结果的明确拒绝 | 每个适配器的 `unsupported_test.go` |
 
-## 原生安装器参与 {#native-installer-participation}
-
-适配器可以从自身包中的 `installation.go` 提供 `agent.Installation`：已注册 kind、锁定版本、受支持平台、激活环境和有界就绪探测。在 `cli/native_harness.go` 中注册它，并将其锁定组件添加到原生分发构建器。此可选契约不会改变 Executor 和 Turn 语义。Runtime 负责校验和、复制、锁和增量安装；适配器负责原生布局和探测。必须在每个宣称的平台上验证安装和执行。原生内容缺失或不兼容时必须失败；绝不会在 Turn 期间自行安装。
-
-## 原生进程所有权 {#native-process-ownership}
-
-daemon 的 `clirunner` 让每个原生子进程在自己的 Unix 进程组中启动（Windows 上为 Job 对象）；其他主机会拒绝启动。显式取消和父上下文取消共享 TERM 宽限期（默认为三秒）以及有界的 KILL 升级过程。当直接进程退出时，内部回收器也会清理进程组的剩余成员，即使某个后代进程仍保持 stdout 打开；在取消过程中，主进程退出后，存活的后代进程仍会保留剩余宽限时间。daemon 的 `stop` 命令最多等待十秒以确认关闭，这涵盖该宽限期以及之后的管道和所有者清理。
-
-所属输出管道在主进程退出后仍可读取。消费者在调用 `Wait` 之前耗尽 stdout 和 stderr；`Wait` 会汇合缓存的进程结果并关闭读取器。`Done` 报告主进程回收和进程组清理信号；它不是原生执行回执，也不是历史已持久化的证据。SDK 适配器会结算每个 Turn，并在发布完成状态前耗尽其观察结果；Executor 关闭还会关闭 Query 并等待原生子进程。进程组用于生命周期监管，而不是隔离或遏制离开进程组的后代进程。
-
-适配器以启动用户的权限无人值守运行原生工具，Harness 从不询问人类。Codex 使用批准策略 `never` 和完全访问权限，在该策略下 Codex 自行处理 MCP elicitation，不会发给客户端；适配器还禁用其阻塞式 `request_user_input` 工具。Claude 通过适配器的工具回调运行，回调直接允许或拒绝、不会询问，使用原生 `default` 权限模式并禁用 SDK sandbox。MiniMax 绕过权限并禁用 sandbox；适配器禁用 `askUser`、不声明 elicitation，并以 ACP `cancelled` 结果答复 `session/request_permission`，MiniMax 将其视为拒绝。原生权限或问题请求都不会到达 Core：需要人工介入时通过 function 工具完成，Session 读取 [`requires_action`](./sessions-events.md#session-status)，由应用提交 function 结果。不要添加权限 profile、bubblewrap 包装器或原生 sandbox 设置；每种 Environment 来源都只有一条执行路径。资源路径属于操作员配置，而不是权限边界。
-
-模型主机不可达时不能让 Turn 一直挂起。适配器通过原生设置让 Harness 自身的连接重试保持有界；Harness 以结构化数据报告最终连接错误时，该错误归为 `connection_failed`（[原生失败分类](../../../docs/zh/runtime-protocol.md#native-failure-classification)）。Core 不另设模型超时。各适配器指南写明其 Harness 的上限。
-
-网络准入遵循 [Restricted network](environments.md#restricted-network)。
-
 ## 原生参考 {#native-references}
 
 | Harness | 适配器 | 原生传输方式 | Runtime 指南 |
diff --git a/contracts/agents-api/zh/index.md b/contracts/agents-api/zh/index.md
index f1bba06f4..089c23d3c 100644
--- a/contracts/agents-api/zh/index.md
+++ b/contracts/agents-api/zh/index.md
@@ -1,10 +1,12 @@
 ---
-title: "Agents API 覆盖台账"
+title: "OpenAI 兼容性"
 source: contracts/agents-api/index.md
-source_hash: 001be7cc7060c4591d1fe053b8de6fd3eea31eccaa4ed9f9fe246fb5efae8298
+source_hash: 7d00d7ffc666357d5c11a92ace8ebfcc1596465df288e75ee4d3e00dcd7b8c73
 ---
 
-Core 旨在以下方固定版本为准支持完整的 OpenAI Agents API（[public API rule](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#public-api)）。本台账记录 Core 对各项资源实现了哪些内容、哪些契约保存其详细信息，并列出相对于 OpenAI 服务的所有已知差异和所有未解决缺口。[API namespaces and credentials](../../../docs/zh/api/index.md) 说明谁调用哪些 API；[Agents API guide](../../../docs/zh/api/public-agent-api.md) 介绍使用方法。
+Core 实现下方固定版本的 OpenAI Agents API。本台账列出各项资源的覆盖情况、相对于官方服务的所有差异以及已知缺口。
+
+目标是支持完整的 API（[public API rule](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#public-api)）。[API 命名空间和凭据](../../../docs/zh/api/index.md) 说明谁调用哪些 API，[Agents API 指南](../../../docs/zh/api/public-agent-api.md) 介绍使用方法。
 
 ## 固定基线 {#pinned-baseline}
 
@@ -37,7 +39,7 @@ Go 输入投影排除 `packages.system`，保留下方记录的明确拒绝行
 | --- | --- | --- | --- |
 | Agents | create, retrieve, update, list, delete | 已实现。所有固定版本设置都会保存；Session 准入只会用到其中一个子集 | [Agents](wire-semantics.md#agents) |
 | Sessions | create (JSON 或流式), retrieve, update, list, delete | 已实现。更新仅接受 `metadata`；删除要求 Session 处于空闲或失败状态 | [Sessions](wire-semantics.md#sessions)、[creation streaming](sessions-events.md#creation-streaming) |
-| Session events | create, stream | 部分实现：支持包含文本和内嵌图像的消息、取消和函数结果；流仅支持实时模式 | [Sessions, events and history](sessions-events.md)、[message content](message-content.md) |
+| Session events | create, stream | 部分实现：支持包含文本和图像的消息、取消和函数结果；流仅支持实时模式 | [Sessions, events and history](sessions-events.md)、[message content](message-content.md) |
 | Turns | retrieve, list | 已实现；Session Turn 路由仅承载根级 Turns | [Turns and Items](sessions-events.md#turns-and-items) |
 | Items | list | 部分实现：支持消息、命令、MCP 调用、functions、web search、reasoning 和 Subagent 协调 Items；其他原生变体不会被投影 | [Turns and Items](sessions-events.md#turns-and-items) |
 | Artifacts | retrieve, list, delete, content | 已实现 | [Environment files and Artifacts](environment-files.md) |
@@ -50,15 +52,15 @@ Go 输入投影排除 `packages.system`，保留下方记录的明确拒绝行
 | Files | create, retrieve, list, delete, content | 已支持 `purpose=user_data`；内容下载会被拒绝 | [Files and Skills](source-files.md) |
 | Skills and Skill versions | create, retrieve, update, list, delete, content | 已实现 | [Files and Skills](source-files.md) |
 
-各 Harness 在不同部署位置支持哪些操作，请参阅 [Harness capabilities](harness-capabilities.md)。[Core wire behavior](wire-semantics.md) 包含适用于各项资源的通用规则：请求、错误和列表。
+各 Harness 在不同部署位置支持哪些操作，请参阅 [Harness capabilities](harness-capabilities.md)。[API 行为](wire-semantics.md) 包含适用于各项资源的通用规则：请求、错误和列表。
 
-Core 自身字段位于 `x_agents_core` 中（[Core extensions](../../../docs/zh/api/public-agent-api.md#core-extensions-x-agents-core)）。Core 管理 API（`/core/v1`）和机器 API（`/api/v1`）不属于 Agents API。
+Core 自身字段位于 `x_agents_core` 中（[Core extensions](../../../docs/zh/api/public-agent-api.md#core-extensions)）。Core 管理 API（`/core/v1`）和机器 API（`/api/v1`）不属于 Agents API。
 
 ## 与 OpenAI 的差异 {#differences-from-openai}
 
 以下每项都是 Core 有意采用或原生提供的行为，而官方服务的行为有所不同。链接中的规则规定了确切行为。
 
-**请求和错误**（[Core wire behavior](wire-semantics.md)）
+**请求和错误**（[API 行为](wire-semantics.md)）
 
 - Core 不会发送 `OpenAI-Organization` 或 `OpenAI-Project` 响应标头。
 - 对事件流、内容下载和 Environment files 列表执行 `HEAD` 会返回 405。
@@ -78,20 +80,32 @@ Core 自身字段位于 `x_agents_core` 中（[Core extensions](../../../docs/zh
 
 - 使用相同 `Idempotency-Key` 重复创建 Session 会返回原 Session；官方服务会创建一个新的 Session。
 - 未指定程序化工具调用时，会保留 Harness 的原生行为；官方默认值为启用。
+- Agent 未声明 `web_search` 工具时，会保留 Harness 的[原生搜索](./execution-tools.md#web-search-and-programmatic-tool-calling)；固定的官方契约未定义未声明该工具时是否搜索。
+- 工作区位置上的 Claude Code 把 Agent 的 `instructions` 追加到原生系统提示词之后，并运行其[原生工具集](./execution-tools.md#web-search-and-programmatic-tool-calling)。其搜索没有缓存模式，也没有域名、位置和上下文大小设置。
+- Claude Code 在原生层丢弃仅含空白的文本块，全空白消息会发送 `(no content)`；Codex 原样交付仅含空白的文本。
+- Claude Code 在 Skill 展开时运行其内联 shell，因此该命令不产生工具观测。
+- Claude Code 在 `environment: none` 上启用 live 搜索时只有 `WebSearch`，因此搜索只产生 `search` 动作，不会打开页面（[网页搜索](./execution-tools.md#web-search-and-programmatic-tool-calling)）。
 - 未指定推理强度时会保持为 null，而不是采用模型的默认值。
+- Codex 把程序化工具调用映射到原生 `code_mode`，由模型编写的脚本调用其他工具；该功能在上游仍处于开发中。
 - Session 的 `agent.tools` 会省略 `tool_search` 声明。
+- Core 拒绝 Session MCP 传输中的内联 `authorization`、`headers` 中的 `Authorization` 条目以及非空的 stdio `env`：凭据只来自 Vault（`credential_id`），环境值只来自 Environment（`env_vars`）（[MCP](execution-tools.md#mcp)）。
+- `stdio` MCP 服务器需要工作区部署位置和 `environment` 来源。Claude Code 在其工作区目录中启动服务器，因此 `cwd` 必须与之相同；服务器继承整个进程环境，其中也有模型提供方密钥和其他服务器的 Vault bearer 令牌；且 `allowed_tools` 须为 null。MiniMax Code 在其私有主目录中启动服务器，因此拒绝所有 `stdio` 服务器（[MCP](execution-tools.md#mcp)）。
+- Claude 会拒绝包含 `${` 的 MCP `server_url` 或 `headers` 值，因为原生客户端会从持有 Core 所持凭据的进程环境中展开这两处的 `${VAR}`。
 - 在 events 202 之后立即删除 Session 会返回 409，因为 Core 会在同一事务中准入该 Turn；官方服务返回 200。
 
 **输入、事件和历史**（[Sessions, events and history](sessions-events.md)、[message content](message-content.md)）
 
 - 提交给 `none` Session 的输入会同步完成准入；Core 不会模拟官方异步准入窗口。
 - 用于恢复等待中 Turn 的函数结果会发出 `turn.in_progress`；取消正在等待函数结果的 Turn 会发出临时 `agent.session.in_progress`。
+- 原生 Harness 放弃的函数调用（例如根关闭或中断子级时被丢弃的 Subagent 调用，或超过 120 秒超时的 MiniMax Code 调用）会被撤回：它不再是待执行操作，之后为它提交结果会返回 409 `conflict_error`。官方 API 没有撤回机制。
 - 在 Turn 中途接入流时，不会发送补发 Item 快照。
 - Items 列表会包含进行中和未完成的输出 Items，并保留失败函数结果中已提交的 `output`。
 - 错误消息会省略官方消息包含的 call 和 executor ID。
 - 与其他文本并存的空文本部分可被接受并存储。
 - 空输入会返回 400 `invalid_request`，附带通用消息和值为 null 的 param；官方响应为 `invalid_request_error`，param 为 `input`。
 - 一旦所有根级 Turn 均已进入终态，Session 用量即可用；官方读取会滞后数秒。
+- Harness 输出（例如命令输出）中的 U+0000 读取时为 U+FFFD；官方服务会保留该字符。
+- `reasoning` Item 携带 Harness 对其原生推理所展示的内容：Harness 产生原生摘要时为该摘要，否则为其原生推理文本，例如 Codex 的原始推理，或模型 API 返回给 Claude Code 的 thinking 文本。每个原生部分对应一个 `summary_text` 部分，没有文本的原生推理不会上报，因此模型提供方的 `thinking.display` 为 `omitted` 时，Claude Code 不上报推理。Codex 流式输出一个 item 先送达的原生通道，即摘要或原始推理文本。
 
 **Files、Skills、Environment files 和 Artifacts**（[Files and Skills](source-files.md)、[Environment files and Artifacts](environment-files.md)）
 
@@ -103,6 +117,8 @@ Core 自身字段位于 `x_agents_core` 中（[Core extensions](../../../docs/zh
 
 **Vaults 和 Credentials**（[Vaults and Credentials](vaults.md)）
 
+- MiniMax Code 逐个运行公共函数调用，因此应用每次只看到一个 `function_call`。
+- MiniMax Code 通过原生 MCP 服务器提供公共函数，其客户端会在 120 秒后使调用失败且无法更改。120 秒后原生向模型报告失败，该调用被撤回，Turn 继续。
 - Vault 和 Credential 的状态仅在内部保存，默认值为 `active`；由于没有归档操作，未带过滤器的列表会同时包含两种状态。
 - `vault_ids` 中包含未知或属于其他账户的 Vault 时会返回 404 "Resource not found."；官方消息会指出该 ID。
 - 更新时显式为 OAuth `access_token`、`refresh` 或 `token_endpoint_auth` 指定 `null`，会保留已存储的值。
@@ -113,27 +129,28 @@ Core 自身字段位于 `x_agents_core` 中（[Core extensions](../../../docs/zh
 
 **配置和工具**
 
-- 显式指定推理强度或摘要、使用 `auto` 之外的服务层级、启用 `web_search` 或启用程序化工具调用，这些设置都会被保存，但在 Session 准入时会被拒绝。
-- Harness 对工具、结构化输出、延迟发现、subagents 和 MCP 的支持因 Harness 和部署位置而异；请参阅 [Harness capabilities](harness-capabilities.md)。MiniMax Code 不提供公共 functions、没有服务源 MCP，也不支持图像输入。
+- 所选 Harness 未声明的 `reasoning.effort`、`reasoning.summary`、`service_tier`、`web_search` 模式或设置、`programmatic_tool_calling` 取值，会被保存，但在 Session 准入时被拒绝（[Harness 能力](harness-capabilities.md#execution-and-input)）。
+- Harness 对工具、结构化输出、延迟发现、subagents 和 MCP 的支持因 Harness 和部署位置而异；请参阅 [Harness capabilities](harness-capabilities.md)。MiniMax Code 不支持图像输入。
 - 由模型推导出的推理默认值不会被解析确定。
-- MCP 工具仅支持 `http` 传输，`stdio` 会被拒绝，Session MCP 传输中的内联 `authorization` 也会被拒绝（[HTTP MCP](execution-tools.md#http-mcp)）。
 
 **执行和历史**
 
-- 流不会发出 reasoning-summary 事件、Environment 的 `pending` 或 `ready` 事件，也不会覆盖固定版本中的所有临时 tool-output 变体。
+- 流不会发出 Environment 的 `pending` 或 `ready` 事件，也不会覆盖固定版本中的所有临时 tool-output 变体。
 - 除 [Turns and Items](sessions-events.md#turns-and-items) 中列出的变体外，其他原生 Item 变体不会被投影，而且 Items 无法修改。
 - 如果取消导致函数结果无法应用，该结果将永远不会作为 Item 出现。
 - 固定版本的 Codex 可能会丢失在订阅其流之前发出的命令输出。
 - Claude Code 和 MiniMax Code 都不报告公共用量。
+- 以 `/` 开头的消息到达 MiniMax Code 时末尾多一个空行，否则 ACP 会将其作为操作员命令执行。
 - 对于原生副作用，Core 不提供崩溃安全或恰好一次保证；已认领的工作若不重放，会在重启后失败。
-- 图像必须是内嵌的 PNG 或 JPEG data URI；远程 URL、`file_id` 和 `detail` 会被拒绝。
+- 图像上的 `file_id` 和 `detail` 会被拒绝；每个 Harness 声明自己接受哪些 `image_url`（[消息内容](message-content.md#images)）。
 
 **Environments 和模板**
 
 - Hosted 工作区准入受[租户容量策略](../../../docs/zh/configuration.md#tenant-capacity)及既有[输入预留截止时间](environments.md#reservations)限制。
-- Runtime 不会实施 `disabled` 或 `restricted` 网络，因此需要这些网络的 Session 会被拒绝（[restricted network policy](environments.md#restricted-network)）。
+- MiniMax Code 未声明 `retained_native_history`，因此无法在 microsandbox 上运行（其每个 Environment 都使用工作区存储）；Core 会拒绝该 Session（[Harness 能力](./harness-capabilities.md)）。
+- 只有 `enabled` 网络可以运行，因此需要 `disabled` 或 `restricted` 的 Session 会被拒绝（[restricted network policy](environments.md#restricted-network)）。
 - `packages.system` 会被拒绝；系统软件包必须预先安装。
-- 冷续接不恢复进程内存、后台进程或临时系统盘修改；已完成的 setup 不会重放。参见 [Environment 持久化](environments.md#runtime-capability-preparation)。Codex 与 Claude Code 已在使用保留 NFS 存储的兼容 microsandbox 节点间通过跨节点内存恢复验证，适用[检查点转移要求](../../../docs/zh/sandbox-provider.md#checkpoint-transfer)。接管未确认停止的旧写入者仍未通过资格验证。在使用保留 NFS 存储的 microsandbox 上，Codex 与 Claude Code 已通过空闲 Turn 后、Turn 中断时以及完成确认后两秒内发生[已确认的计算资源丢失](../../../docs/zh/sandbox-provider.md#confirmed-compute-loss)的续接检查。历史缺失检查保留了原生身份，并以通用 `engine_failed` 或 `environment_unavailable` 结果明确失败。主机崩溃时的持久性及任意崩溃受损历史的完整性仍未通过资格验证。
+- 冷续接不恢复进程内存、后台进程或临时系统盘修改，已完成的 setup 不会重放（参见 [Environment 持久化](environments.md#runtime-capability-preparation)）。在使用保留 NFS 存储的兼容 microsandbox 节点上，Codex 和 Claude Code 已通过[检查点转移](../../../docs/zh/sandbox-provider.md#checkpoint-transfer)以及[已确认的计算丢失](../../../docs/zh/sandbox-provider.md#confirmed-compute-loss)后续接的资格验证。接管未确认停止的旧写入者、主机崩溃时的持久性及任意崩溃受损历史的完整性仍未通过资格验证。
 
 **Files 和 Environment files**
 
@@ -155,10 +172,11 @@ Core 自身字段位于 `x_agents_core` 中（[Core extensions](../../../docs/zh
 ### 尚未与官方服务核实的内容 {#unverified-against-the-official-service}
 
 - 当一个请求存在多项故障时的错误顺序，以及错误处理、默认值和载荷限制的总体一致性。
+- Subagent 的函数调用：Core 将其作为运行该子级的根 Turn 的待执行操作，`turn_id` 为该 Turn。该 Turn 为 `waiting`、Session 为 `requires_action`，根输出可继续，`call_id` 等于该子级 `function_call` Item 的 `call_id`。Claude Code 在根 Turn 收敛时才发布子级的 Item，晚于该待执行操作。
 - Subagent 子级 Turns 和待处理的 Environment file 写入是否会阻止 Session 删除。
 - 官方服务在待处理输入错误与未知结果目标之间的先后顺序。
 - npm、initial-file 和 Skill 安装的失败原因没有官方样本。
-- Codex 对文本旁的空文本部分、失败函数结果中的图像或远程引用图像的行为；Claude 对混合消息中仅含空白或空文本块的行为。
+- Codex 对文本旁的空文本部分、失败函数结果中的图像或远程引用图像的行为。
 - 在 Core 返回 405 的路由上，官方服务的 `HEAD` 行为。
 - 精确主机名之外的 Environment 模板主机名形式，以及 `disabled` 与域结合使用的情况。
 - Files 发生变化时的 purpose 筛选和分页；官方 Skill 上传限制和错误时机。
diff --git a/contracts/agents-api/zh/machine-api.md b/contracts/agents-api/zh/machine-api.md
index e68c60d6a..40bb4c23a 100644
--- a/contracts/agents-api/zh/machine-api.md
+++ b/contracts/agents-api/zh/machine-api.md
@@ -1,41 +1,40 @@
 ---
 title: "机器连接 API"
 source: contracts/agents-api/machine-api.md
-source_hash: e9a16774d2924db9dde18385be315d3a0317c616b029b419165e442fa34fb08d
+source_hash: f3e9a3cd478fcc16f466cf749e49ace8cd49bd8769e9698f6e7a0edacad3c5f7
 ---
 
-机器通过 `/api/v1` 调用 Core：包括沙箱节点、Runtime daemon 和自托管安装器。各路由仅接受所列凭据，不接受 Core 密钥或项目 API 密钥；控制台登录也不授予此处权限。反向代理将 `/api/v1` 直接发送给 Core；Web 不提供这些路由。
+机器通过 `/api/v1` 调用 Core：包括沙箱节点、Runtime daemon 和自托管安装程序。各路由仅接受所列凭据，不接受 Core 密钥或项目 API 密钥；控制台登录也不授予此处权限。反向代理将 `/api/v1` 直接发送给 Core；Web 不提供这些路由。
 
 ## 路由 {#routes}
 
 | 路由 | 调用方 | 凭据 | 契约 |
 | --- | --- | --- | --- |
-| `GET sandbox-node/configuration` | 节点安装器与节点 | 登记 token，或节点凭据加 `X-OAC-Node-ID` | [读取节点配置](#read-the-node-configuration) |
-| `POST sandbox-node/enroll` | 节点安装器 | 登记 token | [登记节点](#enroll-a-node) |
+| `GET sandbox-node/configuration` | 节点安装程序与节点 | 登记 token，或节点凭据加 `X-OAC-Node-ID` | [读取节点配置](#read-the-node-configuration) |
+| `POST sandbox-node/enroll` | 节点安装程序 | 登记 token | [登记节点](#enroll-a-node) |
 | `GET sandbox-node/identity?node_id=` | 节点 | 节点凭据 | [恢复节点身份](#recover-a-node-s-identity) |
 | WebSocket `GET sandbox-node/connect?node_id=` | 节点 | 节点凭据 | [节点代际协议](node-generation-protocol.md) |
-| `GET agent-daemon/install/{version}/…` | 自托管安装器 | 无 | [安装授权](environment-executor-credentials.md#installation-grant) |
-| `POST agent-daemon/installation`, `POST agent-daemon/installation/claim` | 自托管安装器 | 安装授权 | [安装授权](environment-executor-credentials.md#installation-grant) |
+| `GET agent-daemon/install/{version}/…` | 自托管安装程序 | 无 | [安装授权](environment-executor-credentials.md#installation-grant) |
+| `POST agent-daemon/installation`, `POST agent-daemon/installation/claim` | 自托管安装程序 | 安装授权 | [安装授权](environment-executor-credentials.md#installation-grant) |
 | `POST agent-daemon/enroll` | 自托管 daemon | 执行器凭据 | [登记自托管 daemon](#enroll-a-self-hosted-daemon) |
-| `GET agent-daemon/connection?environment_id=` | 自托管安装器 | 执行器凭据 | [私有连接确认](environment-executor-credentials.md#private-connection-confirmation) |
+| `GET agent-daemon/connection?environment_id=` | 自托管安装程序 | 执行器凭据 | [私有连接确认](environment-executor-credentials.md#private-connection-confirmation) |
 | `POST agent-daemon/bootstrap` | Runtime daemon | daemon 凭据 | [daemon 引导](#daemon-bootstrap) |
-| `GET agent-daemon/device-status?device_id=` | Runtime daemon | daemon 凭据 | [设备状态](#device-status) |
 | WebSocket `GET agent-daemon/ws?device_id=&version=` | Runtime daemon | daemon 凭据 | [Core–Runtime 协议](../../../docs/zh/runtime-protocol.md) |
 
 所有凭据通过 `Authorization: Bearer` 头传输，不放入 URL。
 
-生成的 [`runtime.openapi.yaml`](../runtime.openapi.yaml) 仅描述 sandbox-node 配置、登记、身份路由和两个安装路由。两个 WebSocket 及 daemon 引导、设备状态、登记和连接路由在 API 路由器外提供，无生成 schema；本文及所链接契约是它们唯一的定义。
+生成的 [`runtime.openapi.yaml`](../runtime.openapi.yaml) 仅描述 sandbox-node 配置、登记、身份路由和两个安装路由。两个 WebSocket 及 daemon 引导、登记和连接路由在 API 路由器外提供，无生成 schema；本文及所链接契约是它们唯一的定义。
 
 ## 凭据 {#credentials}
 
 | 凭据 | 签发方 | 接受位置 |
 | --- | --- | --- |
-| 登记 token | `POST /core/v1/sandbox/enrollment-tokens`（Web **添加节点**），带节点批准容量。使用一次；在响应 `expires_at` 过期 | 无节点 ID 的 `sandbox-node/configuration`、`sandbox-node/enroll` |
+| 登记 token | `POST /core/v1/sandbox/enrollment-tokens`（Web **添加节点**），带可选的节点限制。使用一次；在响应 `expires_at` 过期 | 无节点 ID 的 `sandbox-node/configuration`、`sandbox-node/enroll` |
 | 节点凭据 | 节点自身：生成 32 至 256 个无空白字符的密钥，在登记时注册 | 带 `X-OAC-Node-ID` 的 `sandbox-node/configuration`、`sandbox-node/identity`、`sandbox-node/connect` |
 | 安装授权 | `self_hosted` Session 的 `x_agents_core.installation` 命令；短期有效 | `agent-daemon/installation` 及其 `claim` |
-| 执行器凭据 | 安装领取，或 Core 密钥[执行器凭据路由](environment-executor-credentials.md) | `agent-daemon/enroll` 和 `agent-daemon/connection`；登记后也作为绑定设备的 daemon 凭据 |
-| 托管沙箱 daemon 凭据 | Core 为每个受管分配签发，通过[引导文件](../../../docs/zh/runtime-bootstrap.md)交付 | `agent-daemon/bootstrap`、`device-status` 和 `ws` |
-| 操作者设备配置 | 具有数据库访问权限的操作者运行 `oac-core-device` | `agent-daemon/bootstrap`、`device-status` 和 `ws` |
+| 执行器凭据 | 安装领取，或[执行器凭据](environment-executor-credentials.md)中使用 Core 密钥的接口 | `agent-daemon/enroll` 和 `agent-daemon/connection`；登记后也作为绑定设备的 daemon 凭据 |
+| 托管沙箱 daemon 凭据 | Core 为每个受管分配签发，通过[引导文件](../../../docs/zh/runtime-bootstrap.md)交付 | `agent-daemon/bootstrap` 和 `ws` |
+| 操作者设备配置 | 具有数据库访问权限的操作者运行 `oac-core-device` | `agent-daemon/bootstrap` 和 `ws` |
 
 Core 对存储的每个 token 和凭据仅保留 SHA-256 摘要；安装授权经签名但不存储。凭据不可互换：各自仅适用于自身路由。
 
@@ -61,7 +60,7 @@ oac-daemon connect --profile default
 - 新节点发送登记 token，不带 `X-OAC-Node-ID`。token 必须有效、未过期、未消费且由此安装签发。活动重置拒绝该读取。
 - 已注册节点发送节点凭据，并在 `X-OAC-Node-ID` 放其 UUID。无查询时读取当前目标。`?generation=N` 仅读取此节点仍可能需要的代际：当前目标、服务 pin，或其上未释放分配或 placement 持有的代际；其他代际被拒绝。重置期间仍可读取，以恢复已有归属资源。
 
-响应包含 `installation_id`、`provider`、`core_url`（安装公开 URL）、`generation`、`specification`、`specification_digest`、`max_active` 和 `max_retained`。不包含管理员、项目或 E2B 凭据，仅适用于节点型提供商。[沙箱部署契约](sandbox-deployment.md#canonical-node-specification)定义 specification 与摘要。
+响应包含 `installation_id`、`provider`、`core_url`（安装公开 URL）、`generation`、`specification`、`specification_digest`。不包含管理员、项目或 E2B 凭据，仅适用于节点型提供商。[沙箱部署契约](sandbox-deployment.md#canonical-node-specification)定义 specification 与摘要。
 
 ### 登记节点 {#enroll-a-node}
 
@@ -76,8 +75,9 @@ oac-daemon connect --profile default
 | `backend_fingerprint` | 节点后端命名空间摘要 |
 | `deployment_generation`, `specification_digest` | 节点读取的配置 |
 | `core_url` | 节点存储并连接的 Core origin |
+| `cpu_count`、`effective_cpu_cores`、`total_memory_bytes`、`available_disk_bytes` | 可选的主机测量值，见[节点协议](node-generation-protocol.md#connection) |
 
-Core 在一个事务中检查 token 有效、部署已初始化且为节点型且未重置、代际与摘要匹配当前 specification、`core_url` 等于安装公开 URL、节点 ID 未使用。仅通过后按 token 批准容量注册节点并消费 token。201 响应为节点身份：`node_id`、`installation_id`、`provider`、`deployment_generation`、`specification_digest`、`max_active` 和 `max_retained`。节点不能提交容量；登记代际和摘要为不可变身份，后续代际使用独立配置。
+Core 在一个事务中检查 token 有效、部署已初始化且为节点型且未重置、代际与摘要匹配当前 specification、`core_url` 等于安装公开 URL、节点 ID 未使用。仅通过后按 token 设置的限制注册节点，token 未设置的限制取所报告主机的[推荐容量](sandbox-deployment.md#recommended-capacity)，并消费 token。201 响应为节点身份：`node_id`、`installation_id`、`provider`、`deployment_generation`、`specification_digest`、`max_active` 和 `max_retained`。节点不能提交限制，但令牌未设置的限制取决于节点报告的主机测量值，范围限定在 1 到 1000000；显式值和之后的修改具有约束力。登记代际和摘要为不可变身份，后续代际使用独立配置。
 
 ### 恢复节点身份 {#recover-a-node-s-identity}
 
@@ -92,6 +92,7 @@ Core 在一个事务中检查 token 有效、部署已初始化且为节点型
 | 401 | `invalid_node_credential` | token 或节点凭据缺失、无效、过期、已消费或属于其他安装 |
 | 409 | `sandbox_specification_mismatch` | 节点代际或摘要不匹配 |
 | 409 | `sandbox_node_address_mismatch` | `core_url` 不是安装公开 URL；token 保持未使用 |
+| 409 | `sandbox_node_host_unmeasured` | token 未设置某个限制，且请求缺少 CPU 数量或有效核数，或总内存；token 保持未使用 |
 | 409 | `idempotency_conflict` | 节点 ID 已注册 |
 | 409 | `sandbox_reset_in_progress` | 重置期间登记或新节点读取配置 |
 | 503 | `runtime_node_unavailable` | 部署未初始化或存储不可用 |
@@ -104,11 +105,7 @@ Core 在一个事务中检查 token 有效、部署已初始化且为节点型
 
 `POST /api/v1/agent-daemon/bootstrap` 携带 daemon 凭据及 `{"device_id": "…"}`，返回 `device_id`、`workspace_id`、`ws_url`（从 `OAC_PUBLIC_URL` 推导，不使用请求头）、`heartbeat_seconds` 和 `protocol_version`。daemon 随后按 [Core–Runtime 协议](../../../docs/zh/runtime-protocol.md#ownership-and-connection)连接 `ws_url`。
 
-### 设备状态 {#device-status}
-
-`GET /api/v1/agent-daemon/device-status?device_id=` 携带 daemon 凭据，返回 `device_id`、`online` 和 `owner`：当前连接所有者的 `owner_pod_id`、`owner_url`、`generation`、`status` 和 `lease_expires_at`，或 null。
-
-引导、设备状态和 WebSocket 路由共享错误体 `{"error": code, "detail": text}`：400 `missing_params`、`missing_device_id` 或 `bad_json`；401 `missing_bearer`、`unknown_device` 或 `bad_credential`；403 `wrong_runtime_type`；500 `internal`；WebSocket 的 `version` 不等于 Core 精确 Runtime 协议版本时返回 426 `incompatible_version`。
+引导和 WebSocket 路由共享错误体 `{"error": code, "detail": text}`：400 `missing_params`、`missing_device_id` 或 `bad_json`；401 `missing_bearer`、`unknown_device` 或 `bad_credential`；403 `wrong_runtime_type`；500 `internal`；WebSocket 的 `version` 不等于 Core 精确 Runtime 协议版本时返回 426 `incompatible_version`。
 
 ### 登记自托管 daemon {#enroll-a-self-hosted-daemon}
 
diff --git a/contracts/agents-api/zh/message-content.md b/contracts/agents-api/zh/message-content.md
index 764a8761b..b7140fb1e 100644
--- a/contracts/agents-api/zh/message-content.md
+++ b/contracts/agents-api/zh/message-content.md
@@ -1,7 +1,7 @@
 ---
 title: "消息内容"
 source: contracts/agents-api/message-content.md
-source_hash: 5d0d5ba2710d1a91db22b66054701b863739d54f36d8c62df0b667ad9acb900e
+source_hash: 743fb8e8ddb2d13fe2dd32f1952e7875b05af241a5dd0ed60c6e3e10a00e8b7a
 ---
 
 用户消息和函数结果共享同一内容模型：由 `input_text` 与 `input_image` 部分组成的有序列表。Core 按发送形式准确存储消息边界、部分顺序和图像引用，并在用户 Item 中原样返回。不下载、转码或修复媒体。Session 创建的 `input` 与 `events.create` 消息共享验证和准入；[Session、事件与历史](sessions-events.md#send-input)定义准入、请求限制和错误。
@@ -19,27 +19,27 @@ source_hash: 5d0d5ba2710d1a91db22b66054701b863739d54f36d8c62df0b667ad9acb900e
 
 ## 图像 {#images}
 
-`input_image` 部分通过内联 data URI 携带 `image_url`：`data:image/png;base64,…` 或 `data:image/jpeg;base64,…`。base64 必须为规范形式，解码图像必须匹配声明类型。Core 不接受远程 URL、`file_id` 或 `detail`。
+`input_image` 部分携带非空白的 `image_url`，即官方 API 允许的远程 URL 或 base64 data URL。Core 不接受 `file_id` 或 `detail`，其余只检查下表中 Harness 声明的规则；Core 从不下载或改写图像，模型提供商对无法读取的图像返回的错误原样返回。
 
 | Harness | 消息图像 |
 | --- | --- |
-| Codex | 在 Harness 支持的所有位置接受：`none`、`openai_hosted`、`self_hosted` |
-| Claude Code | 在 `none`、`openai_hosted`、`self_hosted` 接受 |
+| Codex | 接受 `http`、`https` 以外的任意 URL 并原样传递，适用于 `none`、`openai_hosted`、`self_hosted`。`http` 或 `https` URL 返回 400，因为原生 Codex 在 Turn 中拒绝远程图像 URL |
+| Claude Code | 非 data URL 的引用成为原生 URL 来源；data URL 必须是规范 base64 的 `image/png`、`image/jpeg`、`image/gif` 或 `image/webp`，其他返回 400。适用于 `none`、`openai_hosted`、`self_hosted` |
 | MiniMax Code | 拒绝 |
 
 任何写入之前，准入检查 Harness；Harness 无法接受的图像返回 400。Runtime 也必须报告消息图像支持：Core 仅将输入含图像的 Session 绑定到此类 Runtime，交付给不支持的 Runtime 会失败。应使用接受图像的模型。
 
 ## 仅空白文本 {#whitespace-only-text}
 
-`"   "` 或 `"\n\t"` 等仅含空白的文本为有效内容，原样存储和返回。Harness 能否运行由引擎配置声明：
+`"   "` 或 `"\n\t"` 等仅含空白的文本为有效内容，原样存储和返回。Harness 能否运行由其[声明](harness-onboarding.md#declare-the-harness)指定：
 
 | Harness | 无图像且无非空白文本的消息 |
 | --- | --- |
 | Codex | 准入并原样交付 |
-| Claude Code | 400 `unsupported_or_invalid_configuration` |
+| Claude Code | 准入；原生会丢弃仅含空白的文本块，全空白消息变为 `(no content)` |
 | MiniMax Code | 400 `unsupported_or_invalid_configuration` |
 
-拒绝适用于 Session 创建（含流式和 `self_hosted` 创建）及 `events.create`，发生于任何写入、预留或 Turn 之前，因此不会干扰运行 Turn。同一消息中非空白文本旁的空白对所有 Harness 均准入。空白集合为 Go `unicode.IsSpace` 与 ECMAScript `String.prototype.trim` 的并集，例如 U+0085、U+FEFF；Core 准入和 Claude 桥接层使用相同集合。
+拒绝适用于 Session 创建（含流式和 `self_hosted` 创建）及 `events.create`，发生于任何写入、预留或 Turn 之前，因此不会干扰运行 Turn。同一消息中非空白文本旁的空白对所有 Harness 均准入。空白集合为 Go `unicode.IsSpace` 加 U+FEFF。
 
 ## 函数结果 {#function-results}
 
@@ -51,18 +51,19 @@ source_hash: 5d0d5ba2710d1a91db22b66054701b863739d54f36d8c62df0b667ad9acb900e
 
 | Harness | 函数结果 |
 | --- | --- |
-| Codex | 文本与有序文本/图像输出。Core 仅检查各部分格式正确，并将图像引用原样传给 Harness |
-| Claude Code | 文本输出。仅成功结果可含内联 PNG 或 JPEG 图像；失败结果图像或远程引用在任何存储前返回 400，待处理调用保持开放。Harness 可在原生历史中调整图像尺寸或重新编码；公开 Item 保留提交字节 |
-| MiniMax Code | 无公开函数 |
+| Codex | 文本与有序文本/图像输出，原样传给 Harness。`http` 或 `https` 图像 URL 返回 400，因为原生 Codex 会把携带此类图像的动态工具结果替换为失败 |
+| Claude Code | 文本输出。仅成功结果可含图像，且只能是规范 base64 的 `image/png`、`image/jpeg`、`image/gif`、`image/webp` data URL，因为原生工具结果不携带 URL；失败结果图像或远程引用在任何存储前返回 400，待处理调用保持开放。Harness 可在原生历史中调整图像尺寸或重新编码，或将无法处理的图像替换为文本说明；公开 Item 保留提交字节 |
+| MiniMax Code | 文本输出。图像返回 400，因为原生 MCP 图像内容尚未验证能到达模型 |
 
 ### 应用回执 {#application-receipts}
 
 准入（202）不表示 Harness 使用了结果。适配器确认原生应用后，待处理调用清除：
 
-- **Claude Code** 使用实时根原生工具结果确认，要求匹配 Session、调用 ID、成功标志、准确文本、块数和顺序，且每个图像位置都有原生图像。重放、合成和 Subagent 记录不能确认。
-- **Codex** 使用实时根 dynamic-tool `item/completed` 观察确认，要求匹配线程、Turn、调用、函数名称、状态、成功标志和准确有序内容。仅写入 Harness 不确认。
+- **Claude Code** 使用实时根原生工具结果确认，要求匹配 Session、调用 ID、成功标志、准确文本、块数和顺序，且每个图像位置都有原生图像。重放和合成记录不能确认。Subagent 的调用只由该子级自己的实时结果确认。
+- **Codex** 使用发起调用的线程和 Turn 上的实时 dynamic-tool `item/completed` 观察确认，要求匹配调用、函数名称、状态、成功标志和准确有序内容。仅写入 Harness 不确认。
+- **MiniMax Code** 使用 `functions` MCP 调用的实时原生工具更新确认，要求其回显的结果带有该调用 ID。原生使调用失败（例如 120 秒超时）时，该调用被放弃。
 
-两适配器等待回执最多 10 秒。超时或原生释放且未确认时，应用保持不确定。确认表示 Harness 记录了结果，不表示模型提供商消费了结果。Core 不自动重放结果；提交仍保留用于恢复读取。
+每个适配器等待回执最多 10 秒。超时或原生释放且未确认时，应用保持不确定。确认表示 Harness 记录了结果，不表示模型提供商消费了结果。Core 不自动重放结果；提交仍保留用于恢复读取。原生 Harness 放弃的调用没有回执，会被撤回（[Functions](execution-tools.md#functions)）。
 
 ## Runtime 边界 {#runtime-boundary}
 
diff --git a/contracts/agents-api/zh/model-execution.md b/contracts/agents-api/zh/model-execution.md
index 23ba924aa..6ba22c71e 100644
--- a/contracts/agents-api/zh/model-execution.md
+++ b/contracts/agents-api/zh/model-execution.md
@@ -1,11 +1,34 @@
 ---
 title: "模型执行"
 source: contracts/agents-api/model-execution.md
-source_hash: 1d10a63348861b53281f173f58dacc682b79453c8ea282b768e31d7ef475e1dd
+source_hash: 60789f0925a47a99f818808b5ddf5dd9f853360aa2802a9d35cfd2f5949d9f9a
 ---
 
 每个 Session 都运行一个 Harness，并使用一个模型提供商。Core 通过三个固定版本上游协议未定义的 Core 扩展来选择它们：`x_agents_core.harness` 选择 Harness，`x_agents_core.model_provider` 提供端点和密钥，`x_agents_core.harness_config` 携带原生模型参数。Core 没有提供商目录、模型别名解析或产品权限模型；除 Session 和已保存 Agent 配置包外，唯一存储的配置包是每个 Harness 的一个 [deployment default](#deployment-defaults)。本文档定义 Harness—模型提供商协议：[`internal/modelprovider/config.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/modelprovider/config.go) 负责验证冻结的提供商连接，每个 Harness 则通过 [`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go) 声明其协议和原生参数。
 
+## 模型提供商配置包 {#model-provider-bundle}
+
+Harness 接收一个冻结的模型提供商配置包，其定义见 [`modelprovider.Provider`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/modelprovider/config.go)。Core 在创建 Session 时验证它，Harness 原样使用。
+
+| 字段 | 含义 |
+| --- | --- |
+| `protocol` | 上游 API：`anthropic`、`responses` 或 `chat_completions`，而不是引擎。所选 Harness 必须原生支持它 |
+| `base_url` | 带有效主机名的 HTTPS URL，不得包含凭据、查询参数或片段 |
+| `api_key` | 不得为空，最长 16 KiB，不得包含 NUL、CR 或 LF |
+| `context_window`、`max_output_tokens` | 可选的非负整数，输出限制不得大于上下文限制。请使用真实模型的限制 |
+
+各 Harness 支持的协议和原生 token 限制：
+
+| Harness | 支持的协议（默认项在前） | 原生 token 限制 |
+| --- | --- | --- |
+| Codex | `responses` | `model_context_window`；无输出限制 |
+| Claude Code | `anthropic` | `CLAUDE_CODE_MAX_CONTEXT_TOKENS`（原生仅对其不认识的模型使用）和 `CLAUDE_CODE_MAX_OUTPUT_TOKENS`（原生将其限制在模型上限内） |
+| MiniMax Code | `anthropic`、`responses`、`chat_completions` | 自定义模型的 `limit.context` 和 `limit.output` |
+
+已设置但没有原生设置的限制返回 `model_provider_token_limits_invalid`。
+
+Core 会在写入 Session 前验证解析后的组合。Core 和 Runtime 读取 `internal/harnessconfig` 中相同的有序 `protocols` 声明。不存在模型 API 代理、直通网关或跨协议转换，Harness 内部也不例外。不受支持的已保存配置和 Session 快照一旦使用便会失败；它们绝不会在何处被重写、创建别名或迁移。
+
 ## Harness 选择 {#harness-selection}
 
 ```json
@@ -28,15 +51,7 @@ Session 的 `environment` 和 Environment 模板用于选择准备流程，而
 
 创建 Session 时，Core 会先解析每个显式的模型或 Harness 覆盖值，再应用已保存默认值；未选择 Harness 时，应用部署默认值。已保存 Agent 必须指定模型。内联 `openai_hosted` 或 `none` Session 可以省略模型，以使用解析后 Harness 的部署模型；`self_hosted` 绝不会使用部署模型设置。Core 绝不会根据模型名称推断模型。
 
-提供商配置的优先级依次为：完整的 Session 配置包、完整的已保存配置包，以及解析后 Harness 的部署默认值。Core 绝不会将替换后的端点与继承的密钥合并；仅覆盖模型时会复用整个继承的配置包。每个 Harness 仅通过其原生协议连接：
-
-| Harness | 支持的协议（默认项在前） |
-| --- | --- |
-| Codex | `responses` |
-| Claude SDK | `anthropic` |
-| MiniMax Code | `anthropic`、`responses`、`chat_completions` |
-
-MiniMax Code 要求上下文限制和输出限制均为正数。Core 会在写入 Session 前验证解析后的组合。Core 和 Runtime 读取 `internal/harnessconfig` 中相同的有序 `protocols` 声明。不存在模型 API 代理、直通网关或跨协议转换，Harness 内部也不例外。不受支持的已保存配置和 Session 快照一旦使用便会失败；它们绝不会在何处被重写、创建别名或迁移。
+提供商配置的优先级依次为：完整的 Session 配置包、完整的已保存配置包，以及解析后 Harness 的部署默认值。Core 绝不会将替换后的端点与继承的密钥合并；仅覆盖模型时会复用整个继承的配置包。每个 Harness 仅通过其原生协议连接（见[模型提供商配置包](#model-provider-bundle)）。
 
 适用来源取决于接收密钥的计算资源由谁拥有：
 
@@ -81,10 +96,6 @@ Core 从同一个数据库快照读取 Agent 配置和加密配置包；显式
 }
 ```
 
-- `protocol` 指定上游 API（`anthropic`、`responses` 或 `chat_completions`），而不是引擎。所选 Harness 必须原生支持它。
-- `base_url` 使用 HTTPS 和有效主机名，且不得包含凭据、查询参数或片段。
-- `api_key` 不得为空，最长为 16 KiB，并且不得包含 NUL、CR 或 LF。
-- `context_window` 和 `max_output_tokens` 是可选的非负整数，输出限制不得大于上下文限制；对于 MiniMax Code，两者都必须为正数。请使用真实模型的限制。
 - `agent.model` 是准确的提供商模型 ID；只要提供该值，就始终会替换部署模型。
 - Session 的 `x_agents_core` 接受 `model_provider`、`harness_config` 和 `environment`（[Environments](environments.md#preparation-order)）；任何其他成员，例如 `sandbox_node_id`，都会以 400 拒绝。托管节点放置自动完成。
 
@@ -92,7 +103,7 @@ Core 从同一个数据库快照读取 Agent 配置和加密配置包；显式
 
 解析后的提供商配置会在 Session 创建事务中被冻结并加密，使用自己的加密用途，并绑定到项目和 Session。创建重试会将其纳入请求哈希，因此使用相同 Idempotency-Key 时，更改密钥或端点会产生冲突；密钥进入任何存储哈希时，只会表现为由部署凭据密钥加键控的指纹。任何公开的 Session、Agent、Environment、事件或常规配置均不包含该密钥。顶层扩展仅可写入，无法更新。
 
-在分派时，Core 会通过绑定到 Session 的 daemon 连接，将快照作为一个机密提供商配置包发送出去；适配器会原生应用该配置并直接连接提供商。快照缺失或无法解密时，Core 绝不会回退到其他凭据。对于 `self_hosted`，接收方 daemon 是为该 Session 自身 Environment 注册的执行器，并持有 Session 创建者主体的当前执行器凭据；凭据轮换或吊销会在继续分派前关闭套接字。执行器主机将该配置包存放在其原生 Harness home 中，与托管 Runtime 的做法相同。原生工具以启动账户的权限运行，并且可以读取该账户有权读取的内容；吊销凭据不会擦除已经交付的配置包。
+在分派时，Core 会通过绑定到 Session 的 daemon 连接，将快照作为一个机密提供商配置包发送出去；适配器会原生应用该配置并直接连接提供商。快照缺失或无法解密时，Core 绝不会回退到其他凭据。对于 `self_hosted`，接收方 daemon 是为该 Session 自身 Environment 注册的执行器，并持有 Session 创建者主体的当前执行器凭据；凭据轮换或吊销会在继续分派前关闭套接字。执行器主机将该配置包存放在其原生 Harness home 中，与托管 Runtime 的做法相同。原生工具以启动账户的权限运行，并且可以读取该账户有权读取的内容。工作区的原生配置（例如 Claude Code 的项目设置和 hooks）会像在本机一样生效，并且可以使用提供商密钥，因此只能附加可以接触该密钥的可信仓库。吊销凭据不会擦除已经交付的配置包。
 
 ## 原生模型参数 {#native-model-parameters}
 
@@ -100,13 +111,13 @@ Core 从同一个数据库快照读取 Agent 配置和加密配置包；显式
 
 | Harness | 接受的字段 | 应用方式 |
 | --- | --- | --- |
-| Codex | `model_reasoning_effort`：`none`、`minimal`、`low`、`medium`、`high`、`xhigh` | App-server `-c model_reasoning_effort=...` 以及每个 Turn 的 `collaborationMode.settings.reasoning_effort` |
-| Claude SDK | `effort`：`low`、`medium`、`high`、`xhigh`、`max`；`thinking`：SDK 的 `adaptive`、`enabled` 或 `disabled` 对象 | SDK `Options.effort` 和 `Options.thinking` |
-| MiniMax Code | 仅空对象 | 仍必须给出提供商 token 限制 |
+| Codex | 仅空对象 | 推理强度属于公开的 `reasoning.effort` |
+| Claude Code | `thinking`：SDK 的 `adaptive`、`enabled` 或 `disabled` 对象 | SDK `Options.thinking`；公开的 `reasoning.effort` 对应 `Options.effort` |
+| MiniMax Code | 仅空对象 | 公开的 `reasoning.effort` 成为自定义模型的思考强度 |
 
 对于 `adaptive` 和 `enabled`，Claude `thinking` 接受 `display`（`summarized` 或 `omitted`）；只有 `enabled` 接受正整数 `budgetTokens`；拒绝 `maxThinkingTokens`。这些是原生设置，而不是通用推理词汇表；模型可用性和提供商支持均由 Harness 负责。
 
-提供对象时会替换整个对象；`{}` 会清除它，null 则无效。Session 在选择模型或提供商但未提供原生参数时，会使用 `{}`，而不会继承另一个模型的参数。否则，使用已保存 Agent 提供的对象；使用部署模型的内联 Session 使用部署对象。更改 Harness 会清除继承的参数；对模型、提供商或 Harness 的 Agent 更新如果未提供 `harness_config`，也会清除继承的参数。不进行深度合并。仅设置原生参数的内联扩展会保留已保存的 Harness。该对象和部署默认值都不会启用公开的 `reasoning` 选项。
+提供对象时会替换整个对象；`{}` 会清除它，null 则无效。Session 在选择模型或提供商但未提供原生参数时，会使用 `{}`，而不会继承另一个模型的参数。否则，使用已保存 Agent 提供的对象；使用部署模型的内联 Session 使用部署对象。更改 Harness 会清除继承的参数；对模型、提供商或 Harness 的 Agent 更新如果未提供 `harness_config`，也会清除继承的参数。不进行深度合并。仅设置原生参数的内联扩展会保留已保存的 Harness。
 
 Core 会在写入 Session 前验证解析后的配置，并将其冻结在 Session 的 Agent 配置中；管理员的 execution-configuration 读取结果会显示其值和来源。原生参数不属于机密信息；提供商密钥保存在单独加密的配置包中。重新连接会使用冻结的配置，无法更改提供商、协议或参数；不兼容的冻结配置会导致失败。仅仅支持某种协议，并不能说明结构化输出、工具发现、Web 搜索、详细程度或图像输入是否可用；连接受支持也不能证明远程模型接受某个参数。
 
@@ -125,7 +136,7 @@ PUT 要求提供 `model` 和完整的 `model_provider`；`harness_config` 默认
 
 创建 Session 时，Core 会解密解析后 Harness 的默认值，并像处理其他配置包一样将其冻结在 Session 的加密快照中，因此更改或移除默认值绝不会影响现有 Session。execution-configuration 读取结果会显示冻结的安全视图，其来源为 `deployment`。提供商快照缺失或无效时会安全失败，并且不会回退到其他模型或提供商。
 
-`model_configuration_support` 派生自 Core 和 Runtime 共享的适配器声明：`protocols` 列出可选择的原生协议，并将默认项放在首位；`accepts_harness_config` 表示是否接受原生参数；`token_limits_required` 表示是否必须给出提供商 token 限制。它描述的是构建版本，而不是实时 Runtime 或远程模型。
+`model_configuration_support` 派生自 Core 和 Runtime 共享的适配器声明：`protocols` 列出可选择的原生协议，并将默认项放在首位；`accepts_harness_config` 表示是否接受原生参数；`accepts_max_output_tokens` 表示 `max_output_tokens` 是否有原生设置。它描述的是构建版本，而不是实时 Runtime 或远程模型。
 
 ### 部署默认值观测 {#deployment-default-observations}
 
diff --git a/contracts/agents-api/zh/node-generation-protocol.md b/contracts/agents-api/zh/node-generation-protocol.md
index 3b0f50333..1d04a25a6 100644
--- a/contracts/agents-api/zh/node-generation-protocol.md
+++ b/contracts/agents-api/zh/node-generation-protocol.md
@@ -1,25 +1,60 @@
 ---
 title: "沙箱节点协议"
 source: contracts/agents-api/node-generation-protocol.md
-source_hash: 074df236614044bf7e2c7a3049a6acbfad4bc84f29fe248600cfbcd8c3e8bf09
+source_hash: 699959e60936faf4e3b999fbe5606bcdd1044d7a2edf64b339d8e1354ce90134
 ---
 
-沙箱节点在其主机上运行 Docker 或 microsandbox 提供商，并通过一个 WebSocket 与 Core 相连。Core 通过该连接发送提供商操作；节点针对本地提供商执行这些操作，并报告就绪状态、主机测量值及其持有的部署代次。Core 始终是唯一的生命周期所有者：节点绝不重试变更操作或调度工作。帧和校验器位于 [`services/core/internal/sandbox/node`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/sandbox/node)（`wire.go`、`generation_wire.go`）；节点用于注册和读取配置的 HTTP 路由位于[机器连接 API](machine-api.md#node-routes)。
+沙箱节点协议连接 Core 与 Docker 或 microsandbox 主机：主机针对其本地提供商执行提供商操作，并报告就绪状态、主机测量值及其持有的部署代次。
+
+| | |
+| --- | --- |
+| 调用方 | Core，唯一的生命周期所有者；节点从不重试变更，也不调度工作 |
+| 实现 | 沙箱节点程序，搭配 Docker 与 microsandbox 提供商 |
+| 代码 | [`services/core/internal/sandbox/node`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/sandbox/node)（`wire.go`、`generation_wire.go`） |
+| 传输 | 一个 WebSocket，`GET /api/v1/sandbox-node/connect`；节点用于登记和读取配置的 HTTP 路由见[机器连接 API](machine-api.md#node-routes) |
+| 版本规则 | 与 `node.ProtocolVersion` 精确匹配，见[帧与版本](#frames-and-version) |
+
+节点本地存储、代次租约和恢复不属于线路协议，由 [Node installer](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md#generation-storage-and-recovery) 负责。
+
+## 角色 {#roles}
+
+| 参与方 | 负责 |
+| --- | --- |
+| Core | 节点身份与在线状态、所有者 epoch、目标代次、每个请求及其序号，以及每个保留决定 |
+| 节点 | 其本地提供商、其准备并服务的代次、健康状态与主机测量值，以及针对提供商执行每个请求 |
 
 ## 帧与版本 {#frames-and-version}
 
 每个帧都是一个 JSON 文本消息，其 `version` 等于 `node.ProtocolVersion`；两端都会拒绝任何其他版本，并且没有回退解码器。成员名必须精确且唯一：未知成员、大小写别名、重复项和意外的空值都会被拒绝。控制帧（`hello`、`welcome`、`heartbeat`、`heartbeat_ack`、`retention`、`retention_ack`）最多为 32 KiB；`request` 和 `response` 帧最多为 72 MiB。无效帧会关闭连接。
 
+当前 node wire version 为 9。Core 与 node 必须使用匹配的协议，不提供旧版本解码器。
+
 ## 连接 {#connection}
 
+```mermaid
+sequenceDiagram
+    participant N as Node
+    participant C as Core
+    N->>C: dial /sandbox-node/connect with Bearer credential
+    Note over C: 401 rejected credential (permanent), 409 duplicate connection
+    N->>C: hello (identity, health, generation observations)
+    C->>N: welcome (connection_id, owner_epoch, deployment)
+    loop every 10 s
+        N->>C: heartbeat (connection_id, owner_epoch, health)
+        C->>N: heartbeat_ack (deployment)
+    end
+    C->>N: request (id, sequence, operation)
+    N->>C: response (id, result or error_code)
+```
+
 1. 节点在其存储的 Core 源地址上发起对 `/api/v1/sandbox-node/connect?node_id=<uuid>` 的连接（对于 `https` 使用 `wss`），并以 Bearer 请求头发送节点凭据。Core 对被拒绝的凭据返回 401，节点将其视为永久性拒绝；其他任何失败（包括代理返回的 403）都会使用有界退避进行重试。当某个节点身份已有一个连接正在建立、存活或关闭时，Core 会以 409 拒绝第二个连接。
-2. 节点须在 15 秒内发送 `hello`，其中包含节点身份（`node_id`、`installation_id`、`provider`、`backend_fingerprint`、已登记的 `deployment_generation` 和 `specification_digest`、`max_active`、`max_retained`）、首次健康报告；如果节点能够准备并保留多个部署代次，还包含 `generation_management: true`。除非身份与已认证节点匹配，否则 Core 会关闭连接。
-3. Core 记录节点的存在状态，然后回复 `welcome`，其中包含新的 `connection_id` 和当前 `owner_epoch`；对于支持代次管理的节点，还包含 `deployment`：目标 `generation`、其 `specification_digest` 和可空的 `serving_generation`。节点保存更高的所有者 epoch，并拒绝更低的值。
-4. 节点每 10 秒发送一次 `heartbeat`，其中包含 `connection_id`、`owner_epoch` 和健康状态。对于每次心跳，Core 都会再次认证节点凭据并检查所有者 epoch，记录健康状态并回复 `heartbeat_ack`；对于支持代次管理的节点，回复中还包含 `deployment`。任一端连续 35 秒未收到任何帧时都会关闭连接。
+2. 节点须在 15 秒内发送 `hello`，其中包含节点身份（`node_id`、`installation_id`、`provider`、`backend_fingerprint`、已登记的 `deployment_generation` 和 `specification_digest`、`max_active`、`max_retained`）和首次健康报告。除非身份与已认证节点匹配，否则 Core 会关闭连接。
+3. Core 记录节点的存在状态，然后回复 `welcome`，其中包含新的 `connection_id` 、当前 `owner_epoch` 和 `deployment`：目标 `generation`、其 `specification_digest` 和可空的 `serving_generation`。节点保存更高的所有者 epoch，并拒绝更低的值。
+4. 节点每 10 秒发送一次 `heartbeat`，其中包含 `connection_id`、`owner_epoch` 和健康状态。对于每次心跳，Core 都会再次认证节点凭据并检查所有者 epoch，记录健康状态并回复包含 `deployment` 的 `heartbeat_ack`。任一端连续 35 秒未收到任何帧时都会关闭连接。
 
-只要节点在当前所有者 epoch 下保持连接，并且最近一次心跳距今不足 45 秒，Core 就会将该节点计为在线。心跳会确立提供商的就绪状态和最近的主机测量值，但绝不表示 Session 活动。
+只要节点在当前所有者 epoch 下保持连接，并且最近一次心跳距今不足 45 秒，Core 就会将该节点计为在线。心跳会确立提供商的就绪状态和最近的主机测量值，但绝不表示 Session 活动。[超时与限制](#timeouts-and-limits)列出所有计时器。
 
-健康报告包含 `provider_ready`、可选的固定 `diagnostic`、`observed_at`、最多为 32 的 `active_operations`，以及 [Runtime 遥测 API](runtime-observability-api.md#node-host-observations-and-history) 报告的主机测量值。未启用代次管理的节点每次报告时都会探测其提供商；未就绪的提供商会报告其首个失败检查所属的、与提供商无关的就绪类别，该类别取自探测所包装的类别错误；探测文本、厂商细节和主机路径保留在节点上。节点或代次健康状态中的 `diagnostic` 若不是已声明的类别，该帧即无效。[节点指南](../../../docs/zh/getting-started/nodes.md#readiness-codes) 列出了这些类别及其原因。支持代次管理的节点则按下文所述按代次报告就绪状态。
+健康报告包含 `observed_at`、最多为 32 的 `active_operations`，以及 [Runtime 遥测 API](runtime-observability-api.md#node-host-observations-and-history) 报告的主机测量值。注册请求携带节点为健康报告所取的同样测量值：`cpu_count`、`effective_cpu_cores`、`total_memory_bytes` 和 `available_disk_bytes`，无法测量的省略，并按健康报告同样的规则校验。Core 用它们推导注册令牌未设置的每个限制，见[推荐容量](sandbox-deployment.md#recommended-capacity)。节点按代次报告就绪状态，详见下文。代次观察记录中的 `diagnostic` 若不是已声明的类别，该帧即无效。[节点指南](../../../docs/zh/getting-started/nodes.md#readiness-codes) 列出了这些类别及其原因。
 
 ## 提供商请求 {#provider-requests}
 
@@ -55,17 +90,20 @@ Core 发送包含以下内容的 `request` 帧：
 | `suspend` | `Suspend` | `suspend` | `state` |
 | `resume` | `Resume` | `resume` | `state` |
 | `delete_retained` | `DeleteRetained` | `retained` | 无 |
+| `restore_preparation` | `RestorePreparation` | `key` | `restored` |
+| `save_preparation` | `SavePreparation` | `key` | 无 |
 
-只要 `connection_id`、`owner_epoch` 或 `sequence` 中任一值不匹配，请求就会关闭连接。格式错误的请求会得到 `invalid` 响应。未启用代次管理的节点仅接受其登记的 `deployment_generation`；支持代次管理的节点在对应代次的 Provider 上运行请求，无法运行时回复 `unconfirmed`。Core 仅向节点上已就绪的代次发送 `create` 和非 reconciliation-only 的 `resume`，并且每条连接最多保留 32 个待处理请求。
+只要 `connection_id`、`owner_epoch` 或 `sequence` 中任一值不匹配，请求就会关闭连接。格式错误的请求会得到 `invalid` 响应。节点在所指 `deployment_generation` 的提供商上运行请求，无法运行时回复 `unconfirmed`。Core 仅向节点上已就绪的代次发送 `create` 和非 reconciliation-only 的 `resume`，并且每条连接最多保留 32 个待处理请求。
 
 预算采用相对计时：节点收到请求时以自己的时钟为基准锚定 `timeout_ms`，并在请求排队等待期间持续消耗该预算，因此各主机的时钟无需保持一致。Core 仍会限制自身等待时长。节点队列已满时会关闭连接。
 
-`response` 帧包含 `id` 和 `connection_id`。成功响应携带操作表中指定的结果；对于 `kill`、`kill_compute` 或 `delete_retained`，响应不含结果字段。失败响应携带一个 `error_code`：
+`response` 帧包含 `id` 和 `connection_id`。成功响应携带操作表中指定的结果；对于 `kill`、`kill_compute`、`delete_retained` 或 `save_preparation`，响应不含结果字段。失败响应携带一个 `error_code`：
 
 | `error_code` | 含义 |
 | --- | --- |
 | `invalid`、`ownership`、`exists`、`not_found` | `ErrInvalid`、`ErrOwnership`、`ErrExists`、`ErrNotFound` |
 | `command_unconfirmed` | `ErrCommandUnconfirmed` |
+| `checkpoint_unusable` | `ErrCheckpointUnusable`，`resume` 的结果 |
 | `observation_unavailable`、`runtime_not_running` | 对应的观察结果 |
 | `unsupported` | 该操作被声明为不支持；见下文 |
 | `unconfirmed` 或任何其他值 | 结果未知 |
@@ -74,58 +112,57 @@ Core 发送包含以下内容的 `request` 帧：
 
 节点启动和代次加载会在接受工作前验证完整的提供商操作声明，Core 代理使用同一份已注册声明，因此不支持的操作会在节点解析或原生 I/O 之前被拒绝。操作清单由[操作契约](../../../docs/zh/sandbox-provider.md#explicit-operation-contracts)维护。`unsupported` 响应包含一个 `unsupported` 对象，其中有精确的方法 `operation` 和经作者编写且安全的 `reason`；代理会将两者与请求进行核对。证据缺失、格式错误或不匹配会得到 `unconfirmed` 结果，而绝不会证明变更操作被拒绝。`unsupported` 始终不同于观察不可用，也不同于计算或命令结果未知；它既不确定资源所有权，也不授权重放。
 
+Create 引导和 Resume 请求可携带可选的工作区文件系统绑定。节点在转发前校验其租户及 Environment 与分配引用一致、ObjectID 不可变且有效，以及挂载配置 ID 与所传配置一致。文件系统解析器负责适配器原生所有权校验。策略声明了工作区存储的提供商拒绝缺失的绑定，未声明的提供商拒绝已提供的绑定，两者都不回退。错误响应仅可保留原生 ID 非空且名称、代次、快照来源均匹配请求的 Resume 目标；这仅为清理证据，不代表恢复成功。
+
 ## 代次控制 {#generation-control}
 
-未启用代次管理的节点只服务其登记的代次，配置固定，并且不会收到准备或保留帧。它可以在 `Health.Generations` 报告该精确代次；支持检查点的提供商必须报告，并包含已验证的检查点资格。`provider_ready` 必须与报告的状态一致。支持代次管理的节点会准备 Core 在 `welcome` 和 `heartbeat_ack` 中通告的目标代次，并在此期间继续服务其持久化的服务代次；目标代次的准备独立于服务提供商的就绪状态。
+节点会准备 Core 在 `welcome` 和 `heartbeat_ack` 中通告的目标代次，并在此期间继续服务其持久化的服务代次；目标代次的准备独立于服务提供商的就绪状态。
 
 节点的 `hello` 和心跳最多携带八条代次观察记录。每条记录指定一个正值的有符号 64 位代次编号、其小写 SHA-256 规范摘要、`ready`、`preparing` 或 `failed` 状态，以及可选的固定诊断信息。目标代次和服务代次的记录排在前面，其余记录公平轮换。八条记录限制的是单条消息，而不是节点可保留的代次数量。省略某条观察记录绝不会授权删除，也不会暗示不存在。 支持检查点的 ready 代次携带 `checkpoint`，包含非空且不透明的 `artifact_domain` 和 `execution_class` token，各最多 256 字节。不支持的提供商省略该字段；preparing 或 failed 代次不声明它。Core 将声明与已认证连接和代次一起持久化，仅在当前在线连接的该代次仍 ready 时使用。[提供商契约](../../../docs/zh/sandbox-provider.md#checkpoint-transfer) 定义归档与执行兼容性。
 
-保留使用独立且有界的交换。`retention` 请求最多指定八个本地 `(generation, specification_digest)` 引用、一个 UUID、一个每次递增 1 的 `sequence`、当前 `connection_id` 和所有者 epoch。`retention_ack` 必须与完整的待处理请求匹配，包括条目顺序和身份信息，并为每个条目给出显式布尔值 `keep`。每条连接只能有一个交换处于待处理状态，断连会将其丢弃。任何未经请求、重放、过期、不完整或混合的确认都不会删除任何内容。保留流量从不使用提供商请求队列。
-
-## 本地保留与辅助程序生命周期 {#local-retention-and-helper-lifetime}
-
-Core 的丢弃授权是回收的必要条件，但并非充分条件。排队和运行中的提供商调用、准备过程、本地目标代次以及服务固定引用都会保留引用；回收会再次检查这些引用，并拒绝在已取消的连接上执行。取消提供商调用方并不能证明其原生辅助程序已经停止；节点会将该辅助程序计为存活，直到其实际 `Wait` 返回。
-
-每个代次都拥有一个永久私有租约文件 `state/node/generations/<generation>.lease`。在启动原生辅助程序之前，节点先在该文件上获取共享 flock，在持有该锁时验证持久化租约身份，并要求最终提供商配置已经发布且不存在 preparing、collecting 或 dropped 日志。辅助程序继承该描述符；节点仅在 `Wait` 返回后关闭自己的副本，且绝不显式解锁该共享打开文件描述，因此取消调用方或节点退出都不会释放仍在运行的辅助程序所持的引用。原生辅助程序在调用 SDK 前会设置描述符的 close-on-exec 标志，因此 VM 和守护进程后代不会继承它。
-
-回收在检查引用、删除共享镜像或版本文件或发布 dropped 标记之前，先获取独占非阻塞 flock，并在这些变更期间持续持有该锁。租约文件属于稳定的节点状态，回收期间绝不删除或替换；符号链接、多重硬链接文件、外来所有权、不安全权限以及被替换的锁定路径都会被拒绝。在第一个辅助程序能够启动之前，安装器先独占创建租约并对其执行 fsync，随后以原子方式持久化私有 `.lease-identity` 记录，并对该记录及其目录执行 fsync。该记录绑定安装、代次、规范摘要、设备号和 inode。Python 回收器和 Go 辅助程序打开器在每次打开时都会验证同一记录，包括重启后；身份记录缺失时，两者都不会进行接管，也不会替换其 inode 或在回收后将其擦除。若安装在身份记录持久化前中断，则会拒绝重新接管，并保留该安装以供检查。身份记录被移除或租约被替换时，即使当前元数据一致，也会拒绝重新接管。
+```mermaid
+stateDiagram-v2
+    [*] --> preparing
+    preparing --> ready
+    preparing --> failed
+    failed --> preparing: repair
+    ready --> [*]: dropped
+    failed --> [*]: dropped
+```
 
-已丢弃代次绝不能再次准备或使用。辅助程序退出只能证明本地文件方面的状态，不能证明远程变更操作或结果不确定的提供商回执已释放；Core 对分配和放置的持久保留仍保持独立。
+一个代次可以是目标代次、服务代次、两者兼是或两者皆非。节点将所持有的每个代次报告为 `preparing`、`ready` 或 `failed`；已丢弃的代次不会再被准备或使用。已丢弃代次的本地回收见 [Node installer](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md#generation-storage-and-recovery)。
 
-## 完全匹配的新安装 {#matched-fresh-installation}
+保留使用独立且有界的交换：由节点询问，由 Core 决定。节点的 `retention` 请求最多指定八个本地 `(generation, specification_digest)` 引用、一个 UUID、一个每次递增 1 的 `sequence`、当前 `connection_id` 和所有者 epoch。Core 的 `retention_ack` 必须与完整的待处理请求匹配，包括条目顺序和身份信息，并为每个条目给出显式布尔值 `keep`。每条连接只能有一个交换处于待处理状态，断连会将其丢弃。任何未经请求、重放、过期、不完整或混合的确认都不会删除任何内容。保留流量从不使用提供商请求队列。
 
-主机程序版本与 Core 选择的 Runtime 版本彼此独立。全新节点从控制台当前版本获取其可执行文件和私有准备器，并从经认证的配置中读取确切的 Runtime 源、镜像身份以及原生运行时和固件摘要。当该 Runtime 较旧时，控制台仍会提供其不可变的 `releases/<source>/` 清单、校验和以及允许列表中的制品：Runtime 辅助程序、固件、seccomp 配置文件和镜像字节都来自所选版本；即使下载期间控制台的当前版本发生变化，制品 URL 仍固定到已验证的清单。
+```mermaid
+sequenceDiagram
+    participant N as Node
+    participant C as Core
+    N->>C: retention (id, sequence, up to 8 references)
+    C->>N: retention_ack (keep for every entry, same order)
+    Note over C,N: One exchange is pending per connection
+```
 
-所需的保留版本缺失时，安装会被拒绝，而不会替换为当前 Runtime；仅包含另一个 Runtime 的本地捆绑包也会导致拒绝。所有这些拒绝都发生在安装器写入节点身份、导入 Runtime、注册节点或启动服务之前。
+## 就绪诊断 {#readiness-diagnostics}
 
-已发布的控制台版本会保留其元数据和制品字节。再次发布时，会先验证所有元数据及每个已存在的已声明制品，然后可以原子地仅添加缺失且校验和匹配的已声明制品；任何冲突都会阻止全部添加，并且不会覆盖任何内容。
-
-## 重启恢复 {#restart-recovery}
-
-Runtime 字节缺失时，绝不将固定的放置实例迁移到当前 Runtime。节点将原始代次和规范摘要保留为未就绪状态，并在恢复前通过 Core 的经认证配置路由请求该精确代次。缺少 seccomp 字节可能留下未就绪的提供商占位项；提供商探测发现镜像或原生制品缺失时，会将修复排队，但不会通告就绪状态。
-
-准备和修复串行执行。目标代次和服务代次优先，其余代次则以有界方式推进。每次尝试的截止时间为 30 分钟；失败后依次退避 1、2、5 和 10 分钟，此后最多退避 30 分钟。在连接提供部署信息之前，不准备任何内容。修复保留现有配置和路径，验证所选版本及每个现有同级文件的校验和，并且只下载缺失的不可变文件。字节冲突或保留规范不同都会拒绝修复；如果缺少提供商配置且没有精确的准备计划，也会拒绝，而不是重建该配置。
-
-修复与回收使用相同的独占代次租约和安装锁，因此正在运行的辅助程序或回收器会保持所有权，修复稍后重试。字节恢复后，节点仍会运行提供商的就绪探测；文件存在和具备可执行能力永远不能证明就绪。
-
-## 准备与回收记录 {#preparation-and-collection-records}
-
-新的准备过程会写入两条不同的记录。下载前，`.preparing` 保存安装、代次和规范身份、私有提供商路径以及 `import_started: false`；它是恢复和回收计划，而不是提供商。导入器运行前，计划会记录 `import_started: true`。Python 保留发现流程和 Go 重启恢复流程都能识别仅有待处理状态的计划，但绝不会据此构建、探测或获取提供商；恢复或回收仍需要当前连接上的授权。
-
-只有准备成功才会发布最终 `.json` 提供商配置，该配置只写入一次。Docker 记录其解析器返回的不可变本地镜像 ID；对于同一规范，构建器的配置身份或清单身份均可有效。准备日志清除之前，发布结果必须已经持久化。两者之间发生中断时，会重新验证同一计划和最终身份；计划、规范或路径发生漂移时会拒绝。已取消或失败的导入仍会向 Core 的保留交换保持可见，但不会成为服务代次。
-
-在删除任何原生层对象或版本文件之前，节点都会持久化一份私有回收日志，并将其绑定到安装、代次和规范摘要。重启后，未完成的日志仅是保留交换的候选项：它不能准备、探测、获取或通告该代次，必须重新获取一份与之关联的新 Core 丢弃授权后才能继续。在删除版本文件之前先持久化原生清理完成状态，因此重试可以完成部分删除的版本，而不会运行已经删除的辅助程序。完成持久化文件清理后，再写入与摘要绑定的 dropped 标记，以防重新接管；这些小型的配置和所有权日志会保留为本地身份记录。
-
-对于仅属于该安装的 microsandbox 存储，成功且完整的原生镜像清单可以区分“不存在”和“CLI 失败”；查询失败、清单格式错误、原生层因正在使用而拒绝或所有权不明时，都会保留这些字节。共享 microsandbox 镜像和私有版本会一直保留到最后一个本地引用消失。Docker 镜像属于主机的共享守护进程：自动回收绝不删除或修剪这些镜像，只有主机管理员在确认主机上没有安装需要它们后才能删除。
-
-全新安装还会另行记录其 Runtime 文件的已验证校验和，与主机程序分开保存。回收原始代次时，只删除未被任何保留配置引用的确切私有 Runtime 辅助程序、可执行文件、固件、seccomp 和导入缓存文件。第一次删除前会检查每个剩余文件；哈希未知、字节发生变化、存在链接或缺少所有权元数据时，都会拒绝清理。节点可执行文件、准备器、身份、基础提供商配置和清单会保留，因此重启后的节点仍可读取其登记身份并构建较新的保留提供商。删除共享原生路径前，会先在所有保留配置之间对这些路径进行比较。
+就绪类别编写于 `services/core/internal/sandbox/node_diagnostic.go`，每个类别对应一个导出错误和一个代码。共享的 `services/core/internal/sandbox/testdata/node-diagnostics.json` 测试夹具检查 Go 映射、OpenAPI 源注释和生成的枚举，以及 TypeScript 客户端声明。Web 使用客户端规范化器，并检查每个已声明代码的本地化消息。代码变更时要同步更新这些投影；客户端将未知代码读作 `provider_unavailable`。
 
-下载中断后，只会修复原始路径中缺失的字节。如果在任何导入尝试之前执行回收，准备日志会证明该代次没有已导入的原生镜像。如果某代次的原生可执行文件缺失，且导入可能已经开始，该代次仍会保留：文件缺失永远不能证明原生制品不存在，而空的原生清单也永远不能抹除回执或存储历史。
+准备诊断使用固定的类型化原因。提供商故障、所有权故障、取消和未分类故障保留其类型化代码，或使用 `provider_unavailable`。协议中不会传输任何提供商原始文本。
 
-就绪类别编写于 `services/core/internal/sandbox/node_diagnostic.go`，每个类别对应一个导出错误和一个代码。共享的 `services/core/internal/sandbox/testdata/node-diagnostics.json` 测试夹具检查 Go 映射、OpenAPI 源注释和生成的枚举，以及 TypeScript 客户端声明。Web 使用客户端规范化器，并检查每个已声明代码的本地化消息。代码变更时要同步更新这些投影；客户端将未知代码读作 `provider_unavailable`。
+## 超时与限制 {#timeouts-and-limits}
 
-准备诊断使用固定的类型化原因。只有制品传输、校验和或版本来源验证失败才会报告 `runtime_download_failed`；私有准备器通过退出类别指示这一类失败，Core 和节点都不解析 stderr。提供商故障、所有权故障、取消和未分类故障保留其类型化代码，或使用 `provider_unavailable`。协议中不会传输任何提供商原始文本。
+| 值 | 适用于 | 到期或超出时 |
+| --- | --- | --- |
+| 15 秒 | 连接打开后的 `hello` | 连接关闭 |
+| 10 秒 | 心跳间隔；也是每个帧的写入截止时间 | 写入失败会结束连接 |
+| 35 秒 | 已打开连接上的任意帧 | 任一端关闭连接 |
+| 45 秒 | 在线节点最近一次心跳的时长 | Core 将该节点计为离线 |
+| 1 到 120000 毫秒 | 请求的 `timeout_ms` | 请求以不可用或不确定结束 |
+| 32 | 每个连接的待处理请求数；健康状态中的 `active_operations` | 节点队列已满时关闭连接 |
+| 32 KiB | 控制帧 | 连接关闭 |
+| 72 MiB | `request` 和 `response` 帧 | 连接关闭 |
+| 8 | 每条消息的代次观察记录数；每个 `retention` 请求的引用数 | 缺失的观察记录不代表任何含义 |
 
-创建操作通过 `Bootstrap.Harness` 将会话选择传递到 Runtime 启动协议版本 2。Core 和节点使用协议版本 8，需协调升级配套组件。`Bootstrap.Harness` 是必填字段。十项暂停操作均属于同一个 `SandboxProvider`，必须完整声明支持或不支持；不通过可选接口分派。`Observe` 每次只观测一个 allocation。
+## 一致性测试 {#conformance}
 
-当前线协议版本为 7。Create 引导和 Resume 请求可携带可选的工作区文件系统绑定。节点在转发前校验其租户及 Environment 与分配引用一致、ObjectID 不可变且有效，以及挂载配置 ID 与所传配置一致。文件系统解析器负责适配器原生所有权校验。未提供绑定时选择自有存储；已提供绑定时不得回退。错误响应仅可保留原生 ID 非空且名称、代次、保留状态来源均匹配请求的 Resume 目标；这仅为清理证据，不代表恢复成功。
+[`services/core/internal/sandbox/node`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/sandbox/node) 中的 Go 测试覆盖帧、连接顺序与围栏、请求预算、代次控制和提供商操作，由 `make check-core` 运行。`deploy/node` 中的 Python 节点安装程序测试覆盖代次准备与回收的节点侧。
diff --git a/contracts/agents-api/zh/sandbox-deployment.md b/contracts/agents-api/zh/sandbox-deployment.md
index 8a1a6e696..62757f7e0 100644
--- a/contracts/agents-api/zh/sandbox-deployment.md
+++ b/contracts/agents-api/zh/sandbox-deployment.md
@@ -1,19 +1,13 @@
 ---
 title: "沙箱部署"
 source: contracts/agents-api/sandbox-deployment.md
-source_hash: 618bc3dcf7a027a1629e7c2cb998df759038a3d0804de8c92b2f64b73d124929
+source_hash: b8c5e348f505dc448436e611a6d30235f1ebb789bd41e2544545367b732cd03c
 ---
 
-沙箱部署为 Core 管理的 `openai_hosted` 执行选择沙箱提供商、每个沙箱的资源以及不可变的 Runtime 发行版。PostgreSQL 为每个安装维护一个当前有效选择；Web 和 Core API 写入同一配置。节点文件保存其已安装副本和特定于主机的路径，且不能覆盖其资源或 Runtime。该选择独立于 Harness。部署可以保持未配置状态，没有节点；此时它拒绝托管准入。
+沙箱部署为 Core 管理的 `openai_hosted` 执行选择沙箱提供商和每个沙箱的资源。PostgreSQL 为每个安装维护一个当前有效选择；Web 和 Core API 写入同一配置。节点文件保存其已安装副本和特定于主机的路径，且不能覆盖其资源。Runtime 不属于该选择：每个节点运行其所属安装验证过的 Runtime。该选择独立于 Harness。部署可以保持未配置状态，没有节点；此时它拒绝托管准入。
 
 本契约负责下列 Core API 路由及其语义。[节点指南](../../../docs/zh/getting-started/nodes.md)负责操作员工作流，[机器连接 API](machine-api.md#node-routes)负责节点调用的路由，[沙箱节点协议](node-generation-protocol.md)负责节点连接。
 
-## 挂起策略 {#suspension-policy}
-
-`PATCH /core/v1/sandbox/deployment` 接受 `{"idle_seconds": 300}`。`idle_seconds` 是必填整数，范围为 30–86400 秒，默认为 300。该设置保存在 Core 的数据库中。只有已配置且声明暂停支持的 Provider 可修改；未配置、不支持或正在重置的部署拒绝写入。成功返回当前部署视图，`suspension.idle_seconds` 反映已保存的值。
-
-变更从下一轮生命周期检查起作用于现有和新建的运行中分配，不重启 Core、不推进配置代次，也不重新部署节点。已经开始的挂起不撤销；现有快照和 24 小时快照保留期不变。[容量压力回收](../../../docs/zh/sandbox-provider.md#suspension)仍可在空闲 15 秒后提前挂起。Web 在 **设置** → **沙箱与调度** → **自动挂起** 管理此部署级策略；各节点的容量上限仍属于节点，在 **节点** 中通过 **编辑节点** 编辑。
-
 ## 路由 {#routes}
 
 每个路由都需要 Core 密钥。[Web 的控制台服务器](../../../docs/zh/web/console-server.md)会在服务器端为已登录请求添加该密钥。
@@ -22,12 +16,12 @@ source_hash: 618bc3dcf7a027a1629e7c2cb998df759038a3d0804de8c92b2f64b73d124929
 | --- | --- |
 | `GET /core/v1/sandbox/deployment` | 读取安全的当前配置、推出、重置和资源计数 |
 | `PATCH /core/v1/sandbox/deployment` | 更新整个部署的空闲挂起策略，不改变配置代次 |
-| `POST /core/v1/sandbox/deployment` | 选择初始提供商、资源和 Runtime |
+| `POST /core/v1/sandbox/deployment` | 选择初始提供商和资源 |
 | `PUT /core/v1/sandbox/deployment` | 在线更改同一提供商的目标 |
 | `POST /core/v1/sandbox/deployment/reset` | 启动托管资源的持久清除或将其升级为持久清除 |
 | `DELETE /core/v1/sandbox/deployment/reset?expected_generation=N` | 取消剩余清除 |
 | `POST /core/v1/sandbox/providers/{provider}/discovery` | 使用临时凭据查询提供商配置目录 |
-| `POST /core/v1/sandbox/enrollment-tokens` | 签发具有已批准容量的一次性节点注册令牌 |
+| `POST /core/v1/sandbox/enrollment-tokens` | 签发带可选节点限制的一次性节点注册令牌 |
 | `GET /core/v1/sandbox/nodes` | 列出已注册节点 |
 | `GET /core/v1/sandbox/nodes/{node_id}` | 读取一个节点及其[主机观测和历史](runtime-observability-api.md#node-host-observations-and-history) |
 | `PATCH /core/v1/sandbox/nodes/{node_id}` | 更改节点的名称和容量 |
@@ -44,8 +38,8 @@ POST 和 PUT 接受相同的完整选择，并要求提供先前 GET 返回的 `
 | `expected_generation` | 必填的非负整数，来自 GET；绝不会自动刷新并重放 |
 | `provider` | 必须是 `docker`、`microsandbox`、`e2b` 中恰好一个 |
 | `resources` | 每个沙箱的限制，见下文；Docker 和 microsandbox 必填，E2B 可选 |
-| `runtime` | 不可变的 [Runtime 发行版](#runtime-release)；Docker 和 microsandbox 必填，E2B 必须省略 |
 | `configuration` | 提供商的公开选择器。E2B：不可变的 `template` 构建以及可选且配套的 `api_url` 和 `domain`。Docker 和 microsandbox 仅接受 `{}` 或省略 |
+| `compute_profiles` | 可选映射，包含下文说明的最多八个命名不可变资源选项；省略或 `{}` 会将映射替换为空 |
 | `credential` | 提供商的只写凭据。E2B：`{api_key}`，首次设置时必填，在 PUT 中省略以保留当前密钥；null 或空密钥无效。Docker 和 microsandbox 拒绝该字段 |
 
 请求中没有 Core 地址。Core 根据安装公开 URL（`config.json` 中的 `public_url`，Core 对应 `OAC_PUBLIC_URL`）派生部署的 `core_url`：这是节点和沙箱客户机访问 Core 时使用的源地址。包含 `core_url` 的请求会像包含任何其他未知成员一样被拒绝，并返回 400 `invalid_request`。E2B 客户机从 E2B 云访问 Core，因此当公开 URL 为回环地址时，E2B 选择会被拒绝，并返回 409 `sandbox_configuration_error`。Docker 和 microsandbox 选择接受回环公开 URL，但这仅适用于本地开发，因为客户机的回环地址无法访问其主机。更改公开 URL 属于安装变更：使用旧地址注册的节点不会收到新沙箱，必须移除后重新添加。
@@ -57,33 +51,33 @@ POST 和 PUT 接受相同的完整选择，并要求提供先前 GET 返回的 `
 | `cpus` | 整数，1 到 255 |
 | `memory_mib` | 整数，512 到 1048576 MiB |
 | `root_disk_mib` | microsandbox：至少 1024 MiB；Docker 和 E2B：省略或为零 |
-| `environment_disk_mib` | microsandbox 自有磁盘：至少 1024 MiB；外部文件系统：每个新工作区的获准容量，零表示不请求配额，正值必须至少为 1024 MiB 且要求强制执行配额；Docker 和 E2B：省略或为零 |
+| `environment_disk_mib` | microsandbox：工作区存储上每个新工作区的获准容量，零（默认值）表示不请求配额，正值必须至少为 1024 MiB 且要求强制执行配额；Docker 和 E2B：省略或为零 |
 
-这些限制描述每个沙箱。节点的 `max_active` 和 `max_retained` 是独立的预留限制，主机测量值绝不会允许超过其中任何一个。即使数值满足这些边界，原生提供商仍可能拒绝这些值。
+这些限制描述每个沙箱。节点的 `max_active` 和 `max_retained` 是独立的预留限制，设置方式见[节点与分配](#nodes-and-allocations)；限制一经设置，任何主机测量值都不允许超过其中任何一个。即使数值满足这些边界，原生提供商仍可能拒绝这些值。
 
 Docker 应用 CPU 和内存限制，并检查运行中容器的限制和精确镜像；它没有硬性的根磁盘或工作区磁盘配额。E2B 的 CPU 和内存必须与精确的就绪模板构建一致，Core 会在保存前通过固定版本 SDK 进行验证；磁盘容量仍属于模板的一部分。两种提供商都不接受其无法强制执行的磁盘配额。E2B 选择可以省略 `resources`：此时 Core 将构建的 CPU 数量和内存存储为 `cpus` 和 `memory_mib`，并通过 `specification.resources` 返回，不带磁盘字段。重启时，Core 会加载已提交的 E2B 选择，而不会再次验证模板构建，因此 E2B 中断绝不会阻碍检查或清理；新选择仍需验证。
 
-microsandbox 会配置 CPU、内存、托管根磁盘，以及位于 `/environment` 的独立自有磁盘。[microsandbox 辅助工具](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/tools/microsandbox-provider/README.md)说明了 restore 如何处理这些限制。
+microsandbox 会配置 CPU、内存和托管根磁盘，并在挂载于 `/environment` 的[工作区存储](../../../docs/zh/workspace-provider.md)上运行每个 Environment。[microsandbox 辅助工具](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/tools/microsandbox-provider/README.md)说明了 restore 如何处理这些限制。
 
 
-响应中可选的 `specification.workspace` 是从所选[工作区文件系统](../../../docs/zh/workspace-provider.md)派生的不可变能力回执，不是可独立写入的设置。它仅包含 `attachment`、`user_xattr` 和 `capacity_quota`；文件系统配置、路径和凭据不进入 Sandbox specification。Core 保存前校验组合声明，保留代次校验与节点构造均使用此回执。缺失 `workspace` 时保留自有磁盘模式及现有容量边界。Create 和 Resume 必须且仅当固定代次选择外部存储时提供绑定。
+响应中可选的 `specification.workspace` 是从所选[工作区文件系统](../../../docs/zh/workspace-provider.md)派生的不可变能力回执，不是可独立写入的设置。它仅包含 `attachment`、`user_xattr` 和 `capacity_quota`；文件系统配置、路径和凭据不进入 Sandbox specification。Core 保存前校验组合声明，保留代次校验与节点构造均使用此回执。microsandbox 始终具备该回执，尚未选择工作区存储时保存部署会返回 `workspace_storage_required`。Docker 和 E2B 没有回执，继续使用自有磁盘。Create 和 Resume 必须且仅当固定代次具备该回执时提供绑定。
 
-为现有自有磁盘部署启用外部存储时，先选择文件系统配置，再使用兼容资源更新 Sandbox 部署（不支持配额的文件系统使用 `environment_disk_mib: 0`）。选择文件系统不会改变现有代次或 allocation。下一次 Sandbox 更新派生外部能力回执；旧的自有磁盘 allocation 保留原磁盘。文件系统选择必须支持提供商声明的要求。已采用外部存储的部署要求相同的 `attachment` 和 `user_xattr`；选择可以更改 `capacity_quota`，此后在 Sandbox 更新设置相匹配的 `environment_disk_mib` 之前拒绝新工作区。既有工作区保持其获准时的容量。
+先选择文件系统配置，再配置 microsandbox 部署。选择文件系统不会改变现有代次或 allocation；下一次 Sandbox 更新派生该回执。文件系统选择必须支持提供商声明的要求。现有部署要求相同的 `attachment` 和 `user_xattr`；选择可以更改 `capacity_quota`，此后在 Sandbox 更新设置相匹配的 `environment_disk_mib` 之前拒绝新工作区。既有工作区保持其获准时的容量。
 
-### Runtime 发行版 {#runtime-release}
+### 计算规格 {#compute-profiles}
 
-Docker 和 microsandbox 使用一个经过验证发行包中的每个字段：
+direct 模式部署可以在同一 POST 或 PUT 完整选择中添加 `compute_profiles`，最多八个名称，每个名称匹配 `^[a-z][a-z0-9-]{0,47}$`。值仅包含 `resources` 和 `configuration`，必须显式提供 CPU 和内存。档位继承部署的提供商、Runtime 和凭据，不能更换凭据端点；node 模式拒绝非空档位。提交前逐项规范化并验证不可变 build，任何一项无效均拒绝整个更新。
 
-| 字段 | 标识 |
-| --- | --- |
-| `source_commit` | 由 40 个字符组成的小写提交 SHA |
-| `image_id` | Docker 镜像配置 ID：`sha256:` 加 64 个小写十六进制字符 |
-| `image_manifest_digest` | OCI 镜像清单摘要，格式相同 |
-| `microsandbox_ref` | `oac-runtime@sha256:` 加 64 个小写十六进制字符 |
-| `runtime_sha256` | 原生 microsandbox Runtime 二进制文件的 SHA-256 |
-| `firmware_sha256` | 匹配固件的 SHA-256 |
+```json
+{"compute_profiles":{"memory-8g":{"resources":{"cpus":4,"memory_mib":8192},"configuration":{"template":"template-id:build-uuid"}}}}
+```
+
+以上是请求片段，必须同时提供完整现有部署选择和 `expected_generation`，并使用实际 ready 的不可变 build，资源必须与实测值完全一致。不会自动从 4 核降级到 2 核。默认 `resources`、`configuration` 与这些档位独立。省略或 `{}` 清空可选档位；删除档位仅阻止新 Session 选择，已有 Session 保留冻结配置。GET 返回每个档位的 generation、specification、安全 configuration 和 metadata，不返回凭据。
+
+部署仅保存名称到 generation 的引用；配置唯一存储于不可变 generation 行。默认 generation 大于本次所有档位 generation，因此编号可能跳跃。GC 保留当前档位和已选择档位的未删除 Session，即使尚未分配计算资源。凭据轮换继续让保留 generation 使用当前部署凭据；reset 通过既有托管资源清理流程清空档位映射。
+
+迁移 `000004_session_compute_profiles.sql` 增加部署引用映射和 Session 绑定表，默认值为空，不需要手工数据回填，不改变现有默认资源。配置档位前执行正常迁移。
 
-请从匹配的发行清单中复制这些标识。镜像配置 ID 和 OCI 清单摘要标识不同的对象，绝不能相互替代。节点安装程序会在注册前根据载荷验证已保存的发行版，并保留其导入的精确本地镜像标识。
 
 ### E2B 配置 {#e2b-configuration}
 
@@ -104,9 +98,9 @@ GET 和成功的写入操作会返回 `installation_id`、`provider`、`core_url
 - 请求中的 `resources` 和响应中的 `specification.resources` 是每个沙箱的限制。响应中的 `resources.allocations` 和 `resources.pending` 分别计算尚未释放的分配，以及尚未分配沙箱的待处理托管 Environment。
 - 未配置的部署具有空的提供商且没有 specification。Docker 和 microsandbox 使用 `mode: nodes`；E2B 使用 `mode: direct`，且没有合成节点。
 - `generation` 标识已保存的选择。`owner_epoch` 用于对执行所有者和节点连接进行栅栏隔离；它不能替代 `expected_generation`。
-- `specification_digest` 是服务器对提供商、限制和 Runtime 发行版的标识；注册过程会原样回显该值。
+- `specification_digest` 是服务器对提供商、限制和派生的工作区能力回执的标识；注册过程会原样回显该值。
 
-`packages/agents-client` 中类型化的 `SandboxAdminClient` 会根据准确的这些结构检查部署、节点列表、节点详情和分配响应。未知成员、缺少成员或类型错误都会拒绝整个响应，并产生 502 `invalid_admin_response` 错误。节点的 `diagnostic` 可能不存在，也可能是一个代码，但绝不会为空；客户端会将未知代码读取为 `provider_unavailable`。
+`packages/agents-client` 中类型化的 `SandboxAdminClient` 会根据准确的这些结构检查部署、节点列表、节点详情和分配响应。未知成员、缺少成员或类型错误都会拒绝整个响应，并产生 502 `invalid_admin_response` 错误。节点的 `rollout.diagnostic` 可能不存在，也可能是一个代码，但绝不会为空；客户端会将未知代码读取为 `provider_unavailable`。
 
 ## 初始设置与同提供商更改 {#initial-setup-and-same-provider-changes}
 
@@ -132,6 +126,12 @@ POST 会在持久保存候选配置之前对其进行验证，并且不会创建
 
 凭据验证失败会输出结构化 `sandbox credential verification failed` 日志，字段包括固定的 `phase` 与 `error_class`、数字 `generation` 和 `refs_count`。阶段区分读取当前选择、验证已提交的所有权锚点、使用候选密钥检查当前选择、检查候选选择、读取保留代次、检查某个保留代次、读取分配，以及检查分配引用。读取尚未选定代次时 generation 为零；候选选择报告其输入代次，不代表新提交的代次。日志不包含提供商错误文本、配置、模板、端点或凭据。
 
+## 挂起策略 {#suspension-policy}
+
+`PATCH /core/v1/sandbox/deployment` 接受 `{"idle_seconds": 300}`。`idle_seconds` 是必填整数，范围为 30–86400 秒，默认为 300。该设置保存在 Core 的数据库中。只有已配置且声明暂停支持的提供商可修改；未配置、不支持或正在重置的部署拒绝写入。成功返回当前部署视图，`suspension.idle_seconds` 反映已保存的值。
+
+变更从下一轮生命周期检查起作用于现有和新建的运行中分配，不重启 Core、不推进配置代次，也不重新部署节点。已经开始的挂起不撤销；现有快照和 24 小时快照保留期不变。[容量压力回收](../../../docs/zh/sandbox-provider.md#suspension)仍可提前挂起空闲的分配，并在 retained slot 已满时[提前结束符合条件的检查点的保留期](../../../docs/zh/sandbox-provider.md#cold-replacement-after-checkpoint-retention)。Web 在 **设置** → **沙箱与调度** → **自动挂起** 管理此部署级策略；各节点的容量上限仍属于节点，在 **节点** 中通过 **编辑节点** 编辑。
+
 ## 代次所有权与推出 {#generation-ownership-and-rollout}
 
 `runtime_deployment` 保存当前 specification。被取代的行仅保留不可变的 specification、构建和端点元数据，绝不保留另一个 E2B 密钥。E2B 分配在预留时绑定其代次；节点放置在调度器预留兼容容量时绑定，其分配会复制该代次，即使之后发生更新也是如此。检查、续期、命令和清理使用分配的原始 specification 和端点以及当前密钥；缺失代次绝不会回退到当前 specification。已释放代次的标识仍会保留。
@@ -144,15 +144,24 @@ POST 会在持久保存候选配置之前对其进行验证，并且不会创建
 "rollout": {"state": "settled", "previous_generation_sandboxes": 3, "nodes": null}
 ```
 
-`previous_generation_sandboxes` 使用与资源总数相同的快照，统计旧代次中尚未释放的分配以及没有分配的待处理放置，绝不会重复计算同一资源。E2B 和未配置的部署返回 null `nodes`。节点部署将 `nodes` 返回为计数 `{ready, preparing, failed, update_required, unknown}`，每个尚未移除的节点恰好归入一个类别：
+`previous_generation_sandboxes` 使用与资源总数相同的快照，统计旧代次中尚未释放的分配以及没有分配的待处理放置，绝不会重复计算同一资源。E2B 和未配置的部署返回 null `nodes`。节点部署将 `nodes` 返回为计数 `{ready, preparing, failed, unknown}`，每个尚未移除的节点恰好归入一个类别：
 
 - 在当前连接上离线的节点为 `unknown`；
-- 不具备代次管理且在较旧目标上注册的在线节点为 `update_required`；
 - 否则，当前连接和所有者 epoch 上的精确目标观测会给出 `ready`、`preparing` 或 `failed`，缺少观测则给出 `unknown`。
 
-节点在当前所有者 epoch 下保持连接，并且最近 45 秒内有心跳时，即为在线。目标推出与服务就绪状态相互独立：`unknown`、`preparing`、`failed` 或 `update_required` 不会移除已独立确认的较旧服务代次。`provider_ready` 要求节点在线，并且在该连接和 epoch 上观测到精确的服务代次；不具备代次管理的节点仅能使其注册时的代次满足此条件。固定状态本身绝不表示就绪。
+```mermaid
+flowchart TD
+    A{"Online on its current connection?"} -- no --> U["unknown"]
+    A -- yes --> C{"Target observation on this connection and epoch"}
+    C -- ready --> R["ready"]
+    C -- preparing --> P["preparing"]
+    C -- failed --> F["failed"]
+    C -- missing --> U
+```
+
+节点在当前所有者 epoch 下保持连接且心跳未过期时，即为[在线](node-generation-protocol.md#connection)。目标推出与服务就绪状态相互独立：`unknown`、`preparing` 或 `failed` 不会移除已独立确认的较旧服务代次。`provider_ready` 要求节点在线，并且在该连接和 epoch 上观测到精确的服务代次。固定状态本身绝不表示就绪。
 
-每个节点会添加 `rollout: {state, ready_generation, diagnostic?}`，其中 `ready_generation` 是可为 null 的持久服务固定状态，`diagnostic` 是目标代次的固定代码；分配项会添加 `deployment_generation`。仅当 `rollout.state` 为 `preparing` 或 `reset` 非 null 时，才每五秒轮询一次；旧 Session 以及失败、需要更新或离线的节点本身均不会使轮询保持活动状态。
+每个节点会添加 `rollout: {state, ready_generation, diagnostic?}`，其中 `ready_generation` 是可为 null 的持久服务固定状态，`diagnostic` 是目标代次的固定代码；分配项会添加 `deployment_generation`。仅当 `rollout.state` 为 `preparing` 或 `reset` 非 null 时，才每五秒轮询一次；旧 Session 以及失败或离线的节点本身均不会使轮询保持活动状态。
 
 节点模式创建先验证目标部署，提交 Session、pending Environment 及初始输入，但不预留计算资源。节点全部已满、离线或准备中时，已接受的工作继续等待；未配置部署、reset 或不支持的组合仍拒绝准入。共同调度器对尚未放置的需求进行有界循环扫描，分页按需求记录时间和 Environment ID 排序，每轮使用固定时间上界，避免持续的新需求阻止重新访问较早的工作。它检查在线状态、精确服务代次就绪情况、地址、共享容量和所选代次的 Harness/文件系统兼容性，然后优先选择最新的合格固定代次。预留后的 placement 保持不可变，直到确认释放或已结清的检查点转移。有界扫描跳过暂时不可调度的需求，并在重启后继续。已有 suspended allocation 按[检查点转移契约](../../../docs/zh/sandbox-provider.md#checkpoint-transfer)，通过同一容量锁预留符合条件的检查点容量；这不构成热恢复和未放置工作之间的全局公平性保证。输入保留[原始五分钟期限](./environments.md#reservations)，等待容量的时间也计入其中。
 
@@ -168,6 +177,19 @@ POST 会在持久保存候选配置之前对其进行验证，并且不会创建
 
 `clear` 必填，可取 `auto` 或 `force`。`deadline_seconds` 适用于 `auto`，默认值为 3600，接受 300 到 86400；`force` 必须省略该字段。在关闭新的托管准入之前，Core 会持久保存绝对截止时间和请求方的审计来源信息；请求结束后以及跨重启时，执行所有者会继续推进清除。在 `auto` 模式下，Core 会归档空闲的托管 Session，包括排队或待处理工作以及已暂停沙箱，并等待正在执行或等待的 root Turn 和 Subagent Turn 以及待处理的文件写入完成，同时在 Session 锁下重新检查。到达持久保存的截止时间时，Core 会持久地将操作升级为 `force`。`force` 会对每个符合条件的托管 Session 使用常规归档取消和清理路径。绝不触碰自托管 Session。
 
+```mermaid
+stateDiagram-v2
+    direction LR
+    [*] --> inactive
+    inactive --> auto: POST auto
+    inactive --> force: POST force
+    auto --> force: deadline or POST force
+    auto --> inactive: DELETE
+    force --> inactive: DELETE
+    auto --> unconfigured: no held resources
+    force --> unconfigured: no held resources
+```
+
 以相同代次和模式再次启动时，会保留原始截止时间。`auto` 可以升级为 `force`，但不能反向升级。使用当前 `expected_generation` 发出 DELETE 会取消剩余工作并重新开放准入；它不会撤销归档、恢复已过期 Environment，也不会取消已经请求的清理。没有活动重置时，DELETE 是无操作；请求过期则返回 409。
 
 未激活时 `reset` 为 null，否则为：
@@ -179,7 +201,7 @@ POST 会在持久保存候选配置之前对其进行验证，并且不会创建
                "offline_nodes": [{"node_id": "node-uuid", "name": "worker", "resources": 2}]}}
 ```
 
-一个数据库快照会先按 `cleanup`，再按 `busy` 或 `idle`，对每个尚未释放的分配和每个尚未分配沙箱的待处理托管 Environment 进行划分，因此 `busy + idle + cleanup == resources.allocations + resources.pending`。已删除或已过期且具有未释放回执的 Session 计入 cleanup。`offline_nodes` 是通过分配或活动放置持有资源的离线节点的完整列表，并按 ID 排序，其总和等于 `on_offline_nodes`；存在性依据当前所有者 epoch、连接状态以及 45 秒内的心跳判断，而不依据提供商就绪状态。直接 E2B 资源没有节点。离线资源会持续构成阻塞条件，直到清理确认其已释放。
+一个数据库快照会先按 `cleanup`，再按 `busy` 或 `idle`，对每个尚未释放的分配和每个尚未分配沙箱的待处理托管 Environment 进行划分，因此 `busy + idle + cleanup == resources.allocations + resources.pending`。已删除或已过期且具有未释放回执的 Session 计入 cleanup。`offline_nodes` 是通过分配或活动放置持有资源的离线节点的完整列表，并按 ID 排序，其总和等于 `on_offline_nodes`；存在性依据节点是否[在线](node-generation-protocol.md#connection)判断，而不依据提供商就绪状态。直接 E2B 资源没有节点。离线资源会持续构成阻塞条件，直到清理确认其已释放。
 
 当两个占用计数均达到零时，所有者会排空执行，并原子清除提供商、mode、specification、提供商 configuration、credential、metadata 和提供商 policy，停用节点和未使用的注册令牌，递增代次与所有者 epoch，并记录 `reset_complete`。安装身份和历史会保留。Core 会立即发布未配置状态，即使没有提供商也保留新代次，因此延迟加载无法恢复旧配置。使用 POST 和返回的代次即可重新配置，无需重启。
 
@@ -191,29 +213,37 @@ POST 会在持久保存候选配置之前对其进行验证，并且不会创建
 
 ## 节点与分配 {#nodes-and-allocations}
 
-节点容量由管理员批准，独立于部署 specification。`POST /core/v1/sandbox/enrollment-tokens` 接受可选的 `max_active` 和 `max_retained`，默认分别为 2 和 8，并返回 `{token, expires_at, enrollment_id}`；`enrollment_id` 是该命令的公共句柄，绝不是凭据。microsandbox 会使用两个限制。Docker 绝不暂停，因此 Core 会在此处和 PATCH 中用 `max_active` 替换其 `max_retained`。E2B 没有节点，并返回 409 `sandbox_deployment_conflict`。Core 将批准值与令牌一同存储，并复制到其注册的节点；节点不能提交容量，其本地检查可以拒绝其无法运行的部署，但绝不会提高限制。[节点容量](../../../docs/zh/configuration.md#node-capacity)为操作员说明了这些限制。
+节点容量独立于部署 specification 设置。`POST /core/v1/sandbox/enrollment-tokens` 接受可选的 `max_active` 和 `max_retained`，并返回 `{token, expires_at, enrollment_id}`；`enrollment_id` 是该命令的公共句柄，绝不是凭据。Core 将令牌与发送的限制一同存储，省略的限制保持未设置。节点注册时，Core 把每个显式限制原样复制给节点，并把每个未设置的限制设为注册请求中的主机测量值与当前 specification 的[推荐容量](#recommended-capacity)；限制未设置且没有主机测量值时，返回 409 `sandbox_node_host_unmeasured`，令牌保持未使用。只设置 `max_retained` 时，推导出的 `max_active` 不会超过它；只设置 `max_active` 时，推导出的 `max_retained` 会被提高到至少等于 `max_active`。microsandbox 会使用两个限制。Docker 绝不暂停，因此 Core 会在此处和 PATCH 中用 `max_active` 替换其 `max_retained`。E2B 没有节点，并返回 409 `sandbox_deployment_conflict`。节点不能提交限制，但未设置的限制取决于节点在注册时报告的主机测量值，范围限定在 1 到 1000000。其本地检查可以拒绝其无法运行的部署，但绝不会提高限制。显式值和之后的 PATCH 修改具有约束力：节点注册之后，Core 不再推导。[节点容量](../../../docs/zh/configuration.md#node-capacity)为操作员说明了这些限制。
 
-`GET /core/v1/sandbox/nodes` 返回 `{data: [...]}`，其中每个节点包含 `id`、`name`、`provider`、`online`、`last_seen_at`、`created_at`、`max_active`、`max_retained`，计数项 `active`、`reserved`、`running`、`retained`、`snapshots` 和 `cleanup_pending`，以及 `provider_ready`、`diagnostic`、主机测量值 `cpu_count`、`available_memory_bytes` 和 `available_disk_bytes`、`rollout`、`enrollment_id` 和 `core_url`。`enrollment_id` 是注册该节点的命令的句柄；如果 Core 没有该句柄，则为 null。`core_url` 是注册时的安装公开 URL；`core_url` 与当前公开 URL 不同的节点不会收到新放置。已放置到该节点的工作会继续在那里完成，包括已放置但尚未获得分配的 Environment；只要旧地址仍能访问 Core，其保留沙箱仍可恢复。请移除该节点并重新添加。
+`GET /core/v1/sandbox/nodes` 返回 `{data: [...]}`，其中每个节点包含 `id`、`name`、`provider`、`online`、`last_seen_at`、`created_at`、`max_active`、`max_retained`，计数项 `active`、`reserved`、`running`、`retained`、`snapshots` 和 `cleanup_pending`，以及 `provider_ready`、主机测量值 `cpu_count`、`available_memory_bytes` 和 `available_disk_bytes`、`rollout`、`recommended_capacity`、`enrollment_id` 和 `core_url`。`recommended_capacity` 是 `{max_active, max_retained}`，即节点最新健康状态与当前 specification 的[推荐容量](#recommended-capacity)；在节点报告 CPU 数量或有效核数以及总内存之前，以及当前 specification 未通过校验时，为 null。`enrollment_id` 是注册该节点的命令的句柄；如果 Core 没有该句柄，则为 null。`core_url` 是注册时的安装公开 URL；`core_url` 与当前公开 URL 不同的节点不会收到新放置。已放置到该节点的工作会继续在那里完成，包括已放置但尚未获得分配的 Environment；只要旧地址仍能访问 Core，其保留沙箱仍可恢复。请移除该节点并重新添加。
 
-不具备代次管理的节点会自行报告其提供商的就绪状态：`provider_ready`，未就绪时则报告一个固定的 `diagnostic` 代码。通过 Web 的命令添加的节点会管理代次，因此其就绪状态取决于服务代次，而目标代次的固定代码会出现在 `rollout.diagnostic` 中。节点会对首次失败的就绪检查进行分类，并且只发送代码；携带任何其他值的帧均无效，且 Core 绝不存储或返回探测文本或主机路径。这些代码是与提供商无关的类别：`provider_unavailable`、`host_unsupported`、`artifacts_unavailable`、`runtime_download_failed`、`runtime_image_unavailable` 和 `capacity_insufficient`。`runtime_download_failed` 表示无法传输或验证精确的 Runtime 制品；它绝不会包含制品 URL、凭据或传输输出。[就绪代码](../../../docs/zh/getting-started/nodes.md#readiness-codes)给出了原因和操作员应采取的措施。Core 和节点必须来自同一发行包。
+节点管理代次，因此其 `provider_ready` 取决于服务代次，目标代次的固定代码会出现在 `rollout.diagnostic` 中。节点会对首次失败的就绪检查进行分类，并且只发送代码；携带任何其他值的帧均无效，且 Core 绝不存储或返回探测文本或主机路径。这些代码是与提供商无关的类别：`provider_unavailable`、`host_unsupported`、`artifacts_unavailable`、`runtime_image_unavailable` 和 `capacity_insufficient`。[就绪代码](../../../docs/zh/getting-started/nodes.md#readiness-codes)给出了原因和操作员应采取的措施。Core 和节点必须来自同一发行包。
 
 `PATCH /core/v1/sandbox/nodes/{node_id}` 接受 `{name, max_active, max_retained}`；降低限制不会停止任何正在运行的沙箱。当节点仍持有分配、快照、预留或待处理清理时，包括节点离线期间，`DELETE /core/v1/sandbox/nodes/{node_id}` 会拒绝操作并返回 409 `runtime_node_in_use`。移除操作不会删除任何计算资源，并且会停用该节点的身份；该主机只能作为新节点重新加入。不存在节点排空过程。
 
 `GET /core/v1/sandbox/nodes/{node_id}/allocations` 列出节点尚未释放的分配。每个项的 `compute_phase_changed_at` 表示该分配进入当前 `compute_phase` 的时间；未知时为 null。该时间是阶段切换时间，不是快照到期时间。此响应不提供快照截止时间，不应根据 `suspension.retention_seconds` 推算。
 
+### 推荐容量 {#recommended-capacity}
+
+Core 用一条规则，从节点主机和单个沙箱的大小推导推荐值。`cpus` 在节点报告 `effective_cpu_cores` 时取该值，否则取 `cpu_count`。
+
+- `max_active` 取 `floor(2 × cpus / specification cpus)` 与 `floor((total_memory − 2 GiB) / specification memory)` 中较小者，至少为 1，至多为 1000000。CPU 按核数的两倍分配，因为 Agent 沙箱大多在等待模型。内存从不超配，并为主机和节点服务保留 2 GiB。
+- 不支持检查点的提供商，`max_retained` 等于 `max_active`。否则取 `max_active` 与 `floor(available_disk / 2 / root_disk)` 中较大者，至多为 1000000：挂起的沙箱把根磁盘检查点保留在节点上，其中一半可用磁盘留给它们。
+
+主机未同时报告 CPU 数量或有效核数与总内存时，没有推荐值。Core 仅在注册令牌未设置某个限制时应用它；Web 在 **编辑节点** 中显示它，从不自行应用。
+
 ## 各沙箱提供商中的字段含义 {#what-each-field-means-per-sandbox-provider}
 
 某些字段在不同提供商中保持同一名称，但含义不同或不适用。部署字段来自 `GET /core/v1/sandbox/deployment`，节点和分配字段来自节点路由，Runtime 字段来自 [Runtime 遥测 API](runtime-observability-api.md)；其中 `disk` 仅出现在观测列表中，历史则在 [Session Runtime 历史](runtime-observability-api.md#session-runtime-history)下说明。
 
 | 字段 | microsandbox | E2B | Docker |
 | --- | --- | --- | --- |
-| 独立工作区文件系统 | [Kernel NFS adapter](../../../docs/zh/workspace-provider.md#kernel-nfs-adapter)；与计算资源分开配置 | 不支持 | 不支持 |
-| 部署 `specification.resources` | `cpus`、`memory_mib`、`root_disk_mib` 和 `environment_disk_mib` | `cpus` 和 `memory_mib`，必须等于就绪模板构建中的值；省略时取自该构建；无磁盘字段 | `cpus` 和 `memory_mib`；无磁盘配额 |
-| 部署 `specification.runtime` | 完整的[发行版](#runtime-release)；节点必须与 `microsandbox_ref`、`runtime_sha256` 和 `firmware_sha256` 匹配 | 不存在；`configuration.template` 用于选择构建 | 完整的[发行版](#runtime-release)；节点必须与 `image_id` 或 `image_manifest_digest` 匹配 |
+| 独立工作区文件系统 | 必需：[Kernel NFS adapter](../../../docs/zh/workspace-provider.md#kernel-nfs-adapter)，与计算资源分开配置 | 不支持 | 不支持 |
+| 部署 `specification.resources` | `cpus`、`memory_mib`、`root_disk_mib`，以及作为配额请求的 `environment_disk_mib` | `cpus` 和 `memory_mib`，必须等于就绪模板构建中的值；省略时取自该构建；无磁盘字段 | `cpus` 和 `memory_mib`；无磁盘配额 |
 | 部署 `metadata.template_build` | 不存在：`metadata` 为空 | Core 保存选择时读取到的构建 | 不存在：`metadata` 为空 |
 | 部署 `suspension` | `{idle_seconds, retention_seconds}` | `{idle_seconds, retention_seconds}` | `null` |
 | 部署 `resources.allocations`、`resources.pending` | 所有节点的总数 | Core 中尚未释放的 E2B 沙箱，以及正在等待沙箱的托管 Environment | 所有节点的总数 |
-| 注册令牌 `max_active`、`max_retained` | 两个限制均适用 | 先执行 400 容量检查，然后返回 409 `sandbox_deployment_conflict`；E2B 没有节点 | `max_retained` 始终等于 `max_active` |
+| 注册令牌 `max_active`、`max_retained` | 两个限制均适用；省略的限制在注册时推导 | 先执行 400 容量检查，然后返回 409 `sandbox_deployment_conflict`；E2B 没有节点 | `max_retained` 始终等于 `max_active` |
 | 节点列表和详情 | 已注册节点 | 空列表；详情返回 404 | 已注册节点 |
 | 节点 `retained`、`snapshots`、`max_retained` | 已暂停沙箱数为 `retained` 减去 `active`；`snapshots` 还包含恢复或清理期间保留的快照 | 不适用 | Docker 绝不暂停：`retained` 等于 `active`，`snapshots` 为 0，`max_retained` 等于 `max_active` |
 | 节点 `host.available_disk_bytes` | 节点状态目录所在文件系统的可用空间；沙箱磁盘有自己的配额 | 不适用 | 节点状态目录所在文件系统的可用空间，而不是容器的磁盘 |
@@ -229,6 +259,7 @@ POST 会在持久保存候选配置之前对其进行验证，并且不会创建
 | --- | --- | --- |
 | 400 | `invalid_request_error` 或 `invalid_request` | 请求格式错误 |
 | 400 | `invalid_sandbox_configuration` | 配置验证产生的诊断错误 |
+| 409 | `workspace_storage_required` | 提供商在工作区存储上运行每个 Environment，但尚未选择存储 |
 | 409 | `sandbox_generation_stale` | `expected_generation` 不是当前值；`current_generation` 提供当前代次 |
 | 409 | `sandbox_reset_required` | 提供商不同；详情会指明当前提供商和请求的提供商 |
 | 409 | `sandbox_not_configured` | 更改未配置的部署 |
@@ -241,8 +272,8 @@ POST 会在持久保存候选配置之前对其进行验证，并且不会创建
 
 ## 规范的节点规格 {#canonical-node-specification}
 
-`sandbox/deployment_contract.go`负责资源边界、发行版模式和规范字段顺序，每个已注册提供商的 `sandbox.DeploymentPolicy` 声明其要求；`sandbox/deployment.go`在 Core 中应用这些规则。安装程序会使用 `deploy/node/node_spec.py` 中生成的声明，TypeScript 客户端和 Web 使用 `packages/agents-client/src/deployment-contract.ts` 中生成的边界、模式和提供商声明，因此不存在第二套限制、模式或提供商列表。请在仓库根目录运行 `go run ./services/core/cmd/specification-contract -write` 重新生成两者；作为 `make check` 一部分的沙箱 Go 测试会拒绝过时的投影。
+`sandbox/deployment_contract.go`负责资源边界和规范字段顺序，每个已注册提供商的 `sandbox.DeploymentPolicy` 声明其要求；`sandbox/deployment.go`在 Core 中应用这些规则。安装程序会使用 `deploy/node/node_spec.py` 中生成的声明，TypeScript 客户端和 Web 使用 `packages/agents-client/src/deployment-contract.ts` 中生成的边界和提供商声明，因此不存在第二套限制或提供商列表。请在仓库根目录运行 `go run ./services/core/cmd/specification-contract -write` 重新生成两者；作为 `make check` 一部分的沙箱 Go 测试会拒绝过时的投影。
 
-规范摘要是紧凑 UTF-8 JSON 的 SHA-256，其中 `provider` 位于首位，其次是 `resources`，然后在提供商需要时放置 `runtime`。资源和 Runtime 字段遵循契约的声明顺序；值为零的可选磁盘字段会被省略，必填字段则保持存在。发行版标识采用小写 ASCII，摘要绝不会受传入字段顺序或空白字符影响。`services/core/internal/sandbox/testdata/deployment-contract.json`保存共享验收用例、精确的规范字节和摘要，Go 与 Python 测试都会使用这些内容。
+规范摘要是紧凑 UTF-8 JSON 的 SHA-256，其中 `provider` 位于首位，其次是 `resources`。资源字段遵循契约的声明顺序；值为零的可选磁盘字段会被省略，必填字段则保持存在。摘要绝不会受传入字段顺序或空白字符影响。`services/core/internal/sandbox/testdata/deployment-contract.json`保存共享验收用例、精确的规范字节和摘要，Go 与 Python 测试都会使用这些内容。
 
-规范摘要的 JSON 在 `runtime` 后包含可选的 `workspace`，字段按文件系统声明顺序排列：`attachment`、`user_xattr`、`capacity_quota`，布尔字段始终保留。该回执参与不可变 specification digest。
+规范摘要的 JSON 在 `resources` 后包含可选的 `workspace`，字段按文件系统声明顺序排列：`attachment`、`user_xattr`、`capacity_quota`，布尔字段始终保留。该回执参与不可变 specification digest。
diff --git a/contracts/agents-api/zh/session-diagnostics.md b/contracts/agents-api/zh/session-diagnostics.md
index b6bf3762d..db6d25884 100644
--- a/contracts/agents-api/zh/session-diagnostics.md
+++ b/contracts/agents-api/zh/session-diagnostics.md
@@ -1,9 +1,11 @@
 ---
-title: "根 Session 与 Turn 诊断"
+title: "Session 诊断"
 source: contracts/agents-api/session-diagnostics.md
-source_hash: f6c2bf7d41c48795074e26f5df2393723033cb53533c115581fdfcfb720784b9
+source_hash: e51cae1d19d57fe9bec5d77fc7d07805dbfc76bfa751e133e48e66017a50684d
 ---
 
+管理员通过两个需要 Core 密钥的路由读取 Session 或 Turn 失败的原因，它们报告失败类别和 Item 接收时间。
+
 这些只读路由要求 Core 密钥。项目 ID 选择目标项目，不用于认证。两者都返回 `Cache-Control: no-store`：
 
 - `GET /core/v1/projects/{project_id}/sessions/{session_id}/diagnostics`
diff --git a/contracts/agents-api/zh/sessions-events.md b/contracts/agents-api/zh/sessions-events.md
index 9d5ec0416..33a9f41cf 100644
--- a/contracts/agents-api/zh/sessions-events.md
+++ b/contracts/agents-api/zh/sessions-events.md
@@ -1,10 +1,10 @@
 ---
 title: "Session、事件和历史"
 source: contracts/agents-api/sessions-events.md
-source_hash: ec4793c064dfe73020c3cade63a2b17d3ac08e72f1528cd33110630bbbcf623c
+source_hash: 2eb9f5ed442a080fde67e95c749ad3cd0e79692a5cf5e36d1771328627f6df4e
 ---
 
-本契约涵盖 Session 内部发生的事情：发送输入、实时事件流，以及读取 Turn、Item 和使用量的持久化历史。Session 资源本身（创建配置、重试标识、更新、列出和删除）见 [Core 线协议行为](wire-semantics.md)。消息和函数结果内容见[消息内容](message-content.md)。[Agents API 指南](../../../docs/zh/api/public-agent-api.md)展示了使用 SDK 和 HTTP 的调用方式。
+本契约涵盖 Session 内部发生的事情：发送输入、实时事件流，以及读取 Turn、Item 和使用量的持久化历史。Session 资源本身（创建配置、重试标识、更新、列出和删除）见 [API 行为](wire-semantics.md)。消息和函数结果内容见[消息内容](message-content.md)。[Agents API 指南](../../../docs/zh/api/public-agent-api.md)展示了使用 SDK 和 HTTP 的调用方式。
 
 ## 恢复模型 {#recovery-model}
 
@@ -27,6 +27,20 @@ Session 的 `status` 和 `last_active_at` 由其最新的根 Turn 以及仍在
 | `requires_action` | 最新 Turn 正在等待函数结果且未请求取消，或输入正在等待 `self_hosted` 机器连接。`required_actions` 列出 `function_call` 或 `environment_connection` 条目 |
 | `failed` | 最新 Turn 失败（`error` 为 "The execution could not complete."）、为 Environment 预留的输入失败、初始输入在接纳前到期，或 Environment 初始化失败（见 [Environment 初始化失败](#environment-initialization-failure)） |
 
+```mermaid
+stateDiagram-v2
+    [*] --> idle
+    idle --> in_progress: Turn queued
+    in_progress --> idle: completed or cancelled
+    in_progress --> requires_action: awaits function result
+    idle --> requires_action: awaits self_hosted machine
+    requires_action --> in_progress: result or machine
+    requires_action --> idle: cancelled
+    in_progress --> failed: Turn failed
+    idle --> failed: input expired or Environment failed
+    failed --> in_progress: new input
+```
+
 Turn 失败后 Session 仍可使用：新输入会启动一个新 Turn。后来预留的输入到期时，Session 保持为 `idle`。Environment 初始化失败或过期会阻止新工作。
 
 ## 发送输入 {#send-input}
@@ -66,9 +80,7 @@ Turn 失败后 Session 仍可使用：新输入会启动一个新 Turn。后来
 
 ### 包含 Environment 的会话 {#sessions-with-an-environment}
 
-在 `openai_hosted` 和 `self_hosted` Session 中，Turn 运行期间发送的消息会立即加入该 Turn。发送给空闲 Session 的消息会为 Environment 预留该批次：请求等待 Turn 开始，从预留时起最多等待五分钟。预留等待 `self_hosted` 机器连接时，Session 显示为 `requires_action`，并带有 `environment_connection` 操作。在这些部署方式下，携带消息的批次只能包含消息。仅取消和仅结果的批次会立即被接纳，并且不会创建 Turn。
-
-当 Turn 启动时，等待中的请求以 202 结束；超过截止时间时，以 409 `environment_input_expired` 结束；管理员归档 Session 或重置其部署并取消预留时，以 409 `environment_input_cancelled` 结束；Environment 失败或过期时，以 409 `environment_unavailable` 结束。断开等待中的请求不会取消预留，也不会重新开始其截止计时。
+在 `openai_hosted` 和 `self_hosted` Session 中，Turn 运行期间发送的消息会立即加入该 Turn。发送给空闲 Session 的消息会为 Environment 预留该批次：请求等待 Turn 开始，从预留时起最多等待五分钟，Turn 启动时以 202 结束，否则以某个[输入错误](#input-errors)结束。预留等待 `self_hosted` 机器连接时，Session 显示为 `requires_action`，并带有 `environment_connection` 操作。在这些部署方式下，携带消息的批次只能包含消息。仅取消和仅结果的批次会立即被接纳，并且不会创建 Turn。断开等待中的请求不会取消预留，也不会重新开始其截止计时。
 
 ### 输入错误 {#input-errors}
 
@@ -83,9 +95,11 @@ Turn 失败后 Session 仍可使用：新输入会启动一个新 Turn。后来
 | `call_id` 未标识该 Session 的任何函数调用的结果 | 400 `invalid_request_error`, param null | "Unknown pending tool call." |
 | 为该 Session 的某个调用提交结果，但 `turn_id` 标识另一个 Turn、未知 Turn ID，或不是 Turn ID 的值 | 400 `invalid_request_error`, param null | "The tool call belongs to a different Turn." |
 | 缺失、格式错误或来自其他作用域的 Session | 404 `not_found_error` | "Resource not found." |
+| 预留的批次在 Turn 启动前超过五分钟截止时间 | 409 `environment_input_expired` | "The environment input deadline elapsed before admission." |
+| 预留的批次因管理员归档 Session 或重置其部署而被取消 | 409 `environment_input_cancelled` | "The environment input was cancelled before admission." |
 | `openai_hosted` Environment 预配失败后提交新输入 | 409 `conflict_error` | "the hosted environment failed to provision" |
 | `self_hosted` Environment 失败后提交新输入、Environment 失败时输入已在等待，或 Environment 已过期 | 409 `environment_unavailable` | "The environment is no longer available for new input." |
-| Session Harness 无法处理的消息，例如 Claude Code 上仅含空白的文本 | 400 `unsupported_or_invalid_configuration` | 见[仅含空白的文本](message-content.md#whitespace-only-text) |
+| Session Harness 无法处理的消息，例如 MiniMax Code 上仅含空白的文本 | 400 `unsupported_or_invalid_configuration` | 见[仅含空白的文本](message-content.md#whitespace-only-text) |
 
 `turn_id` 为空或 `call_id` 为空白时，会返回通用的 400 `invalid_request`。错误消息绝不会重复调用方输入或内部标识符。
 
@@ -128,6 +142,7 @@ Turn 失败后 Session 仍可使用：新输入会启动一个新 Turn。后来
 - `item.added` 和 `item.done` 始终携带 `output_index`；输入 Item 的该值为 null。函数结果只发出 `item.added`；`item.done` 用于代理输出。
 - 助手消息遵循以下单一顺序：先发送 `content` 为空的进行中 `item.added`，再发送文本为空的 `content_part.added`，然后发送 `output_text.delta` 事件、`output_text.done`、`content_part.done` 和 `item.done`。首次观察时已完整的消息（例如结构化输出）会在一个 `output_text.delta` 中逐字节发送全部文本。完整文本会替换此前累积的增量。
 - Codex 命令输出以 `agent.output.command_execution_output.delta` 流式传输，并携带命令的 Item ID 和输出索引。原生输出配额和文本转换规则适用，因此这些增量并非逐字节捕获的原始结果；完整 Item 才是权威结果。
+- reasoning Item 遵循以下单一顺序：先发送 `summary` 为空的进行中 `item.added`；然后按顺序对每个 `summary_text` 部分发送文本为空的 `reasoning_summary_part.added` 和 `reasoning_summary_text.delta` 事件，并在下一个部分开始或 Item 结束时发送 `reasoning_summary_text.done` 和 `reasoning_summary_part.done`；最后发送 `item.done`。被取消或失败的 Turn 截断的部分，其 `reasoning_summary_part.done` 的 `status` 为 `incomplete`，否则为 null。子 Turn 快照改写了先前文本时，新文本只出现在 done 事件中。
 - 已取消或失败的 Turn 会将其未完成的 Item 标记为 `incomplete`，并保留其部分内容。
 - 函数调用会一直保留在 `required_actions` 中，直到 Harness 应用其结果，或取消操作或 Turn 结束将其移除。重复通知不会发出新状态。
 
@@ -145,11 +160,14 @@ Turn 和 Item 列表接受 `after`、`limit` 和 `order`（[列表规则](wire-s
 | `command_execution` | 命令、报告的输出、退出代码、持续时间和工作目录 |
 | `mcp_call` | 服务器和工具标识、参数、结构化结果或错误 |
 | `function_call`、`function_call_output` | 关联的调用及其结果。结果始终携带 `output` 和 `error`；提交时省略这些字段则值为 null。存储的结果会保留提交时字段是否存在的信息。原生文件更改显示为 `apply_patch` 函数调用，更改内容作为参数，不会生成虚构结果 |
-| `web_search_call` | 支持的操作字段（`search`、`open_page`、`find_in_page`、`other`） |
-| `reasoning`、`agent_message` 和 Subagent 协调调用 | 见 [Subagents](subagents.md)。`agent_message` 没有状态；reasoning 状态可以为 null |
+| `web_search_call` | 支持的操作字段（`search`、`open_page`、`find_in_page`、`other`）；Claude Code 以 `search` 报告 `WebSearch`，以 `open_page` 报告 `WebFetch` |
+| `reasoning` | 一个原生推理 item，每个原生部分对应一个 `summary_text` 部分，仅在 Agent 设置了 `reasoning.summary` 时出现；为 null（默认）时，任何 Turn（根或子）都没有 `reasoning` Item 和 reasoning 事件。文本内容见 [OpenAI 兼容性](index.md#differences-from-openai)。子 Turn 的 Item 状态可以为 null |
+| `agent_message` 和 Subagent 协调调用 | 见 [Subagents](subagents.md)。`agent_message` 没有状态 |
 
 工具失败不会导致其 Turn 失败。Session 的项目可以读取工具输出，其中可能包含该工具自己的诊断文本。
 
+PostgreSQL 无法存储 U+0000，因此 Harness 输出（例如命令输出）中的 U+0000 在存储、事件流和列表中都会替换为 U+FFFD，Turn 照常继续。
+
 ## 使用量 {#usage}
 
 Turn 和 Session 的 `usage` 使用固定的 `TokenUsage` 字段：输入、缓存输入、输出、推理输出和 token 总数。`null` 表示未知，绝不表示零。
diff --git a/contracts/agents-api/zh/source-files.md b/contracts/agents-api/zh/source-files.md
index 6f8e1f59c..3eae82672 100644
--- a/contracts/agents-api/zh/source-files.md
+++ b/contracts/agents-api/zh/source-files.md
@@ -1,7 +1,7 @@
 ---
 title: "文件与 Skill"
 source: contracts/agents-api/source-files.md
-source_hash: 320216a4e7ac0d1e3e2455dfe622e0f91576ea1d0aa00d11911683b0e98387f1
+source_hash: 86d63f3ea780394ed99c0f5ec9d566117140a8650cb780e4b038e4ab45155ba9
 ---
 
 Files（`/v1/files`）和 Skills（`/v1/skills`）是具有独立生命周期的项目资源，不依赖 Session。File 保存上传字节，Environment 通过 ID 复制它们。Skill 保存不可变、版本化的包，由模板和 Session 引用。项目的所有 API 密钥共享这些资源。
@@ -57,8 +57,6 @@ Files（`/v1/files`）和 Skills（`/v1/skills`）是具有独立生命周期的
 
 Core 在自身数据库中以 PostgreSQL 大对象存储 File 字节。上传和删除分别在单一事务中提交，失败不会留下部分字节或元数据。[备份](../../../docs/zh/getting-started/operations.md#back-up)数据库时包含大对象；删除 File 不会将其从预写日志或旧备份移除。
 
-存在 File 行时，源文件 schema 拒绝降级。先通过 API 删除 File，以清理大对象。
-
 复制到工作区时读取 File 一致快照，可在 File 删除后完成；后续查询失败。删除 File 不改变工作区副本。
 
 ## Skill {#skills}
diff --git a/contracts/agents-api/zh/subagents.md b/contracts/agents-api/zh/subagents.md
index 90322bfc7..c4346f1aa 100644
--- a/contracts/agents-api/zh/subagents.md
+++ b/contracts/agents-api/zh/subagents.md
@@ -1,7 +1,7 @@
 ---
 title: "子 Agent"
 source: contracts/agents-api/subagents.md
-source_hash: 8fed8b73a8403d2ccf80354b2a981f11240eba3c10d5a0257206a39d048b92a7
+source_hash: 6c4fe5212d8473ff319fea4a6abf30d8038b75dd663dd9612ddad023adb918c7
 ---
 
 启用 `multi_agent.enabled` 后，Harness 可以启动原生子 Agent。Core 通过锁定版本的 SDK（见 [`upstream.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/upstream.json)）中的六项 Subagent 读取操作公开它们，并根据适配器观察结果记录它们。当 `multi_agent.enabled=false` 时，Runtime 会移除原生子 Agent 工具。[Harness capabilities](harness-capabilities.md) 列出各 Harness 在哪些组合中支持子 Agent。
@@ -52,12 +52,12 @@ Core 根据已授权的 Session 绑定关系分配合公开 ID 和所有权。
 
 ## 原生配置 {#native-profiles}
 
-[Harness capabilities](harness-capabilities.md#tools) 列出被拒绝的工具组合。
+Subagent 像本地运行该 Harness 一样使用 Agent 的函数和 HTTP MCP 工具；其调用如何呈现见 [Functions](execution-tools.md#functions)，各组合见 [Harness capabilities](harness-capabilities.md#tools)。Codex 子级继承 Agent 的 HTTP MCP 服务器；fork 出的子级继承其函数，使用全新历史的子级没有函数。Claude Code 子级继承父级的工具，因此原生调用 Agent 的函数（`mcp__functions__<name>`）和 HTTP MCP 工具。
 
-**Codex.** 适配器会启用原生 `multi_agent` 特性，将嵌套深度设为 64，并把并发限制映射到 `agents.max_threads`。它会禁用原生钩子、插件、代码模式和 `multi_agent_v2`；如果原生钩子列表非空，或托管配置要求强制启用冲突特性，则拒绝启动。关闭和重新打开的事实来自直接工具输出，并与同一次调用的持久化完成记录相关联，因此需要原生持久化回执。原生 Turn 时间具有秒级精度。根级 Turn 完成后，子级文件工作可以在同一所有者下完成。超过调用方截止时间后，取消操作仍会在同一所有者下继续；后续调用可以确认已经收敛，而无需重复执行原生中断。
+**Codex.** 适配器会启用原生 `multi_agent` 特性，并把并发限制映射到 `agents.max_threads`；嵌套深度和其他原生特性保持 Codex 默认值。如果托管配置要求强制启用代码模式或 `multi_agent_v2`（它们的协作调用不留下持久化回执），则拒绝启动。没有中立 Item 类型的子级 Item（例如图像查看和上下文压缩）不会被投影。关闭和重新打开的事实来自直接工具输出，并与同一次调用的持久化完成记录相关联，因此需要原生持久化回执。原生 Turn 时间具有秒级精度。根级 Turn 完成后，子级文件工作可以在同一所有者下完成。超过调用方截止时间后，取消操作仍会在同一所有者下继续；后续调用可以确认已经收敛，而无需重复执行原生中断。
 
-**Claude SDK.** 锁定版本 SDK 的原生 Agent 和 SendMessage 调用会运行唯一的子级类型 `oac_worker`；该类型继承模型，并可使用工作区中的 Bash、Agent 和 SendMessage；bridge 的 `subagent_resources` 特性控制是否启用它。子级使用原生 Bash，权限继承自父级的启动用户。私有子级记录用于确定父子关系、首次自身输入时间及后续自身 Turns；继承的父级上下文会被排除。查询所有者会在启动前接纳子级，并将子级历史保留至工作收敛。已确认的取消操作会写入不可变的操作回执，因为原生中止可能不会留下终态记录。不存在关闭操作：已完成或已取消的子级保持 active 状态。向运行中的子级发送消息、使用后台工作、采用其他子级配置以及按次覆盖模型都会被拒绝。[Claude SDK adapter](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/packages/claude-sdk-adapter/README.md#subagents) 记录了详细信息。
+**Claude Code.** 锁定版本 SDK 的原生 Agent 和 SendMessage 调用会运行原生的 Agent 类型及其原生提示词，支持按次指定 `model`、`name` 和 worktree 隔离；子级继承父级的工具，在 `none` 上即 Agent 和 SendMessage。bridge 的 `subagent_resources` 特性控制是否启用。子级使用原生 Bash，权限继承自父级的启动用户。私有子级记录用于确定父子关系、首次自身输入时间及后续自身 Turns；继承的父级上下文会被排除。查询所有者会在启动前接纳子级，并将子级历史保留至工作收敛。子级调用函数前，桥接层会根据其实时记录发送子级的身份和未结束的 Turn；取消根 Turn 会中止子级待处理的调用，该调用随后被撤回。子级的函数调用是带有 `function_call_output` 的 `function_call` Item，MCP 调用是 `mcp_call` Item。已确认的取消操作会写入不可变的操作回执，因为原生中止可能不会留下终态记录。不存在关闭操作：已完成或已取消的子级保持 active 状态。SendMessage 的 `to` 可以是子级 ID，也可以是创建时给出的 `name`。向运行中的子级发送消息和 remote 隔离会被拒绝，原生设置 `CLAUDE_CODE_DISABLE_BACKGROUND_TASKS` 会移除后台工作。[Claude SDK adapter](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/packages/claude-sdk-adapter/README.md#subagents) 记录了详细信息。
 
-**MiniMax Code.** 原生 ACP 委派（`task`、`task_append`、`task_stop`）会创建子级。Session 私有 SQLite 记录提供子级身份、已接受的输入、终态时间和自身消息。原生 task-create 事务会在启动前强制执行并发限制，并且原生准备过程必须在任何模型输入前确认该限制和受限工具配置。不存在关闭或重新打开操作，原生工作器也不会委派嵌套工作。
+**MiniMax Code.** 原生 ACP 委派（`task`、`task_append`、`task_stop`）会创建子级。Session 私有 SQLite 记录提供子级身份、已接受的输入、终态时间和自身消息。原生 task-create 事务会在启动前强制执行并发限制，并且原生准备过程必须在任何模型输入前确认该限制并确认后台 Bash 已关闭。不存在关闭或重新打开操作，原生工作器也不会委派嵌套工作。子级不获得 Session 的函数和 MCP 服务器，因为原生 ACP 会话服务器只属于根会话。
 
 Claude 和 MiniMax 在子级工作收敛时发布经验证的子级历史，而不是持续发布子级进度。向子级传播根级完成状态、完整的子级增量排序以及跨根级 Turns 的无界后台工作均尚未得到支持。
diff --git a/contracts/agents-api/zh/wire-semantics.md b/contracts/agents-api/zh/wire-semantics.md
index e448eac7b..b9c0810c5 100644
--- a/contracts/agents-api/zh/wire-semantics.md
+++ b/contracts/agents-api/zh/wire-semantics.md
@@ -1,10 +1,10 @@
 ---
-title: "Core 协议行为"
+title: "API 行为"
 source: contracts/agents-api/wire-semantics.md
-source_hash: 13d033e194fe4316dfaeced837907b594e4c95d93ebbf9ef9078f47b42cbec92
+source_hash: 1f374322fcfd4a9fda8162004342162b1c3b8e3b5f12c2f2871f68bd593751da
 ---
 
-已锁定版本的 OpenAI Python SDK（[upstream.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/upstream.json)）定义了 `/v1` 路由、字段和类型。本页面说明这些类型未作规定之处 Core 的行为，例如状态码、错误字段、默认值和列表边界，以及 Core 与官方服务存在差异的地方。[coverage ledger](index.md) 列出了这些差异和尚存缺口；[Sessions, events and history](sessions-events.md)、[message content](message-content.md)、[Vaults](vaults.md)、[source Files and Skills](source-files.md) 和 [Environment files and Artifacts](environment-files.md) 分别负责各自资源的规则。
+已锁定版本的 OpenAI Python SDK（[upstream.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/upstream.json)）定义了 `/v1` 路由、字段和类型。本页面说明这些类型未作规定之处 Core 的行为，例如状态码、错误字段、默认值和列表边界，以及 Core 与官方服务存在差异的地方。[OpenAI 兼容性](index.md) 列出了这些差异和尚存缺口；[Sessions, events and history](sessions-events.md)、[message content](message-content.md)、[Vaults](vaults.md)、[source Files and Skills](source-files.md) 和 [Environment files and Artifacts](environment-files.md) 分别负责各自资源的规则。
 
 下文所称“Beta 路由”是 `/v1/agents` 和 `/v1/vaults` 下的路由。“Files and Skills”是 `/v1/files` 和 `/v1/skills` 下的路由，这些路由会忽略 `OpenAI-Beta`。
 
@@ -158,7 +158,7 @@ Agent 创建要求提供 `model`。对于省略的字段，Core 会保存并返
 | Function `defer_loading` | `false` |
 | `programmatic_tool_calling.enabled` | `true` |
 | `web_search` | 保存每个已锁定模式；请参阅 [tool policy](execution-tools.md#web-search-and-programmatic-tool-calling) |
-| HTTP MCP 传输方式 | 以 `headers: {}` 保存；拒绝非空标头。Origin 和 allowlist 默认值见 [public MCP connection origin](environments.md#public-mcp-connection-origin) |
+| HTTP MCP 传输方式 | 以 `headers: {}` 保存；非空标头按给定值存储，`Authorization` 标头被拒绝。Origin 和 allowlist 默认值见 [public MCP connection origin](environments.md#public-mcp-connection-origin) |
 
 保存某个值并不会使其可执行。Session 创建允许的配置集合更小；请参阅 [Session admission](#session-admission)。
 
@@ -179,7 +179,7 @@ Agent 创建和更新正文以及 Session 创建中的内联 `agent`，会在其
 
 在同一个对象内，Core 会先报告联合类型的 `type`，然后报告未知成员，再按文档顺序报告成员值，最后按固定 schema 的顺序报告缺失成员；先检查 tools，再检查 `text`，并在重复项和 schema 根检查之前检查整个对象。没有字符串根 `type` 的 schema 不会被检查。Function 和 output schema、`request_metadata` 和 `x_agents_core` 使用各自的解析器。更新正文和 Session 内联 Agent 会在查找 Agent 之前进行验证，因此属于当前租户、属于外部租户、缺失和格式错误的 Agent ID 会得到相同的响应。
 
-即使无法执行，Core 也会保存已锁定形状允许的值：任意长度的函数名称、已启用的 programmatic tool calling、reasoning effort `max` 和 service tier `flex`。
+即使所选 Harness 无法执行，Core 也会保存已锁定形状允许的值：任意长度的函数名称，以及 Harness 未声明的 reasoning、service tier、Web 搜索和 programmatic tool calling 取值。
 
 ### Session 准入 {#session-admission}
 
@@ -187,15 +187,14 @@ Session 的有效配置还必须通过执行准入，无论配置来自保存还
 
 | 配置 | 消息 |
 | --- | --- |
-| 显式 `reasoning.effort` 或 `reasoning.summary` | "Explicit reasoning execution options are not supported by this service yet." |
-| `service_tier` 不是 `auto` | "Execution currently supports service_tier=auto only." |
-| 已启用的 `web_search` 或省略模式的 `web_search`、已启用的 `programmatic_tool_calling` | 见 [tool policy](execution-tools.md#web-search-and-programmatic-tool-calling) |
-| 超过 64 个函数，或函数名称为空或超过 512 字节 | "This service supports at most 64 function tools." 或 "Function names must be nonempty, unique and at most 512 bytes." |
-| 两个 `programmatic_tool_calling` 声明、两个使用同一标签的 MCP 服务器 | "Execution requires distinct tool controls."、"Execution requires distinct MCP server labels." |
+| Harness 未声明的 `reasoning.effort`、`reasoning.summary`、`service_tier`、`web_search` 模式或设置、`programmatic_tool_calling` 取值或 `text.verbosity` | 指出字段的消息，例如 `reasoning.effort "max" is not supported by this Harness.`；见 [tool policy](execution-tools.md#web-search-and-programmatic-tool-calling) 和 [Harness 能力](harness-capabilities.md#execution-and-input) |
+| 函数名称为空或重复 | "Function names must be nonempty and unique." |
+| 两个使用同一标签的 MCP 服务器 | "Execution requires distinct MCP server labels." |
+| 未声明 `retained_native_history` 的 Harness，运行在把每个 Environment 都放在 workspace 存储上的 sandbox provider 上（[Harness 能力](harness-capabilities.md)） | "This Session's harness does not retain its native history, which the sandbox provider's workspace storage requires. Use a harness that supports retained_native_history, or a sandbox provider with its own disk." |
 
 每 Session 的 `tools` 替换可以允许一个其已保存 tools 原本会被拒绝的 Session。每种工具和 Harness 的支持情况见 [execution and tools](execution-tools.md)。
 
-省略、null 和显式 `medium` text verbosity 会产生相同的 Session 配置。对于原生目录未声明 verbosity 支持的模型，Codex 适配器会丢弃 `medium` 设置并使用模型默认值，同时拒绝 `low` 或 `high`。
+省略、null 和显式 `medium` text verbosity 会产生相同的 Session 配置。
 
 ### 更新、删除和列表 {#update-delete-and-list}
 
@@ -248,4 +247,4 @@ Subagent 子 Turn 和待处理的 Environment 文件写入不会阻止删除。
 
 ### 响应字段 {#response-fields}
 
-Session 的 `agent.tools` 会省略 `tool_search` 声明，因为已锁定的 Session 工具联合类型不包含这些声明；冻结配置仍会保留它们。在 `self_hosted` Session 上，`environment.remote_url` 是 Core 守护进程的 WebSocket URL，即公共 URL 下的 `/api/v1/agent-daemon/ws`，只有 OpenAgentCore 的 Runtime 守护进程会与其通信；请求无法设置此值。其他 Session 字段遵循已锁定的类型；`x_agents_core` 的说明见 [Agents API guide](../../../docs/zh/api/public-agent-api.md#core-extensions-x-agents-core)。
+Session 的 `agent.tools` 会省略 `tool_search` 声明，因为已锁定的 Session 工具联合类型不包含这些声明；冻结配置仍会保留它们。在 `self_hosted` Session 上，`environment.remote_url` 是 Core 守护进程的 WebSocket URL，即公共 URL 下的 `/api/v1/agent-daemon/ws`，只有 OpenAgentCore 的 Runtime 守护进程会与其通信；请求无法设置此值。其他 Session 字段遵循已锁定的类型；`x_agents_core` 的说明见 [Agents API guide](../../../docs/zh/api/public-agent-api.md#core-extensions)。
diff --git a/deploy/README.md b/deploy/README.md
index 53ce99450..642beaee9 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -14,9 +14,9 @@
 
 Preparation happens in `<install-dir>.staging`. On entry, the installer removes an empty stage or one with the empty ownership directory `.oac-installer-<hash of the installation path>`; it preserves unrecognized directories. Ordinary failures remove owned staging immediately. The ownership marker is created atomically before downloading files. A killed process leaves staging for the next attempt. The release's `compose.yaml` is verified against its published checksum in the stage and must name the installer's own release in `OAC_REVISION`. Publication happens only after downloads, checks and pulls succeed. Later failures preserve saved configuration, containers and the Docker data volume. `<install-dir>.lock` is a persistent lock directory shared by installation and mutating operator commands; the existing `runtimefs` platform adapter owns locking.
 
-An existing directory runs the release named by `OAC_REVISION` in its `compose.yaml`. When that is the installer's release, the installer resumes: it keeps the saved settings, pulls only missing images and starts the services the way `oac apply` does. The port check applies only to new directories. Another release is refused unless `--upgrade` is given. An upgrade stages the new `compose.yaml` and `oac`, pulls the new images, then runs `oac-core check-config` and init against the staged `compose.yaml` together with the directory's `.env` and `compose.override.yaml`. Init upgrades the data volume or refuses, for example a downgrade; until it succeeds, the running installation is unchanged. The installer then renames `oac` and `compose.yaml` into place and starts the services with `--pull never --remove-orphans`, recreating every changed container. Rerunning the same command retries an interrupted upgrade. The upgrade leaves the deployment's Runtime unchanged; the final message names the console step that applies the new one.
+An existing directory runs the release named by `OAC_REVISION` in its `compose.yaml`. When that is the installer's release, the installer resumes: it keeps the saved settings, pulls only missing images and starts the services the way `oac apply` does. The port check applies only to new directories. Another release is refused.
 
-`install.py --upgrade` upgrades a source-bundle installation the same way, under the same lock. It publishes the bundle's node payload beside earlier releases, renders the new `compose.yaml` and rewrites only its own `compose.override.yaml` entries, the four service images and Web's `/node-payload` bind, keeping every other entry. After the same two checks it moves the payload's `active.json`, renames `oac`, `compose.override.yaml` and `compose.yaml` into place and starts the services. On its own release it resumes like `oac install`; another release is refused without `--upgrade`, and `--public-url` is required only for a new directory.
+`install.py` resumes a source-bundle installation of its own release under the same lock; another release is refused, and `--public-url` is required only for a new directory.
 
 `install.py` prepares a new installation in a `.staging-*` directory inside the installation directory: the node payload, `.env`, `oac` and both Compose files. After `docker compose config` accepts them, it moves them into place, `compose.yaml` last. An earlier failure removes the stage, and the directory too when the run created it, so the same command can be rerun; the next run also removes a stage left by a killed run. A directory with other contents but no `compose.yaml` is refused.
 
diff --git a/deploy/compose/compose.yaml b/deploy/compose/compose.yaml
index d2742fa78..3830c54d8 100644
--- a/deploy/compose/compose.yaml
+++ b/deploy/compose/compose.yaml
@@ -22,8 +22,8 @@ services:
     depends_on:
       init: {condition: service_completed_successfully}
     environment:
-      POSTGRES_USER: agents_api
-      POSTGRES_DB: agents_api
+      POSTGRES_USER: oac
+      POSTGRES_DB: oac
       POSTGRES_PASSWORD_FILE: /run/database/password
     volumes:
       - type: volume
@@ -36,7 +36,7 @@ services:
         volume: {nocopy: true, subpath: secrets/database}
         read_only: true
     healthcheck:
-      test: [CMD-SHELL, "pg_isready -h 127.0.0.1 -U agents_api -d agents_api"]
+      test: [CMD-SHELL, "pg_isready -h 127.0.0.1 -U oac -d oac"]
       interval: 2s
       timeout: 5s
       retries: 30
@@ -54,7 +54,7 @@ services:
     environment:
       OAC_PUBLIC_URL: &public-url ${OAC_PUBLIC_URL:-http://localhost:${OAC_WEB_PORT:-8080}}
       OAC_INSTALLATION_ID_FILE: /run/oac/installation.id
-      OAC_DATABASE_URL: postgres://agents_api@database:5432/agents_api?sslmode=disable
+      OAC_DATABASE_URL: postgres://oac@database:5432/oac?sslmode=disable
       OAC_DATABASE_PASSWORD_FILE: /run/database/password
       OAC_CREDENTIAL_KEY_FILE: /run/oac/credential.key
       OAC_CORE_KEY_DIGESTS_FILE: /run/oac/core-key-digests.json
diff --git a/deploy/compose/smoke-pins.json b/deploy/compose/smoke-pins.json
deleted file mode 100644
index 5d7cd61e8..000000000
--- a/deploy/compose/smoke-pins.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "tag": "v0.0.11",
-  "compose_sha256": "0368e256f8f1830017e5440820cbdb0f148a613fa5e50abdf3a459e20fd72a5e"
-}
diff --git a/deploy/compose/test_compose.py b/deploy/compose/test_compose.py
index 38d675e6d..7724d8846 100644
--- a/deploy/compose/test_compose.py
+++ b/deploy/compose/test_compose.py
@@ -92,7 +92,6 @@ def test_direct_sandbox_capacity_reaches_core(self):
             self.assertNotIn(key, services['web']['environment'])
 
     def test_database_stays_on_postgresql_16_pinned_by_digest(self):
-        # An upgrade keeps the data volume only within one PostgreSQL major version.
         self.assertRegex(render_compose.DATABASE_PIN, r'^postgres:16-alpine@sha256:[0-9a-f]{64}$')
 
     def test_public_url_can_be_configured_after_initial_startup(self):
diff --git a/deploy/install-source.py b/deploy/install-source.py
index c14c1f27e..461cf23b9 100644
--- a/deploy/install-source.py
+++ b/deploy/install-source.py
@@ -70,7 +70,7 @@ def port_holder_hint(port):
         if not directory:
             return f'\nThe Compose project {name} holds it.'
         if Path(directory).exists():
-            return f'\nThe installation in {directory} holds it; upgrade or manage it with --install-dir {directory}.'
+            return f'\nThe installation in {directory} holds it; manage it with --install-dir {directory}.'
         return f'\nThe Compose project {name} holds it, and its installation directory {directory} no longer exists. Remove it with: docker compose -p {name} down --volumes --remove-orphans (this deletes its data)'
     return ''
 
@@ -94,7 +94,7 @@ def compose_revision(text):
     return next((line.split(':', 1)[1].strip() for line in text.splitlines() if line.strip().startswith('OAC_REVISION:')), '')
 
 
-def install(bundle, destination, host, port, public_url, upgrade):
+def install(bundle, destination, host, port, public_url):
     manifest = load_manifest(offline_root=bundle)
     revision = manifest['source_commit']
     for name in manifest['artifacts'].values():
@@ -120,8 +120,8 @@ def install(bundle, destination, host, port, public_url, upgrade):
         previous = compose_revision((destination / 'compose.yaml').read_text()) if existing else ''
         if existing and not previous:
             raise ValueError(f'Incomplete installation: preserve {destination} and choose another directory')
-        if previous and previous != revision and not upgrade:
-            raise ValueError(f'This installation runs release {previous[:12]}; this bundle is {revision[:12]}. Back up the installation (Upgrade in the operations guide), then rerun with --upgrade.')
+        if previous and previous != revision:
+            raise ValueError(f'This installation runs release {previous[:12]}; this bundle is {revision[:12]}. To use this release, uninstall the installation, which deletes its data, then install again.')
         if not existing and public_url is None:
             raise ValueError('--public-url is required for a new installation')
         check_docker()
@@ -137,8 +137,12 @@ def install(bundle, destination, host, port, public_url, upgrade):
             root = destination if existing else stage
             payload = root / 'node-payload'
             node_payload.publish(payload, bundle)
-            # These files contain only public distribution bytes and must be readable by Web.
-            for directory, dirs, files in os.walk(payload):
+            # Core's image carries only the native installer catalog; Core serves the archives from here.
+            native = bundle / 'native-installers'
+            if native.is_dir():
+                shutil.copytree(native, root / 'native-installers' / revision, dirs_exist_ok=True)
+            # These files contain only public distribution bytes and must be readable by Web and Core.
+            for directory, dirs, files in [*os.walk(payload), *os.walk(root / 'native-installers')]:
                 os.chmod(directory, 0o755)
                 for name in files:
                     os.chmod(Path(directory) / name, 0o644)
@@ -149,45 +153,40 @@ def install(bundle, destination, host, port, public_url, upgrade):
             for name in ('core', 'web', 'database'):
                 template = template.replace('__OAC_' + name.upper() + '_IMAGE__', images[name])
             (stage / 'compose.yaml').write_text(template)
-            # The installer owns only the service images and Web's payload bind; other entries are the operator's.
+            # The installer owns only the payload binds; other entries are the operator's.
             saved = destination / 'compose.override.yaml'
             try:
                 override = json.loads(saved.read_text()) if saved.is_file() else {}
             except ValueError:
                 raise ValueError('compose.override.yaml must stay JSON so the installer can replace its own entries') from None
             services = override.setdefault('services', {})
-            # compose.yaml is the one home of the image references; earlier installers also wrote them here.
-            for name in ('core', 'web', 'init', 'database'):
-                services.setdefault(name, {}).pop('image', None)
-            web = services['web']
+            web = services.setdefault('web', {})
             web['volumes'] = [volume for volume in web.get('volumes', []) if not (isinstance(volume, dict) and volume.get('target') == '/node-payload')]
             web['volumes'].append({'type': 'bind', 'source': str(destination / 'node-payload'), 'target': '/node-payload', 'read_only': True})
+            core = services.setdefault('core', {})
+            core['volumes'] = [volume for volume in core.get('volumes', []) if not (isinstance(volume, dict) and volume.get('target') == '/opt/oac/native-installers')]
+            if native.is_dir():
+                core['volumes'].append({'type': 'bind', 'source': str(destination / 'native-installers' / revision), 'target': '/opt/oac/native-installers', 'read_only': True})
             (stage / 'compose.override.yaml').write_text(json.dumps(override, indent=2) + '\n')
             os.chmod(stage / 'compose.override.yaml', 0o600)
             shutil.copyfile(bundle / 'oac', stage / 'oac')
             os.chmod(stage / 'oac', 0o700)
             compose = ('docker', 'compose', '-f', str(stage / 'compose.yaml'), '-f', str(stage / 'compose.override.yaml'), '--project-directory', str(root))
             if existing:
-                # Init upgrades the data volume or refuses; until then the running release is untouched.
-                # On the same release init comes first: it finishes a first start that stopped before it,
+                # Init comes first: it finishes a first start that stopped before it,
                 # so check-config finds the secrets.
-                checks = [('Configuration check', ('run', '--rm', '--no-deps', '--entrypoint', '/usr/local/bin/oac-core', 'core', 'check-config')),
-                          ('Data volume check', ('run', '--rm', '--no-deps', 'init'))]
-                if previous == revision:
-                    checks.reverse()
+                checks = [('Data volume check', ('run', '--rm', '--no-deps', 'init')),
+                          ('Configuration check', ('run', '--rm', '--no-deps', '--entrypoint', '/usr/local/bin/oac-core', 'core', 'check-config'))]
                 for step, check in checks:
-                    failure = (f'{step} failed; no service was changed. See the output above.' if previous == revision
-                               else f'Upgrade stopped; the running services are unchanged. {step} failed; see the output above.')
-                    run(failure, *compose, *check, cwd=destination)
+                    run(f'{step} failed; no service was changed. See the output above.', *compose, *check, cwd=destination)
             else:
                 run('Compose configuration check failed; see the output above. Nothing was installed.', *compose, 'config', '--quiet', cwd=destination)
-            node_payload.activate(payload, revision)
+            if not existing and native.is_dir():
+                os.replace(stage / 'native-installers', destination / 'native-installers')
             # compose.yaml goes last: it marks the directory as an installation.
             for name in ('oac', 'compose.override.yaml', 'compose.yaml') if existing else ('node-payload', '.env', 'oac', 'compose.override.yaml', 'compose.yaml'):
                 os.replace(stage / name, destination / name)
             committed = True
-        # Installations from earlier releases kept a checksum that no longer describes compose.yaml.
-        (destination / 'compose-sha256sums.txt').unlink(missing_ok=True)
         print(f'Configuration ready in {destination}. Starting services…', flush=True)
         run('Starting services failed; see the output above. Settings and data are kept: fix the cause and rerun the same command.',
             'docker', 'compose', 'up', '-d', '--wait', '--wait-timeout', '180', '--pull', 'never', '--remove-orphans', cwd=destination)
@@ -199,8 +198,6 @@ def install(bundle, destination, host, port, public_url, upgrade):
         if published.returncode or not published.stdout.strip():
             raise ValueError(f"Web is running without its published port {web_port}; something else holds it.{port_holder_hint(web_port)}\nFree the port, then rerun the same command.")
         print(f"Console: {settings.get('OAC_PUBLIC_URL') or 'http://localhost:' + web_port}")
-        if previous and previous != revision:
-            print(f"Upgraded from {previous[:12]} to {revision[:12]}. Settings → Sandbox and scheduling offers this release's Runtime; sandboxes keep their current Runtime until you apply it.")
         if existing:
             print(f'Core key: {destination / "oac"} core-key --show')
         else:
@@ -220,7 +217,6 @@ def main():
     parser.add_argument('--host', default='127.0.0.1')
     parser.add_argument('--web-port', type=int, default=8080)
     parser.add_argument('--public-url', help='HTTP(S) origin reachable by browsers and nodes; required for a new installation')
-    parser.add_argument('--upgrade', action='store_true', help='upgrade an existing installation to this release')
     args = parser.parse_args()
     if not args.install_dir.is_absolute() or args.install_dir == Path('/'):
         parser.error('installation directory must be absolute and cannot be /')
@@ -235,7 +231,7 @@ def main():
             parser.error('public URL must be a canonical http or https origin without a path, such as https://core.example')
     destination = args.install_dir.resolve()
     try:
-        install(BUNDLE, destination, args.host, args.web_port, args.public_url, args.upgrade)
+        install(BUNDLE, destination, args.host, args.web_port, args.public_url)
     except KeyboardInterrupt:
         sys.exit('Interrupted; rerun the same command to continue.')
     except PermissionError as error:
diff --git a/deploy/install.ps1 b/deploy/install.ps1
index 4fe1c05e6..cb70255d6 100644
--- a/deploy/install.ps1
+++ b/deploy/install.ps1
@@ -11,6 +11,7 @@
             try { Invoke-WebRequest -UseBasicParsing -Uri "$base/$name" -OutFile (Join-Path $directory $name); return }
             catch {
                 if ($_.Exception.Response -and [int]$_.Exception.Response.StatusCode -eq 404) { throw "Release $version not found." }
+                if ($attempt -lt 5) { Write-Host "Download interrupted; retrying ($($attempt + 1)/5)..." }
                 Start-Sleep -Seconds 3
             }
         }
diff --git a/deploy/install.sh b/deploy/install.sh
index 9cd2d63ee..d54cf33ec 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 # The native oac command owns installation on every platform.
+# The whole script is one function called on the last line, so a cut-off download never runs partway.
+main() {
 set -euo pipefail
 case "$(uname -s)" in Linux) os=linux;; Darwin) os=darwin;; *) echo 'Use install.ps1 on Windows.' >&2; exit 1;; esac
 case "$(uname -m)" in x86_64) arch=amd64;; arm64|aarch64) arch=arm64;; *) echo 'Unsupported CPU architecture.' >&2; exit 1;; esac
@@ -13,17 +15,24 @@ done
 base="https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download"
 if [[ "$version" != latest ]]; then base="https://github.com/MiniMax-AI/OpenAgentCore/releases/download/$version"; fi
 umask 077
-temporary="$(mktemp -d "${TMPDIR:-/tmp}/oac.XXXXXX")"
-trap 'rm -rf "$temporary"' EXIT
+# An unfinished download stays in a per-account cache so a rerun resumes it. It does not depend on ~/.oac, which oac itself reports when it is not writable.
+cache="${TMPDIR:-/tmp}/oac-install-$(id -u)"
+[[ ! -L "$cache" ]] || { echo "Download cache $cache must not be a symbolic link." >&2; exit 1; }
+mkdir -p "$cache"
+[[ -d "$cache" && -O "$cache" ]] || { echo "Download cache $cache must belong to the current account." >&2; exit 1; }
+chmod 700 "$cache"
+trap 'echo "Interrupted; rerun the installer to continue." >&2; exit 130' INT
 # Resume after resets, fail only when a download stalls (no total time cap), and give up after five attempts.
 download() {
-  local name="$1" progress="$2" attempt code
+  local name="$1" file="$2" progress="$3" attempt code
   for attempt in 1 2 3 4 5; do
     if code="$(curl --fail "$progress" --location --proto '=https' --proto-redir '=https' --connect-timeout 15 \
       --speed-limit 1024 --speed-time 60 --continue-at - --write-out '%{http_code}' \
-      --output "$temporary/$name" "$base/$name")"; then return 0; fi
+      --output "$cache/$file" "$base/$name")"; then return 0; fi
     [[ "$code" != 404 ]] || { echo "Release $version not found." >&2; exit 1; }
-    sleep 3
+    # The partial file already holds the whole download; the checksum decides.
+    [[ "$code" != 416 ]] || return 0
+    if (( attempt < 5 )); then echo "Download interrupted; retrying ($((attempt + 1))/5)..." >&2; sleep 3; fi
   done
   echo "Could not download $name from GitHub. Check the network (set HTTPS_PROXY if a proxy is required) and rerun the installer." >&2
   exit 1
@@ -31,10 +40,32 @@ download() {
 asset="oac-$os-$arch"
 progress=--silent
 if [[ -t 2 ]]; then progress=--progress-bar; fi
-download "$asset.sha256" --silent
-download "$asset" "$progress"
-cd "$temporary"
-if command -v sha256sum >/dev/null; then actual="$(sha256sum "$asset")"; else actual="$(shasum -a 256 "$asset")"; fi
-[[ "$actual" == "$(cat "$asset.sha256")" ]] || { rm -f "$asset"; echo 'Installer checksum mismatch. Rerun the installer to download it again.' >&2; exit 1; }
-chmod 700 "$asset"
-"./$asset" install "$@"
+# The checksum is always fetched fresh and names the cached binary, so a moved "latest" never mixes files.
+rm -f "$cache/$asset.sha256"
+download "$asset.sha256" "$asset.sha256" --silent
+expected=
+read -r expected _ < "$cache/$asset.sha256" || true
+[[ "$expected" =~ ^[0-9a-f]{64}$ ]] || { rm -f "$cache/$asset.sha256"; echo 'Installer checksum file is invalid. Rerun the installer to download it again.' >&2; exit 1; }
+binary="$cache/$asset.$expected"
+for stale in "$cache/$asset".*; do
+  [[ "$stale" == "$binary" || "$stale" == "$cache/$asset.sha256" || ! -e "$stale" ]] || rm -f "$stale"
+done
+verified() {
+  local actual=
+  if command -v sha256sum >/dev/null; then read -r actual _ < <(sha256sum "$binary"); else read -r actual _ < <(shasum -a 256 "$binary"); fi
+  [[ "$actual" == "$expected" ]]
+}
+# A complete file from an earlier run is used without asking the server for more.
+if [[ ! -s "$binary" ]] || ! verified; then
+  download "$asset" "$asset.$expected" "$progress"
+  verified || { rm -f "$binary"; echo 'Installer checksum mismatch. Rerun the installer to download it again.' >&2; exit 1; }
+fi
+chmod 700 "$binary"
+# oac reports its own interruption.
+trap - INT
+status=0
+"$binary" install "$@" || status=$?
+if (( status == 0 )); then rm -rf "$cache"; fi
+exit "$status"
+}
+main "$@"
diff --git a/deploy/kubernetes/README.md b/deploy/kubernetes/README.md
index f7842e566..f242af690 100644
--- a/deploy/kubernetes/README.md
+++ b/deploy/kubernetes/README.md
@@ -28,11 +28,13 @@ Both images always come from one commit, so the console never talks to a Core of
 
 ## Deploy
 
+**Installation boundary:** the current source uses the `oac_schema_version` migration ledger and a folded schema baseline. A database from the earlier `agents_api_schema_version` installation cannot be upgraded by this workflow. Do not dispatch against that database: the replacement would attempt to create existing objects after the old Pod has stopped. Preserve the database, state volume and credential key; plan a separate installation and any required data transfer before changing the deployed source. Source synchronization or merging into `beta` does not authorize reinstallation.
+
 Merge the deployment workflow into `main`. Run **Actions** → **core-deploy** → **Run workflow** from `main` and select `source_branch` (`main` by default or `beta`), then give it a release tag or a full commit SHA already merged into that source branch. Both choices replace the same production Core and Web; `beta` does not create a separate environment. Review the [beta integration ledger](https://github.com/sandbaseai/OpenAgentCore/blob/beta/deploy/kubernetes/BETA_CHANGELOG.md) on the beta branch before selecting a beta revision. Keep the workflow branch set to `main`, including when deploying beta. The run builds both images, pushes them, applies the secrets and the environment, rolls Core out and then Web, and checks that both Services have a ready endpoint. It does not create an Ingress or configure DNS or certificates. Route `/v1` and `/api/v1` to `oac-core:8091`, and all other paths to `oac-web:8080`, in the `openagentcore` namespace. After configuring HTTPS, check `/healthz`, verify that unauthenticated `/v1/agents` returns `401`, and qualify a fresh E2B Session and Turn.
 
 **A deployment is an outage.** Core's single replica stops before its replacement starts, and the replacement migrates the schema before it listens, so the Agents API, the machine routes and every running Session are unavailable for the rollout. Deploy in a window you can afford to lose. The Pod that takes over also needs the previous one's leased database connection to be gone; until it is, `AcquireLease` fails and Core exits, and the rollout depends on a restart landing inside the 15-minute deadline.
 
-To roll back, run the workflow again with the earlier commit. A rollback across a schema migration is not automatic: the earlier Core runs against the newer schema.
+To roll back within the same compatible installation schema, run the workflow again with the earlier commit. A source rollback does not undo migrations and cannot cross the migration-ledger or folded-baseline boundary. Restore a compatible database and state snapshot through a separately approved recovery procedure when required.
 
 ## Settings
 
diff --git a/deploy/node/README.md b/deploy/node/README.md
index 883810251..5307ff177 100644
--- a/deploy/node/README.md
+++ b/deploy/node/README.md
@@ -8,7 +8,7 @@ These modules are packaged as `node-install.pyz`, which Web serves at `/node-ins
 | `distribution.py` | Verified artifacts, private temporary files, release metadata and Docker image identity |
 | `install_display.py`, `node_output.py` | Terminal output |
 | `provider_assets.py` | Node provider artifact names, generated by `go run ./services/core/cmd/provider-artifacts` |
-| `node_payload.py` | Publish a release's node files without replacing bytes already installed, then activate a release |
+| `node_payload.py` | Publish the installation's node files without replacing bytes already installed |
 
 ## Accounts and permissions
 
@@ -40,10 +40,44 @@ The distribution manifest is the one download contract for nodes: flat versioned
 - A Compose installation keeps only the node metadata from its release archive; Core's image never acquires execution-only payloads.
 - A node obtains bootstrap metadata from the console that generated its command. Web serves artifacts it has locally and redirects missing declared execution artifacts to the versioned HTTPS release base in the verified manifest. Web never downloads or caches those bytes.
 - Only artifact requests may follow HTTPS redirects, and only without credentials or cookies. Metadata and enrollment requests stay on the configured console. The console publishes only fixed non-secret files and declared artifact names.
-- Download into private temporary files, verify size and SHA-256 before an atomic rename, resume a leftover partial artifact download with an HTTP range (a server that cannot resume, or bytes that fail verification, restart the file) and clear leftover extracted files before retrying, and reuse only verified cache entries or exact image identities. Never select a release other than the pinned one.
+- Download into private temporary files, verify size and SHA-256 before an atomic rename, resume a leftover partial artifact download with an HTTP range (a server that cannot resume, or bytes that fail verification, restart the file) and clear leftover extracted files before retrying, and reuse only verified cache entries or exact image identities. Never select a release other than the installation's own.
 - Release downloads are anonymous. Never add repository credentials to installed node or Runtime configuration.
 - Manual builds use the `build-<full SHA>` release tag and tag builds the `v*` tag. The manifest's download base must match the release tag; artifact file names and source provenance keep the full source SHA.
 
+## Generation storage and recovery
+
+A node stores the deployment generations it prepares under its installation state and keeps, collects and repairs them on its own. The [Sandbox node protocol](../../contracts/agents-api/node-generation-protocol.md) defines what crosses the wire: generation observations, the retention exchange and the readiness classes.
+
+### Local retention and helper lifetime
+
+A Core drop grant is necessary but not sufficient for collection. Queued and running provider calls, preparation, the local target and the serving pin all keep references; collection rechecks them and refuses on an already canceled connection. A canceled provider caller does not prove that its native helper stopped: the node counts a helper until its actual `Wait` returns.
+
+Every generation owns a permanent private lease file, `state/node/generations/<generation>.lease`. Before starting a native helper, the node takes a shared flock on it, validates the durable lease identity under that lock, and requires the published final provider configuration and no dropped journal. The helper inherits the descriptor; the node closes its own copy only after `Wait` and never unlocks the shared open-file description, so a canceled caller or a node exit does not release a live helper's reference. Native helpers set the descriptor close-on-exec before calling the SDK, so VM and daemon descendants do not inherit it.
+
+Collection takes the exclusive nonblocking flock before it inspects references, or publishes the dropped marker, and holds it through that change. Lease files belong to stable node state and are never removed or replaced during collection; symlinks, multiply linked files, foreign ownership, unsafe permissions and replaced lock paths are refused. Before the first helper can start, the installer creates the lease exclusively and fsyncs it, then atomically persists and fsyncs a private `.lease-identity` record and its directory. The record binds installation, generation, specification digest, device and inode. The Python collector and the Go helper opener validate the same record on every open, including after a restart; neither adopts a missing identity, replaces its inode or erases it after collection. An installation interrupted before the identity is durable refuses re-adoption and is kept for inspection. A removed identity or a replaced lease refuses even when its current metadata agree.
+
+A dropped generation can never be prepared or used again. A helper's exit is evidence about local files only, not proof that a remote mutation or an uncertain provider receipt has been released; Core's durable allocation and placement retention stays independent.
+
+### Installation payload
+
+One installation serves exactly one release. A node gets its executable, private preparer and Runtime from the console that generated its command, and the Runtime stays on the node until uninstall. The console serves a single flat payload: `node-install.pyz`, `manifest.json`, `SHA256SUMS`, `runtime/seccomp.json` and the declared `artifacts/<filename>`. Artifact URLs stay pinned to the verified manifest. A node program that belongs to another installation of Core is refused with the remove, uninstall and add steps before the installer writes the node identity, imports the Runtime, registers the node or starts its service.
+
+A published console payload keeps its metadata and artifact bytes. Publishing it again first validates all metadata and every existing declared artifact, then may atomically add only missing, checksum-matched declared artifacts; any conflict prevents every addition, and nothing is overwritten.
+
+### Restart recovery
+
+Missing Runtime bytes never move a placement to another Runtime. The node keeps the original generation and specification digest as unready and asks Core's authenticated configuration route for that exact generation before recovery. Missing seccomp bytes may leave an unready provider placeholder; a missing image or native artifact found by a provider probe keeps the generation unready, and rerunning the node's command restores the installation's missing bytes.
+
+Preparation is serialized. Target and serving generations come first, with bounded progress on the others. Each attempt has a 30-minute deadline, and failures back off for 1, 2, 5 and 10 minutes, then at most 30. Nothing is prepared before the connection has delivered deployment facts. Conflicting bytes or a different retained specification refuse preparation.
+
+Preparation takes the same exclusive generation lease and installation lock as collection, so a live helper or a running collector keeps ownership and preparation retries later. The node still runs the provider's readiness probe; file presence and executable capability never establish readiness.
+
+### Preparation and collection records
+
+Preparation writes the generation's final `.json` provider configuration, which is write-once: a copy of the node's base provider configuration with the generation's specification and number, written after Core authorized the generation and the node confirmed that the installation's Runtime is still available. Every generation of a node shares that Runtime and, for microsandbox, its store. Publication is atomic, so an interrupted preparation leaves either nothing or the complete file, and a rerun revalidates it.
+
+Collection writes a digest-bound dropped marker under the generation lease after a fresh correlated Core drop grant. The marker prevents re-adoption; the small configuration and ownership journals stay as local identity records. It never removes the installation's Runtime, images or stores. Docker images belong to the host's shared daemon, and uninstall keeps them and prints the command that removes them.
+
 ## Image identity
 
 The manifest's `images` records each exported image's config digest, and `image_manifest_digests` its OCI manifest or index digest. Derive and verify both from the same archive, including its referenced config and layer bytes, and require the build host's selected image ID to match one of them.
diff --git a/deploy/node/node_generations.py b/deploy/node/node_generations.py
index 584ceab92..911b653f8 100644
--- a/deploy/node/node_generations.py
+++ b/deploy/node/node_generations.py
@@ -4,13 +4,10 @@
 import fcntl
 import io
 import stat
-import hashlib
 import json
 import os
 from pathlib import Path
 import re
-import shutil
-import subprocess
 import sys
 import zipfile
 
@@ -47,10 +44,6 @@ def helper_archive(args, installer):
 
 def install_helper(root, args, installer, archive=None):
     """Keep the executed, trusted installer available to the unprivileged node."""
-    settings = root / "preparation.json"
-    value = {"source_url": args.source_url or args.core_url}
-    if settings.exists() and installer.private_json(settings) != value:
-        raise installer.InstallError("The retained node artifact origin differs; preserve its configuration")
     target = root / "generation-preparer.pyz"
     installer.existing_file(target)
     if archive is None:
@@ -59,7 +52,6 @@ def install_helper(root, args, installer, archive=None):
         with os.fdopen(os.open(staged, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "wb") as output:
             output.write(archive)
         os.replace(staged, target)
-    atomic_json(settings, value)
 
 
 def generation_marker(root, generation, suffix, digest, installation, installer):
@@ -71,7 +63,7 @@ def generation_marker(root, generation, suffix, digest, installation, installer)
     with os.fdopen(descriptor) as stream:
         info = os.fstat(stream.fileno())
         if (not stat.S_ISREG(info.st_mode) or stat.S_IMODE(info.st_mode) != 0o600
-                or info.st_uid != os.getuid() or info.st_nlink != 1 or info.st_size > (16384 if suffix == ".preparing" else 4096)):
+                or info.st_uid != os.getuid() or info.st_nlink != 1 or info.st_size > 4096):
             raise installer.InstallError("Invalid generation ownership journal")
         try:
             value = json.load(stream)
@@ -80,31 +72,11 @@ def generation_marker(root, generation, suffix, digest, installation, installer)
         named = path.lstat()
         if (named.st_dev, named.st_ino) != (info.st_dev, info.st_ino):
             raise installer.InstallError("Generation ownership journal was replaced")
-    if digest is None:
-        digest = value.get("specification_digest") if isinstance(value, dict) else None
-        if not isinstance(digest, str) or not re.fullmatch(r"[a-f0-9]{64}", digest):
-            raise installer.InstallError("Invalid preparation specification identity")
     expected = {"installation_id": installation, "generation": generation, "specification_digest": digest}
     if (not isinstance(value, dict) or type(value.get("generation")) is not int
             or any(value.get(key) != item for key, item in expected.items())):
         raise installer.InstallError("Invalid generation ownership journal")
-    keys = set(expected)
-    if suffix == ".collecting":
-        keys.add("native_complete")
-        if type(value.get("native_complete")) is not bool:
-            raise installer.InstallError("Invalid generation collection journal")
-    if suffix == ".preparing":
-        keys.add("import_started")
-        if "configuration" in value:
-            keys.add("configuration")
-            plan = value["configuration"]
-            if (not isinstance(plan, dict) or plan.get("installation_id") != installation or plan.get("generation") != generation
-                    or plan.get("provider") not in ("docker", "microsandbox")
-                    or installer.node_spec.digest(plan["provider"], plan.get("specification")) != digest):
-                raise installer.InstallError("Invalid generation preparation plan")
-        if type(value.get("import_started")) is not bool:
-            raise installer.InstallError("Invalid generation preparation journal")
-    if set(value) != keys:
+    if set(value) != set(expected):
         raise installer.InstallError("Invalid generation journal fields")
     return value
 
@@ -114,68 +86,6 @@ def marker_identity(args):
             "specification_digest": args.specification_digest}
 
 
-def record_root_runtime(root, args, manifest, sums, installer):
-    checksums = {"runtime/seccomp.json": sums["runtime/seccomp.json"]}
-    checksums.update({name: installer.distribution.artifact(manifest, name)["sha256"]
-                      for name in installer.provider_assets.artifacts(args.provider, ("runtime",))})
-    archive = installer.distribution.artifact(manifest, "images/runtime.tar.gz")
-    checksums["images/runtime.tar.gz"] = archive["sha256"]
-    checksums["images/runtime.tar"] = archive["unpacked_sha256"]
-    value = {"installation_id": args.installation_id, "source_commit": manifest["source_commit"], "sha256": checksums}
-    path = root / "runtime-artifacts.json"
-    if installer.existing_file(path):
-        if installer.private_json(path) != value:
-            raise installer.InstallError("Original Runtime artifact ownership differs")
-        return
-    atomic_json(path, value)
-
-
-def root_runtime_files(root, value, others, installer):
-    """Return only verified original Runtime files that no retained config uses."""
-    def paths(configuration):
-        if configuration["provider"] == "docker":
-            return [Path(configuration["native"]["seccomp_file"])]
-        return [Path(configuration["native"][key]) for key in ("helper_path", "runtime_path", "firmware_path")]
-    names = ["runtime/seccomp.json", "images/runtime.tar.gz", "images/runtime.tar"]
-    if value["provider"] == "microsandbox":
-        names.extend(installer.MICRO)
-    own_paths = paths(value)
-    if not any(path == root / name for path in own_paths for name in names):
-        return []
-    referenced = {Path(os.path.realpath(path)) for item in others for path in paths(item)}
-    auxiliary = {root / name for name in ("runtime/seccomp.json", "images/runtime.tar.gz", "images/runtime.tar")}
-    # An original Runtime provider also retains its import cache and policy.
-    if any(path in referenced for path in own_paths):
-        referenced.update(auxiliary)
-    candidates = [root / name for name in names if root / name not in referenced]
-    if not candidates:
-        return []
-    record = root / "runtime-artifacts.json"
-    installer.no_links(record)
-    if not installer.existing_file(record):
-        raise installer.InstallError("Original Runtime artifact ownership is missing; preserve its files")
-    saved = installer.private_json(record)
-    base = installer.private_json(root / "provider.json")
-    if not base or base.get("installation_id") != value["installation_id"] or base.get("provider") != value["provider"]:
-        raise installer.InstallError("Original Runtime configuration differs")
-    source = base["specification"]["runtime"]["source_commit"]
-    if (not saved or set(saved) != {"installation_id", "source_commit", "sha256"}
-            or saved["installation_id"] != value["installation_id"] or saved["source_commit"] != source
-            or not isinstance(saved["sha256"], dict) or set(saved["sha256"]) != set(names)
-            or any(not isinstance(digest, str) or not re.fullmatch(r"[a-f0-9]{64}", digest) for digest in saved["sha256"].values())):
-        raise installer.InstallError("Original Runtime artifact ownership differs")
-    if value["provider"] == "microsandbox" and any(
-            saved["sha256"][name] != base["specification"]["runtime"][field]
-            for name, field in zip(installer.MICRO[1:], ("runtime_sha256", "firmware_sha256"))):
-        raise installer.InstallError("Original Runtime artifact hashes differ from its specification")
-    for path in candidates:
-        installer.no_links(path)
-        if installer.existing_file(path):
-            if path.stat().st_nlink != 1 or installer.file_digest(path) != saved["sha256"][str(path.relative_to(root))]:
-                raise installer.InstallError("Original Runtime file differs; refusing deletion")
-    return candidates
-
-
 def retained_configs(root, installer):
     directory = root / "state/node/generations"
     result = {}
@@ -193,73 +103,9 @@ def retained_configs(root, installer):
                 if value["generation"] in result and result[value["generation"]] != value:
                     raise installer.InstallError("Conflicting retained generation configuration")
                 result[value["generation"]] = value
-    if directory.exists():
-        for path in sorted(directory.glob("*.preparing")):
-            if not re.fullmatch(r"[1-9][0-9]*\.preparing", path.name):
-                raise installer.InstallError("Invalid preparation filename")
-            if not base:
-                raise installer.InstallError("Preparation installation identity is unavailable")
-            journal = generation_marker(root, int(path.stem), ".preparing", None, base["installation_id"], installer)
-            plan = journal.get("configuration")
-            if plan is None:
-                if int(path.stem) not in result:
-                    raise installer.InstallError("Preparation plan is missing")
-                continue
-            validate_preparation_plan(root, plan, base, installer)
-            if generation_marker(root, plan["generation"], ".dropped", journal["specification_digest"], plan["installation_id"], installer):
-                continue
-            final = result.get(plan["generation"])
-            if final is not None:
-                verify_plan_final(plan, final, installer)
-            else:
-                result[plan["generation"]] = plan
     return result
 
 
-def validate_preparation_plan(root, plan, base, installer):
-    if (not base or any(plan.get(key) != base.get(key) for key in ("installation_id", "provider", "core_url"))
-            or type(plan.get("generation")) is not int):
-        raise installer.InstallError("Preparation plan installation differs")
-    runtime = plan["specification"]["runtime"]
-    source = runtime["source_commit"]
-    if not re.fullmatch(r"[a-f0-9]{40}", source):
-        raise installer.InstallError("Preparation release identity differs")
-    if plan["provider"] == "docker":
-        policy = Path(plan["native"]["seccomp_file"])
-        if policy not in (root / "runtime/seccomp.json", root / "releases" / source / "runtime/seccomp.json"):
-            raise installer.InstallError("Preparation policy is outside its immutable release")
-        if plan["native"]["image"] not in (runtime["image_id"], runtime["image_manifest_digest"]):
-            raise installer.InstallError("Preparation image differs from the specification")
-        installer.no_links(policy)
-    else:
-        micro = plan["native"]
-        paths = [Path(micro[key]) for key in ("helper_path", "runtime_path", "firmware_path")]
-        if not any(paths == [release / name for name in installer.MICRO] for release in (root, root / "releases" / source)):
-            raise installer.InstallError("Preparation artifacts are outside their immutable release")
-        expected_home = generation_home(root, plan, base, installer)
-        if micro["checkpoint_root"] != base["native"]["checkpoint_root"]:
-            raise installer.InstallError("Preparation checkpoint store differs")
-        installer.prepare_checkpoint_root(Path(micro["checkpoint_root"]), initialize=False)
-        if Path(micro["runtime_home"]) != expected_home:
-            raise installer.InstallError("Preparation native store differs")
-        for path in paths + [expected_home]:
-            installer.no_links(path)
-    configuration = dict(plan, core_url=plan["core_url"].removesuffix("/api/v1"))
-    installer.node_spec.verify_provider(plan, configuration, plan.get("native", {}).get("image"))
-
-
-def verify_plan_final(plan, final, installer):
-    expected = copy.deepcopy(plan)
-    if plan["provider"] == "docker":
-        image = final.get("native", {}).get("image")
-        runtime = plan["specification"]["runtime"]
-        if image not in (runtime["image_id"], runtime["image_manifest_digest"]):
-            raise installer.InstallError("Final Docker image differs from the preparation specification")
-        expected["native"]["image"] = image
-    if expected != final:
-        raise installer.InstallError("Final generation differs from its immutable preparation plan")
-
-
 def owned_root(args, installer):
     if os.getuid() == 0:
         raise installer.InstallError("Generation operations run only as the node service user")
@@ -273,19 +119,8 @@ def owned_root(args, installer):
     return root, identity
 
 
-def generation_home(root, configuration, base, installer):
-    runtime = configuration["specification"]["runtime"]
-    previous = base["specification"]["runtime"]
-    if (runtime["runtime_sha256"], runtime["firmware_sha256"]) == (previous["runtime_sha256"], previous["firmware_sha256"]):
-        return Path(base["native"]["runtime_home"])
-    material = ":".join((configuration["installation_id"], runtime["runtime_sha256"], runtime["firmware_sha256"]))
-    home = Path.home() / ".oac/m" / hashlib.sha256(material.encode()).hexdigest()[:12]
-    if len(os.fsencode(home)) > 48:
-        raise installer.InstallError("HOME is too long for versioned microsandbox socket paths")
-    return home
-
-
 def image_available(value, installer):
+    """Whether the installation's Runtime that this configuration names is still on the node."""
     try:
         if value["provider"] == "docker":
             seccomp = Path(value["native"]["seccomp_file"])
@@ -293,68 +128,22 @@ def image_available(value, installer):
             json.loads(seccomp.read_text())
             raw = installer.checked(list(installer.DOCKER) + ["image", "inspect", value["native"]["image"], "--format", "{{.Id}} {{.Os}}/{{.Architecture}}"], "Cannot inspect pinned image")
             return raw.strip() == value["native"]["image"] + " linux/amd64"
-        micro, runtime = value["native"], value["specification"]["runtime"]
+        micro = value["native"]
         for key in ("helper_path", "runtime_path", "firmware_path"):
             if not installer.existing_file(Path(micro[key])):
                 return False
-        if (installer.file_digest(Path(micro["runtime_path"])) != runtime["runtime_sha256"]
-                or installer.file_digest(Path(micro["firmware_path"])) != runtime["firmware_sha256"]):
+        if (installer.file_digest(Path(micro["runtime_path"])) != micro["runtime_sha256"]
+                or installer.file_digest(Path(micro["firmware_path"])) != micro["firmware_sha256"]):
             return False
         env = dict(os.environ, MSB_BACKEND="local", MSB_HOME=micro["runtime_home"], MSB_PATH=micro["runtime_path"], MSB_LIBKRUNFW_PATH=micro["firmware_path"])
-        image = json.loads(installer.checked([micro["runtime_path"], "image", "inspect", runtime["microsandbox_ref"], "--format", "json"], "Cannot inspect pinned image", env=env))
-        return image.get("digest") == runtime["microsandbox_ref"].split("@", 1)[1] and image.get("architecture") == "amd64" and image.get("os") == "linux"
+        image = json.loads(installer.checked([micro["runtime_path"], "image", "inspect", micro["image"], "--format", "json"], "Cannot inspect pinned image", env=env))
+        return image.get("digest") == micro["image"].split("@", 1)[1] and image.get("architecture") == "amd64" and image.get("os") == "linux"
     except (installer.InstallError, OSError, ValueError):
         return False
 
 
-def runtime_files(root, value, args, manifest, sums, installer):
-    """Restore only absent immutable bytes; existing conflicts are never replaced."""
-    source = args.configuration["specification"]["runtime"]["source_commit"]
-    release = root / "releases" / source
-    if value is not None:
-        if args.provider == "microsandbox":
-            release = Path(value["native"]["helper_path"]).parents[2]
-            if any(Path(value["native"][key]) != release / name for key, name in zip(
-                    ("helper_path", "runtime_path", "firmware_path"), installer.MICRO)):
-                raise installer.InstallError("Retained Runtime artifact paths differ")
-        else:
-            release = Path(value["native"]["seccomp_file"]).parents[1]
-            if Path(value["native"]["seccomp_file"]) != release / "runtime/seccomp.json":
-                raise installer.InstallError("Retained Runtime seccomp path differs")
-        if release not in (root, root / "releases" / source):
-            raise installer.InstallError("Retained Runtime artifacts are outside this installation")
-    installer.no_links(release)
-    installer.safe_directory(release)
-    names = installer.provider_assets.artifacts(args.provider, ("policy", "runtime"))
-    saved = installer.private_json(release / "manifest.json")
-    if (release / "manifest.json").exists():
-        if saved is None:
-            raise installer.InstallError("Retained Runtime manifest is unreadable")
-        try:
-            installer.node_spec.verify_release(args.configuration, saved)
-        except installer.node_spec.SpecificationError as error:
-            raise installer.RuntimeDownloadError("Retained Runtime release provenance differs") from error
-    # Inspect every existing byte before starting any repair, so a missing file
-    # cannot hide a conflicting sibling or redirect a later download.
-    for name in names:
-        path = release / name
-        installer.no_links(path)
-        if installer.existing_file(path):
-            expected = sums[name] if name == "runtime/seccomp.json" else installer.distribution.artifact(manifest, name)["sha256"]
-            if installer.file_digest(path) != expected:
-                raise installer.RuntimeDownloadError("Retained Runtime artifact checksum differs")
-    for name in names:
-        installer.safe_directory((release / name).parent)
-        if name == "runtime/seccomp.json":
-            installer.download(args.source_url, name, release, sums[name], prefix="releases/" + source + "/")
-        else:
-            installer.distribution.obtain_artifact(manifest, name, release / name)
-            os.chmod(release / name, 0o700)
-    atomic_json(release / "manifest.json", manifest)
-    return release
-
-
 def prepare(args, installer):
+    """Write the generation's configuration: the installation's own Runtime under the specification Core authorized."""
     root, identity = owned_root(args, installer)
     with installer.install_lock(root), collection_lease(
             root, args.generation, installer, marker_identity(args),
@@ -362,82 +151,27 @@ def prepare(args, installer):
             and not (root / "state/node/generations" / (str(args.generation) + ".json")).exists()):
         directory = root / "state/node/generations"
         target = directory / (str(args.generation) + ".json")
-        if (generation_marker(root, args.generation, ".dropped", args.specification_digest, args.installation_id, installer)
-                or generation_marker(root, args.generation, ".collecting", args.specification_digest, args.installation_id, installer)):
+        if generation_marker(root, args.generation, ".dropped", args.specification_digest, args.installation_id, installer):
             raise installer.InstallError("A dropped generation cannot be adopted again")
-        preparation = generation_marker(root, args.generation, ".preparing", args.specification_digest, args.installation_id, installer)
         args.core_url = identity["core_url"]
-        args.configuration = installer.node_spec.fetch(args, "", identity, installer.open_request,
-                                                       generation=args.generation, allow_selection_change=True)
-        if args.configuration["specification_digest"] != args.specification_digest:
+        configuration = installer.node_spec.fetch(args, "", identity, installer.open_request,
+                                                  generation=args.generation, allow_selection_change=True)
+        if configuration["specification_digest"] != args.specification_digest:
             raise installer.InstallError("Core generation identity differs from its authorization")
-        args.provider = args.configuration["provider"]
-        configurations = retained_configs(root, installer)
         base = installer.private_json(root / "provider.json")
-        runtime = args.configuration["specification"]["runtime"]
-        value = configurations.get(args.generation)
-        finalized = target.exists() or base["generation"] == args.generation
+        value = retained_configs(root, installer).get(args.generation)
         if value is not None:
-            installer.node_spec.verify_provider(value, args.configuration, value.get("native", {}).get("image"))
+            installer.node_spec.verify_provider(value, configuration, value.get("native", {}).get("image"))
         else:
-            for candidate in configurations.values():
-                # Unpublished plans must never be used as ready reuse candidates.
-                if any((directory / (str(candidate["generation"]) + suffix)).exists() for suffix in (".preparing", ".collecting", ".dropped")):
-                    continue
-                if candidate["specification"]["runtime"] == runtime and image_available(candidate, installer):
-                    value = copy.deepcopy(candidate)
-                    value["generation"] = args.generation
-                    value["specification"] = args.configuration["specification"]
-                    break
-        if not finalized or value is None or not image_available(value, installer):
-            settings = installer.private_json(root / "preparation.json")
-            args.source_url = installer.origin(settings["source_url"])
-            manifest, sums = installer.metadata(args.source_url, prefix="releases/" + runtime["source_commit"] + "/")
-            try:
-                installer.node_spec.verify_release(args.configuration, manifest)
-            except installer.node_spec.SpecificationError as error:
-                raise installer.RuntimeDownloadError("Runtime release provenance differs") from error
-            if args.provider == "microsandbox":
-                args.runtime_home = Path(value["native"]["runtime_home"]) if value else generation_home(root, args.configuration, base, installer)
-                args.checkpoint_root = Path(base["native"]["checkpoint_root"])
-            if value is None:
-                value = installer.provider_config(root / "releases" / runtime["source_commit"], args, runtime["image_id"])
-            if preparation is None:
-                preparation = dict(marker_identity(args), import_started=False, configuration=copy.deepcopy(value))
-                atomic_json(directory / (str(args.generation) + ".preparing"), preparation)
-            release = runtime_files(root, value, args, manifest, sums, installer)
-            if args.provider == "microsandbox":
-                installer.safe_directory(args.runtime_home)
-                owner = args.runtime_home / "oac-installation.json"
-                if not owner.exists() and any(args.runtime_home.iterdir()):
-                    raise installer.InstallError("Versioned microsandbox store contains unowned state")
-                installer.write_once(owner, installer.json_text({"installation_id": args.installation_id}))
-            preparation = dict(preparation, import_started=True)
-            atomic_json(directory / (str(args.generation) + ".preparing"), preparation)
-            runtime_image = installer.prepare_runtime(release, args, manifest)
-            if finalized:
-                installer.node_spec.verify_provider(value, args.configuration, runtime_image)
-            elif args.provider == "docker":
-                if runtime_image not in (runtime["image_id"], runtime["image_manifest_digest"]):
-                    raise installer.InstallError("Resolved Docker image is outside the authorized specification")
-                value = copy.deepcopy(value)
-                value["native"]["image"] = runtime_image
-        if preparation and preparation.get("configuration"):
-            verify_plan_final(preparation["configuration"], value, installer)
+            value = copy.deepcopy(base)
+            value["generation"], value["specification"] = args.generation, configuration["specification"]
+        if not image_available(value, installer):
+            raise installer.InstallError("This installation's Runtime is missing on the node; remove the node, uninstall it and add it again")
         if installer.existing_file(target):
             if installer.private_json(target) != value:
                 raise installer.InstallError("Immutable generation configuration differs")
         else:
             atomic_json(target, value)
-        # If interrupted after publication, restart rechecks the same plan and
-        # final identity. It never edits the published provider configuration.
-        pending = directory / (str(args.generation) + ".preparing")
-        pending.unlink(missing_ok=True)
-        descriptor = os.open(directory, os.O_RDONLY | os.O_DIRECTORY)
-        try:
-            os.fsync(descriptor)
-        finally:
-            os.close(descriptor)
 
 
 @contextlib.contextmanager
@@ -507,94 +241,13 @@ def collection_lease(root, generation, installer, identity=None, initialize=Fals
 def collect(args, installer):
     root, _ = owned_root(args, installer)
     with installer.install_lock(root), collection_lease(root, args.generation, installer, marker_identity(args)):
-        configurations = retained_configs(root, installer)
-        value = configurations.get(args.generation)
+        value = retained_configs(root, installer).get(args.generation)
         if value is None:
             return
         if (value["installation_id"] != args.installation_id
                 or installer.node_spec.digest(value["provider"], value["specification"]) != args.specification_digest):
             raise installer.InstallError("Collection grant does not match the local generation")
-        source = value["specification"]["runtime"]["source_commit"]
-        if not re.fullmatch(r"[a-f0-9]{40}", source):
-            raise installer.InstallError("Invalid retained release identity")
-        release = root / "releases" / source
-        installer.no_links(release)
-        directory = root / "state/node/generations"
-        journal = generation_marker(root, args.generation, ".collecting", args.specification_digest, args.installation_id, installer)
-        if journal is None:
-            journal = dict(marker_identity(args), native_complete=False)
-            atomic_json(directory / (str(args.generation) + ".collecting"), journal)
-        others = [item for generation, item in configurations.items() if generation != args.generation]
-        original_files = root_runtime_files(root, value, others, installer)
-        if not journal["native_complete"]:
-            preparation = generation_marker(root, args.generation, ".preparing", args.specification_digest, args.installation_id, installer)
-            if preparation is None or preparation["import_started"]:
-                collect_image(args, value, others, installer)
-            # Persist native completion before deleting its executable. A fresh
-            # Core grant is still required after restart to finish file cleanup.
-            journal["native_complete"] = True
-            atomic_json(directory / (str(args.generation) + ".collecting"), journal)
-        directory = root / "state/node/generations"
-        installer.safe_directory(directory)
-        if not any(item["specification"]["runtime"]["source_commit"] == source for item in others):
-            release = root / "releases" / source
-            installer.no_links(release)
-            if release.exists():
-                shutil.rmtree(release)
-            if release.parent.exists():
-                descriptor = os.open(release.parent, os.O_RDONLY | os.O_DIRECTORY)
-                try:
-                    os.fsync(descriptor)
-                finally:
-                    os.close(descriptor)
-
-        for path in original_files:
-            path.unlink(missing_ok=True)
-        for parent in {path.parent for path in original_files}:
-            if parent.exists():
-                descriptor = os.open(parent, os.O_RDONLY | os.O_DIRECTORY)
-                try:
-                    os.fsync(descriptor)
-                finally:
-                    os.close(descriptor)
-        atomic_json(directory / (str(args.generation) + ".dropped"), marker_identity(args))
-        # Keep the immutable configuration and permanent journal as restart
-        # identity. They contain no provider credentials and are not readiness.
-
-
-def collect_image(args, value, others, installer):
-    if value["provider"] == "microsandbox":
-        micro, image = value["native"], value["specification"]["runtime"]["microsandbox_ref"]
-        shared = [item for item in others if item["native"]["runtime_home"] == micro["runtime_home"]]
-        home = Path(micro["runtime_home"])
-        installer.no_links(home)
-        if not home.is_dir() or installer.private_json(home / "oac-installation.json") != {"installation_id": args.installation_id}:
-            raise installer.InstallError("Microsandbox store ownership differs")
-        runtime_path = Path(micro["runtime_path"])
-        installer.no_links(runtime_path)
-        if not installer.existing_file(runtime_path) or installer.file_digest(runtime_path) != value["specification"]["runtime"]["runtime_sha256"]:
-            raise installer.InstallError("Cannot verify retained microsandbox executable")
-        env = dict(os.environ, MSB_BACKEND="local", MSB_HOME=micro["runtime_home"], MSB_PATH=micro["runtime_path"], MSB_LIBKRUNFW_PATH=micro["firmware_path"])
-        if not any(item["specification"]["runtime"]["microsandbox_ref"] == image for item in shared):
-            # A failed inspect/remove is not proof of absence. A successful full
-            # inventory must contain only understood immutable references.
-            raw = installer.checked([micro["runtime_path"], "image", "list", "--quiet"], "Cannot verify microsandbox image inventory", env=env)
-            references = raw.splitlines()
-            if any(not re.fullmatch(r"[^\s@]+@sha256:[a-f0-9]{64}", item) for item in references):
-                raise installer.InstallError("Cannot verify microsandbox image inventory")
-            if any(item.split("@", 1)[1] == image.split("@", 1)[1] for item in references):
-                installer.checked([micro["runtime_path"], "image", "remove", image, "--quiet"], "Runtime image is still in use", env=env)
-        if not shared:
-            raw = installer.checked([micro["runtime_path"], "sandbox", "list", "--format", "json"], "Cannot verify empty microsandbox store", env=env)
-            if json.loads(raw) != []:
-                raise installer.InstallError("Microsandbox store still contains native sandboxes")
-            home = Path(micro["runtime_home"])
-            installer.safe_directory(home)
-            if installer.private_json(home / "oac-installation.json") != {"installation_id": args.installation_id}:
-                raise installer.InstallError("Microsandbox store ownership differs")
-            # Native emptiness never authorizes discarding receipt/lock history.
-    else:
-        # Docker imported content belongs to the host daemon, including idle
-        # serving pins in other installations. This installation has no authority
-        # to remove it; its private generation/release files can still be collected.
-        return
+        # The Runtime belongs to the installation; uninstall removes it. Keep the immutable
+        # configuration and this permanent journal as restart identity. They contain no
+        # provider credentials and are not readiness.
+        atomic_json(root / "state/node/generations" / (str(args.generation) + ".dropped"), marker_identity(args))
diff --git a/deploy/node/node_install.py b/deploy/node/node_install.py
index 458543718..b239dcfe4 100644
--- a/deploy/node/node_install.py
+++ b/deploy/node/node_install.py
@@ -42,10 +42,6 @@ class InstallError(Exception):
     pass
 
 
-class RuntimeDownloadError(InstallError):
-    """A fixed private helper exit category for transfer/provenance failures."""
-
-
 MICRO = provider_assets.artifacts("microsandbox", ("runtime",))
 DOCKER = ("docker", "--host", "unix:///var/run/docker.sock")
 DOCKER_SOCKET = Path("/var/run/docker.sock")
@@ -55,6 +51,8 @@ class RuntimeDownloadError(InstallError):
 # this dedicated service user under a root-owned system unit; root never runs a
 # file the service user can write.
 SERVICE_USER = "oac-node"
+# Core's UID: workspace storage gives sandboxes files owned by it, so the node account must match.
+SERVICE_UID = 65532
 SERVICE_HOME = Path("/var/lib/oac-node")
 SYSTEM_RECORDS = Path("/etc/oac-node")
 SYSTEM_UNITS = Path("/etc/systemd/system")
@@ -127,6 +125,8 @@ def registration_failure(stderr):
     status, code = matches[-1].group(1).decode(), (matches[-1].group(2) or b"").decode()
     if code == "sandbox_node_address_mismatch":
         return AddressChanged(node_spec.PUBLIC_URL_CHANGED + " The token was not used; downloaded files are kept.")
+    if code == "sandbox_node_host_unmeasured":
+        return InstallError("Core could not measure this host's CPUs and memory, so it cannot derive the node limits. Request a token with explicit limits, then rerun the command.")
     if status == "401":
         return InstallError(node_spec.ENROLLMENT_EXPIRED + " Downloaded files are kept.")
     return InstallError(REGISTRATION_UNCONFIRMED + " Core answered HTTP " + status + (" " + code if code else "") + ".")
@@ -136,7 +136,7 @@ def discard_unregistered(root):
     """Remove what an earlier attempt decided, so a new command can register this host.
 
     Only for a node Core never recorded: downloads, the image and the service file stay."""
-    for name in ("installation.json", "provider.json", "runtime-artifacts.json", "preparation.json"):
+    for name in ("installation.json", "provider.json"):
         if existing_file(root / name):
             (root / name).unlink()
     if (root / "state/node").is_dir() and not (root / "state/node").is_symlink():
@@ -176,48 +176,48 @@ def fetch(source, name):
                 # A body cut short by the connection reads as a normal end; the declared length tells.
                 declared = getattr(response, "headers", {}).get("Content-Length", "")
             if len(raw) > 1024 * 1024:
-                raise RuntimeDownloadError("Node bootstrap metadata is too large: " + name)
+                raise InstallError("Node bootstrap metadata is too large: " + name)
             if declared.isdigit() and int(declared) != len(raw):
                 raise http.client.IncompleteRead(raw, int(declared) - len(raw))
             return io.BytesIO(raw)
         except (urllib.error.URLError, TimeoutError, ConnectionError, http.client.IncompleteRead) as error:
             if not transient(error) or attempt == 2:
                 status = " (HTTP " + str(error.code) + ")" if isinstance(error, urllib.error.HTTPError) else ""
-                raise RuntimeDownloadError("Cannot download node metadata " + name + status + "; check the console URL, TLS and network, then rerun") from None
+                raise InstallError("Cannot download node metadata " + name + status + "; check the console URL, TLS and network, then rerun") from None
             time.sleep(attempt + 1)
 
 
-def metadata(source, prefix=""):
-    read = lambda name: fetch(source, prefix + name)
+def metadata(source):
+    read = lambda name: fetch(source, name)
     with read("SHA256SUMS") as response:
         raw = response.read(1024 * 1024 + 1)
     if len(raw) > 1024 * 1024:
-        raise RuntimeDownloadError("Invalid distribution checksum list")
+        raise InstallError("Invalid distribution checksum list")
     sums = {}
     try:
         for line in raw.decode().splitlines():
             checksum, name = line.split("  ", 1)
             if name in sums or not re.fullmatch(r"[0-9a-f]{64}", checksum):
-                raise RuntimeDownloadError("Invalid distribution checksum entry")
+                raise InstallError("Invalid distribution checksum entry")
             sums[name] = checksum
     except ValueError:
-        raise RuntimeDownloadError("Invalid distribution checksum list") from None
+        raise InstallError("Invalid distribution checksum list") from None
     with read("manifest.json") as response:
         raw = response.read(1024 * 1024 + 1)
     if len(raw) > 1024 * 1024 or hashlib.sha256(raw).hexdigest() != sums.get("manifest.json"):
-        raise RuntimeDownloadError("Distribution manifest checksum mismatch")
+        raise InstallError("Distribution manifest checksum mismatch")
     try:
         manifest = json.loads(raw)
     except (ValueError, TypeError):
-        raise RuntimeDownloadError("Invalid distribution manifest") from None
+        raise InstallError("Invalid distribution manifest") from None
     if (not isinstance(manifest, dict) or manifest.get("platform") != "linux/amd64" or not re.fullmatch(r"[0-9a-f]{40}", manifest.get("source_commit", ""))
             or not re.fullmatch(r"sha256:[0-9a-f]{64}", manifest.get("images", {}).get("runtime", ""))):
-        raise RuntimeDownloadError("Unsupported node distribution")
+        raise InstallError("Unsupported node distribution")
     distribution.image_identities(manifest, "runtime")
     for name in dict.fromkeys(item["path"] for items in provider_assets.CATALOG.values() for item in items if item["role"] != "policy"):
         distribution.artifact(manifest, name)
-    # Metadata stays on the console; artifact requests may redirect to its pinned release.
-    manifest["artifact_base_url"] = source + "/node-install/releases/" + manifest["source_commit"] + "/artifacts"
+    # Metadata stays on the console; artifact requests may redirect to the release.
+    manifest["artifact_base_url"] = source + "/node-install/artifacts"
     return manifest, sums
 
 
@@ -266,21 +266,21 @@ def file_digest(path):
     return result.hexdigest()
 
 
-def download(source, name, root, expected, prefix="", replace=False):
+def download(source, name, root, expected, replace=False):
     target = root / name
     safe_directory(target.parent)
     if existing_file(target):
         if file_digest(target) == expected:
             return
         if not replace:
-            raise RuntimeDownloadError("Installed node payload differs; refusing to overwrite it")
+            raise InstallError("Installed node payload differs; refusing to overwrite it")
         target.unlink()
     with distribution.temporary_file(target) as temporary:
-        with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "wb") as output, fetch(source, prefix + name) as response:
+        with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "wb") as output, fetch(source, name) as response:
             for block in iter(lambda: response.read(1024 * 1024), b""):
                 output.write(block)
         if file_digest(Path(temporary)) != expected:
-            raise RuntimeDownloadError("Node payload checksum mismatch: " + name)
+            raise InstallError("Node payload checksum mismatch: " + name)
         os.replace(temporary, target)
     if name.startswith("native/"):
         os.chmod(target, 0o700)
@@ -336,7 +336,7 @@ def prepare_checkpoint_root(directory, *, initialize=True):
         os.close(descriptor)
 
 
-def provider_config(root, args, runtime_image):
+def provider_config(root, args, manifest, runtime_image):
     result = {"installation_id": args.installation_id, "provider": args.provider, "core_url": args.core_url + "/api/v1",
               "specification": args.configuration["specification"], "generation": args.configuration["generation"]}
     if args.provider == "docker":
@@ -350,7 +350,9 @@ def provider_config(root, args, runtime_image):
         core_rules = [{"action": "allow", "direction": "egress", "destination": address, "protocol": "tcp", "port": str(port)} for address in addresses]
         result["native"] = {
             "helper_path": str(root / MICRO[0]), "runtime_path": str(root / MICRO[1]), "firmware_path": str(root / MICRO[2]),
-            "runtime_home": str(getattr(args, "runtime_home", micro_home(args.installation_id))),
+            "image": manifest["runtime_ref"], "runtime_sha256": manifest["microsandbox"]["runtime_sha256"],
+            "firmware_sha256": manifest["microsandbox"]["firmware_sha256"],
+            "runtime_home": str(micro_home(args.installation_id)),
             "checkpoint_root": str(checkpoint_root(args)),
             "network": {"default_egress": "deny", "default_ingress": "deny", "rules": core_rules + [
                 {"action": "allow", "direction": "egress", "destination": "public"},
@@ -369,7 +371,7 @@ def drop_runtime_archives(root):
 
 
 def micro_env(root, args):
-    return dict(os.environ, MSB_BACKEND="local", MSB_HOME=str(getattr(args, "runtime_home", micro_home(args.installation_id))),
+    return dict(os.environ, MSB_BACKEND="local", MSB_HOME=str(micro_home(args.installation_id)),
                 MSB_PATH=str(root / MICRO[1]), MSB_LIBKRUNFW_PATH=str(root / MICRO[2]))
 
 
@@ -461,23 +463,13 @@ def install_lock(root):
         yield
 
 
-NEWER_NODE_SOFTWARE = ("This host's node program differs from the one this console serves, usually because Core was upgraded "
-                       "after the node was added. Nothing was changed. To move the node to this release, choose Remove node on "
-                       "the Nodes page, uninstall it on this host, then add the host again with Add node.")
-
-
-def refuse_newer_node_software(root, manifest, names):
-    """A registered node keeps its own program; a rerun cannot swap it for another release's."""
-    for name in names:
-        target = root / name
-        if existing_file(target) and not distribution.matches(target, distribution.artifact(manifest, name)):
-            raise InstallError(NEWER_NODE_SOFTWARE)
-
+NOT_THIS_INSTALLATION = ("This host's node was added with another Core address, release or provider. Nothing was changed. To use it with this Core, "
+                         "choose Remove node on the Nodes page, uninstall it on this host, then add the host again with Add node.")
 
 GIB = 1024 ** 3
 
 
-def require_disk(root, args, program_manifest, manifest, names):
+def require_disk(root, args, manifest, names):
     """Refuse before downloading when the node account's disk cannot hold what is still missing.
 
     The Runtime archive and its unpacked copy exist only until the image is imported; a
@@ -485,7 +477,7 @@ def require_disk(root, args, program_manifest, manifest, names):
     needed = 0
     for name in names:
         if name != "runtime/seccomp.json":
-            entry = distribution.artifact(program_manifest if name in provider_assets.artifacts(args.provider, ("node",)) else manifest, name)
+            entry = distribution.artifact(manifest, name)
             target = root / name
             if not (target.is_file() and distribution.matches(target, entry)):
                 needed += entry["size"] - distribution.resumable(distribution.partial_path(target), entry["size"])
@@ -511,33 +503,26 @@ def require_disk(root, args, program_manifest, manifest, names):
 def register_node(root, args, token, helper_archive=None, *, secret_path):
     """Download and verify the payload, prepare the Runtime and register; not the service."""
     install_display.step("Downloading and verifying node files")
-    program_manifest, program_sums = metadata(args.source_url)
-    selected = args.configuration["specification"]["runtime"]
-    manifest, sums = program_manifest, program_sums
-    if selected["source_commit"] != program_manifest["source_commit"]:
-        manifest, sums = metadata(args.source_url, prefix="releases/" + selected["source_commit"] + "/")
-    node_spec.verify_release(args.configuration, manifest)
-    runtime_prefix = "releases/" + manifest["source_commit"] + "/"
+    manifest, sums = metadata(args.source_url)
     names = provider_assets.artifacts(args.provider, ("node", "runtime", "policy"))
     if "runtime/seccomp.json" not in sums:
         raise InstallError("The distribution is missing required node checksums")
-    node_names = provider_assets.artifacts(args.provider, ("node",))
-    if (root / "registered.json").exists():
-        refuse_newer_node_software(root, program_manifest, node_names)
-    require_disk(root, args, program_manifest, manifest, names)
     state = {"installation_id": args.installation_id, "provider": args.provider, "core_url": args.core_url,
              "source_commit": manifest["source_commit"], "generation": args.configuration["generation"],
              "specification_digest": args.configuration["specification_digest"]}
+    marker = root / "registered.json"
+    if marker.exists() and marker.read_text() != json_text(state):
+        raise InstallError(NOT_THIS_INSTALLATION)
+    require_disk(root, args, manifest, names)
     write_once(root / "installation.json", json_text(state))
-    node_generations.record_root_runtime(root, args, manifest, sums, sys.modules[__name__])
     for name in names:
         if name == "runtime/seccomp.json":
-            download(args.source_url, name, root, sums[name], prefix=runtime_prefix, replace=args.disposable)
+            download(args.source_url, name, root, sums[name], replace=args.disposable)
         else:
             target = root / name
             safe_directory(target.parent)
             existing_file(target)
-            distribution.obtain_artifact(program_manifest if name in node_names else manifest, name, target, args.disposable)
+            distribution.obtain_artifact(manifest, name, target, args.disposable)
             os.chmod(target, 0o700)
     node_generations.install_helper(root, args, sys.modules[__name__], helper_archive)
     safe_directory(root / "state/node")
@@ -550,10 +535,9 @@ def register_node(root, args, token, helper_archive=None, *, secret_path):
     runtime_image = prepare_runtime(root, args, manifest)
     # Retain the original network policy when recovering a partial installation.
     if not existing_file(root / "provider.json"):
-        write_once(root / "provider.json", json_text(provider_config(root, args, runtime_image)))
+        write_once(root / "provider.json", json_text(provider_config(root, args, manifest, runtime_image)))
     else:
         node_spec.verify_provider(json.loads((root / "provider.json").read_text()), args.configuration, runtime_image)
-    marker = root / "registered.json"
     if not existing_file(marker):
         # The one-time credential is never passed through process arguments or service environments.
         with os.fdopen(os.open(secret_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "w") as secret:
@@ -567,8 +551,6 @@ def register_node(root, args, token, helper_archive=None, *, secret_path):
             discard_unregistered(root)
             raise
         write_once(marker, json_text(state))
-    elif marker.read_text() != json_text(state):
-        raise InstallError("Registered node identity differs; refusing to replace it")
 
 
 def prepare_service_node(args, token, helper_archive):
@@ -1072,6 +1054,17 @@ def account_plan():
         raise InstallError("An account named " + SERVICE_USER + " exists but was not created or adopted by this installer "
                            "(home " + account.pw_dir + ", shell " + account.pw_shell + ", uid " + str(account.pw_uid)
                            + ", or groups beyond its own, docker and kvm). Rename or remove it, then rerun." + NOTHING_CHANGED)
+    if account is not None and account.pw_uid != SERVICE_UID:
+        raise InstallError("The " + SERVICE_USER + " account has UID " + str(account.pw_uid) + ", but it must use UID "
+                           + str(SERVICE_UID) + " to match Core. Renumber or remove it, then rerun." + NOTHING_CHANGED)
+    if account is None:
+        try:
+            holder = pwd.getpwuid(SERVICE_UID).pw_name
+        except KeyError:
+            holder = None
+        if holder:
+            raise InstallError("UID " + str(SERVICE_UID) + " belongs to the account " + holder + ", but the " + SERVICE_USER
+                               + " account must use it to match Core. Remove or renumber that account, then rerun." + NOTHING_CHANGED)
     if SERVICE_HOME.is_symlink() or (SERVICE_HOME.exists() and not SERVICE_HOME.is_dir()):
         raise InstallError(str(SERVICE_HOME) + " must be a directory, not a symbolic link." + NOTHING_CHANGED)
     if SERVICE_HOME.exists() and (account is None or SERVICE_HOME.stat().st_uid != account.pw_uid):
@@ -1087,7 +1080,7 @@ def prepare_account(account, record, group):
         # A record of an account that no longer exists is stale; the new account replaces it.
         records.unlink(missing_ok=True)
         shell = next((path for path in ("/usr/sbin/nologin", "/sbin/nologin") if os.path.exists(path)), "/bin/false")
-        checked(["useradd", "--system", "--user-group", "--no-create-home", "--home-dir", str(SERVICE_HOME),
+        checked(["useradd", "--system", "--uid", str(SERVICE_UID), "--user-group", "--no-create-home", "--home-dir", str(SERVICE_HOME),
                  "--shell", shell, SERVICE_USER], "Cannot create the " + SERVICE_USER + " service user")
         account = service_account()
         record = {"format": 1, "created": True, "uid": account.pw_uid, "groups_added": []}
@@ -1490,11 +1483,7 @@ def main(argv=None):
     if args.generation_action:
         if args.generation is None or not 1 <= args.generation <= 9223372036854775807 or not re.fullmatch(r"[0-9a-f]{64}", args.specification_digest or ""):
             parser.error("Invalid generation authorization")
-        try:
-            (node_generations.prepare if args.generation_action == "prepare" else node_generations.collect)(args, sys.modules[__name__])
-        except (RuntimeDownloadError, distribution.ArtifactError):
-            print("Runtime artifact transfer or verification failed", file=sys.stderr)
-            raise SystemExit(65) from None
+        (node_generations.prepare if args.generation_action == "prepare" else node_generations.collect)(args, sys.modules[__name__])
         return
     if os.geteuid() != 0:
         raise InstallError("Node installation and removal require root. Run this command with sudo.")
diff --git a/deploy/node/node_payload.py b/deploy/node/node_payload.py
index 6cbe8826b..405f147d0 100644
--- a/deploy/node/node_payload.py
+++ b/deploy/node/node_payload.py
@@ -1,8 +1,6 @@
-"""Publish release node payloads without replacing installed bytes, then activate one."""
+"""Publish the installation's node payload without replacing installed bytes."""
 import json
 import os
-from pathlib import Path
-import re
 import shutil
 import tempfile
 
@@ -14,19 +12,13 @@ class PayloadError(Exception):
 
 
 def publish(destination, source):
-    """Publish the release in source under destination/releases/<commit> and return the commit.
+    """Copy the release in source into destination, which holds exactly one release.
 
-    Each release stays immutable and addressable while nodes retain it. The active pointer is not moved.
-    """
+    Installed bytes are immutable: a file with other bytes is refused, and only absent files are added."""
     if destination.is_symlink():
         raise PayloadError("Invalid node payload directory")
-    destination.mkdir(mode=0o700, exist_ok=True)
     manifest = json.loads((source / "manifest.json").read_text())
-    revision = manifest.get("source_commit", "")
-    if not re.fullmatch(r"[0-9a-f]{40}", revision):
-        raise PayloadError("Invalid node payload release identity")
-    metadata_names = ("node-install.pyz", "manifest.json", "SHA256SUMS", "runtime/seccomp.json")
-    names = list(metadata_names)
+    names = ["node-install.pyz", "manifest.json", "SHA256SUMS", "runtime/seccomp.json"]
     for logical in manifest.get("artifacts", {}):
         entry = artifact(manifest, logical)
         name = "artifacts/" + entry["filename"]
@@ -37,91 +29,33 @@ def publish(destination, source):
                     or path.stat().st_size != entry["size"] or digest(path) != entry["sha256"]):
                 raise PayloadError("Offline artifact verification failed: " + logical)
             names.append(name)
-    target = destination / "releases" / revision
-    if target.is_symlink() or target.parent.is_symlink():
-        raise PayloadError("Installed node payload differs; preserve it and inspect the distribution")
-    target.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
-    if target.exists():
-        # Validate the complete published metadata and every existing declared
-        # artifact before filling any absence. Existing bytes are immutable.
-        for name in metadata_names:
-            previous = target / name
-            if (previous.parent.is_symlink() or previous.is_symlink() or not previous.is_file()
-                    or digest(previous) != digest(source / name)):
+    destination.mkdir(mode=0o700, exist_ok=True)
+    for name in names:
+        incoming, target = source / name, destination / name
+        if incoming.is_symlink() or not incoming.is_file():
+            raise PayloadError("Invalid node payload source file")
+        target.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        if target.parent.is_symlink() or target.is_symlink():
+            raise PayloadError("Installed node payload differs; preserve it and inspect the distribution")
+        if target.exists():
+            if not target.is_file() or digest(target) != digest(incoming):
                 raise PayloadError("Installed node payload differs; preserve it and inspect the distribution")
-        artifacts = target / "artifacts"
-        if artifacts.is_symlink() or artifacts.exists() and not artifacts.is_dir():
-            raise PayloadError("Installed node artifact directory differs")
-        missing = []
-        for logical in manifest.get("artifacts", {}):
-            entry = artifact(manifest, logical)
-            name = "artifacts/" + entry["filename"]
-            previous = target / name
-            if previous.is_symlink() or previous.exists() and (not previous.is_file()
-                    or previous.stat().st_size != entry["size"] or digest(previous) != entry["sha256"]):
-                raise PayloadError("Installed node artifact differs; refusing repair")
-            if not previous.exists() and name in names:
-                missing.append((name, entry))
-        if missing:
-            artifacts.mkdir(mode=0o700, exist_ok=True)
-            for name, entry in missing:
-                descriptor, temporary = tempfile.mkstemp(prefix=".payload-", dir=artifacts)
-                try:
-                    with os.fdopen(descriptor, "wb") as outgoing, (source / name).open("rb") as incoming:
-                        shutil.copyfileobj(incoming, outgoing)
-                        outgoing.flush()
-                        os.fsync(outgoing.fileno())
-                    if Path(temporary).stat().st_size != entry["size"] or digest(Path(temporary)) != entry["sha256"]:
-                        raise PayloadError("Node artifact changed during repair")
-                    # Publish without replacing bytes introduced concurrently.
-                    os.link(temporary, target / name)
-                finally:
-                    os.unlink(temporary)
-            for directory in (artifacts, target):
-                descriptor = os.open(directory, os.O_RDONLY | os.O_DIRECTORY)
-                try:
-                    os.fsync(descriptor)
-                finally:
-                    os.close(descriptor)
-        return revision
-    with tempfile.TemporaryDirectory(prefix=".payload-", dir=target.parent) as temporary:
-        stage = Path(temporary) / "release"
-        stage.mkdir(mode=0o700)
-        for name in names:
-            path = source / name
-            if path.is_symlink() or not path.is_file():
-                raise PayloadError("Invalid node payload source file")
-            copied = stage / name
-            copied.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
-            with path.open("rb") as incoming, copied.open("xb") as outgoing:
-                os.chmod(copied, 0o600)
-                shutil.copyfileobj(incoming, outgoing)
+            continue
+        descriptor, temporary = tempfile.mkstemp(prefix=".payload-", dir=target.parent)
+        try:
+            with os.fdopen(descriptor, "wb") as outgoing, incoming.open("rb") as stream:
+                shutil.copyfileobj(stream, outgoing)
                 outgoing.flush()
                 os.fsync(outgoing.fileno())
-        os.rename(stage, target)
-    return revision
-
-
-def activate(destination, revision):
-    """Atomically point destination/active.json at a published release."""
-    pointer = destination / "active.json"
-    if pointer.is_symlink():
-        raise PayloadError("Invalid active node payload pointer")
-    descriptor, temporary = tempfile.mkstemp(prefix=".active-", dir=destination)
-    try:
-        with os.fdopen(descriptor, "w") as stream:
-            json.dump({"source_commit": revision}, stream)
-            stream.write("\n")
-            stream.flush()
-            os.fsync(stream.fileno())
-        # Web reads the pointer as another user while it serves the previous release.
-        os.chmod(temporary, 0o644)
-        os.replace(temporary, pointer)
-        descriptor = os.open(destination, os.O_RDONLY | os.O_DIRECTORY)
+            # Publish without replacing bytes introduced concurrently.
+            os.link(temporary, target)
+        except FileExistsError:
+            raise PayloadError("Installed node payload differs; preserve it and inspect the distribution") from None
+        finally:
+            os.unlink(temporary)
+    for directory in {(destination / name).parent for name in names}:
+        descriptor = os.open(directory, os.O_RDONLY | os.O_DIRECTORY)
         try:
             os.fsync(descriptor)
         finally:
             os.close(descriptor)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
diff --git a/deploy/node/node_spec.py b/deploy/node/node_spec.py
index 6895e5b79..dfb9ef4ce 100644
--- a/deploy/node/node_spec.py
+++ b/deploy/node/node_spec.py
@@ -1,4 +1,4 @@
-"""Read the Core-owned node specification and verify its matched release."""
+"""Read the Core-owned node specification."""
 import hashlib
 import http.client
 import json
@@ -22,27 +22,20 @@ class UnrecordedIdentity(SpecificationError):
                       "and run it on this host.")
 
 
-def release(manifest):
-    return {"source_commit": manifest["source_commit"],
-            "image_id": manifest["images"]["runtime"],
-            "image_manifest_digest": manifest["image_manifest_digests"]["runtime"],
-            "microsandbox_ref": manifest["runtime_ref"],
-            "runtime_sha256": manifest["microsandbox"]["runtime_sha256"],
-            "firmware_sha256": manifest["microsandbox"]["firmware_sha256"]}
-
-
 # BEGIN GENERATED DEPLOYMENT CONTRACT
 # Generated from sandbox/deployment_contract.go; do not edit.
-_CONTRACT = json.loads("{\"workspace_fields\":[\"attachment\",\"user_xattr\",\"capacity_quota\"],\"resources\":[{\"name\":\"cpus\",\"min\":1,\"max\":255,\"omit_zero\":false},{\"name\":\"memory_mib\",\"min\":512,\"max\":1048576,\"omit_zero\":false},{\"name\":\"root_disk_mib\",\"min\":0,\"max\":4294967295,\"omit_zero\":true},{\"name\":\"environment_disk_mib\",\"min\":0,\"max\":4294967295,\"omit_zero\":true}],\"runtime\":[{\"name\":\"source_commit\",\"pattern\":\"[0-9a-f]{40}\"},{\"name\":\"image_id\",\"pattern\":\"sha256:[0-9a-f]{64}\"},{\"name\":\"image_manifest_digest\",\"pattern\":\"sha256:[0-9a-f]{64}\"},{\"name\":\"microsandbox_ref\",\"pattern\":\"oac-runtime@sha256:[0-9a-f]{64}\"},{\"name\":\"runtime_sha256\",\"pattern\":\"[0-9a-f]{64}\"},{\"name\":\"firmware_sha256\",\"pattern\":\"[0-9a-f]{64}\"}],\"providers\":{\"docker\":{\"mode\":\"nodes\",\"disk\":false,\"runtime\":true,\"default_resources\":{\"cpus\":2,\"memory_mib\":2048}},\"e2b\":{\"mode\":\"direct\",\"disk\":false,\"runtime\":false,\"default_resources\":null},\"microsandbox\":{\"mode\":\"nodes\",\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true},\"disk\":true,\"runtime\":true,\"default_resources\":{\"cpus\":2,\"memory_mib\":4096,\"root_disk_mib\":8192,\"environment_disk_mib\":8192}}},\"minimum_disk\":1024}")
+_CONTRACT = json.loads("{\"workspace_fields\":[\"attachment\",\"user_xattr\",\"capacity_quota\"],\"resources\":[{\"name\":\"cpus\",\"min\":1,\"max\":255,\"omit_zero\":false},{\"name\":\"memory_mib\",\"min\":512,\"max\":1048576,\"omit_zero\":false},{\"name\":\"root_disk_mib\",\"min\":0,\"max\":4294967295,\"omit_zero\":true},{\"name\":\"environment_disk_mib\",\"min\":0,\"max\":4294967295,\"omit_zero\":true}],\"providers\":{\"docker\":{\"mode\":\"nodes\",\"disk\":false,\"default_resources\":{\"cpus\":2,\"memory_mib\":2048}},\"e2b\":{\"mode\":\"direct\",\"disk\":false,\"default_resources\":null},\"microsandbox\":{\"mode\":\"nodes\",\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true},\"disk\":true,\"default_resources\":{\"cpus\":2,\"memory_mib\":4096,\"root_disk_mib\":8192}}},\"minimum_disk\":1024}")
 # END GENERATED DEPLOYMENT CONTRACT
 
 
 def canonical_spec(provider, specification, validate=True):
     rules = _CONTRACT["providers"][provider]
-    if validate and (not isinstance(specification, dict) or set(specification) - {"workspace"} != ({"resources", "runtime"} if rules["runtime"] else {"resources"})):
+    if validate and (not isinstance(specification, dict) or set(specification) - {"workspace"} != {"resources"}):
         raise ValueError("Invalid specification fields")
     workspace = specification.get("workspace")
     requirements = rules.get("workspace")
+    if validate and requirements and workspace is None:
+        raise ValueError("Workspace storage is required")
     if validate and workspace is not None:
         if (not isinstance(workspace, dict) or set(workspace) - set(_CONTRACT["workspace_fields"])
                 or not requirements or workspace.get("attachment") != requirements["attachment"]
@@ -69,17 +62,6 @@ def canonical_spec(provider, specification, validate=True):
         if value or not rule["omit_zero"]:
             ordered[name] = value
     result = {"provider": provider, "resources": ordered}
-    if rules["runtime"]:
-        runtime = specification["runtime"]
-        if validate and (not isinstance(runtime, dict) or set(runtime) != {rule["name"] for rule in _CONTRACT["runtime"]}):
-            raise ValueError("Invalid release fields")
-        ordered_runtime = {}
-        for rule in _CONTRACT["runtime"]:
-            value = runtime[rule["name"]]
-            if validate and (not isinstance(value, str) or not re.fullmatch(rule["pattern"], value)):
-                raise ValueError("Invalid release identity")
-            ordered_runtime[rule["name"]] = value
-        result["runtime"] = ordered_runtime
     if workspace is not None:
         result["workspace"] = {field: workspace[field] if field == "attachment" else bool(workspace.get(field, False)) for field in _CONTRACT["workspace_fields"]}
     return result
@@ -98,9 +80,7 @@ def validate(data, args):
         if (provider not in ("docker", "microsandbox") or data["installation_id"] != args.installation_id
                 or data["core_url"] != args.core_url or type(data["generation"]) is not int or data["generation"] < 1
                 or getattr(args, "provider", None) not in (None, provider)
-                or set(spec) - {"workspace"} != {"resources", "runtime"}
-                or type(data["max_active"]) is not int or type(data["max_retained"]) is not int
-                or not 1 <= data["max_active"] <= data["max_retained"] <= 1000000):
+                or set(spec) - {"workspace"} != {"resources"}):
             raise ValueError()
         canonical_spec(provider, spec)
         if data["specification_digest"] != digest(provider, spec):
@@ -168,11 +148,6 @@ def fetch(args, token, retained, open_request, allow_enrollment=False, generatio
     return data
 
 
-def verify_release(configuration, manifest):
-    if configuration["specification"]["runtime"] != release(manifest):
-        raise SpecificationError("Core Runtime release differs from this distribution; use the matched installation artifacts")
-
-
 def verify_provider(stored, configuration, runtime_image):
     spec, provider = configuration["specification"], configuration["provider"]
     if (stored.get("specification") != spec or stored.get("provider") != provider
diff --git a/deploy/node/test_generation_review_regressions.py b/deploy/node/test_generation_review_regressions.py
index 82eb11515..0fe09d62e 100644
--- a/deploy/node/test_generation_review_regressions.py
+++ b/deploy/node/test_generation_review_regressions.py
@@ -13,7 +13,6 @@
 import node_generations
 import node_install as installer
 import node_payload
-import test_node_install
 import test_node_generations
 
 
@@ -24,64 +23,8 @@ def fixture(self, kind):
         self.addCleanup(case.doCleanups)
         return case
 
-    def test_containerd_resolution_recovers_interrupted_commit(self):
-        case = self.fixture(test_node_install.NodeInstallTests)
-        case.containerd = True
-        case.payloads["runtime/seccomp.json"] = b"{}"
-        case.refresh_manifest()
-        case.install()
-        case.manifest['source_commit'] = 'f' * 40
-        case.refresh_manifest()
-        configuration = json.loads(case.configuration_response(None).read())
-        configuration['generation'] = 2
-        case.args.generation = 2
-        case.args.specification_digest = configuration['specification_digest']
-        path = case.root / 'state/node/generations/2.json'
-        original = node_generations.atomic_json
-        def interrupted(path, value):
-            original(path, value)
-            if path.name == '2.json':
-                raise OSError('interrupted after resolved configuration')
-        with mock.patch.object(installer.node_spec, 'fetch', return_value=configuration):
-            with mock.patch.object(node_generations, 'atomic_json', side_effect=interrupted):
-                with self.assertRaises(OSError):
-                    node_generations.prepare(case.args, installer)
-            self.assertEqual(installer.private_json(path)['native']['image'], case.manifest['image_manifest_digests']['runtime'])
-            self.assertTrue(installer.private_json(path.with_suffix('.preparing'))['import_started'])
-            node_generations.prepare(case.args, installer)
-            saved = path.read_bytes()
-            node_generations.prepare(case.args, installer)
-            self.assertEqual(path.read_bytes(), saved)
-            self.assertFalse(path.with_suffix('.preparing').exists())
-            self.assertTrue(node_generations.image_available(installer.private_json(path), installer))
-
-    def test_unresolved_import_remains_discoverable_and_collectible(self):
-        case = self.fixture(test_node_install.NodeInstallTests)
-        case.containerd = True
-        case.payloads["runtime/seccomp.json"] = b"{}"
-        case.refresh_manifest()
-        case.install()
-        case.manifest['source_commit'] = 'f' * 40
-        case.refresh_manifest()
-        configuration = json.loads(case.configuration_response(None).read())
-        configuration['generation'] = 2
-        case.args.generation = 2
-        case.args.specification_digest = configuration['specification_digest']
-        with mock.patch.object(installer.node_spec, 'fetch', return_value=configuration), mock.patch.object(installer, 'prepare_runtime', side_effect=installer.InstallError('daemon unavailable')):
-            with self.assertRaises(installer.InstallError):
-                node_generations.prepare(case.args, installer)
-        self.assertIn(2, node_generations.retained_configs(case.root, installer))
-        record = installer.private_json(case.root / 'state/node/generations/2.preparing')
-        self.assertTrue(record['import_started'])
-        self.assertEqual(record['configuration']['specification'], configuration['specification'])
-        self.assertFalse((case.root / 'state/node/generations/2.json').exists())
-        node_generations.collect(case.args, installer)
-        node_generations.collect(case.args, installer)
-        self.assertNotIn(2, node_generations.retained_configs(case.root, installer))
-        self.assertTrue((case.root / 'provider.json').exists())
-
     def test_live_helper_replaced_inode_is_refused_after_restart(self):
-        case = self.fixture(test_node_generations.CollectionTests)
+        case = self.fixture(test_node_generations.GenerationTests)
         lease = case.directory / '1.lease'
         helper = subprocess.Popen([sys.executable, '-c', 'import os,fcntl,sys; f=os.open(sys.argv[1],os.O_RDWR);fcntl.flock(f,fcntl.LOCK_SH);print("locked",flush=True);sys.stdin.read()', str(lease)], stdin=subprocess.PIPE, stdout=subprocess.PIPE, text=True)
         try:
@@ -96,7 +39,6 @@ def test_live_helper_replaced_inode_is_refused_after_restart(self):
             with self.assertRaises(installer.InstallError):
                 node_generations.collect(case.args, installer)
             self.assertIsNone(helper.poll())
-            self.assertTrue(case.release.exists())
             self.assertFalse((case.directory / '1.dropped').exists())
             with old.open('rb') as stream:
                 with self.assertRaises(BlockingIOError):
@@ -107,10 +49,10 @@ def test_live_helper_replaced_inode_is_refused_after_restart(self):
             helper.communicate(timeout=10)
             self.assertEqual(helper.returncode, 0)
         node_generations.collect(case.args, installer)
-        self.assertFalse(case.release.exists())
+        self.assertTrue((case.directory / '1.dropped').exists())
 
     def test_interrupted_lease_initialization_is_not_reclaimed(self):
-        case = self.fixture(test_node_generations.CollectionTests)
+        case = self.fixture(test_node_generations.GenerationTests)
         identity = dict(node_generations.marker_identity(case.args), generation=3)
         with mock.patch.object(node_generations, 'atomic_json', side_effect=OSError('power loss')):
             with self.assertRaises(OSError):
@@ -122,7 +64,7 @@ def test_interrupted_lease_initialization_is_not_reclaimed(self):
         (case.directory / '1.lease-identity').unlink()
         with self.assertRaises(OSError):
             node_generations.collect(case.args, installer)
-        self.assertTrue(case.release.exists())
+        self.assertFalse((case.directory / '1.dropped').exists())
 
     def payload_fixture(self, directory):
         root = directory / 'installation'; root.mkdir()
@@ -136,47 +78,45 @@ def payload_fixture(self, directory):
         for name, raw in files.items():
             path = bundle / name; path.parent.mkdir(parents=True, exist_ok=True); path.write_bytes(raw)
         node_payload.publish(root / 'node-payload', bundle)
-        return root, bundle, root / 'node-payload/releases' / source, entries
+        return root, bundle, root / 'node-payload', entries
 
-    def test_publish_keeps_releases_and_activate_swaps_the_pointer(self):
+    def test_publish_is_flat_and_adds_and_repairs_verified_missing_artifacts(self):
         with tempfile.TemporaryDirectory() as temp:
-            root, bundle, old, _ = self.payload_fixture(Path(temp))
-            payload = root / 'node-payload'
-            node_payload.activate(payload, old.name)
-            (bundle / 'manifest.json').write_text(json.dumps({'source_commit': 'b' * 40, 'artifacts': {}}))
-            self.assertEqual(node_payload.publish(payload, bundle), 'b' * 40)
-            self.assertEqual(json.loads((payload / 'active.json').read_text()), {'source_commit': old.name})
-            node_payload.activate(payload, 'b' * 40)
-            self.assertEqual(json.loads((payload / 'active.json').read_text()), {'source_commit': 'b' * 40})
-            self.assertEqual(sorted(path.name for path in (payload / 'releases').iterdir()), [old.name, 'b' * 40])
-
-    def test_thin_release_adds_and_repairs_verified_missing_artifact(self):
-        with tempfile.TemporaryDirectory() as temp:
-            root, bundle, release, entries = self.payload_fixture(Path(temp))
+            root, bundle, payload, entries = self.payload_fixture(Path(temp))
+            self.assertEqual(sorted(path.name for path in payload.iterdir()), ['SHA256SUMS', 'manifest.json', 'node-install.pyz', 'runtime'])
             (bundle / 'artifacts').mkdir()
             for name, entry in entries.items():
                 (bundle / 'artifacts' / entry['filename']).write_bytes((name + ' verified artifact').encode())
-            original = (release / 'manifest.json').read_bytes()
-            node_payload.publish(root / 'node-payload', bundle)
-            artifact = release / 'artifacts' / entries['node']['filename']
+            original = (payload / 'manifest.json').read_bytes()
+            node_payload.publish(payload, bundle)
+            artifact = payload / 'artifacts' / entries['node']['filename']
             self.assertEqual(artifact.read_bytes(), b'node verified artifact')
             artifact.unlink()
-            node_payload.publish(root / 'node-payload', bundle)
+            node_payload.publish(payload, bundle)
             self.assertEqual(artifact.read_bytes(), b'node verified artifact')
-            self.assertEqual((release / 'manifest.json').read_bytes(), original)
+            self.assertEqual((payload / 'manifest.json').read_bytes(), original)
             self.assertEqual(artifact.stat().st_nlink, 1)
 
     def test_published_conflict_refuses_every_missing_repair(self):
         with tempfile.TemporaryDirectory() as temp:
-            root, bundle, release, entries = self.payload_fixture(Path(temp))
-            (bundle / 'artifacts').mkdir(); (release / 'artifacts').mkdir()
+            root, bundle, payload, entries = self.payload_fixture(Path(temp))
+            (bundle / 'artifacts').mkdir(); (payload / 'artifacts').mkdir()
             node = entries['node']['filename']; helper = entries['helper']['filename']
             (bundle / 'artifacts' / node).write_bytes(b'node verified artifact')
-            (release / 'artifacts' / helper).write_bytes(b'changed')
+            (bundle / 'artifacts' / helper).write_bytes(b'helper verified artifact')
+            (payload / 'artifacts' / helper).write_bytes(b'changed')
             with self.assertRaises(node_payload.PayloadError):
-                node_payload.publish(root / 'node-payload', bundle)
-            self.assertFalse((release / 'artifacts' / node).exists())
-            self.assertEqual((release / 'artifacts' / helper).read_bytes(), b'changed')
+                node_payload.publish(payload, bundle)
+            self.assertEqual((payload / 'artifacts' / helper).read_bytes(), b'changed')
+
+    def test_another_release_cannot_replace_published_bytes(self):
+        with tempfile.TemporaryDirectory() as temp:
+            root, bundle, payload, _ = self.payload_fixture(Path(temp))
+            before = (payload / 'manifest.json').read_bytes()
+            (bundle / 'manifest.json').write_text(json.dumps({'source_commit': 'b' * 40, 'artifacts': {}}))
+            with self.assertRaises(node_payload.PayloadError):
+                node_payload.publish(payload, bundle)
+            self.assertEqual((payload / 'manifest.json').read_bytes(), before)
 
     def test_transfer_classification_excludes_provider_and_path_errors(self):
         with self.assertRaises(distribution.ArtifactError):
@@ -191,16 +131,8 @@ def test_transfer_classification_excludes_provider_and_path_errors(self):
                 distribution.checked_path(root / 'link')
             self.assertNotIsInstance(got.exception, distribution.ArtifactError)
 
-    def test_private_helper_exit_classification_never_parses_text(self):
-        for expression, code in (("installer.RuntimeDownloadError('secret')", 65), ("installer.distribution.ArtifactError('secret')", 65), ("installer.InstallError('runtime_download_failed secret')", 1)):
-            script = "import sys,runpy,node_generations; sys.argv=['node_install.py','--installation-id','94be54a1-138c-4f30-bc87-b13686272dbe','--generation-action','prepare','--generation','2','--specification-digest','" + 'a' * 64 + "'];\ndef fail(args,installer): raise " + expression + "\nnode_generations.prepare=fail; runpy.run_module('node_install',run_name='__main__',alter_sys=True)"
-            result = subprocess.run([sys.executable, '-c', script], capture_output=True, text=True, timeout=10, cwd=Path(__file__).parent)
-            self.assertEqual(result.returncode, code, result.stderr)
-            if code == 65:
-                self.assertNotIn('secret', result.stderr)
-
     def test_lease_record_is_fsynced_before_any_caller_can_enter(self):
-        case = self.fixture(test_node_generations.CollectionTests)
+        case = self.fixture(test_node_generations.GenerationTests)
         identity = dict(node_generations.marker_identity(case.args), generation=4)
         operations = []
         original = node_generations.os.fsync
@@ -213,63 +145,3 @@ def sync(fd):
                 record = installer.private_json(case.directory / '4.lease-identity')
                 lease = (case.directory / '4.lease').stat()
                 self.assertEqual((record['device'], record['inode']), (lease.st_dev, lease.st_ino))
-
-    def test_unpublished_plan_refuses_path_or_installation_drift(self):
-        case = self.fixture(test_node_install.NodeInstallTests)
-        case.payloads["runtime/seccomp.json"] = b"{}"
-        case.refresh_manifest(); case.install()
-        case.manifest['source_commit'] = 'f' * 40; case.refresh_manifest()
-        configuration = json.loads(case.configuration_response(None).read()); configuration['generation'] = 2
-        case.args.generation = 2; case.args.specification_digest = configuration['specification_digest']
-        with mock.patch.object(installer.node_spec, 'fetch', return_value=configuration), mock.patch.object(installer, 'prepare_runtime', side_effect=installer.InstallError('stopped')):
-            with self.assertRaises(installer.InstallError): node_generations.prepare(case.args, installer)
-        path=case.root/'state/node/generations/2.preparing'
-        original=installer.private_json(path)
-        for field,value in (("installation_id","foreign"),("core_url","http://foreign/api/v1")):
-            changed=json.loads(json.dumps(original)); changed['configuration'][field]=value
-            node_generations.atomic_json(path,changed)
-            with self.assertRaises(installer.InstallError): node_generations.retained_configs(case.root,installer)
-        changed=json.loads(json.dumps(original)); changed['configuration']['native']['seccomp_file']=str(case.home/'foreign')
-        node_generations.atomic_json(path,changed)
-        with self.assertRaises(installer.InstallError): node_generations.collect(case.args,installer)
-        self.assertFalse((case.root/'state/node/generations/2.dropped').exists())
-        node_generations.atomic_json(path,original)
-        node_generations.collect(case.args,installer)
-
-    def test_pending_fifo_is_refused_without_opening_a_blocking_reader(self):
-        case = self.fixture(test_node_generations.CollectionTests)
-        import os
-        os.mkfifo(case.directory/'2.preparing',0o600)
-        with self.assertRaises(installer.InstallError): node_generations.retained_configs(case.root,installer)
-
-    def test_final_identity_never_changes_on_resolver_drift(self):
-        case = self.fixture(test_node_install.NodeInstallTests)
-        case.payloads["runtime/seccomp.json"] = b"{}"; case.refresh_manifest(); case.install()
-        case.manifest['source_commit']='f'*40; case.refresh_manifest()
-        cfg=json.loads(case.configuration_response(None).read()); cfg['generation']=2
-        case.args.generation=2;case.args.specification_digest=cfg['specification_digest']
-        with mock.patch.object(installer.node_spec,'fetch',return_value=cfg):
-            node_generations.prepare(case.args,installer)
-            path=case.root/'state/node/generations/2.json';before=path.read_bytes()
-            # The same spec allows both IDs, but a finalized local provider is immutable.
-            case.containerd=True
-            with self.assertRaises(installer.node_spec.SpecificationError): node_generations.prepare(case.args,installer)
-            self.assertEqual(path.read_bytes(),before)
-
-    def test_collecting_generation_is_retained_but_never_reused(self):
-        case=self.fixture(test_node_install.NodeInstallTests)
-        case.args.provider="microsandbox";case.install()
-        cfg=json.loads(case.configuration_response(None).read());cfg['generation']=2
-        case.args.generation=2;case.args.specification_digest=cfg['specification_digest']
-        original=installer.private_json(case.root/'provider.json')
-        marker=dict(installation_id=case.args.installation_id,generation=1,specification_digest=installer.node_spec.digest('microsandbox',original['specification']),native_complete=False)
-        node_generations.atomic_json(case.root/'state/node/generations/1.collecting',marker)
-        real=node_generations.image_available
-        def available(value,installer):
-            self.assertNotEqual(value['generation'],1,'collecting entry was considered for reuse')
-            return real(value,installer)
-        with mock.patch.object(installer.node_spec,'fetch',return_value=cfg),mock.patch.object(node_generations,'image_available',side_effect=available):
-            node_generations.prepare(case.args,installer)
-        final=installer.private_json(case.root/'state/node/generations/2.json')
-        self.assertNotEqual(final['native']['helper_path'],original['native']['helper_path'])
-        self.assertIn(1,node_generations.retained_configs(case.root,installer))
diff --git a/deploy/node/test_node_generations.py b/deploy/node/test_node_generations.py
index 0b2c66311..2d210261f 100644
--- a/deploy/node/test_node_generations.py
+++ b/deploy/node/test_node_generations.py
@@ -1,8 +1,7 @@
-"""Collection retains bytes until local helper ownership settles."""
+"""Generation preparation copies the installation's Runtime; collection retains identity until local helper ownership settles."""
 import fcntl
 import os
 import json
-import hashlib
 from pathlib import Path
 import tempfile
 from types import SimpleNamespace
@@ -14,23 +13,20 @@
 import node_spec
 
 
-class CollectionTests(unittest.TestCase):
+class GenerationTests(unittest.TestCase):
     def setUp(self):
         temporary = tempfile.TemporaryDirectory()
         self.addCleanup(temporary.cleanup)
         self.root = Path(temporary.name)
         self.directory = self.root / "state/node/generations"
         self.directory.mkdir(parents=True, mode=0o700)
-        self.value = {"installation_id": "test-installation", "generation": 1, "provider": "docker", "native": {"image": "sha256:" + "a" * 64},
-                      "specification": {"resources": {"cpus": 1, "memory_mib": 1024}, "runtime": {"source_commit": "b" * 40, "image_id": "sha256:" + "a" * 64, "image_manifest_digest": "sha256:" + "c" * 64, "microsandbox_ref": "oac-runtime@sha256:" + "d" * 64, "runtime_sha256": "e" * 64, "firmware_sha256": "f" * 64}}}
+        self.value = {"installation_id": "test-installation", "generation": 1, "provider": "docker", "core_url": "https://core.example/api/v1",
+                      "native": {"image": "sha256:" + "a" * 64, "seccomp_file": str(self.root / "runtime/seccomp.json")},
+                      "specification": {"resources": {"cpus": 1, "memory_mib": 1024}}}
         self.args = SimpleNamespace(installation_id="test-installation", generation=1, specification_digest=node_spec.digest("docker", self.value["specification"]))
-        self.release = self.root / "releases" / ("b" * 40)
-        self.value["native"]["seccomp_file"] = str(self.release / "runtime/seccomp.json")
-        self.release.mkdir(parents=True)
-        (self.release / "artifact").write_bytes(b"immutable bytes")
         node_generations.atomic_json(self.root / "provider.json", self.value)
         self.initialize_lease()
-        for patch in (mock.patch.object(node_generations, "owned_root", return_value=(self.root, {})),
+        for patch in (mock.patch.object(node_generations, "owned_root", return_value=(self.root, {"core_url": "https://core.example"})),
                       mock.patch.object(installer, "checked", return_value="")):
             patch.start()
             self.addCleanup(patch.stop)
@@ -40,7 +36,37 @@ def initialize_lease(self):
                                                node_generations.marker_identity(self.args), initialize=True):
             pass
 
-    def test_busy_helper_refuses_all_mutations_then_same_inode_collects(self):
+    def next_generation(self, resources):
+        specification = {"resources": resources}
+        configuration = {"installation_id": "test-installation", "provider": "docker", "core_url": "https://core.example", "generation": 2, "specification": specification, "specification_digest": node_spec.digest("docker", specification)}
+        self.args.generation, self.args.specification_digest = 2, configuration["specification_digest"]
+        return configuration
+
+    def test_prepare_publishes_the_installation_runtime_under_the_authorized_specification(self):
+        configuration = self.next_generation({"cpus": 2, "memory_mib": 2048})
+        with mock.patch.object(node_spec, "fetch", return_value=configuration), mock.patch.object(node_generations, "image_available", return_value=True):
+            node_generations.prepare(self.args, installer)
+            published = json.loads((self.directory / "2.json").read_text())
+            self.assertEqual(published, dict(self.value, generation=2, specification=configuration["specification"]))
+            node_generations.prepare(self.args, installer)
+        self.assertEqual(json.loads((self.directory / "2.json").read_text()), published)
+        self.assertEqual(json.loads((self.root / "provider.json").read_text()), self.value)
+
+    def test_prepare_refuses_an_unauthorized_dropped_or_unavailable_generation(self):
+        configuration = self.next_generation({"cpus": 2, "memory_mib": 2048})
+        with mock.patch.object(node_spec, "fetch", return_value=dict(configuration, specification_digest="0" * 64)):
+            with self.assertRaisesRegex(installer.InstallError, "differs from its authorization"):
+                node_generations.prepare(self.args, installer)
+        with mock.patch.object(node_spec, "fetch", return_value=configuration), mock.patch.object(node_generations, "image_available", return_value=False):
+            with self.assertRaisesRegex(installer.InstallError, "Runtime is missing"):
+                node_generations.prepare(self.args, installer)
+        self.assertFalse((self.directory / "2.json").exists())
+        node_generations.atomic_json(self.directory / "2.dropped", node_generations.marker_identity(self.args))
+        with mock.patch.object(node_spec, "fetch", return_value=configuration):
+            with self.assertRaisesRegex(installer.InstallError, "dropped generation"):
+                node_generations.prepare(self.args, installer)
+
+    def test_busy_helper_refuses_collection_then_same_inode_collects(self):
         lease = self.directory / "1.lease"
         descriptor = os.open(lease, os.O_CREAT | os.O_RDWR, 0o600)
         self.addCleanup(os.close, descriptor)
@@ -48,31 +74,25 @@ def test_busy_helper_refuses_all_mutations_then_same_inode_collects(self):
         fcntl.flock(descriptor, fcntl.LOCK_SH)
         with self.assertRaisesRegex(installer.InstallError, "helper is still active"):
             node_generations.collect(self.args, installer)
-        installer.checked.assert_not_called()
-        self.assertEqual((self.release / "artifact").read_bytes(), b"immutable bytes")
         self.assertFalse((self.directory / "1.dropped").exists())
         fcntl.flock(descriptor, fcntl.LOCK_UN)
         node_generations.collect(self.args, installer)
-        self.assertFalse(self.release.exists())
         self.assertTrue((self.directory / "1.dropped").exists())
+        self.assertEqual(node_generations.retained_configs(self.root, installer), {})
         node_generations.collect(self.args, installer)
-        installer.checked.assert_not_called()
         final = lease.stat()
         self.assertEqual((original.st_dev, original.st_ino), (final.st_dev, final.st_ino))
 
-    def test_collection_holds_exclusive_lease_during_deletion(self):
-        lease = self.directory / "1.lease"
-        original = node_generations.shutil.rmtree
-        def remove(path):
-            descriptor = os.open(lease, os.O_RDWR)
-            try:
-                with self.assertRaises(BlockingIOError):
-                    fcntl.flock(descriptor, fcntl.LOCK_SH | fcntl.LOCK_NB)
-            finally:
-                os.close(descriptor)
-            return original(path)
-        with mock.patch.object(node_generations.shutil, "rmtree", side_effect=remove):
-            node_generations.collect(self.args, installer)
+    def test_collection_leaves_the_installations_runtime_and_other_generations(self):
+        other = dict(self.value, generation=2)
+        node_generations.atomic_json(self.directory / "2.json", other)
+        seccomp = self.root / "runtime/seccomp.json"
+        seccomp.parent.mkdir()
+        seccomp.write_text("{}")
+        node_generations.collect(self.args, installer)
+        installer.checked.assert_not_called()
+        self.assertTrue(seccomp.exists())
+        self.assertEqual(node_generations.retained_configs(self.root, installer), {2: other})
 
     def test_symlink_and_shared_inode_are_not_collection_authority(self):
         lease = self.directory / "1.lease"
@@ -85,38 +105,11 @@ def test_symlink_and_shared_inode_are_not_collection_authority(self):
             try:
                 with self.assertRaises((OSError, installer.InstallError)):
                     node_generations.collect(self.args, installer)
-                installer.checked.assert_not_called()
-                self.assertTrue((self.release / "artifact").exists())
+                self.assertFalse((self.directory / "1.dropped").exists())
             finally:
                 lease.unlink()
 
-    def test_native_inventory_failure_and_unknown_output_retain_every_byte(self):
-        self.micro_fixture()
-        for failure in (installer.InstallError("daemon unavailable"), "not a verified image ID"):
-            installer.checked.side_effect = failure if isinstance(failure, Exception) else None
-            installer.checked.return_value = failure
-            with self.assertRaises(installer.InstallError):
-                node_generations.collect(self.args, installer)
-            self.assertTrue((self.release / "artifact").exists())
-            self.assertFalse((self.directory / "1.dropped").exists())
-            self.assertFalse(json.loads((self.directory / "1.collecting").read_text())["native_complete"])
-
-    def test_restart_after_partial_file_cleanup_skips_native_and_finishes(self):
-        def interrupted(path):
-            (path / "artifact").unlink()
-            raise OSError("interrupted file cleanup")
-        with mock.patch.object(node_generations.shutil, "rmtree", side_effect=interrupted):
-            with self.assertRaises(OSError):
-                node_generations.collect(self.args, installer)
-        self.assertTrue(json.loads((self.directory / "1.collecting").read_text())["native_complete"])
-        self.assertFalse((self.directory / "1.dropped").exists())
-        installer.checked.reset_mock()
-        node_generations.collect(self.args, installer)
-        installer.checked.assert_not_called()
-        self.assertFalse(self.release.exists())
-        self.assertEqual(node_generations.retained_configs(self.root, installer), {})
-
-    def test_restart_after_files_removed_before_final_marker(self):
+    def test_restart_after_an_interrupted_final_marker_finishes(self):
         original = node_generations.atomic_json
         def interrupt(path, value):
             if path.suffix == ".dropped":
@@ -125,124 +118,22 @@ def interrupt(path, value):
         with mock.patch.object(node_generations, "atomic_json", side_effect=interrupt):
             with self.assertRaises(OSError):
                 node_generations.collect(self.args, installer)
-        self.assertFalse(self.release.exists())
-        installer.checked.reset_mock()
+        self.assertFalse((self.directory / "1.dropped").exists())
         node_generations.collect(self.args, installer)
-        installer.checked.assert_not_called()
         self.assertTrue((self.directory / "1.dropped").exists())
 
-    def test_invalid_journal_never_authorizes_deletion_or_hides_configuration(self):
-        for suffix in (".collecting", ".dropped", ".preparing"):
-            path = self.directory / ("1" + suffix)
-            value = node_generations.marker_identity(self.args)
-            if suffix == ".collecting": value["native_complete"] = True
-            if suffix == ".preparing": value["import_started"] = False
-            for field, invalid in (("installation_id", "foreign"), ("generation", 2), ("specification_digest", "a" * 64)):
-                node_generations.atomic_json(path, dict(value, **{field: invalid}))
-                with self.assertRaises(installer.InstallError):
-                    node_generations.collect(self.args, installer)
-                self.assertTrue(self.release.exists())
-                path.unlink()
-        installer.checked.assert_not_called()
-
-    def test_shared_image_and_release_survive_until_last_generation(self):
-        other = dict(self.value, generation=2)
-        node_generations.atomic_json(self.directory / "2.json", other)
-        node_generations.collect(self.args, installer)
-        installer.checked.assert_not_called()
-        self.assertTrue((self.release / "artifact").exists())
-        self.args.generation = 2
-        self.initialize_lease()
-        node_generations.collect(self.args, installer)
-        self.assertFalse(self.release.exists())
-
-    def test_never_imported_generation_can_collect_missing_executable(self):
-        runtime, _, _ = self.micro_fixture()
-        runtime.unlink()
-        node_generations.atomic_json(self.directory / "1.preparing", dict(node_generations.marker_identity(self.args), import_started=False))
-        node_generations.collect(self.args, installer)
-        installer.checked.assert_not_called()
-        self.assertFalse(self.release.exists())
-
-    def micro_fixture(self):
-        self.value["provider"] = "microsandbox"
-        home = self.root / "micro-store"
-        home.mkdir(mode=0o700)
-        node_generations.atomic_json(home / "oac-installation.json", {"installation_id": self.args.installation_id})
-        runtime = self.release / "msb"
-        runtime.write_bytes(b"verified native executable")
-        runtime.chmod(0o700)
-        image = self.value["specification"]["runtime"]["microsandbox_ref"]
-        self.value["specification"]["runtime"]["runtime_sha256"] = hashlib.sha256(runtime.read_bytes()).hexdigest()
-        self.value["native"] = {"helper_path": str(self.release / "helper"), "runtime_home": str(home), "checkpoint_root": str(self.root / "checkpoints"), "runtime_path": str(runtime), "firmware_path": str(self.release / "firmware")}
-        self.args.specification_digest = node_spec.digest("microsandbox", self.value["specification"])
-        node_generations.atomic_json(self.root / "provider.json", self.value)
-        # This fixture changes provider before any helper exists.
-        for suffix in (".lease", ".lease-identity"):
-            (self.directory / ("1" + suffix)).unlink()
-        self.initialize_lease()
-        return runtime, image, home
-
-    def test_micro_interrupted_native_removal_and_missing_runtime_fail_closed(self):
-        runtime, image, home = self.micro_fixture()
-        present = [True]
-        def native(command, *_args, **_kwargs):
-            if command[1:3] == ["image", "list"]: return image + "\n" if present[0] else ""
-            if command[1:3] == ["image", "remove"]:
-                present[0] = False
-                raise installer.InstallError("interrupted native removal")
-            if command[1:3] == ["sandbox", "list"]: return "[]"
-            raise AssertionError(command)
-        installer.checked.side_effect = native
-        with self.assertRaises(installer.InstallError): node_generations.collect(self.args, installer)
-        raw = runtime.read_bytes()
-        runtime.unlink()
-        installer.checked.reset_mock()
-        with self.assertRaisesRegex(installer.InstallError, "executable"):
-            node_generations.collect(self.args, installer)
-        installer.checked.assert_not_called()
-        self.assertTrue(self.release.exists())
-        runtime.write_bytes(raw)
-        runtime.chmod(0o700)
-        node_generations.collect(self.args, installer)
-        self.assertFalse(self.release.exists())
-        self.assertTrue((home / "oac-installation.json").exists())
-
-    def test_docker_collection_preserves_another_installations_idle_serving_image(self):
-        second = self.root.parent / (self.root.name + "-second")
-        second.mkdir(mode=0o700)
-        self.addCleanup(lambda: node_generations.shutil.rmtree(second))
-        # The second installation's enrolled generation still backs an idle
-        # serving pin. No container is needed to protect its daemon-level image.
-        other = dict(self.value, installation_id="second-installation")
-        node_generations.atomic_json(second / "provider.json", other)
-        before = (second / "provider.json").read_bytes()
-        host_images = {self.value["native"]["image"]}
-        def docker(command, *_args, **_kwargs):
-            if "rm" in command or "prune" in command: host_images.clear()
-            raise AssertionError("generation GC must not manage shared Docker images")
-        installer.checked.side_effect = docker
-        node_generations.collect(self.args, installer)
-        installer.checked.assert_not_called()
-        self.assertEqual(host_images, {other["native"]["image"]})
-        self.assertEqual((second / "provider.json").read_bytes(), before)
-        self.assertFalse(self.release.exists())
-        self.assertEqual(node_generations.retained_configs(self.root, installer), {})
+    def test_invalid_journal_never_authorizes_collection(self):
+        path = self.directory / "1.dropped"
+        for field, invalid in (("installation_id", "foreign"), ("generation", 2), ("specification_digest", "a" * 64)):
+            node_generations.atomic_json(path, dict(node_generations.marker_identity(self.args), **{field: invalid}))
+            with self.assertRaises(installer.InstallError):
+                node_generations.collect(self.args, installer)
+            path.unlink()
 
     def test_fifo_journal_is_refused_without_blocking(self):
-        path = self.directory / "1.collecting"
-        os.mkfifo(path, 0o600)
-        with self.assertRaises(installer.InstallError): node_generations.collect(self.args, installer)
-        installer.checked.assert_not_called()
-        self.assertTrue(self.release.exists())
-
-    def test_release_path_conflict_is_refused_before_native_mutation(self):
-        foreign = self.root / "foreign"
-        self.release.rename(foreign)
-        self.release.symlink_to(foreign, target_is_directory=True)
-        with self.assertRaises(installer.InstallError): node_generations.collect(self.args, installer)
-        installer.checked.assert_not_called()
-        self.assertTrue((foreign / "artifact").exists())
+        os.mkfifo(self.directory / "1.dropped", 0o600)
+        with self.assertRaises(installer.InstallError):
+            node_generations.collect(self.args, installer)
 
 
 if __name__ == "__main__":
diff --git a/deploy/node/test_node_helper_transfer.py b/deploy/node/test_node_helper_transfer.py
index f0a7a92aa..920a89067 100644
--- a/deploy/node/test_node_helper_transfer.py
+++ b/deploy/node/test_node_helper_transfer.py
@@ -32,7 +32,6 @@ def test_captured_archive_survives_removal_of_private_source(self):
             self.assertEqual(stat.S_IMODE(helper.stat().st_mode), 0o600)
             with zipfile.ZipFile(helper) as archive:
                 self.assertEqual(set(archive.namelist()), {"__main__.py", "node_spec.py", "distribution.py", "node_generations.py", "install_display.py", "node_output.py", "provider_assets.py"})
-            self.assertEqual(json.loads((root / "preparation.json").read_text()), {"source_url": "https://core.example"})
 
     @unittest.skipUnless(hasattr(os, "fork") and os.geteuid() == 0, "requires a disposable Linux root test environment")
     def test_real_service_uid_cannot_read_private_download_but_can_install_snapshot(self):
diff --git a/deploy/node/test_node_install.py b/deploy/node/test_node_install.py
index c45d17ba0..0a7124b9e 100644
--- a/deploy/node/test_node_install.py
+++ b/deploy/node/test_node_install.py
@@ -86,7 +86,7 @@ def setUp(self):
                       mock.patch.object(installer, "open_request", side_effect=self.configuration_response),
                       mock.patch.object(installer.distribution.urllib.request, "build_opener", return_value=mock.Mock(open=self.artifact_response)),
                       mock.patch.object(installer, "micro_home", return_value=self.home / "m"),
-                      mock.patch.object(installer, "fetch", side_effect=lambda source, name: io.BytesIO(self.payloads[name.split("/", 2)[2] if name.startswith("releases/") else name])),
+                      mock.patch.object(installer, "fetch", side_effect=lambda source, name: io.BytesIO(self.payloads[name])),
                       mock.patch.object(installer, "checked", side_effect=self.checked),
                       mock.patch.object(installer.distribution, "docker_command", side_effect=self.docker_command),
                       mock.patch.object(installer.subprocess, "run", return_value=subprocess.CompletedProcess([], 0, b"statically linked", b""))):
@@ -99,17 +99,19 @@ def configuration_response(self, request, **kwargs):
             raise urllib.error.HTTPError(request.full_url, 401, "", {}, None)
         resources = {"cpus": self.cpus, "memory_mib": 6144}
         if self.args.provider == "microsandbox":
-            resources.update(root_disk_mib=10240, environment_disk_mib=12288)
-        spec = {"resources": resources, "runtime": node_spec.release(self.manifest)}
+            resources.update(root_disk_mib=10240)
+        spec = {"resources": resources}
+        if self.args.provider == "microsandbox":
+            spec["workspace"] = {"attachment": "host_directory", "user_xattr": True, "capacity_quota": False}
         configuration = {"installation_id": self.args.installation_id, "provider": self.args.provider,
-                         "core_url": self.args.core_url, "generation": 1, "specification": spec, "max_active": 2, "max_retained": 8,
+                         "core_url": self.args.core_url, "generation": 1, "specification": spec,
                          "specification_digest": node_spec.digest(self.args.provider, spec)}
         return io.BytesIO(json.dumps(configuration).encode())
 
     def artifact_response(self, request, **kwargs):
         url = getattr(request, "full_url", request)
         # The fixture manifest records a release URL; nodes still download from their console.
-        self.assertTrue(url.startswith(self.args.source_url + "/node-install/releases/" + self.manifest["source_commit"] + "/artifacts/"), url)
+        self.assertTrue(url.startswith(self.args.source_url + "/node-install/artifacts/"), url)
         for name, item in self.manifest["artifacts"].items():
             if url.endswith("/" + item["filename"]):
                 return Response(self.payloads[name])
@@ -179,263 +181,6 @@ def docker_command(self, arguments, **kwargs):
     def install(self):
         installer.prepare_service_node(self.args, "synthetic-once-token", installer.node_generations.helper_archive(self.args, installer))
 
-    def install_current_program_with_retained_runtime(self, provider):
-        self.args.provider = provider
-        old_source, new_source = self.manifest["source_commit"], "f" * 40
-        program = copy.deepcopy(self.manifest)
-        program["source_commit"] = new_source
-        payloads = dict(self.payloads)
-        payloads[installer.provider_assets.artifacts("docker", ("node",))[0]] = b"new protocol program from current release"
-        for name, artifact in program["artifacts"].items():
-            artifact["filename"] = artifact["filename"].replace(old_source, new_source)
-            artifact["size"] = len(payloads[name])
-            artifact["sha256"] = hashlib.sha256(payloads[name]).hexdigest()
-        payloads["manifest.json"] = json.dumps(program).encode()
-        payloads["SHA256SUMS"] = "".join(hashlib.sha256(raw).hexdigest() + "  " + name + "\n"
-                                               for name, raw in payloads.items() if name != "SHA256SUMS").encode()
-        fetched = []
-        def fetch(_source, name):
-            fetched.append(name)
-            if name.startswith("releases/" + old_source + "/"):
-                return io.BytesIO(self.payloads[name.split("/", 2)[2]])
-            self.assertIn(name, ("manifest.json", "SHA256SUMS"))
-            return io.BytesIO(payloads[name])
-        def artifact_response(request, **_kwargs):
-            url = getattr(request, "full_url", request)
-            for manifest, files in ((program, payloads), (self.manifest, self.payloads)):
-                prefix = self.args.source_url + "/node-install/releases/" + manifest["source_commit"] + "/artifacts/"
-                for name, item in manifest["artifacts"].items():
-                    if url == prefix + item["filename"]:
-                        # Only the node executable comes from the host release.
-                        self.assertEqual(manifest["source_commit"], new_source if name == installer.provider_assets.artifacts("docker", ("node",))[0] else old_source)
-                        return Response(files[name])
-            raise AssertionError("Unexpected immutable artifact URL " + url)
-        with mock.patch.object(installer, "fetch", side_effect=fetch), mock.patch.object(installer.distribution.urllib.request, "build_opener", return_value=mock.Mock(open=artifact_response)):
-            self.install()
-        self.assertEqual((self.root / installer.provider_assets.artifacts("docker", ("node",))[0]).read_bytes(), payloads[installer.provider_assets.artifacts("docker", ("node",))[0]])
-        config = json.loads((self.root / "provider.json").read_text())
-        self.assertEqual(config["specification"]["runtime"], node_spec.release(self.manifest))
-        self.assertEqual(json.loads((self.root / "registered.json").read_text())["source_commit"], old_source)
-        self.assertIn("releases/" + old_source + "/runtime/seccomp.json", fetched)
-        if provider == "microsandbox":
-            for name in installer.MICRO:
-                self.assertEqual((self.root / name).read_bytes(), self.payloads[name])
-
-    def test_current_program_pairs_with_core_selected_retained_docker_runtime(self):
-        self.install_current_program_with_retained_runtime("docker")
-
-    def test_current_program_pairs_with_core_selected_retained_micro_runtime(self):
-        self.install_current_program_with_retained_runtime("microsandbox")
-
-    def test_missing_retained_runtime_never_falls_back_to_current_runtime(self):
-        program = copy.deepcopy(self.manifest)
-        program["source_commit"] = "f" * 40
-        with mock.patch.object(installer, "metadata", side_effect=[(program, {}), installer.InstallError("Retained release unavailable")]) as metadata:
-            with self.assertRaisesRegex(installer.InstallError, "Retained release unavailable"):
-                self.install()
-        self.assertEqual(metadata.call_args_list[1].kwargs, {"prefix": "releases/" + self.manifest["source_commit"] + "/"})
-        self.assertFalse((self.root / "installation.json").exists())
-        self.assertFalse(any("register" in command or "load" in command or "enable" in command for command, _ in self.calls))
-
-    def recovery_args(self):
-        self.args.generation = 1
-        self.args.specification_digest = json.loads((self.root / "state/node/identity.json").read_text())["identity"]["specification_digest"]
-        return self.args
-
-    def prepare_successor_runtime(self):
-        self.manifest["source_commit"] = "f" * 40
-        self.refresh_manifest()
-        config = json.loads(self.configuration_response(None).read())
-        config["generation"] = 2
-        self.args.generation = 2
-        self.args.specification_digest = config["specification_digest"]
-        with mock.patch.object(installer.node_spec, "fetch", return_value=config):
-            installer.node_generations.prepare(self.args, installer)
-        return installer.private_json(self.root / "state/node/generations/2.json")
-
-    def test_original_runtime_gc_interruption_preserves_restart_identity_and_successor(self):
-        self.args.provider = "microsandbox"
-        self.install()
-        successor = self.prepare_successor_runtime()
-        keep = (installer.provider_assets.artifacts("docker", ("node",))[0], "generation-preparer.pyz", "provider.json", "registered.json",
-                "installation.json", "preparation.json", "runtime-artifacts.json", "state/node/identity.json")
-        before = {name: (self.root / name).read_bytes() for name in keep}
-        original = installer.private_json(self.root / "provider.json")
-        self.args.generation = 1
-        self.args.specification_digest = node_spec.digest("microsandbox", original["specification"])
-        real_unlink = Path.unlink
-        def interrupted(path, *args, **kwargs):
-            if path == self.root / installer.MICRO[1]:
-                raise OSError("interrupted original Runtime cleanup")
-            return real_unlink(path, *args, **kwargs)
-        with mock.patch.object(Path, "unlink", new=interrupted):
-            with self.assertRaises(OSError): installer.node_generations.collect(self.args, installer)
-        self.assertFalse((self.root / installer.MICRO[0]).exists())
-        self.assertTrue((self.root / installer.MICRO[1]).exists())
-        self.assertTrue(installer.private_json(self.root / "state/node/generations/1.collecting")["native_complete"])
-        self.assertEqual(installer.private_json(self.root / "provider.json"), original)
-        self.assertEqual(installer.node_generations.retained_configs(self.root, installer)[2], successor)
-        count = len(self.calls)
-        installer.node_generations.collect(self.args, installer)
-        self.assertEqual(len(self.calls), count)
-        for name in ("runtime/seccomp.json", "images/runtime.tar.gz", "images/runtime.tar") + installer.MICRO:
-            self.assertFalse((self.root / name).exists(), name)
-        for name, raw in before.items(): self.assertEqual((self.root / name).read_bytes(), raw, name)
-        self.assertEqual(installer.node_generations.retained_configs(self.root, installer), {2: successor})
-        self.assertTrue(installer.node_generations.image_available(successor, installer))
-
-    def test_original_runtime_gc_refuses_changed_sibling_before_deleting_any_file(self):
-        self.args.provider = "microsandbox"
-        self.install()
-        self.prepare_successor_runtime()
-        original = installer.private_json(self.root / "provider.json")
-        self.args.generation = 1
-        self.args.specification_digest = node_spec.digest("microsandbox", original["specification"])
-        firmware = self.root / installer.MICRO[2]
-        firmware.write_bytes(b"changed private file")
-        before = {name: (self.root / name).read_bytes() for name in ("runtime/seccomp.json",) + installer.MICRO}
-        count = len(self.calls)
-        with self.assertRaisesRegex(installer.InstallError, "refusing deletion"):
-            installer.node_generations.collect(self.args, installer)
-        self.assertEqual(len(self.calls), count)
-        for name, raw in before.items(): self.assertEqual((self.root / name).read_bytes(), raw, name)
-
-    def test_original_runtime_gc_missing_ownership_refuses_and_preserves_unknown_files(self):
-        self.install()
-        self.prepare_successor_runtime()
-        (self.root / "runtime-artifacts.json").unlink()
-        unknown = self.root / "native/bin/operator-owned-file"
-        unknown.write_bytes(b"unowned")
-        self.args.generation = 1
-        original = installer.private_json(self.root / "provider.json")
-        self.args.specification_digest = node_spec.digest("docker", original["specification"])
-        seccomp = (self.root / "runtime/seccomp.json").read_bytes()
-        with self.assertRaisesRegex(installer.InstallError, "ownership is missing"):
-            installer.node_generations.collect(self.args, installer)
-        self.assertEqual((self.root / "runtime/seccomp.json").read_bytes(), seccomp)
-        self.assertEqual(unknown.read_bytes(), b"unowned")
-
-    def test_shared_original_firmware_survives_until_its_last_generation(self):
-        self.args.provider = "microsandbox"
-        self.install()
-        successor = self.prepare_successor_runtime()
-        successor["native"]["firmware_path"] = str(self.root / installer.MICRO[2])
-        installer.node_generations.atomic_json(self.root / "state/node/generations/2.json", successor)
-        original = installer.private_json(self.root / "provider.json")
-        self.args.generation = 1
-        self.args.specification_digest = node_spec.digest("microsandbox", original["specification"])
-        installer.node_generations.collect(self.args, installer)
-        self.assertFalse((self.root / installer.MICRO[0]).exists())
-        self.assertFalse((self.root / installer.MICRO[1]).exists())
-        self.assertTrue((self.root / installer.MICRO[2]).exists())
-        self.assertTrue(installer.node_generations.image_available(successor, installer))
-        self.args.generation = 2
-        self.args.specification_digest = node_spec.digest("microsandbox", successor["specification"])
-        with installer.node_generations.collection_lease(self.root, 2, installer, installer.node_generations.marker_identity(self.args), initialize=True):
-            pass
-        def inventory(command, *_args, **_kwargs):
-            if command[1:3] == ["image", "list"]: return ""
-            if command[1:3] == ["sandbox", "list"]: return "[]"
-            raise AssertionError(command)
-        with mock.patch.object(installer, "checked", side_effect=inventory):
-            installer.node_generations.collect(self.args, installer)
-        self.assertFalse((self.root / installer.MICRO[2]).exists())
-        self.assertTrue((self.root / "provider.json").exists())
-        self.assertTrue((self.root / installer.provider_assets.artifacts("docker", ("node",))[0]).exists())
-
-    def test_original_runtime_gc_preserves_exact_shared_native_file_references(self):
-        self.args.provider = "microsandbox"
-        self.install()
-        original = installer.private_json(self.root / "provider.json")
-        other = json.loads(json.dumps(original))
-        other["generation"] = 2
-        directory = self.root / "state/node/generations"
-        directory.mkdir(mode=0o700, exist_ok=True)
-        installer.node_generations.atomic_json(directory / "2.json", other)
-        before = {name: (self.root / name).read_bytes() for name in ("runtime/seccomp.json",) + installer.MICRO}
-        installer.node_generations.collect(self.recovery_args(), installer)
-        for name, raw in before.items(): self.assertEqual((self.root / name).read_bytes(), raw, name)
-        self.assertEqual(installer.node_generations.retained_configs(self.root, installer), {2: other})
-
-    def test_interrupted_new_generation_recovers_partial_download_at_same_identity(self):
-        self.args.provider = "microsandbox"
-        self.install()
-        original = (self.root / "provider.json").read_bytes()
-        self.manifest["source_commit"] = "f" * 40
-        self.refresh_manifest()
-        config = json.loads(self.configuration_response(None).read())
-        config["generation"] = 2
-        self.args.generation = 2
-        self.args.specification_digest = config["specification_digest"]
-        real_obtain = installer.distribution.obtain_artifact
-        def interrupted(manifest, name, path):
-            if name == installer.MICRO[1]:
-                raise OSError("interrupted partial download")
-            return real_obtain(manifest, name, path)
-        with mock.patch.object(installer.node_spec, "fetch", return_value=config):
-            with mock.patch.object(installer.distribution, "obtain_artifact", side_effect=interrupted):
-                with self.assertRaises(OSError):
-                    installer.node_generations.prepare(self.args, installer)
-            directory = self.root / "state/node/generations"
-            saved = json.loads((directory / "2.preparing").read_text())["configuration"]
-            self.assertFalse((directory / "2.json").exists())
-            self.assertEqual(saved["specification"], config["specification"])
-            self.assertFalse(json.loads((directory / "2.preparing").read_text())["import_started"])
-            helper = Path(saved["native"]["helper_path"])
-            inode = helper.stat().st_ino
-            self.assertFalse(Path(saved["native"]["runtime_path"]).exists())
-            installer.node_generations.prepare(self.args, installer)
-            self.assertEqual(helper.stat().st_ino, inode)
-            self.assertEqual(json.loads((directory / "2.json").read_text()), saved)
-            self.assertFalse((directory / "2.preparing").exists())
-        self.assertEqual((self.root / "provider.json").read_bytes(), original)
-
-    def test_restart_repairs_only_missing_micro_bytes_at_original_paths(self):
-        self.args.provider = "microsandbox"
-        self.install()
-        before = (self.root / "provider.json").read_bytes()
-        helper = self.root / installer.MICRO[0]
-        runtime = self.root / installer.MICRO[1]
-        old_inode = runtime.stat().st_ino
-        helper.unlink()
-        installer.node_generations.prepare(self.recovery_args(), installer)
-        self.assertEqual(helper.read_bytes(), self.payloads[installer.MICRO[0]])
-        self.assertEqual(runtime.stat().st_ino, old_inode)
-        self.assertEqual((self.root / "provider.json").read_bytes(), before)
-        self.assertEqual(json.loads((self.root / "state/node/generations/1.json").read_text()), json.loads(before))
-
-    def test_restart_refuses_conflicting_sibling_before_repairing_missing_file(self):
-        self.args.provider = "microsandbox"
-        self.install()
-        helper = self.root / installer.MICRO[0]
-        runtime = self.root / installer.MICRO[1]
-        helper.unlink()
-        runtime.write_bytes(b"conflicting retained runtime")
-        with self.assertRaisesRegex(installer.InstallError, "artifact checksum differs"):
-            installer.node_generations.prepare(self.recovery_args(), installer)
-        self.assertFalse(helper.exists())
-        self.assertEqual(runtime.read_bytes(), b"conflicting retained runtime")
-
-    def test_live_helper_or_collection_excludes_restart_repair(self):
-        self.args.provider = "microsandbox"
-        self.install()
-        helper = self.root / installer.MICRO[0]
-        helper.unlink()
-        directory = self.root / "state/node/generations"
-        directory.mkdir(mode=0o700, exist_ok=True)
-        descriptor = os.open(directory / "1.lease", os.O_CREAT | os.O_RDWR, 0o600)
-        try:
-            for mode in (fcntl.LOCK_SH, fcntl.LOCK_EX):
-                fcntl.flock(descriptor, mode | fcntl.LOCK_NB)
-                with self.assertRaisesRegex(installer.InstallError, "helper is still active"):
-                    installer.node_generations.prepare(self.recovery_args(), installer)
-                self.assertFalse(helper.exists())
-                fcntl.flock(descriptor, fcntl.LOCK_UN)
-        finally:
-            os.close(descriptor)
-        installer.node_generations.prepare(self.args, installer)
-        self.assertEqual(helper.read_bytes(), self.payloads[installer.MICRO[0]])
-
     def test_docker_installs_matched_payload_registers_and_starts_persistent_service(self):
         system = self.sudo_host()
         installer.install_system(self.args, "synthetic-once-token")
@@ -488,8 +233,10 @@ def test_microsandbox_imports_image_and_allows_only_explicit_private_core_endpoi
         self.args.provider = "microsandbox"
         self.install()
         config = json.loads((self.root / "provider.json").read_text())["native"]
-        # Resources, the image and artifact hashes are read from the specification.
-        self.assertEqual(set(config), {"helper_path", "runtime_path", "firmware_path", "runtime_home", "checkpoint_root", "network"})
+        # The image and artifact hashes come from the installation's verified manifest.
+        self.assertEqual(set(config), {"helper_path", "runtime_path", "firmware_path", "image", "runtime_sha256", "firmware_sha256", "runtime_home", "checkpoint_root", "network"})
+        self.assertEqual((config["image"], config["runtime_sha256"], config["firmware_sha256"]),
+                         (self.manifest["runtime_ref"], self.manifest["microsandbox"]["runtime_sha256"], self.manifest["microsandbox"]["firmware_sha256"]))
         rules = config["network"]["rules"]
         self.assertIn({"action": "allow", "direction": "egress", "destination": "172.29.144.1", "protocol": "tcp", "port": "24443"}, rules)
         self.assertNotIn("private", [rule["destination"] for rule in rules])
@@ -599,6 +346,10 @@ def test_unconfirmed_registration_retains_state_removes_token_and_does_not_start
     def test_registration_failure_names_only_cores_fixed_answer(self):
         self.assertEqual(str(installer.registration_failure(b"secret /home/path details")), installer.REGISTRATION_UNCONFIRMED)
 
+    def test_registration_failure_names_unmeasured_host(self):
+        message = str(installer.registration_failure(b"node enrollment rejected (HTTP 409 sandbox_node_host_unmeasured)\n"))
+        self.assertIn("explicit limits", message)
+
     def test_changed_public_url_clears_unregistered_state_for_a_new_command(self):
         # Core refused the address before consuming the token, so it has no record of this node.
         self.register_stderr = b"node enrollment rejected (HTTP 409 sandbox_node_address_mismatch)\n"
@@ -630,12 +381,12 @@ def test_different_commit_provider_or_core_cannot_overwrite_retained_installatio
         for field, value in (("provider", "microsandbox"), ("core_url", "https://other.example")):
             before = getattr(self.args, field)
             setattr(self.args, field, value)
-            with self.assertRaisesRegex((installer.InstallError, node_spec.SpecificationError), "differs|prepares the changed"):
+            with self.assertRaisesRegex((installer.InstallError, node_spec.SpecificationError), "differs|prepares the changed|added with another Core address"):
                 self.install()
             setattr(self.args, field, before)
         self.manifest["source_commit"] = "f" * 40
         self.refresh_manifest()
-        with self.assertRaisesRegex((installer.InstallError, node_spec.SpecificationError), "differs|prepares the changed"):
+        with self.assertRaisesRegex((installer.InstallError, node_spec.SpecificationError), "differs|prepares the changed|added with another Core address"):
             self.install()
         self.assertEqual((self.root / "provider.json").read_bytes(), original)
 
@@ -654,7 +405,7 @@ def test_installed_payload_and_config_are_not_overwritten(self):
         self.install()
         target = self.root / installer.provider_assets.artifacts("docker", ("node",))[0]
         target.write_bytes(b"existing-different-payload")
-        with self.assertRaisesRegex(installer.InstallError, "Remove node.*Add node"):
+        with self.assertRaises(installer.distribution.DistributionError):
             self.install()
         self.assertEqual(target.read_bytes(), b"existing-different-payload")
 
@@ -715,7 +466,7 @@ def run_as(account, function, *arguments):
             self.service_steps.append("wait_ready" if function is installer.wait_ready else function.__name__)
             with mock.patch.object(installer.Path, "home", return_value=Path(account.pw_dir)):
                 function(*arguments)
-        for patch in (mock.patch.multiple(installer, SERVICE_HOME=service_home, SYSTEM_RECORDS=system / "etc",
+        for patch in (mock.patch.multiple(installer, SERVICE_HOME=service_home, SERVICE_UID=os.getuid(), SYSTEM_RECORDS=system / "etc",
                                           SYSTEM_UNITS=system / "units", SYSTEM_LOCKS=system / "run",
                                           CHILD_DOCKER_CONFIG=system / "docker-config",
                                           SYSTEMD_RUNNING=system / "systemd", SELINUX_ENFORCE=system / "selinux",
@@ -724,7 +475,8 @@ def run_as(account, function, *arguments):
                       mock.patch.object(installer.shutil, "which", side_effect=lambda tool: None if tool == "docker" and not self.docker_installed else "/usr/bin/" + tool),
                       mock.patch.object(installer.grp, "getgrnam", side_effect=lambda name: SimpleNamespace(gr_mem=["oac-node"] if self.joined else [])),
                       mock.patch.object(installer.os, "getgrouplist", side_effect=lambda name, gid: [gid]),
-                      mock.patch.object(installer.grp, "getgrgid", side_effect=lambda gid: SimpleNamespace(gr_name=self.device_group))):
+                      mock.patch.object(installer.grp, "getgrgid", side_effect=lambda gid: SimpleNamespace(gr_name=self.device_group)),
+                      mock.patch.object(installer.pwd, "getpwuid", side_effect=KeyError)):
             patch.start()
             self.addCleanup(patch.stop)
         return system
@@ -773,7 +525,7 @@ def test_sudo_mode_prepares_the_host_and_reruns_without_changes(self):
         system = self.sudo_host()
         installer.install_system(self.args, "synthetic-once-token")
         commands = [call for call, _ in self.calls]
-        self.assertIn(["useradd", "--system", "--user-group", "--no-create-home", "--home-dir", str(self.home / "service"),
+        self.assertIn(["useradd", "--system", "--uid", str(os.getuid()), "--user-group", "--no-create-home", "--home-dir", str(self.home / "service"),
                        "--shell", next(path for path in ("/usr/sbin/nologin", "/sbin/nologin", "/bin/false") if os.path.exists(path) or path == "/bin/false"),
                        "oac-node"], commands)
         self.assertTrue(any(call[:3] == ["usermod", "--append", "--groups"] for call in commands))
@@ -991,6 +743,23 @@ def test_uninstall_keeps_a_store_it_did_not_create(self):
         self.assertIn("Kept the microsandbox store", self.uninstall_output(False))
         self.assertTrue(store.is_dir())
 
+    def test_sudo_mode_refuses_when_another_account_holds_core_uid(self):
+        self.sudo_host()
+        with mock.patch.object(installer.pwd, "getpwuid", return_value=SimpleNamespace(pw_name="nonroot")):
+            with self.assertRaisesRegex(installer.InstallError, "UID [0-9]+ belongs to the account nonroot.*Nothing was changed"):
+                installer.install_system(self.args, "synthetic-once-token")
+        self.assertFalse([call for call, _ in self.calls if call[:1] in (["useradd"], ["usermod"], ["systemctl"])])
+
+    def test_sudo_mode_refuses_an_existing_account_with_another_uid(self):
+        self.sudo_host()
+        (self.home / "service").mkdir()
+        self.account = SimpleNamespace(pw_name="oac-node", pw_uid=os.getuid() + 1, pw_gid=os.getgid(),
+                                       pw_dir=str(self.home / "service"), pw_shell="/usr/sbin/nologin")
+        with mock.patch.object(installer.os, "getgrouplist", return_value=[os.getgid()]):
+            with self.assertRaisesRegex(installer.InstallError, "must use UID [0-9]+ to match Core.*Nothing was changed"):
+                installer.install_system(self.args, "synthetic-once-token")
+        self.assertFalse([call for call, _ in self.calls if call[:1] in (["useradd"], ["usermod"], ["systemctl"])])
+
     def test_uninstall_leaves_an_adopted_account_as_found(self):
         system = self.sudo_host()
         (self.home / "service").mkdir()
@@ -1218,13 +987,14 @@ def test_a_registered_node_keeps_its_state_when_the_configuration_changes(self):
             self.install()
         self.assertEqual((self.root / "provider.json").read_bytes(), saved)
 
-    def test_a_registered_node_given_a_newer_release_says_to_remove_and_add_it_again(self):
+    def test_a_registered_node_of_another_installation_says_to_remove_and_add_it_again(self):
         self.install()
         program = self.root / installer.provider_assets.artifacts("docker", ("node",))[0]
         saved = program.read_bytes()
-        self.payloads[program.relative_to(self.root).as_posix()] = b"program of the upgraded Core"
+        self.manifest["source_commit"] = "f" * 40
+        self.payloads[program.relative_to(self.root).as_posix()] = b"program of another installation"
         self.refresh_manifest()
-        with self.assertRaisesRegex(installer.InstallError, "Remove node on the Nodes page.*Add node"):
+        with self.assertRaisesRegex(installer.InstallError, "added with another Core address.*Remove node on the Nodes page.*Add node"):
             self.install()
         self.assertEqual(program.read_bytes(), saved)
 
diff --git a/deploy/node/test_node_spec.py b/deploy/node/test_node_spec.py
index e4f8da322..68b3256d1 100644
--- a/deploy/node/test_node_spec.py
+++ b/deploy/node/test_node_spec.py
@@ -14,14 +14,10 @@
 class SpecificationTests(unittest.TestCase):
     def setUp(self):
         self.args = argparse.Namespace(core_url="https://core.example", installation_id="94be54a1-138c-4f30-bc87-b13686272dbe", provider=None)
-        self.spec = {"resources": {"cpus": 2, "memory_mib": 4096}, "runtime": {
-            "source_commit": "a" * 40, "image_id": "sha256:" + "b" * 64,
-            "image_manifest_digest": "sha256:" + "c" * 64,
-            "microsandbox_ref": "oac-runtime@sha256:" + "d" * 64,
-            "runtime_sha256": "e" * 64, "firmware_sha256": "f" * 64}}
+        self.spec = {"resources": {"cpus": 2, "memory_mib": 4096}}
         self.data = {"installation_id": self.args.installation_id, "provider": "docker", "generation": 3,
                      "specification": self.spec, "specification_digest": node_spec.digest("docker", self.spec),
-                     "core_url": self.args.core_url, "max_active": 2, "max_retained": 8}
+                     "core_url": self.args.core_url}
         self.retained = {"core_url": self.args.core_url, "credential": "f" * 64, "identity": {
             "node_id": "634d97be-e54d-40f0-9468-ae6b62be85bf", "installation_id": self.args.installation_id,
             "provider": "docker", "deployment_generation": 3, "specification_digest": self.data["specification_digest"]}}
@@ -99,20 +95,8 @@ def test_invalid_limits_digests_and_provider_assertions_are_rejected(self):
         with self.assertRaises(node_spec.SpecificationError):
             node_spec.validate(self.data, self.args)
 
-    def test_capacity_requires_approved_bounded_integers(self):
-        for key, value in (("max_active", None), ("max_active", True), ("max_active", 0),
-                           ("max_retained", 1), ("max_retained", 1000001)):
-            data = copy.deepcopy(self.data)
-            data[key] = value
-            with self.subTest(key=key, value=value), self.assertRaises(node_spec.SpecificationError):
-                node_spec.validate(data, self.args)
-        self.data["max_active"], self.data["max_retained"] = 3, 9
-        result = node_spec.fetch(self.args, "", self.retained, mock.Mock(return_value=self.response()))
-        self.assertEqual((result["max_active"], result["max_retained"]), (3, 9))
-
     def test_digest_is_independent_of_response_object_key_order(self):
         reordered = copy.deepcopy(self.spec)
-        reordered["runtime"] = dict(reversed(list(reordered["runtime"].items())))
         reordered["resources"] = dict(reversed(list(reordered["resources"].items())))
         self.assertEqual(node_spec.digest("docker", reordered), node_spec.digest("docker", self.spec))
 
diff --git a/deploy/test_install.ps1 b/deploy/test_install.ps1
index bf7423671..c0a19cf98 100644
--- a/deploy/test_install.ps1
+++ b/deploy/test_install.ps1
@@ -21,7 +21,7 @@ function Invoke-WebRequest {
 # A failure writes one error and sets a non-zero exit code; the session stays open.
 function Assert-Failure([string]$Pattern, [string[]]$Arguments = @('--help')) {
     $global:LASTEXITCODE = 0
-    $output = (& "$PSScriptRoot/install.ps1" @Arguments 2>&1 | Out-String)
+    $output = (& "$PSScriptRoot/install.ps1" @Arguments *>&1 | Out-String)
     if ($LASTEXITCODE -eq 0 -or $output -notlike $Pattern) { throw "Expected a failure matching $Pattern, got exit $LASTEXITCODE`: $output" }
 }
 & "$PSScriptRoot/install.ps1" --help
@@ -35,5 +35,5 @@ Assert-Failure '*Missing release tag*' @('--version')
 $testAssets.Status = 404
 Assert-Failure '*Release v9.9.9 not found*' @('--version=v9.9.9')
 $testAssets.Status = 503
-Assert-Failure '*Check the network*'
+Assert-Failure '*retrying (2/5)...*Check the network*'
 exit 0
diff --git a/deploy/test_install.py b/deploy/test_install.py
index 0db560185..18d8c9407 100644
--- a/deploy/test_install.py
+++ b/deploy/test_install.py
@@ -10,7 +10,7 @@
 
 
 class LauncherTests(unittest.TestCase):
-    def run_launcher(self, system='Darwin', machine='arm64', corrupt=False, arguments=('--install-dir', '/path with spaces/core', '--version', 'v1.2.3'), missing=False, outage=False):
+    def run_launcher(self, system='Darwin', machine='arm64', corrupt=False, arguments=('--install-dir', '/path with spaces/core', '--version', 'v1.2.3'), missing=False, outage=False, seed=None, interrupt=False):
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
             binary = b'#!/bin/sh\nprintf "%s\\n" "$@"\n'
@@ -18,24 +18,42 @@ def run_launcher(self, system='Darwin', machine='arm64', corrupt=False, argument
             scripts = {
                 'uname': '#!/bin/sh\nif [ "$1" = -s ]; then echo ' + system + '; else echo ' + machine + '; fi\n',
                 'curl': '''#!/usr/bin/env python3
-import pathlib,sys
+import os,pathlib,signal,sys,time
 args=sys.argv
 url=args[-1]; target=pathlib.Path(args[args.index('--output') + 1])
 asset=url.rsplit('/',1)[1]
+if INTERRUPT:
+    os.kill(os.getppid(), signal.SIGINT); time.sleep(0.2); sys.exit(2)
 if asset.endswith('.sha256'):
     target.write_text(DIGEST + '  ' + asset.removesuffix('.sha256') + '\\n')
+elif target.exists():
+    # Like curl --continue-at -: append the rest, or answer 416 when the file is already complete.
+    have = target.stat().st_size
+    with open(HERE + '/curl.log', 'a') as log: log.write(str(have) + '\\n')
+    if have >= len(BINARY):
+        sys.stdout.write('416'); sys.exit(22)
+    with open(target, 'ab') as out: out.write(BINARY[have:])
 else:
     target.write_bytes(BINARY)
 if OUTAGE: sys.exit(22)
 if MISSING:
     sys.stdout.write('404'); sys.exit(22)
-'''.replace('OUTAGE', repr(outage)).replace('MISSING', repr(missing)).replace('DIGEST', repr('0' * 64 if corrupt else digest)).replace('BINARY', repr(binary)),
+'''.replace('OUTAGE', repr(outage)).replace('MISSING', repr(missing)).replace('DIGEST', repr('0' * 64 if corrupt else digest)).replace('BINARY', repr(binary)).replace('INTERRUPT', repr(interrupt)).replace('HERE', repr(str(root))),
             }
             scripts['sleep'] = '#!/bin/sh\n'
             for name, contents in scripts.items():
                 (root / name).write_text(contents); (root / name).chmod(0o700)
-            return subprocess.run(['/bin/bash', str(SCRIPT), *arguments],
-                                  env={**os.environ, 'PATH': str(root) + os.pathsep + os.environ['PATH']}, capture_output=True, text=True)
+            cache = root / f'oac-install-{os.getuid()}'
+            if seed:
+                cache.mkdir(mode=0o700)
+                for name, contents in seed.items():
+                    (cache / name).write_bytes(contents)
+            result = subprocess.run(['/bin/bash', str(SCRIPT), *arguments],
+                                    env={**os.environ, 'TMPDIR': str(root), 'PATH': str(root) + os.pathsep + os.environ['PATH']}, capture_output=True, text=True)
+            result.cache = sorted(path.name for path in cache.iterdir()) if cache.exists() else []
+            log = root / 'curl.log'
+            result.resumed = [int(line) for line in log.read_text().split()] if log.exists() else []
+            return result
 
     def test_linux_and_mac_share_argument_forwarding(self):
         for system, machine in [('Linux', 'x86_64'), ('Linux', 'aarch64'), ('Darwin', 'arm64'), ('Darwin', 'x86_64')]:
@@ -52,7 +70,7 @@ def test_no_arguments_run_the_installer(self):
     def test_version_forms_and_dangling_version(self):
         for arguments in [('--version=v1.2.3',), ('--version', 'v1.2.3')]:
             self.assertEqual(self.run_launcher(arguments=arguments).returncode, 0)
-        result = self.run_launcher(arguments=('--upgrade', '--version'))
+        result = self.run_launcher(arguments=('--install-dir', '--version'))
         self.assertEqual(result.returncode, 1)
         self.assertIn('Missing release tag', result.stderr)
 
@@ -65,6 +83,41 @@ def test_download_failures_say_what_to_do(self):
         self.assertIn('Check the network', result.stderr)
         self.assertEqual(result.stdout, '')
 
+    def test_download_failures_print_each_retry(self):
+        result = self.run_launcher(outage=True)
+        self.assertEqual(result.stderr.count('Download interrupted; retrying'), 4)
+        self.assertIn('retrying (2/5)...', result.stderr)
+
+    def test_rerun_resumes_the_unfinished_download(self):
+        binary = b'#!/bin/sh\nprintf "%s\\n" "$@"\n'
+        name = 'oac-linux-amd64.' + hashlib.sha256(binary).hexdigest()
+        result = self.run_launcher('Linux', 'x86_64', seed={name: binary[:10], 'oac-linux-amd64.' + '1' * 64: b'old'})
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.resumed, [10])
+        self.assertEqual(result.cache, [])
+
+    def test_complete_cached_binary_runs_without_downloading_again(self):
+        binary = b'#!/bin/sh\nprintf "%s\\n" "$@"\n'
+        name = 'oac-linux-amd64.' + hashlib.sha256(binary).hexdigest()
+        result = self.run_launcher('Linux', 'x86_64', seed={name: binary})
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.resumed, [])
+        self.assertNotIn('curl', result.stderr)
+
+    def test_corrupt_cached_file_is_discarded(self):
+        binary = b'#!/bin/sh\nprintf "%s\\n" "$@"\n'
+        name = 'oac-linux-amd64.' + hashlib.sha256(binary).hexdigest()
+        result = self.run_launcher('Linux', 'x86_64', seed={name: b'x' * (len(binary) + 5)})
+        self.assertEqual(result.returncode, 1)
+        self.assertIn('checksum mismatch', result.stderr)
+        self.assertEqual(result.stdout, '')
+        self.assertNotIn(name, result.cache)
+
+    def test_interrupt_says_how_to_continue(self):
+        result = self.run_launcher(interrupt=True)
+        self.assertEqual(result.returncode, 130)
+        self.assertIn('Interrupted; rerun the installer to continue.', result.stderr)
+
     def test_corrupt_binary_is_never_executed(self):
         result = self.run_launcher(corrupt=True)
         self.assertNotEqual(result.returncode, 0)
diff --git a/deploy/test_install_source.py b/deploy/test_install_source.py
index e72afd2d2..af326e433 100644
--- a/deploy/test_install_source.py
+++ b/deploy/test_install_source.py
@@ -47,14 +47,14 @@ def docker(self, *args, **kwargs):
         reply = self.replies.get(key, (0, '127.0.0.1:19873' if key == 'port' else '', ''))
         return subprocess.CompletedProcess(args, reply[0], reply[1], reply[2])
 
-    def install(self, upgrade=False, image='sha256:' + '1' * 64, failure=None, port=19873):
+    def install(self, image='sha256:' + '1' * 64, failure=None, port=19873):
         def run(message, *args, **kwargs):
             self.calls.append((args, kwargs))
             if failure and failure in args:
                 raise ValueError(message)
         with patch.object(installer, 'ensure_docker_image', return_value=image) as load, patch.object(installer, 'run', side_effect=run), patch.object(installer, 'docker', side_effect=self.docker):
             self.load = load
-            installer.install(self.bundle, self.destination, '127.0.0.1', port, None if upgrade else f'http://127.0.0.1:{port}', upgrade)
+            installer.install(self.bundle, self.destination, '127.0.0.1', port, f'http://127.0.0.1:{port}')
 
     def main(self):
         """Run the command line and return its exit message."""
@@ -68,7 +68,7 @@ def commands(self):
         return [args[args.index('--project-directory') + 2:] if '--project-directory' in args else args[2:] for args, _ in self.calls]
 
     def snapshot(self):
-        return {name: (self.destination / name).read_bytes() for name in ('compose.yaml', 'compose.override.yaml', '.env', 'oac', 'node-payload/active.json')}
+        return {name: (self.destination / name).read_bytes() for name in ('compose.yaml', 'compose.override.yaml', '.env', 'oac', 'node-payload/manifest.json')}
 
     def test_complete_compose_preserves_secrets_and_serves_whole_payload(self):
         self.install()
@@ -84,8 +84,7 @@ def test_complete_compose_preserves_secrets_and_serves_whole_payload(self):
         self.assertTrue(mounts['/node-payload']['read_only'])
         self.assertEqual(services['init']['environment']['OAC_REVISION'], self.revision)
         self.assertEqual(services['web']['environment']['OAC_PUBLIC_URL'], 'http://127.0.0.1:19873')
-        self.assertEqual(json.loads((self.destination / 'node-payload/active.json').read_text()), {'source_commit': self.revision})
-        self.assertTrue((self.destination / 'node-payload/releases' / self.revision / 'node-install.pyz').is_file())
+        self.assertTrue((self.destination / 'node-payload/node-install.pyz').is_file())
         self.assertEqual(os.stat(self.destination / '.env').st_mode & 0o777, 0o600)
         self.assertIn('--pull', self.calls[-2][0])
         self.assertIn('never', self.calls[-2][0])
@@ -144,43 +143,36 @@ def test_same_release_reruns_init_before_the_configuration_check(self):
         with self.assertRaisesRegex(ValueError, '^Data volume check failed; no service was changed. See the output above.$'):
             self.install(failure='init')
 
-    def test_upgrade_checks_the_new_release_before_replacing_it_and_keeps_operator_entries(self):
+    def test_another_release_is_refused_and_a_rerun_keeps_operator_entries(self):
         self.install()
         override = json.loads((self.destination / 'compose.override.yaml').read_text())
         nfs = {'type': 'bind', 'source': '/srv/workspaces', 'target': '/srv/workspaces'}
         override['services']['core']['volumes'] = [nfs]
-        override['services']['core']['image'] = 'old'
         (self.destination / 'compose.override.yaml').write_text(json.dumps(override))
+        self.install()
+        services = json.loads((self.destination / 'compose.override.yaml').read_text())['services']
+        self.assertEqual(services['core']['volumes'], [nfs])
+        self.assertEqual(os.stat(self.destination / 'compose.override.yaml').st_mode & 0o777, 0o600)
         before = self.snapshot()
-        upgraded = 'b' * 40
-        self.manifest['source_commit'] = upgraded
+        self.manifest['source_commit'] = 'b' * 40
         (self.bundle / 'manifest.json').write_text(json.dumps(self.manifest))
         self.write_sums()
-        (self.bundle / 'oac').write_bytes(b'upgraded operator')
-
-        self.calls = []
-        with self.assertRaisesRegex(ValueError, 'rerun with --upgrade'):
+        with self.assertRaisesRegex(ValueError, 'To use this release, uninstall the installation'):
             self.install(image='sha256:' + '2' * 64)
         self.assertEqual(self.snapshot(), before)
-        with self.assertRaisesRegex(ValueError, '^Upgrade stopped; the running services are unchanged. Data volume check failed; see the output above.$'):
-            self.install(upgrade=True, image='sha256:' + '2' * 64, failure='init')
-        self.assertEqual(self.snapshot(), before)
 
-        self.calls = []
-        self.install(upgrade=True, image='sha256:' + '2' * 64)
-        self.assertEqual([command[-1] for command in self.commands()], ['check-config', 'init', '--remove-orphans'])
-        services = json.loads((self.destination / 'compose.override.yaml').read_text())['services']
-        self.assertEqual(services['core']['volumes'], [nfs])
-        self.assertEqual(os.stat(self.destination / 'compose.override.yaml').st_mode & 0o777, 0o600)
-        self.assertFalse([name for name, service in services.items() if 'image' in service])
-        self.assertEqual((self.destination / 'compose.yaml').read_text().count('sha256:' + '2' * 64), 4)
-        self.assertEqual([volume['target'] for volume in services['web']['volumes']], ['/node-payload'])
-        self.assertIn('OAC_REVISION: ' + upgraded, (self.destination / 'compose.yaml').read_text())
-        self.assertEqual((self.destination / 'oac').read_bytes(), b'upgraded operator')
-        self.assertEqual((self.destination / '.env').read_bytes(), before['.env'])
-        payload = self.destination / 'node-payload'
-        self.assertEqual(json.loads((payload / 'active.json').read_text()), {'source_commit': upgraded})
-        self.assertEqual(sorted(path.name for path in (payload / 'releases').iterdir()), [self.revision, upgraded])
+    def test_core_serves_the_bundled_native_installers_of_the_running_release(self):
+        native = self.bundle / 'native-installers'
+        native.mkdir()
+        (native / 'catalog.json').write_text('{}')
+        (native / 'linux-amd64.tar.gz').write_bytes(b'native')
+        self.install()
+        served = self.destination / 'native-installers' / self.revision
+        config = json.loads(subprocess.check_output(['docker', 'compose', 'config', '--format', 'json'], cwd=self.destination, text=True))
+        mount = {v['target']: v for v in config['services']['core']['volumes']}['/opt/oac/native-installers']
+        self.assertEqual((mount['type'], mount['source'], mount['read_only']), ('bind', str(served), True))
+        self.assertEqual((served / 'linux-amd64.tar.gz').read_bytes(), b'native')
+        self.assertEqual(os.stat(served / 'linux-amd64.tar.gz').st_mode & 0o777, 0o644)
 
     def test_thin_bundle_rejected_before_creating_installation(self):
         self.manifest['artifacts'] = {'native/bin/node': {'filename': 'missing'}}
diff --git a/docs.json b/docs.json
index 536edfd3a..04e0453b1 100644
--- a/docs.json
+++ b/docs.json
@@ -1,65 +1,111 @@
 {
   "navigation": {
-    "groups": [
+    "tabs": [
       {
-        "group": "Get started",
-        "pages": [
-          "docs/getting-started/index",
-          "docs/getting-started/install",
-          "docs/getting-started/quickstart",
-          "docs/examples"
+        "tab": "Docs",
+        "groups": [
+          {
+            "group": "Get started",
+            "pages": [
+              "docs/getting-started/index",
+              "docs/getting-started/install",
+              "docs/getting-started/quickstart"
+            ]
+          },
+          {
+            "group": "Operate",
+            "pages": [
+              "docs/getting-started/install-options",
+              "docs/getting-started/public-address",
+              "docs/web/index",
+              "docs/web/console-server",
+              "docs/getting-started/sandbox-backends",
+              "docs/getting-started/workspace-storage",
+              "docs/getting-started/nodes",
+              "docs/getting-started/operations",
+              "docs/getting-started/troubleshooting",
+              "docs/configuration"
+            ]
+          },
+          {
+            "group": "Concepts",
+            "pages": [
+              "docs/concepts",
+              "docs/architecture"
+            ]
+          }
         ]
       },
       {
-        "group": "Operate",
-        "pages": [
-          "docs/getting-started/install-options",
-          "docs/getting-started/nodes",
-          "docs/getting-started/self-hosted",
-          "docs/getting-started/operations",
-          "docs/configuration"
+        "tab": "API",
+        "groups": [
+          {
+            "group": "Build on the API",
+            "pages": [
+              "docs/api/index",
+              "docs/api/public-agent-api",
+              "docs/getting-started/self-hosted",
+              "docs/examples"
+            ]
+          },
+          {
+            "group": "Agents API reference",
+            "pages": [
+              "contracts/agents-api/index",
+              "contracts/agents-api/wire-semantics",
+              "contracts/agents-api/harness-capabilities",
+              "contracts/agents-api/sessions-events",
+              "contracts/agents-api/message-content",
+              "contracts/agents-api/execution-tools",
+              "contracts/agents-api/subagents",
+              "contracts/agents-api/environments",
+              "contracts/agents-api/environment-files",
+              "contracts/agents-api/source-files",
+              "contracts/agents-api/vaults"
+            ]
+          },
+          {
+            "group": "Core API reference",
+            "pages": [
+              "contracts/agents-api/admin-api",
+              "contracts/agents-api/core-errors",
+              "contracts/agents-api/sandbox-deployment",
+              "contracts/agents-api/environment-executor-credentials",
+              "contracts/agents-api/session-diagnostics",
+              "contracts/agents-api/core-metrics",
+              "contracts/agents-api/runtime-observability-api",
+              "contracts/agents-api/runtime-observability",
+              "contracts/agents-api/machine-api"
+            ]
+          }
         ]
       },
       {
-        "group": "API guides",
-        "pages": [
-          "docs/api/index",
-          "docs/api/public-agent-api",
-          "contracts/agents-api/admin-api",
-          "contracts/agents-api/machine-api",
-          "contracts/agents-api/harness-capabilities"
-        ]
-      },
-      {
-        "group": "Architecture and extensions",
-        "pages": [
-          "docs/concepts",
-          "docs/architecture",
-          "docs/runtime-protocol",
-          "docs/runtime-bootstrap",
-          "docs/sandbox-provider",
-          "contracts/agents-api/harness-onboarding",
-          "docs/development"
+        "tab": "Extend",
+        "groups": [
+          {
+            "group": "Protocols",
+            "pages": [
+              "docs/runtime-protocol",
+              "docs/runtime-bootstrap",
+              "contracts/agents-api/harness-onboarding",
+              "contracts/agents-api/harness-catalog",
+              "contracts/agents-api/model-execution",
+              "docs/sandbox-provider",
+              "contracts/agents-api/node-generation-protocol",
+              "docs/workspace-provider"
+            ]
+          },
+          {
+            "group": "Contribute",
+            "pages": [
+              "docs/development",
+              "docs/maintainers",
+              "docs/web/console-api-usage"
+            ]
+          }
         ]
       }
     ]
-  },
-  "redirects": [
-    {
-      "source": "/docs/getting-started/README",
-      "destination": "/docs/getting-started/index"
-    },
-    {
-      "source": "/docs/api/README",
-      "destination": "/docs/api/index"
-    },
-    {
-      "source": "/docs/web/README",
-      "destination": "/docs/web/index"
-    },
-    {
-      "source": "/contracts/agents-api/README",
-      "destination": "/contracts/agents-api/index"
-    }
-  ]
+  }
 }
diff --git a/docs/api/index.md b/docs/api/index.md
index 40eaaacae..fb3487b6b 100644
--- a/docs/api/index.md
+++ b/docs/api/index.md
@@ -2,7 +2,7 @@
 title: "API namespaces and credentials"
 ---
 
-Core serves three namespaces. Each has one kind of caller and its own credential, and a credential works only in its own namespace.
+Core serves three API namespaces, each for one kind of caller with its own credential: applications on `/v1`, administrators on `/core/v1`, and machines on `/api/v1`. A credential works only in its own namespace.
 
 | Namespace | Caller | Credential | Contents | Owner |
 | --- | --- | --- | --- | --- |
@@ -12,14 +12,8 @@ Core serves three namespaces. Each has one kind of caller and its own credential
 
 A credential used in another namespace gets 401: a Project API key on `/core/v1` or `/api/v1`, the Core key on `/v1` or `/api/v1`. How Projects and keys behave is in [Projects own assets](../concepts.md#projects-own-assets).
 
-**Routing.** Web forwards `/v1`, `/api/v1` and `/docs` to Core unchanged ([console server](../web/console-server.md)). A signed-in browser reaches `/core/v1` through Web, which adds the Core key. Operator scripts call `/core/v1` inside Core's network namespace on the Core host ([script the Core API](../getting-started/operations.md#script-the-core-api)).
+**Routing.** Web [forwards the API paths to Core](../web/console-server.md#request-boundary). A signed-in browser reaches `/core/v1` through Web, which adds the Core key. Operator scripts call `/core/v1` inside Core's network namespace on the Core host ([script the Core API](../getting-started/operations.md#script-the-core-api)).
 
-**API reference.** Core serves a read-only Swagger UI of the three namespaces at `/docs`, and the documents at `/docs/openapi.yaml`, `/docs/core.openapi.yaml` and `/docs/runtime.openapi.yaml`. No credential is required, and the page sends no API requests. Open it on the console origin, for example `http://localhost:8080/docs`. The browser loads Swagger UI from `unpkg.com`.
+## API reference
 
-## Machine connection API
-
-Nodes, Runtime daemons and the self-hosted installer call `/api/v1` with their own credentials. The [machine connection API](../../contracts/agents-api/machine-api.md) lists every route, caller and credential.
-
-Operator scripts configure independent filesystem storage through Core-key-authenticated `GET` and `PUT /core/v1/workspace-storage`; see [Workspace storage](../../contracts/agents-api/admin-api.md#workspace-storage).
-
-Web and operator scripts update the sandbox idle policy through Core-key-authenticated `PATCH /core/v1/sandbox/deployment`; see [Sandbox deployment](../../contracts/agents-api/sandbox-deployment.md).
+Core serves a read-only Swagger UI of the three namespaces at `/docs`, and the documents at `/docs/openapi.yaml`, `/docs/core.openapi.yaml` and `/docs/runtime.openapi.yaml`. No credential is required, and the page sends no API requests. Open it on the console origin, for example `http://localhost:8080/docs`. The browser loads Swagger UI from `unpkg.com`.
diff --git a/docs/api/public-agent-api.md b/docs/api/public-agent-api.md
index 9915f2ccc..229f06454 100644
--- a/docs/api/public-agent-api.md
+++ b/docs/api/public-agent-api.md
@@ -2,9 +2,7 @@
 title: "Agents API guide"
 ---
 
-Core serves the [OpenAI Agents API](https://platform.openai.com/docs/api-reference) at `/v1`. Use the official OpenAI SDK or plain HTTP. This guide shows both for every common operation, and notes where Core differs from OpenAI.
-
-New to the API? Run the [quickstart](../getting-started/quickstart.md) first.
+Core serves the OpenAI Agents API at `/v1`. This guide shows every common task with the official OpenAI SDK and with plain HTTP, and where Core differs from OpenAI. If you have not started a Session yet, begin with [Run your first Session](../getting-started/quickstart.md).
 
 ## Before you start
 
@@ -30,13 +28,13 @@ client = OpenAI()  # reads OPENAI_BASE_URL and OPENAI_API_KEY
 **HTTP.** Every request needs a Bearer key. Routes under `/agents` and `/vaults` also need `OpenAI-Beta: agents=v1`; `/files` and `/skills` do not. The SDK sets both. The HTTP examples below use this shell helper:
 
 ```sh
-oac() {  # oac PATH [curl options]: call /agents or /vaults with the required headers
+agents() {  # agents PATH [curl options]: call /agents or /vaults with the required headers
   curl -sS "$OPENAI_BASE_URL$1" \
     -H "Authorization: Bearer $OPENAI_API_KEY" \
     -H "OpenAI-Beta: agents=v1" \
     -H "Content-Type: application/json" "${@:2}"
 }
-oac /agents
+agents /agents
 ```
 
 On a shared host, `-H @<(printf 'Authorization: Bearer %s\n' "$OPENAI_API_KEY")` keeps the key out of the process list.
@@ -54,9 +52,9 @@ On a shared host, `-H @<(printf 'Authorization: Bearer %s\n' "$OPENAI_API_KEY")`
 | [Skills](#skills) | `/skills` | Versioned capability bundles |
 | [Environment Templates](#environment-templates) | `/agents/environments/templates` | Reusable workspace setup |
 | [Vaults](#vaults) | `/vaults` | Write-only credentials for MCP servers |
-| Subagents | `/agents/sessions/{id}/subagents` | Read-only child work; see [subagents](../../contracts/agents-api/subagents.md) |
+| Subagents | `/agents/sessions/{id}/subagents` | Read-only child work; see [Subagents](../../contracts/agents-api/subagents.md) |
 
-Core preserves the pinned SDK routes listed in [upstream-routes.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/upstream-routes.json). Configuration additions live in [`x_agents_core`](#core-extensions-x_agents_core). The Project-key [input receipt extension](../../contracts/agents-api/sessions-events.md#input-receipts) identifies the exact user Items admitted by a batch without changing the official events response.
+Core preserves the pinned SDK routes listed in [upstream-routes.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/upstream-routes.json). Configuration additions live in [`x_agents_core`](#core-extensions). The Project-key [input receipt extension](../../contracts/agents-api/sessions-events.md#input-receipts) identifies the exact user Items admitted by a batch without changing the official events response.
 
 ## Common tasks
 
@@ -67,7 +65,7 @@ Core preserves the pinned SDK routes listed in [upstream-routes.json](https://gi
 | Stop the current Turn, or recover after a lost response | [Cancel](#cancel), [idempotency](#idempotency) |
 | Call your own code from the agent | [Function tools](#function-tools) |
 | Give the agent Skills, packages, files and setup commands | [Skills](#skills), [Environment Templates](#environment-templates) |
-| Connect an MCP server with credentials | [Vaults](#vaults) and [execution tools](../../contracts/agents-api/execution-tools.md) |
+| Connect an MCP server with credentials | [Vaults](#vaults) and [Execution tools](../../contracts/agents-api/execution-tools.md) |
 | Use Skill or Plugin directories on your own machine | [Local capability directories](../getting-started/self-hosted.md#local-capability-directories) |
 | Put files in the workspace, or download what the agent wrote | [Files](#files) |
 | Read the conversation and tool results | [Turns and Items](#turns-and-items) |
@@ -91,15 +89,19 @@ Lists return:
 
 The SDK pages for you:
 
-```python
+::: code-group
+
+```python [Python]
 for session in client.beta.agents.sessions.list(limit=100):
     print(session.id, session.status)
 ```
 
-```sh
-oac "/agents/sessions?limit=100&after=$LAST_ID"
+```sh [curl]
+agents "/agents/sessions?limit=100&after=$LAST_ID"
 ```
 
+:::
+
 Two lists differ: `GET /files` returns up to 10,000 files at once, and workspace files use an opaque `page` token (see [Workspace files](#workspace-files)).
 
 ### Idempotency
@@ -136,17 +138,17 @@ See [creation retries](../../contracts/agents-api/wire-semantics.md#creation-ret
 
 Every response carries `X-Request-Id`; include it when reporting a problem.
 
-### Core extensions: `x_agents_core`
+### Core extensions: `x_agents_core` {#core-extensions}
 
 Core runs several Harnesses and accepts your own model access. Those settings are the only additions to the OpenAI shapes, and they sit inside `x_agents_core`:
 
 | Field | Where | Value |
 | --- | --- | --- |
 | `harness` | Agent, or a Session's inline `agent` | `codex`, `claude_sdk` or `mcode` |
-| `model_provider` | Agent, or Session creation (top level) | `protocol`, `base_url`, `api_key`, and for `mcode` also `context_window` and `max_output_tokens`. The protocol must be one of the Harness's native protocols |
-| `harness_config` | Agent, inline `agent`, or Session creation (top level, wins) | The Harness's native model parameters, such as Codex's `model_reasoning_effort` |
+| `model_provider` | Agent, or Session creation (top level) | `protocol`, `base_url`, `api_key`, and optionally `context_window` and `max_output_tokens`. The protocol must be one of the Harness's native protocols |
+| `harness_config` | Agent, inline `agent`, or Session creation (top level, wins) | The Harness's native model parameters, such as Claude Code's `thinking` |
 | `environment` | `openai_hosted` or `self_hosted` Session creation (top level) | Portable preparation: `environment_template_id`, `files`, `env`, `packages`, `setup_commands`, `skills`, `plugins`, `capability_directories`. A field may not also appear in `environment`; see [Environments](../../contracts/agents-api/environments.md#preparation-order) |
-| `installation` | Read-only, on `self_hosted` Sessions | Short-lived install commands for your machine; see [self-hosted execution](../getting-started/self-hosted.md) |
+| `installation` | Read-only, on `self_hosted` Sessions | Short-lived install commands for your machine; see [Run self-hosted Sessions](../getting-started/self-hosted.md) |
 
 Any other member is rejected with 400. `api_key` is write-only: reads return `api_key_configured`. `harness_config` replaces the whole object; `{}` clears it. With the SDK, pass these through `extra_body`.
 
@@ -158,13 +160,15 @@ The Harness is the agent program that runs a Session: Codex (`codex`), Claude Co
 - **Provider.** The Harness calls your provider directly, with one of the Harness's native protocols; there is no conversion, and a mismatch is rejected when the Session is created. [Model execution](../../contracts/agents-api/model-execution.md#saved-defaults-and-precedence) lists each Harness's protocols and which provider a Session uses on each Environment type. A Session freezes its provider at creation.
 - **Native parameters.** `harness_config` carries the Harness's own model settings; see [native model parameters](../../contracts/agents-api/model-execution.md#native-model-parameters).
 
-Not every combination of Harness, placement and operation is supported; the [Harness capabilities](../../contracts/agents-api/harness-capabilities.md) lists them.
+Not every combination of Harness, placement and operation is supported. [Harness capabilities](../../contracts/agents-api/harness-capabilities.md) lists them, including limits such as image input, usage reporting and public functions.
 
 ## Agents
 
 An Agent is saved configuration. Sessions copy it when they start, so editing an Agent affects only new Sessions.
 
-```python
+::: code-group
+
+```python [Python]
 agent = client.beta.agents.create(
     model="your-model-id",
     name="Reviewer",
@@ -173,8 +177,8 @@ agent = client.beta.agents.create(
 )
 ```
 
-```sh
-oac "/agents" -d '{
+```sh [curl]
+agents "/agents" -d '{
   "model": "your-model-id",
   "name": "Reviewer",
   "instructions": "Review code changes and report problems.",
@@ -182,6 +186,8 @@ oac "/agents" -d '{
 }'
 ```
 
+:::
+
 ```json
 {"id": "00000000-0000-4000-8000-000000000001", "object": "agent", "model": "your-model-id", "name": "Reviewer",
  "instructions": "...", "tools": [], "metadata": {}, "created_at": 1790000000,
@@ -200,7 +206,7 @@ oac "/agents" -d '{
 
 - **Update** changes only the fields you send. `metadata` replaces all pairs; `null` clears `name` or `instructions`.
 - **Delete** keeps existing Sessions.
-- **Tools** are functions, MCP servers, `tool_search` (Claude) and `web_search` with `mode: "disabled"`. Support depends on Harness and Environment; see [execution tools](../../contracts/agents-api/execution-tools.md).
+- **Tools** are functions, MCP servers, `tool_search` (Claude) and `web_search`. Support depends on Harness and Environment; see [Execution tools](../../contracts/agents-api/execution-tools.md).
 
 ## Sessions
 
@@ -208,7 +214,9 @@ A Session is one conversation with a fixed configuration and its own Environment
 
 ### Create a Session
 
-```python
+::: code-group
+
+```python [Python]
 session = client.beta.agents.sessions.create(
     environment={"type": "openai_hosted"},
     agent_id=agent.id,
@@ -217,8 +225,8 @@ session = client.beta.agents.sessions.create(
 )
 ```
 
-```sh
-oac "/agents/sessions" -H "Idempotency-Key: $(uuidgen)" -d '{
+```sh [curl]
+agents "/agents/sessions" -H "Idempotency-Key: $(uuidgen)" -d '{
   "environment": {"type": "openai_hosted"},
   "agent_id": "00000000-0000-4000-8000-000000000001",
   "input": "Review the files in /workspace and summarize the risks.",
@@ -226,6 +234,8 @@ oac "/agents/sessions" -H "Idempotency-Key: $(uuidgen)" -d '{
 }'
 ```
 
+:::
+
 Returns 201 with the Session:
 
 ```json
@@ -248,10 +258,10 @@ Returns 201 with the Session:
 | `environment.type` | Runs on | Notes |
 | --- | --- | --- |
 | `openai_hosted` | A sandbox Core creates on a node or E2B; the administrator provides the capacity | Optional `network`, `packages`, `files`, `skills`, `plugins`, `env`, `capability_directories`, `setup_commands`, or a template |
-| `self_hosted` | Your own Linux, macOS or Windows machine | Requires an absolute `workspace_directory`. Skills, packages, files or a template go in `x_agents_core.environment`. The response carries install commands in `x_agents_core.installation`; see [self-hosted execution](../getting-started/self-hosted.md). The Session brings its own `model_provider` |
+| `self_hosted` | Your own Linux, macOS or Windows machine | Requires an absolute `workspace_directory`. Skills, packages, files or a template go in `x_agents_core.environment`. The response carries install commands in `x_agents_core.installation`; see [Run self-hosted Sessions](../getting-started/self-hosted.md). The Session brings its own `model_provider` |
 | `none` | A device connection an operator registered, with no workspace | `input` required. The model comes from the installation default, or from the device when no default is configured |
 
-A new `openai_hosted` Session reads `idle` while Core prepares its sandbox; its first Turn starts when the Environment is ready. The [Environment contract](../../contracts/agents-api/environments.md) owns placement, expiry and preparation.
+A new `openai_hosted` Session reads `idle` while Core prepares its sandbox; its first Turn starts when the Environment is ready. [Environments and Templates](../../contracts/agents-api/environments.md) owns placement, expiry and preparation.
 
 ### Session status
 
@@ -279,7 +289,9 @@ All input goes to one endpoint as a list of events. It returns 202 after durable
 
 ### Send a message
 
-```python
+::: code-group
+
+```python [Python]
 client.beta.agents.sessions.events.create(
     session.id,
     events=[{
@@ -290,34 +302,42 @@ client.beta.agents.sessions.events.create(
 )
 ```
 
-```sh
-oac "/agents/sessions/$SESSION_ID/events" -H "Idempotency-Key: $KEY" -d '{
+```sh [curl]
+agents "/agents/sessions/$SESSION_ID/events" -H "Idempotency-Key: $KEY" -d '{
   "events": [{"type": "agent.session.input.message",
               "input": [{"role": "user", "content": [{"type": "input_text", "text": "Now fix the first risk."}]}]}]
 }'
 ```
 
+:::
+
 - **When idle,** a message starts a new Turn. **While a Turn runs,** it joins that Turn (steering); it does not start a parallel task.
-- **Content** is `input_text`, plus `input_image` as an inline PNG or JPEG data URI. Codex and Claude Code accept images; MiniMax Code rejects them. The whole request is limited to 1 MiB.
-- Full rules: [message content](../../contracts/agents-api/message-content.md).
+- **Content** is `input_text`, plus `input_image` with an `image_url`; the Harness decides which references it accepts. The whole request is limited to 1 MiB.
+- Full rules: [Message content](../../contracts/agents-api/message-content.md).
 
 ### Cancel
 
-```python
+::: code-group
+
+```python [Python]
 client.beta.agents.sessions.events.create(session.id, events=[{"type": "agent.session.input.cancel"}])
 ```
 
-```sh
-oac "/agents/sessions/$SESSION_ID/events" -d '{"events": [{"type": "agent.session.input.cancel"}]}'
+```sh [curl]
+agents "/agents/sessions/$SESSION_ID/events" -d '{"events": [{"type": "agent.session.input.cancel"}]}'
 ```
 
+:::
+
 The Turn is cancelled when it reaches `cancelled`, not when the request returns. A cancel while idle does nothing when no input is pending; a pending Environment input reservation returns 409. A self-hosted machine keeps its workspace and history when you restart the same installation; see [operate the installation](../getting-started/self-hosted.md#operate-the-installation).
 
 ## Stream events
 
 `GET /agents/sessions/{id}/events` is a server-sent event stream. It is **live only**: events sent while you were disconnected are not replayed. Open it before sending input, and recover gaps from [Turns and Items](#turns-and-items).
 
-```python
+::: code-group
+
+```python [Python]
 with client.beta.agents.sessions.events.stream(session.id) as stream:
     for event in stream:
         if event.type == "agent.session.turn.output_text.delta":
@@ -326,10 +346,12 @@ with client.beta.agents.sessions.events.stream(session.id) as stream:
             break
 ```
 
-```sh
-oac "/agents/sessions/$SESSION_ID/events" -N
+```sh [curl]
+agents "/agents/sessions/$SESSION_ID/events" -N
 ```
 
+:::
+
 ```text
 event: agent.session.turn.output_text.delta
 data: {"type": "agent.session.turn.output_text.delta", "item_id": "item_...", "delta": "Hello", ...}
@@ -355,7 +377,9 @@ The stream stays open across Turns. To stream one Turn and handle [function call
 
 A Turn is one piece of work started by input. Items are its recorded content: messages, reasoning, tool calls and their results. Both are durable; read them to check results or recover after a disconnect.
 
-```python
+::: code-group
+
+```python [Python]
 turns = client.beta.agents.sessions.turns.list(session.id, order="desc")
 latest = turns.data[0]
 print(latest.status, latest.usage)
@@ -363,18 +387,20 @@ for item in client.beta.agents.sessions.items.list(session.id, order="asc"):
     print(item.type)
 ```
 
-```sh
-oac "/agents/sessions/$SESSION_ID/turns?order=desc&limit=1"
-oac "/agents/sessions/$SESSION_ID/items?order=asc"
+```sh [curl]
+agents "/agents/sessions/$SESSION_ID/turns?order=desc&limit=1"
+agents "/agents/sessions/$SESSION_ID/items?order=asc"
 ```
 
+:::
+
 | Turn `status` | Meaning |
 | --- | --- |
 | `queued`, `in_progress` | Not finished |
 | `waiting` | Waiting for a function result |
 | `completed`, `failed`, `cancelled` | Finished |
 
-- **Usage** (`input_tokens`, `output_tokens`, `total_tokens`, …) is null when unknown, never zero. A Session's usage stays null while a Turn runs; Claude Code and MiniMax Code report none ([usage rules](../../contracts/agents-api/sessions-events.md#usage)).
+- **Usage** (`input_tokens`, `output_tokens`, `total_tokens`, …) is null when unknown, never zero. A Session's usage stays null while a Turn runs ([usage rules](../../contracts/agents-api/sessions-events.md#usage)).
 - Turn lists contain top-level Turns only. Read child work under `/subagents`.
 
 ## Function tools
@@ -409,13 +435,13 @@ with client.beta.agents.sessions.stream(
 Without the helper, read the call from `session.required_actions`, then send:
 
 ```sh
-oac "/agents/sessions/$SESSION_ID/events" -d '{
+agents "/agents/sessions/$SESSION_ID/events" -d '{
   "events": [{"type": "agent.session.input.tool_result",
               "turn_id": "turn_...", "call_id": "call_...", "success": true, "output": "Sunny in Paris"}]
 }'
 ```
 
-Resending the same result is safe. A different result for the same call, or one sent after cancellation, fails with 409. MiniMax Code doesn't support public functions.
+Resending the same result is safe. A different result for the same call, or one sent after cancellation, fails with 409.
 
 ## Files
 
@@ -429,32 +455,40 @@ Three kinds of file serve different purposes:
 
 ### Source Files
 
-```python
+::: code-group
+
+```python [Python]
 f = client.files.create(file=open("data.csv", "rb"), purpose="user_data")
 ```
 
-```sh
+```sh [curl]
 curl "$OPENAI_BASE_URL/files" -H "Authorization: Bearer $OPENAI_API_KEY" \
   -F purpose=user_data -F file=@data.csv
 ```
 
+:::
+
 Only `purpose=user_data` is accepted, up to 512 MiB. No Beta header. Their content cannot be downloaded again; use the ID in workspace files or templates.
 
 ### Workspace files
 
 Copy a file into the workspace of the Session's Environment (`session.environment.id`):
 
-```python
+::: code-group
+
+```python [Python]
 env_id = session.environment.id
 client.beta.agents.environments.files.create(env_id, type="file_id", file_id=f.id, path="/workspace/data.csv")
 client.beta.agents.environments.files.create(env_id, type="inline", data="aGVsbG8K", path="/workspace/hello.txt")
 page = client.beta.agents.environments.files.list(env_id, path="/workspace")
 ```
 
-```sh
-oac "/agents/environments/$ENV_ID/files" -d '{"type": "file_id", "file_id": "file-...", "path": "/workspace/data.csv"}'
+```sh [curl]
+agents "/agents/environments/$ENV_ID/files" -d '{"type": "file_id", "file_id": "file-...", "path": "/workspace/data.csv"}'
 ```
 
+:::
+
 - `inline` data is base64, up to 5 MiB decoded; `file_id` up to 50 MiB.
 - Parent directories are created. An existing file is never overwritten (400).
 - The list shows regular files in one directory, not recursively. It pages with a `page` token and returns `next`.
@@ -463,32 +497,40 @@ oac "/agents/environments/$ENV_ID/files" -d '{"type": "file_id", "file_id": "fil
 
 When a Turn completes, Core captures the regular files under the workspace's `outputs/` directory. Artifacts stay readable after the Environment is gone.
 
-```python
+::: code-group
+
+```python [Python]
 for a in client.beta.agents.sessions.artifacts.list(session.id):
     data = client.beta.agents.sessions.artifacts.content(a.id, session_id=session.id)
     data.write_to_file(a.path.rsplit("/", 1)[-1])
 ```
 
-```sh
-oac "/agents/sessions/$SESSION_ID/artifacts"
-oac "/agents/sessions/$SESSION_ID/artifacts/$ARTIFACT_ID/content" -o report.md
+```sh [curl]
+agents "/agents/sessions/$SESSION_ID/artifacts"
+agents "/agents/sessions/$SESSION_ID/artifacts/$ARTIFACT_ID/content" -o report.md
 ```
 
+:::
+
 Each Artifact has `path`, `size_bytes`, `turn_id` and `environment_id`. Deleting one leaves the workspace file alone.
 
 ## Skills
 
 A Skill is a versioned bundle of instructions and files an agent can use. Upload a directory or a ZIP; each upload is a version.
 
-```sh
-curl "$OPENAI_BASE_URL/skills" -H "Authorization: Bearer $OPENAI_API_KEY" -F files=@my-skill.zip
-```
+::: code-group
 
-```python
+```python [Python]
 skill = client.skills.create(files=[("my-skill/SKILL.md", open("my-skill/SKILL.md", "rb"))])
 client.skills.versions.create(skill.id, files=[...], default=True)
 ```
 
+```sh [curl]
+curl "$OPENAI_BASE_URL/skills" -H "Authorization: Bearer $OPENAI_API_KEY" -F files=@my-skill.zip
+```
+
+:::
+
 - No Beta header. Select up to 50 Skills per Environment; each archive is at most 5 MiB compressed and 20 MiB expanded.
 - SDK 3.13.0 drops a single ZIP file from the upload; use HTTP for a ZIP.
 - Attach Skills to a Session through its `environment.skills` or a [template](#environment-templates).
@@ -529,17 +571,17 @@ client.beta.agents.vaults.credentials.create(
 session = client.beta.agents.sessions.create(environment={"type": "none"}, input="...", vault_ids=[vault.id], agent_id=agent.id)
 ```
 
-The HTTP path is `/vaults`, with the Beta header. A Session selects credentials from its `vault_ids`, optionally by `credential_id`; the MCP server's URL must match the selected credential's `mcp_server_url` exactly in either case. The [Vaults contract](../../contracts/agents-api/vaults.md) owns selection, errors, OAuth refresh and deletion. An MCP tool's `connection_origin` decides whether Core's side or the workspace connects to the server, and each Harness supports a different set: see [MCP connection origin](../../contracts/agents-api/environments.md#public-mcp-connection-origin).
+The HTTP path is `/vaults`, with the Beta header. A Session selects credentials from its `vault_ids`, optionally by `credential_id`; the MCP server's URL must match the selected credential's `mcp_server_url` exactly in either case. [Vaults and Credentials](../../contracts/agents-api/vaults.md) owns selection, errors, OAuth refresh and deletion. An MCP tool's `connection_origin` decides whether Core's side or the workspace connects to the server, and each Harness supports a different set: see [MCP connection origin](../../contracts/agents-api/environments.md#public-mcp-connection-origin).
 
 ## Diagnose a failure
 
 1. Read the Session's `status` and `error`, and the latest Turn's `error`. A failed Turn reports only a generic `internal_error`.
 2. Check that the Environment is connected and its harness is available.
 3. Check the harness, model and tool combination in [Harness capabilities](../../contracts/agents-api/harness-capabilities.md).
-4. Read the Session's [Project diagnostics extension](../../contracts/agents-api/session-diagnostics.md#project-diagnostics-extension) for its safe failure category; ask the administrator to check [troubleshooting](../getting-started/operations.md#troubleshooting) for service logs, credentials and node readiness.
+4. Read the Session's [Project diagnostics extension](../../contracts/agents-api/session-diagnostics.md#project-diagnostics-extension) for its safe failure category; ask the administrator to check [troubleshooting](../getting-started/troubleshooting.md) for service logs, credentials and node readiness.
 
 A 401 usually means a key from another namespace; see [API namespaces and credentials](./index.md).
 
 ## Differences from OpenAI
 
-Core differs from the OpenAI service in some behavior, such as Session creation idempotency and Harness-specific tool support. The [coverage ledger](../../contracts/agents-api/index.md#differences-from-openai) lists every difference and the per-resource status; the [public OpenAPI](../../contracts/agents-api/openapi.yaml) has the exact schemas.
+Core differs from the OpenAI service in some behavior, such as Session creation idempotency and Harness-specific tool support. The [OpenAI compatibility](../../contracts/agents-api/index.md#differences-from-openai) lists every difference and the per-resource status; the [public OpenAPI](../../contracts/agents-api/openapi.yaml) has the exact schemas.
diff --git a/docs/architecture.md b/docs/architecture.md
index 8047b305e..6ffe2f5b4 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -4,44 +4,32 @@ title: "Architecture"
 
 OpenAgentCore is an Agent execution platform that brings Harnesses, models, tools, Sessions and execution environments together through replaceable protocol implementations. It separates orchestration, compute and native execution. Core owns the API and durable state. Sandbox Providers manage compute. Independent workspace filesystem adapters manage durable Environment storage through a separate protocol. A Runtime daemon prepares an Environment and runs the selected Harness, whose native SDK or protocol owns the model and tool loop.
 
-The recommended self-managed deployment is microsandbox with independent persistent workspace storage, currently provided by the kernel NFS adapter. E2B is the managed-compute alternative. Both use the same Core orchestration and capability checks. Docker remains an available Provider. Compute and filesystem adapters declare their supported combinations; a deployment choice does not introduce a separate Agent execution flow. See [Sandbox Providers](./sandbox-provider.md) and [workspace filesystem providers](./workspace-provider.md) for their contracts and supported capabilities.
+The recommended self-managed deployment is microsandbox with kernel NFS workspace storage. E2B supplies managed compute. Docker runs on nodes without checkpoint or external storage. All use the same Core orchestration and capability checks. Compute and filesystem adapters declare their supported combinations; a deployment choice does not introduce a separate Agent execution flow. The [Sandbox Provider protocol](./sandbox-provider.md) and the [Workspace filesystem protocol](./workspace-provider.md) define their contracts and supported capabilities.
 
 ```mermaid
 flowchart TB
-    App["Application / official SDK"] <-->|"Agents API /v1: HTTP and SSE"| Core
-    Web["Web administrator console"] <-->|"Core API /core/v1"| Core
-    Core["Core: authorization, configuration snapshots,<br/>orchestration and durable state"]
-    Core --- DB[("PostgreSQL")]
-    Core -->|"Sandbox Provider protocol"| SP["Sandbox Provider:<br/>microsandbox / E2B / Docker"]
-    Core -->|"Workspace filesystem protocol"| FS["Workspace filesystem adapter: NFS"]
-    SP -->|"Resolve external attachment"| FS
-    FS -->|"Own durable storage"| Store[("Independent Environment storage")]
-    SP -.->|"Provision compute and bootstrap Runtime"| R
-    User["User-machine installer"] -.->|"Start Runtime"| R
-    Core <-->|"Core–Runtime protocol:<br/>preparation, execution, events and receipts"| R
-    subgraph Env["Environment: managed sandbox or user-owned machine"]
-        R["Runtime daemon"] --> P["Workspace and capability preparation"]
-        P -->|"Harness protocol"| A["Harness adapter"]
-        A <-->|"Native SDK or protocol"| H["Native Harness: model and tool loop"]
-        H <--> F["Workspace, tools and artifacts"]
-    end
-    F <-->|"Mount when the combination supports external storage"| Store
-    H <-->|"Model API"| Model["Model provider"]
-    H <-->|"MCP"| MCP["Local or remote MCP servers"]
+    App["Application"] -->|"Application–Core"| Core
+    Web["Web"] -->|"Web–Core"| Core
+    Core[("Core + PostgreSQL")]
+    Core -->|"Core–Sandbox Provider"| SP["Sandbox Provider"]
+    Core -->|"Workspace filesystem"| FS["Workspace storage"]
+    SP -->|"Provider–Runtime"| Env
+    Core <-->|"Core–Runtime"| Env["Environment:<br/>Runtime + Harness"]
+    Env -->|"Harness–Model provider"| Model["Model provider"]
 ```
 
-Dashed arrows show provisioning and installation. Solid arrows show component interactions, including in-process interfaces. The daemon initiates its authenticated WebSocket connection to Core. The [API index](./api/index.md) describes the application, operator and machine namespaces; [protocol boundaries](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#protocols-at-every-boundary) lists each protocol's code and owning document.
+The Runtime daemon initiates its authenticated WebSocket connection to Core. [API namespaces and credentials](./api/index.md) describes the application, operator and machine namespaces; [protocol boundaries](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#protocols-at-every-boundary) lists each protocol's code and owning document.
 
 ## Component responsibilities
 
 | Component | Responsibility | Reference |
 | --- | --- | --- |
 | Core | Authenticate callers, resolve and freeze configuration, schedule Turns, handle cancellation and pending interactions, persist resources and execution facts in PostgreSQL | [Core service](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/README.md) |
-| Sandbox Provider | Create, observe, renew and reclaim compute; supply Runtime startup input | [Sandbox Provider](./sandbox-provider.md), [Runtime bootstrap](./runtime-bootstrap.md) |
-| Workspace filesystem adapter | Create, observe and delete durable Environment storage; validate and resolve its compute attachment | [Workspace filesystem providers](./workspace-provider.md) |
+| Sandbox Provider | Create, observe, renew and reclaim compute; supply Runtime startup input | [Sandbox Provider protocol](./sandbox-provider.md), [Runtime bootstrap](./runtime-bootstrap.md) |
+| Workspace filesystem adapter | Create, observe and delete durable Environment storage; validate and resolve its compute attachment | [Workspace filesystem protocol](./workspace-provider.md) |
 | Sandbox node | Operate a Docker or microsandbox host and reconcile its assigned generation and allocations | [Sandbox node protocol](../contracts/agents-api/node-generation-protocol.md) |
 | Runtime | Prepare the workspace and capabilities, manage Session Executors, execute Turns and report events and receipts | [Core–Runtime protocol](./runtime-protocol.md) |
-| Harness adapter | Validate native configuration, invoke the upstream SDK or protocol, translate events and confirm native cleanup | [Harness onboarding](../contracts/agents-api/harness-onboarding.md) |
+| Harness adapter | Validate native configuration, invoke the upstream SDK or protocol, translate events and confirm native cleanup | [Harness protocol](../contracts/agents-api/harness-onboarding.md) |
 | Model provider | Serve the model protocol selected for the Harness | [Model execution](../contracts/agents-api/model-execution.md) |
 | Web | Let administrators configure and observe the installation through a server-side Core API connection | [Console server](./web/console-server.md) |
 
@@ -51,9 +39,34 @@ The [repository map](./development.md#repository-map) locates these components.
 
 ## A Session, end to end
 
-An application creates a Session through the Agents API. Core resolves its configuration and execution location. A managed Session obtains compute through the selected Sandbox Provider; a self-hosted Session waits for the user to run its installation command. A Session with `environment: none` uses a connected execution device without a workspace. The [application guide](./api/public-agent-api.md#create-a-session) describes these choices.
+An application creates a Session through the Agents API, and Core resolves its configuration and execution location. A managed Session obtains compute from the selected Sandbox Provider. A self-hosted Session waits for the user to run its installation command, which starts the Runtime in place of steps 2 and 3. A Session with `environment: none` uses a connected execution device without a workspace. The [application guide](./api/public-agent-api.md#create-a-session) describes these choices.
 
-After the daemon connects, Core checks the available Harness and requested capabilities. The Runtime prepares a workspace Environment and its capability snapshot, then prepares or reuses the Session Executor. Each Turn runs through the native Harness. Core persists the output, tool interactions and receipts for application reads and events. Completion or cancellation settles the Turn; a healthy Executor can serve the next Turn in the same Environment.
+```mermaid
+%%{init: {"sequence": {"actorMargin": 16, "width": 100}}}%%
+sequenceDiagram
+    autonumber
+    participant App as Application
+    participant Core
+    participant P as Sandbox Provider
+    participant R as Runtime
+    participant H as Harness
+    App->>Core: Create Session
+    Core->>P: Create(Bootstrap)
+    P->>R: Start Runtime
+    R->>Core: Connect, heartbeat
+    Core->>R: runtime_prepare
+    R-->>Core: prepare result
+    App->>Core: Send input
+    Core->>R: execution_prepare
+    R-->>Core: status ready
+    Core->>R: execution_start
+    R->>H: Run the Turn
+    H-->>R: Native events
+    R-->>Core: delta, tool_call, done
+    Core-->>App: Stream events
+```
+
+After the daemon connects, Core checks the available Harness and requested capabilities. The Runtime prepares a workspace Environment and its capability snapshot, then prepares or reuses the Session Executor. Core persists the output, tool interactions and receipts for application reads and events. Completion or cancellation settles the Turn; a healthy Executor can serve the next Turn in the same Environment.
 
 For checkpoint-capable compute, Core automatically suspends idle work and releases active compute capacity after confirmed capture and source stop. New work restores retained memory on an eligible compatible node; independent workspace storage stays attached to the same Environment identity. The [checkpoint lifecycle](./sandbox-provider.md#suspension) owns idle admission, wake and retention, and [checkpoint transfer](./sandbox-provider.md#checkpoint-transfer) defines the shared-store and compatibility requirements. An unreachable node alone never authorizes a replacement writer.
 
diff --git a/docs/assets/architecture-api-surfaces.png b/docs/assets/architecture-api-surfaces.png
deleted file mode 100644
index a4b997d21..000000000
Binary files a/docs/assets/architecture-api-surfaces.png and /dev/null differ
diff --git a/docs/assets/architecture-dark.svg b/docs/assets/architecture-dark.svg
new file mode 100644
index 000000000..7e9346edb
--- /dev/null
+++ b/docs/assets/architecture-dark.svg
@@ -0,0 +1,17 @@
+<!-- Generated by scripts/generate-architecture-diagram.py; edit that script and run it again. -->
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1560 1270" width="1560" height="1270" role="img" aria-labelledby="title"><title id="title">OpenAgentCore deployment and protocol boundaries</title><style>.canvas{fill:#111712}
+.region{stroke-width:1.2}
+.control{fill:#17201a;stroke:#3f5f4a}.control+g .band{fill:#1c2920}
+.compute{fill:#131d1c;stroke:#386058}.compute+g .band{fill:#182725}
+.sandbox{fill:#162521;stroke:#4f8574}.sandbox+g .band{fill:#1b302a}
+.managed{fill:#1f1d13;stroke:#b0924c;stroke-dasharray:6 5}.managed+g .band{fill:#2a271a}
+.user{fill:#181f14;stroke:#6c7f4c}.user+g .band{fill:#1f2919}
+.storage{fill:#1c1c17;stroke:#6e6852}.storage+g .band{fill:#25241d}
+.external{fill:#161a19;stroke:#4c5651}.external+g .band{fill:#1d2321}
+.sep{stroke:rgba(232,241,235,.08);stroke-width:1}
+.card{fill:#1c2520;stroke:#33433a;stroke-width:1}
+.rt,.t1{fill:#e8f1eb}.rs,.t2,.lg{fill:#94a59b}
+.pill rect{fill:#4ade80}.pl{fill:#04210f}
+.line{fill:none;stroke:#8fa598;stroke-width:1.4}.dash{stroke-dasharray:6 5}
+.arrow,.dot{fill:#8fa598}
+text{text-rendering:geometricPrecision;font-kerning:normal}@font-face{font-family:"OAC Plex";font-weight:400;src:url(data:font/woff;base64,d09GRgABAAAAAFZYAA8AAAAAtIwAAQABAAAAAAAAAAAAAAAAAAAAAAAAAABHREVGAAABWAAAADEAAAA0A+gEL0dQT1MAAAGMAAAi3wAAW8iuClg1R1NVQgAAJGwAAAFYAAACYr/7r01PUy8yAAAlxAAAAFoAAABgarIHYFNUQVQAACYgAAAASwAAAF5fvkM5Y21hcAAAJmwAAAGzAAACfHO4jI5nYXNwAAAoIAAAAAwAAAAMAAkAG2dseWYAACgsAAAl/wAARGLlTIrjaGVhZAAATiwAAAA2AAAANhywjf5oaGVhAABOZAAAACEAAAAkB9kH+WhtdHgAAE6IAAACMwAABDgOoTU0bG9jYQAAULwAAAIFAAACHux72jZtYXhwAABSxAAAABwAAAAgAR4A0m5hbWUAAFLgAAABCgAAAkAy4102cG9zdAAAU+wAAAJsAAAEbROuFbN42g3BsRGAIBQFsLzPaeU8zqjzeE7BNrQ0kAguQDnFLZ69vD7x62KYWiqHtgBvbQYaAAAAeNqckgOUJUkURG9kfcxM27221dbatm3btm3btm3btsa234m1UffkrXjpDwT0YRNuILfMcquswzJbH7jXLnRsv9e2OzP3LlvusxvTkgOYMoWEIv9SZb+p+E2VIud33nav3VjGXsRusufedcu9dmZmwLPAe8k7ZIBIuO/nNxQ2qt/wlJJrcq+kbSinNyB6IZ8Y79SkM5AGU0qPDtMB2ivaLsF22kIbaR2tphW0lBZRh5o0r2bXjGpUtUpVECownpEMpi9f8Qnv8QYv8UxUj9FXBR7gLm6JGddFviK4SHtxTnAaJ3CU4BD6sh9KLekhpI6w0urOX6Tpw9OHxaHOl9nzePQxe017Rntme1Z7S/u8sDjeeUm76J4XnLeyt7YXsJvstexWe6mw6Os7jLcnh6UjnEc7T+s82P7YPVV2m91oz2zf9+Nn+SZ8uPfv4/5auyEsJoYTFejn/0SiEGT0ok9U5dRRpIGOmHM6Z7AQ5wXNXBy0cGXQytVBG3dxN+3cG3TydNDFs0E3ZcAi/6J1/KYJ/F3g+2UMZwwwjgkUlJSn95/8q9ZKhJejlF00WH31lT7Re3pDL+kZPaYHdJduiXSdrtBFOken6QQdpUO0n/bQTtpGm0XbQGtpFS2nJdSjNi2ouTVrVNOrPtZVqk+M57QNk5mswcYwNs5540ceM4FPMgyPNlCn/ch+wU7G8B1fxL4mzjU+9Wf4KE42TEapBZA67PfsL+zp7cvseezH7DXtGe1lCHOC85b2efa89hqE+dJ+wT1b2ZsQ5kTnJnstu9VeijB9nb0zk52PcB7tXO/8rj3UPtz9jfZ9hLnGeXbnQ51ncr7IeTq7yq612+wGwowCEiWIItAnUpEyquhNLfNTzoJ0MBcncjpNnMlFdHIJV7Mk13EXK3Ivz7Iez/My2yOgYIOCsfSmF1n+Hh1FKSIBvcJnkANV8hi9gj99plz328p+aMpD/M8nVuL3wGgfeK9IzokiS7MssDwrkLFSkGcV1qfAZkE1WwQ17Mne1JIo82zh2awY5LwmY+UgxyqsSmK1IM/qQYE1gjxrBgXWYm0y75V4JSiSqPBeybskr5fXF7y+6PUFry96fWKdIMe6QZ71ghzrB3nfN/N9fQb6+VsXq5ADZsmGmv7B0OCF7Krsgmy/YJtstawpmzWNTG+lO9J5aZU0rd7RY7pER2kXraUmVfMOD3EEials1DV22FAQheEJM6fOdmIGqUsq41bCG0qdzszM1IbNlr8zZjg6v2akofue4H4qjiPFqfIWdaUJ7+I9le2OB9EZ3d6nvli0Z09VxFENCpSYrHZjip3GDH+Wnau2Yp6/UO2p9EbJ+hXTJ1HMu15k7Vu1HDWoQ4ESE6Ke8Lm+GzGres4Tn49b+qqu/lM56TwN0dO+C+yizPsZzXpcyOAvsnTxjjJe0yaqYtG9Ozl/+rRGfq7jrd2oQR0KlJBpVmqmPWdhTs083TmLPeso43TWC+v/ETWoQ4ESnSJd6LWKfhUDsgcxxB9mR+zvKH/M/o67fqxLf9SgDgVKdIp0oZ+yQdkj/FH+OPtSxfeoQR0KlOgU7UKvb6qP7Zc5oDJnW8Mwf4Sm0bhltk403o1+50GIZn//ORH7n5GsRdaymcEfZ+/T+DC6YJXHma+tUJbKcfceXbsyukw83gvYi1zVLf2eRRdkeDtyDZRkXqrbOJ7teZx2oe505u1osv/NaEErvEVypzGjUz5Zdt51vmf5522vPvoPRDyg9lvUoA5N8Saa0YJWFO6VOCTNHIAkWYIwXIvem+udvVnbxmnxbNu2X+DZNgIPgWfbts2zbdvW9n2R01Fd3bs9e6iMf8tZWZlZWb01EaKPUoeDI8Dx4ARwA7gR3CSR91znZc7bec437OFvpByuRoHRlMeQj8XPxpGPx2ZyTtDgFBD33qVGxNhXIgZfj0LROEk5jS/ElfE6u/sefKqeV3dCN6trmVko8eFYiWUnqpMlal2Obq9E0huRchj6G4HNRqG7Mdh8BnNmsD73nJzM7j3SgoMFdef1ybo/EjIb24JR8Le6HUHMh88J4AZwI7gJJKEfS3T6LmsMd5AbyL12xN6Zh5v3WvR69KX6PB3dyL1ZG3IPTQzUx6jEyZZRqyTapThr9LxBzips5fH5zdmKXDGlyNfH55Es3TtcD4341ufs4MXGPQlWuatuU2kBaWVF+IMuPTrBLyTJPkSuYJuuzZadGnzBelrjtdVGnis9erZvdfRMbntyct+jL7jJCHPPrMaqnOnu+aAfV5cGH2hzT3ywVZgW1ge0ZgG9L78EIJhYxShvUruUWLnnxOo9jvg7UOfWTDAazwrpGc6tZNYHoeNVYVKg5/UyZzYYhG/TAiaKtyyQ+mJnPT1EX8h2/sZq66V3KaOAjJ6ID5ULf8AIT/twAev1alsZi8c5g1SKT4558RwujXLmYqy11LQS8q3X+tZ1twxX2aO2aLjvIGPQZuwrQdQI6XNjA7leKSWER66es1ngjxsz4zmz2QcYbVpJxw1LwxYeFogRV5ij5dHeTxyVndOSIfVUdxfp8k0lMkFaewG/W673tN7Z7Pwm+RZok7NB1tGeRL4q1EOni368+mRnW6hHw5U+iU+skeM4zlwtw7fiX2bcmE9sLdLRLFP3zAf8ZyNRein4TcrDkZu7AY1NFH9eBz6npwAfi1FiB/BnnPwVwFf0Qx+Qe0B2TA4fNxdfpBSjJcYMHWdML3X5MA4MD3hWrq+ONIbHYOcu/iw7hjMrws21ACdyjM+3P3dlWQXN5jzFEt+I3jmFO3YOxDXGSGzWWjZ2jucI0vw9AldesFDLvsF/KuiVXMcNRvj5aN9e4XTKPZRr6iOgvUY9c23Ce3Ce7x5c1c09SKvk1DxezlT8YJXmyb6Is4lvA4mFXtloxcsCEahctNVVx8QfmWtzEheIPnSvGyF7UV4E8ERV7nwur2cWXu6Xp43XBsYI7DB7efd9qNfgtYm/E7re7xAjevxO0OuH1BMk/GMjmo7pM6rIR4IxoBOsh2ZqnTBCZWjZpVek0lF65299/9cDloLIxYcAEJ8a5MURiQlojJyS930KZtOyhrZdTz4L96xn1jIjjQXCTlku2H17jXHWg79ZU2sTzra2CLe5vqFs1UffWiKp38cAfOI97rcFOvS+1uFSZOwTfQftx22Z777f8uZMHlEFrFcE5akSVUZvhaqiVgOVqjrVSFsLVKX68QZdrdqhBl6d96SHFy3VzP9sZ9F3IXSgvCEdJG9IB/Pm+RYj3uGN+iLe+37hP7zfePW7TV797kWGJHKLL4FMSimgQGVBmeigjL/8hgElIWcKebYqlHfGIhBFzlTZib7/2UW5sUMg9sthh+gIpKviMPtwOiDyfKhUkAdVs38grZXsHgTmVQgSpzyhHU1YwkfoBQihA9ulMtGLQcwjMroUhVJ9lOxbI+ISOvIR/uBSumsb2tBAlntGsqF0kaIWXaZDafTa6CUHe5DQG7pES0nkMaRMcXUfwYvqXS2kCsqxbz6ysmMQTaDFPkLYHaoRFELNqkVAK17YJDBTg6CnVCi0o6m3T1sWeknTdrLpFaKEXgyyRIemp5l2S5H4gqZc0rbx2S/FtK5+N+A3AtHmBx0Pdtzckd3+dfuJrVtb34Qub923tXLg4IGXt0IDkzuyB6wc8OiAvfuP77i53+39qvvWtgxuOb95eXNl0/Smp5vObfi64d6GvRvs+rfrj63bWnstKKz5tObgmv5Vx1cOrzi6fHr59WVflh1c1ga1ldaWZkMRECnZDM0s+RP8ST275OeSLwVvF/9YfHpxc+HIwlcLH2cM1LovcmpqP7H968J6/goNWNm6b8HCgk9b96WExB61n5i3siOb/Qkh92Dk1tR0bnwHcWIPQnVbPWo6N/fEmv5xKp+ec3X2l1lrMydnNsbKM1ZGH02faD/Z+/PI5MjAXsemPW7dmDoxhTfspE/RcIaOkTXkREGs2ELMq+cXjLP5vjiXX4SPlffqE9TV6hp1osS8k4l5X6nTJNrdR7QbQp13bLWdlruMruPIEjjek9FTYgcUmSLZgQ8+8YLXAcMyhZlpmXmdZfq0nxOzLSksdsiycNkMcsgnaJJjydYZBi14YXhG+zv39Sm995Q8Zej4/H27q7urbt26dQv6tVpEQ71Cvt7voYBanCtGnyfez0K987mY73iBiN2IRbjM+ZWi/NXuvca6+Vrny8kVk2PZStdXmQX9qOcec/1xZazBWqzDemzARmxyz2ZsQROa0YJWtKEdHehEF7qxVZ7blNGD7crtRR/6MYBBDGEH/XZiF3bjVWmv4XW8gcN0vLXEAoXcAgUWmCixQCEs0DD5CbX/bETsReSlEfPEWtosxhL3LSWXlVlkB4uMsMiXcovUscjEDBYpFC1CNqEZLWhFG9rRgU50oRtb5bmNTj3YLo9e9KEfAxjEEP6BHnuxD/txAAcxjEP4IAtdF3GlBv7l1uEf7DkLYR0scHeD9EYsxCLnYR3XFmMJDZeSy1D0mbdyC42w0GdZ6BMsNMxChfCZsAK+PSvwC3n2oKoV3LsX+7AfB3AQwziEaVag15JU4wUVPnCFeediXOnOJdKXOl6Gq50X/eBLavlW+MEq/sAHUlv9g/t2uG8ndmE39krbh/04gIMYxiG8Kq/X8DrewGH53Vz0YNSggFqc5+os1Duei4bou1/KNT9L87pi+yhxMZL25DKE9rSOPq1tVrqW9+nq3ovN2IImNKMFrWhDOzrQiS50Yxt9elDdc78+3VLYh/04gIMYxqHcc69mGf36Q6La/PDaL+WWOVtimctF1ow1ZrPAkbztJtT88mI0k74Ga7EO67EBG7Hp249kqfY7lLkTu7AbPxHtWtH3yqMSytrVcUQlRA2Qe2FeiyN5G86boQ2//b6X4rGye9GHfgxgEEOoqGG00Q+nWvoXbaRWMStb6IlLaZo81HmZhzoOD4VRJ2o202ijVmHz8Cb57cQu7MZM3rQqNDUyhHYNevMi/YKG7F2XRoHc7uUjgWeMBDR8ju0bZxwBIprLuwfb5d2LPvRjAIMYgmheadPq0V2+r+F1vIHD9PmxD5oBpFG/fKybl6LEtWD3FBG+1yN8GsuU2Ys+9GMAgxhCZTR4VVmv4XW8kXvX/dnHXDlH3WtQQC3OVcJ56j8L52uPOmkXox5zPDmXnIf5k6K96w1s3ajEsIbjsIZ2LYudk0eSZ17j3hVY6f4flc9jGQtJX4O1WIf12ICN2OSezdiCJjSjBU/gSSU/hafxDJ6T1oo2tKMDnehCN7ZmrEfHHmynYy/60I8BDGII3248XRp+wnIpAp2vhg1o9G+h9EWOozfwiytpsoS8RvoKmP8kS1TzlSc9/xSexjOI2pA92C6/XvShHwMYxBB2yHsndmE3fkm7T2j3T2Q1rhbIWjJGAJFiFmif1bnnYtS7Noec67555HxygRpe4rghVnmF4pzG8aXkZTzrCseLcaVrS+S31PEyxNzGSLECK2m/KpuX5jSPy28N1mId1mMDNmITHTYrdwvZhGa04AnXKq3ynLRW19rQjg50ogvdEOGyF9zzIl7Cy9hGtx5sp3sv+tCPAQxiCP/g+g667sQu7MZeafuwHwdwEMM4hMN0uWNq9pHvENWSpT5ST86NfYzZRX9B0V8uT/6SrElTPSlZ8xo1WU6ukHNxhniWH80wf1ZezEDIJjSjBZVWbJXWhnZ0oBNd6MY2uvWgms+FteiyE7uwG1WtRffrp8/TMAthKTIs5fhDLZVizpcqYk6BlepY6et8TtypMhertETVudlHsYQyK3pg9dFUvj/CbwpltZ+fat7o3+UVNR/Jo+xYxJTlairCpto+Lq81WIt1WI8N2IjK2qYaybMXfejHAAYxhMrISOMPmWeLiGmufT6tLihrx9nRhhEZHae2c22JUspmMlGrqXFDrapHy2rtS4+n8DSewbPV27gsymrLyjnFjG159dTYkNrTvm2ygPHBcW4FbfmJZIHvsOaVo2L5OCH/XvShHwMYxBCmzUBxFc1LPTFLmjdAzA/vS20XEWq4rO1WyVlUojVvc/4UnsYzYdtCir3VPI7dK6NJdbsr88eLHunOiL1kLVk6Rkfslb5g2visL5FTtm+MvvSjyfYzxFd5VsTXavH02xjHy/vdHxRryIdrUEAt6qRdjHpHMV8j55HzlXIJ2UA2YqEcFpGXRhtORPRY7j3dislvqu1p7fbp7DrXrnfPzZN/n92iHW7F7YjfouFu3IN7cR/ud+0BPCiCxO9VyUfIX3Xtt6SvLv/9WnVL0nsztqAJzWjBE649h1bHbWhHBzrRhW684PqLeAkvY5s69GC7evaiD/0YwCD4WHZYfd90T/yWkYxfGZLpt4PuO5YV4veIJ5yX/+70bP6Lvy9lpz0Tv/jDn8Yae3pUnBrZUjREgxZpRMQD0kp1auxHmkXhGtrEOkOJK7DKOf/MbnB8I27CLdr9VtyO1GLuuwf34j7c79oD0GLRWr+kzF/27Go1elQv+hPHf4rSVnsM1df53/4ux1ak3akqq2Tziso4VXVeMX3dMxG/CzxKnlDvEXmeJN8nx8jT7jlDjuMiEeAHs+VYxTKH8abUt/jX2+Q7CP8gj+CoXnWMPO56XXpyhRb7dp9u5Alf0T//N1/Bf0J/PBt98Wbnq1noUedvkm+FjxZKfTR+s3pCziPST+IURjGGqB05jprws2uwPB9bLoh1m3lSPtIUqq6RDkf//hhbnjP5X/G+o4ZWBce1ZPg4zWdhdj5yXIALcRFSlHJvRCnPRZTCJWgE/fLodCS7wn2LEbsH5DJcDauJND4WVxO5f9JrDdZiHdZjAzZik+c2K28L2YRmtEBkyUeoxUaoH4z50LNZHm1cb0M7OtCJLnSD706LONvp3Is+9GMAgxjCP3hmL/ZhPw7gIIZxCIeVa5TCLFygfovImAGQxk5aLU8xrTGidx4nUoyIdo2n6tgl+/DIB32q+twcP1m5T0AvPYSsx1wswCXwJiC9B4k9VOeLsQRLsQyxbxrvQfZ+6PrevKzqWv4FvIiX8DLSHlu1fVJl78U+7McBHMQwDuEwfT7OZhnNnOGcWNsux8fi/3Othe2GIu81vOXy7GkMTT4pus+JVXFd6R2uPCfXhny9shznyGtCr2ZR9joS9tC2sW91gz6lXCkFnKs3n+fJWeAJLG7OIn2+0dpeu6d3sPZIvjc7O99tG8gW40rnMZN2vAxXO76GvDaiincv5MpMv5Ff7LzJ73Flr8FarMN6bMBGbHYfz8u2ui/tSlfdgRuYvo8obR/24wAOYhiH8Cp9XsPreAOHlcduYX/vQGh/aRo3GxG7DohdB3jjpr4T+RuUkfCwWBfLa5u0HmxHL/rQjwEMYgiVb8QOe+7qqjuA9kFCA35esuP62RiRI4bSQkT6PuwARm2q+TrteYXWMoNjh5u1x6968recryZjzYc3nb/lPH05gvfUM76CkB7faGDEvTFO4hRGkcZLeY/HvGWOMhvUf6ESl8vlOufXs8nNWvKX3fVb5GrpU31mQOnzpkpXp/QNhnQlZyfcM4KTfpV/hhzHb+bjztnimINa1GMu5ns6RSOIRnTL8pYqTI0lzmMswXW4nq/cQOMbcRNupkF8x4Pb3Hs7eQd5t/zvkc+95H1kfN+DB5XzMH7Z8a9m7IxH5THjWITKsajaeFMZ+ZI30KUXfejHAAYxhJnGHLOJcj9gi/echw/I+3g+0z2tfmecj7t+hfbW6s6ircnwNO39y9o2vE3aau3+aLT1GG9rVMrlJTOgunwGpCTpx8jjzkfcexLva4VT5KjSxhyfJs+Q49L+rhgnUYMCanGeq7NwAV3r1Oti1EsXtfMdTP5By0swFTtO8In/zRZjCe9dSi5DxBE1W44VWAW9WU35iftuxE24eXJH+k7lNvneTt5B3qk2d+FuNbpHze8l7yPjOxY8KP+H8DAeQbGHvMVaP5j9uef+An+JajF5E2JnFE1oRgueUE9zmOL8xXGrtDa0owOd6EI3KndDkz+xSy/60I8BDGLIKPkP7LMX+7AfB3AQwzgEs8PifBdTrZ3lra1Xq+dJvM8Op9hv1C8Px5yf1nZnnI9Lr0lz3t+KmcrnxbMGLb9QStHjPsvjRtwxwHZWmJ5TZ3f25Cu5uuJKDr5KS2WXe9pw0mOUHCPPYBwLI3rGGhg3Kyn8mc+LmlPfvCHFLfIoGVFT+rR1ItKXjYh1IubHqKE+eazOoqRH8Sbewtt4ByJj+jLuhPP4ThCjjsc8q4ek/vnbeZS0A4ICamFmnvb5653Pcc9ccj4Zq9C0p3+WvdMMPO1IpR1n12MvNTT/BM2/lO8TPJfdittxp/vuQvQARA/A/a49gIc8/wiKrfdWHjFn8/5C9hf4S8w8m58o7rigCc1oQSva0I4OdKIL3YjVJnqqztT/NWa+4UmI1RoiVtErPAg8ORtJ3ixeqdco7xnjhREtefa4a3O18f+mlVzus8mjzMOTN8U3jTiZt+8oxnAa0bbkgqxBnjGfnDwwFXt59i/TPfZbskY5b5HrDrkOZ+/hKI7TK0Zz19/3/ChOe/4MOU67xhgzI6o7y/tYcd6glZ8m35L2ttLewbuuvUcecY3e2THyOE7QscLzlfLZ9M3t+TEnUHs1/0yxpkjfBZOhEzlO1odXFmt5Vi1nx3gV41SU/aU0TilXmYVUZm67qNmFUaOVzqI2Zb0r/7qTjNwQ33+Sf6gX+XKc7jUooBbnuhpjDdKbMunxpoyMN2WIN2XO0y8R9Doro3zcOWrc+c9sMZbwkqXkMkRvck/0Jn5yK25HfGWOexHzDmkPoDhujETPeUx5jzteg7VYh/XYgI3YRJfN2IImNKMFTyjvObQ6bkM7OtCJLnRjq7xfIF/ES3gZadWlLr3oQz8GMIihyX3ZP6jTXuzDfhzAQQzjEIrRtJDmHhHjyJj98eYR9jipjPfJU5N789nA63nvGolYd1Gszq4DKxRnMyk2522ax+QRhDeCV2RzUr/UJ0v64xcihw/qk6fwQX3y4vDSlbjO2c2042fTahd+hvBSjCJ6BVYU/QqzkH41RsZaB5dhCa5h++VKWOHaStJ6NXrULepxK27HPWlX9mz2AH4LxX29ifCTrfgo6yLrYBY9WzYOxYiHI4idUTLfGU0jm9E6n3kvN2tYmeaIbMNj7TLm/XCYRv+khLeUMKKET2TvkBFZpB3BMRx3X3HHri6tRNIYKk+l5fuhVtJTJaU1T2PRMzyVdngjqv9gyR5cVtyDI2MHDSfTesf+IKJEcoESJvIxj9coabWczPanSiDfwXti8hEYM9IO34hnT6nnqFYcIyPWOR6X/nPZOfyxBgXUoh5zMX/yG7HSXAIrzZJV5kTSZmrOWchHXLGCfDCfZ7JB2dxyk3w3Ywua0IwWtKIN7ehAJ7rQjeqrTmOC8qZGSjYlw6Y46ZjXl8+E6BWtSM5Pc63VbEbbfFXSmM8gLy/a03lEfDJmcZ5MEYLMZ0PJro+I4V9m169kNSigFjETUp9ZqHc+F8W3Wx9Pb0WuTPYey2392fCt0n32mP+LU7fidtxJo7twtx25e3jFveR95P2uPQDeUmwH9/wF/hIxy6HjGqzFOqzHBmzEJrptxhY0oRktaEUb2tGBTnShG1tn2Peb/ouzz+bWTpae1i8iFod1R4rWdd5QEvfOpl4XsxsU13+FmEelXpc8JHKPyBqegVP5exTRPc0W5ook/xO7CsXd8M+XRdhHYSSPOB0jOCImkTEXSfMBO9+xr9wQ+3B0zntO9GG6Rx9GrFrU/h286873cARHpR9z/YRnRhA+F315JPlcRAhynMfU0PezoZ8co5YNaW//+7WvH/O3PA5eFJG21EYfFsMjfiPFvbTXc3m+11M39W6EnK+Us0r5j7zdRR9o96kxD/kssWSkMDt0LhJU/D0K9nK9NuwlntE3Ykmy2+xv490LC4d1aZKsmupe+rc8yJL1VGi2ILdcIdolfFm7/6r8f0v+qxExvtSPEX7hXL1yy9WV/n2X8OEHxZ9vZjVieIGsJcWfqd8COa6XNte1BektbSYGfa24pxl7+ovpckH+JuC8bJX2/dHsnIhHpX8pRDwq+2s5d/PYiEOIOCTtAfyifIo7NWqnDBE34tAmemymxxayCc1owZMlu93P0K9VWhva0YFOdKEbEXvo3os+9GMAgxjCYbpr0RRv9LR8LDZSIloTJ6KXfSKP7GPFqECO85PGyr4U/Uirz9iXjpEz96fZ0Z8ukfun83hjxiJ1dXh4XdHDyXfwLm3eI48g4iUZOwCk/pQ8fRRRAsajnafXYbiiDhMfoQ7ZB8cD1z4u58gh5rALi+U5i/LI8GsydhvIFCGm5qopokaZJJtN+Tk5Sk5FCHb7/07OAQiSJIiiv91r27a9gfXZtu8CZ1/gGDjba+ts27Zt274XP2o2eo358WZa011drezMrJIqbZ7qO/p9ajm1vKQ8r2xdxmVc/F28Wjxc3Fuex+/NxcLikuKwYpdibNG9aFuk+Y/55/mb+fx8an5Gflp+TL5VPj7vCs2zX7O7sxuz6dlJ2RHZQdke2U4ZSn9Pf0Rfow/T+elp6QnpTsXf5dSKzvO2LW/zb/QqwxWl3QtUpJZFGVySoDOCxlf0Zto0O4m+tS5KzkkOSnZIJibDk4FJ96Ru/Hn8arxLvFHcPt4o+pQe7x6Nbles9oqQlKJIueq4P7aGDDUJUYWWjLeW4zhc7y3cjqmt+mkgV8Vg1FVDNZI5E7SRr+utmbMtGqQd0WBsnV00RLuhYdoDDXdbpxE6g+t3lKZqmjbWDM3Xplqqm7St2z3trvv0qA7QU+gQt346VIlsvUNPZYrtUSdfXpmzfFbMxmng3G/H/gAvu/O458OavNLOxne7jzXE/N2OI1URYoxnwHzo5Mz/HJpU2yrUIo8hWjqS3ws2NFt/DfnVaWjv9aHcgsnxWpewUg6y2z23VuIcT8Bfjv8t5HcRLIYlQO2quedEjhomKoRNCPMhZcxzV5jinOEwpY5ah+ylNWUQRV6q1WrjWW2ArNJaRukGxaZK1VshQ3PFHMNUkziXJ8MUONSxZNqT+O7tux0ssxzgJXgFXoWaPVKyr7foargGroXr4Hq4AW6E2DU2ktqlRH56UocwAmp5aFNDnm4je0rbe+8XEh/9cI0ex8eY/zg8AU9C7GycoRDZooxsG7VSyvHPoQk0VV2OPr5rcT4yfhFcDJfApTADZsIsmA1zYC7MgwU+Y97RIlgMSyCyJ4l9dHbdDwzZUwBJ8II0t91baE81d/zlTWxc+yb5fQfeZc0ZNS/v9zTJ9fyGo9NX2MZ9XQ1dc9WWa8TIvMZDfFzlJacyXLOAXgW8oY6TvyRvG7y+4Ol/l7mJbS97YxxTr7UxaA6XwXSovSsknCG8l9jPTSYpYwv1DOt5Fl6Al+AVeM1PWCxV/wevtiNQz1DeyM/VlHHVzkPbETHr+tCWcAM5P4Wh4LFm2UZVL/QKto80zTU90VuRrcfY5XyTodTTDwk2xTuQeamXKWXVBoj9voPdyzBWp9+5Xqv5uqDw1Ekc58kwBTZyzdv+DP/B8mbMdpJtojqeiiXnqc97TvUdhaUgxfaTy/RseLdLwlX3ayjZM+pt+yuy1ZB6b15hqOYxruN/PwMr+rVeAvtPJd/NpCxYeX7f81rfdSSWc8+ZLZ2o627QDwbAFpR+S9ib4X3B8TDGj4KjYVolo+8m5t8H98MD8CA8BA/DI4DnxW9q7Lk9LZG9D3z7LNkoRGpf8x6Vikzo483HWVF3NVYdXxVN1rk30MLP5VLboMJP5zL0BroDyvykzrUTyrQzyiu9hNZZuSShb5upGhpKktV6MeW/ifZCzbUPauH1tFTE/CGKLClBqYlRqTomQbkKs/wnM2v+xBZ1oQEeSkyECpUmdjlzU/2kgTV/XPb/Ac4YQ7YAeNpiYGRgYOBisGCoYmBxcfMJYZBKrizKATRFDyB8dWEAxn/v/V9932zbDLO9vOxm27nlWubMbEyZQ56VW15uNm5nuh2f53kPDd5+aOtug/dsPLLPYDn8+KFAyHTkis2b9x4wf8u+/XvN3HZo42ZT9+zcvtH4fUf3HjISoYNQIEMg5MiUKv/F9dgT62J1zI2BXlqur+SoZfpqDCediyw6kUchVGpddPXBJ599USJ3zDZrdNcRhgu9EaiF/K+bKQwzG1ddM9iNJg11q0nD3GnScB1SdFj+Nz50bc1Pbs13keaNlhjp1JnXPuBTOl0ItZzUJleto6/u6nSmNz7LvPdJ5l3y37b83lIrd1ymS+KV+Mv7utwalU7KhDmW0ppf7H8lMuP9ryOtazqCdObw3AsSG5p4m931DCFsaf3PUF0acs99Dzz0yGNPPG3MLSkqncGmJv3/Ez0sRXd42mNgYQpknMDAysDAtIepi4GBoQdCM95lsGE04GBk4mZlZmViZmBibmBgSAfKazFAgaeTrwLDAQaF/39ZGP+9ZWBgSWAUVmBgnA+SY2Jh2gWkFBiYALNDDncAAHjaBcGxAQFRFACwvH+ghx4AAAYCAB1Yw0CGkwihJENFhpH0OZ2f0eWzf55jJi7PzT2WkoKahgwphvEl/RBCioU9MkmKFQj+0V8IlAB42n3MMwAdWQAF0DMza9t4Ybm2bXtj27Zt27Zt27Ztp8qPky65aA9iJHhCIsIT7ogL4CefudMDXvW+z2SSXyXVXIxej/6Mp8Tz4k3xliRK7kjuTdKFONwb7g9PhOfCSyFtyBjeDB+Er8KQNGnTtEzTOu1jaZ9MXbx44eJFBK/5wOcyK6CyHpe1P+LJ1zVJktxzU3s8PBNeuKq9Ed6/hXY3F7dwsRdczEvqrVTG1BOp+7hw/PLX7rxrp512vA47su1Iu+PTHc/vCNs3bP9x+5/b/9iWb9tv8YPRIyI/oQBKoYFmRD8ARF9dO0D0UfSZ2yS6y/9+VkY9+XzuJ1lkVVp5P/jSt3L53o+qqqKazL6QTW7ZlfWNwyKJO9zpLne7Rw755VQuutt/aqurlvoKKOiAwor5R83oPkXsV0JFy61wyBKFVHfSMsX9a5eddstkuCGGGmmYEUYZbaJxxptgqkkmm2KsaWaZboY5ZqpktkXmW2Chxebpo4mGGmmmsaaaa6GtVlpro5P2OuiopS566KqbXrqrrKeB+ulvgEH6Gmyu3s4564zzfvGrP/zmd39eAmUml78AAAEAAgAJAAr//wAPeNq1OwdgG8eRt3sAIXZCICpBtEMj0TsBggWdBItAEiyiehdlx7Jky116xy1y7z1+W25KHCVWeiKnuKQnLvK39Ko4suSauIc8/OwdAIIU5fJFxO3dze5O25nZciMKUzqKQt+i6yiaElGUT6wXm/RivQ7dxT6MdOwf6brZt6L4NmhnL7yF3sdNlIFyUZSeMZgtZgtTVQUPAX8w6PMF/GbGUCWywLNXJhX7LPAmlTbLfN5gMIDed+is1VVY2LQiOLrKvWFga7Tb2St1S1en18x0Xrsj2dvhtHYxLYrG5S5Pvs+TYHyhSDvjaIuuHmWPPWI1S83tSpuKAj68wMfrwEczZQQ+AjwLHA9AV+4L+MQWQhHYMRc5QPcL5AOB3nU+37rewHCzIPcfpqjRGDUlVqzIu93xi0bHLowD1bnZqNKlf7LVrhpPTaXGCa3xwlt4OT7G0/KJ4Y+jIpM2c1QtjDTk5UgBJY6UbDwnaB4OxNb6fGtjgQG54Mrk8HDS2GU0duFj7C88rviFY6MXxd3ufJQjorK3Pql3KWEIKBfI9RuQC4QUEp1y4ojKQoAaQ/KqKiT91IUXfmporSzREHNl+vsznrQ0otxUd8sll9ySDBis9snkVGLKabeEEmVdHTudrsT/U10h/5x6obIwx/87wL+CYkCCeTIyqVQ/zz/NKUpPKCJ5ensksj2d2hxkrx/p8/Q3h5U7+m0JM2o1dNclLhwdvTAR291vViRWOm1t/jj6lTXjENU6k2bQViuozA2SNZFxYQI+oi+flJHCJd6Vz3eEh3fu3Im+l94eSKTvSbNxCuzbVrDjZThLdVBpKg88NpfVEQqUbmXllBDODzYwDmJAnQjGmym9BemyBRD94WUdO8dyW5x2s0zhtTh97qmI2iNV64Y2qrXuqc56Va3SZmfOWj854IoeUsp9XdlE9qu+aNQHVziQ0mvC1nZ3TW0to7K01Qhko8FAzlFTU62xpPWKZJt/xEFjUYtC3tSf1ppqGYXB3Y7GPT61z8MV81I2UX4qTuU+SsrTSGhZIJNkgbxLSCi1ig/kGuQL5GOLQr00L+fp5Kuq6sX1AUOFcH+dF4n9j5KgMOrglOg4jLq00hulYkZc9EAxuJ8kFcmtyXVGdBEjcTm7f9ta9uuoK5WW2vXsPcSrBymK+hJgqafEFCUBX+OdDUStogHrXqVCoVTJ5fEc3qtsrm9WcsXc5VgwNwu9UaGD672MklGUHNo3VzFMYCGa8Vww4r+kiOcyfNXcITBDXJjHVpSF5bjgZQmFfCIJQ4ukIMOKWzZ8/8UNXxgCAWxT9/2C/QkSrfgW34d6k6NN+UjgJf3ezLTZc4MuI755biPFt6GVMP5m0kbsk/JKkp+qq/LTI7mcQNwd9U1IccNQfMXKXLBT22HIBcPaMIMFeWuHp6O9h9diMsNpsajO8og0UdIF1BYirxwSwLdgRCg+cmAEOBqp1kWRA+xyoSkiRWqms3MmxZex0dFY79hYMVbwZSY3mh3NcQUfwTvw8tJsIQcGF0dwseRjR/Cf4F/k5yM4ewwJFsZwEm875ucmoXiJuYn++PH2J0hdOTv5kWBBxOV1vxYLqKaS7rsxhKyS1oXV5mi71mXr1mPBOqWtJSc3c/OMEeL048BjO+gDFBCSkdAMHFksTsxbcGnaAfbkcl5Vb2Q2MmFN1uMLW3xtrkHbzIr2mF8aEMe9Hr/PbZ3oc07UhZxOU7vdqrGLqkT6LvfQQLNJ5VZYbCYTs6yqvr/T22ehipHbh2+lJPwqIkCiNxkCHxe7fci2uc0+7lZJ+nbtmnGb0Exaqlp/Y5rdT/rmgPe/gMTS0mzG+wC/yCBP6FZBYyy2Yl0uGtGFjbm8qXPbWjTAPkNszYC2gAMDluVQ/BqwVBMOaJ9E7gtJfMi45uu56Q5hx+ohLChQhw8jirTVwrD+iafoo31yaBoqljRjsTAi0eevGQ6FcE8sk+jFgY6Bqzf1ObC9Dwv+8Oc//4Fcc7Pv3XffexQiGNBLWMD5uwRQ+Th/BxTS739z7eX0/pXfOLL2KvpmJEDUk09+wL7zs58R+mKwqD/zY2yS+OgGzIC6QhzTSLZ3xd9qW+zmthHLU7lLFMJH0Lq5K7RMQ/osrGAP5KG3HlA8XpRUH0D6gF6K9OhxdjcygfnuZf8D+RLo4nSU3UesVw7FDnyEEhEe9YxFL2IkPgknJd4xlWZfSo+/dUZsSiPUTD33HD7Crp2bnJyDGWcN9BuGfhLQlo1bQ3o5oxFJNTTnZ7TUVzb7yuc1SDux2RSQS1w2tWvE//LzRr9a7Tc+/5TepVK59PjIxlF/t0ZQhSTmqD28OoCSHyjdjIFxK5H9mNymNWhtcpAyAvGjD/+IUpejx2nWTmNT+xKJfVOTF+iT0onY9JYt04lpaUK/t27k/j17HhrP9bcFY5efsf2Mi1Ph9v4JCnOSbQHJaigZkascOCzzMjBrTkx+Op3+9OQdd0SmvN6pyB34yNC9e/bcO5T1b0jtTm30UYjDIwI8tWQcxHpp8Q+L2An0GPsYirPfQxP4SPZE9u98azQHrauJX5dafzmPHmC/hlzsUa4dVZR7J8htLnvDYuH5iMYzC3Yjxnq6fktu/PJs9qqVa/cZUop18a61fv+GuCfnueeVrZ7Y2IE95x7IjyfbO3rD21K7UtsihqQvlWXvpopSbC1KAfsEcFYoAely9v58Hm3Ioyj7AzCLX8DqME3aR6HIl6QG6kxAz3l4nj2+cSNSbNyYxs50eu5F0lYNnv0otAXflOjFRMfzsUnMbERJ33TnyKaGwZpwIBh9Ax+Z+2fnpGsqs9wRjifQoRJ3mwEDsV2YRZninIoQmj2+KZ+nN//bNnYWydDkWS8Dk9df+AH7H+yuorZ/Df2EhEsiEvo1e3ketQGNm0p4n+c5A4y874PsjIimYfZYc/YVSWHqijNHhZ0HD3YK8ZF3P/3pd+fSeHAP+wJy75n7WllvPGfQBzoT9yWaExby9OgGUqDH7p17AviauBeniPYwN7rXwOg2UvolZ0Xe/sqDjDZOX9nff+U0X3atDgRWd0XXBAJr6mBM9xwY48uB8NbUualtHR3b4LY1TBVtPAjc1VEK3t5KRs6IK1wVzE/WM+lwTPY8/TRMdkrinZ6V3V3THpSelTt0fp1DznO9muNaTrUB11ISoANOXMm6SLoE87Pb2mwj5/Xy/HftHHJVCLA27WIyyyY/+yleih13T9WO37e0HFmQo4HsoCTisiBkUVXpr0SSrklXX/KBdXc+VJTlaWRn/x0fcU71Dm5uAgO295VEQlQ7jIMYJHKAPJXzJTdhLnQ3IopcrsFETKTPX9jebZruGlihCjvDPVPOyExyxS5Lj3qsKzHUGrGHkxNtkTPqYmG/x9cX1Tu1NfWN7sFA97g9AnthZ6RDb28FkH/Q37vWTyESgbCZi84UAhsi3oTNv8//Hjfhs+duwmdnoc0U8EoisRQ0QKbF8rxY2gRM5XX93d39urzn7DVrznSBweXiq5zOVXF0mN285cre3iu3EJtvBlpDgKc0Q0rID23cenz6nCHhinMnod8D7AeoCq0vtqa3Earl1uUfzdDwQy1rHls5EMGxqfXjMTq6YuKra1b14jhgOcz+EwlRDu6zSIByc2m0GlEFbuZV8DyU5ksJ/NESBrApjv1+y+P4q+v/+NKWb+Jvok1okj2BZOwhWJaa2N9QiPTAyRL34mJXNJJ/Y/0R+sj6f6Bm9Ch7GIiuIashaKvj25qkpSkS61gBupW9DP2KPTObHcTG7ODcb4mNRUG/6k/gk/axM7zeM8byO7zeHflQXKuNh4IJrTZRN3Fg9+4Hx8cf3L37wER/50xid3J7Z+f25O7ETCeR3QfEmMrIKbKEIGBghg08Izrs+fblX8ti78OBL/IRKgWtpWT+42UIARulw5huXHY7EZaywWOeeG+sN9Ew0BCYTiTXey0px3ey2YkXHVu9dZG+pLe1bcDtXxUNTuesn+dtH70PmN3EnrxLoIUpHheX0mXXII2Ybw9mMqmOYFLWvTyY6+hcHx7uMCfaO8/IRMc7ZT0tmd7s4GB2FN0S94pCIZfVrfYb2obDidEGgcjWH4iu8jNBjbvNl+xa1p0gmjdDYedm4gYyqgEYKlCIFMxLL0Y/zrGPI+PeLVvG5xC+Oov+xkrT6A0yt4IMQ9wZzhEy0kiqp30870sxTSSToL+zzzWLxGa/Mbo22DGTjYyGpT0tsZ7MwEDGHZJllDD9su8oDBL/+iQMGs/mYKomNcgoatClhNcEUJQCRRVlL1lJNw75GrBIDsRPby2OvpmwY2Cy/czsGWmJUOzobYf4F9meccYYJubkyrrYBWPD+3dPtgRnLhrBrQ4VzN3JmUi/Ie5a5oobireiTTQCD8uIthDMu8Suq6dRLfufA+hnePdlP8tSNDfHaGB8WyBah4DXBecEPi8/wkvtwyQL3pB9xZmh4Z5QbM/27XtioZ7h0Bm5/lyun1yxVCoGV11gdTgzLl4mGY/m1sHyfFyyTDyegTVdf7xT2hnnCjQeDjQGwlzB6ZG3a16PqBn0x4AeLbAGrvA80Sl6xFJOiQM7QIlNzh4bp8R0//bwyxWKREc4NYa2gxrVTqLG1PZI7ILvLVIk6KgPdPRZ4MJKhak0aNPCzDMQWhgBRHIAgVGSJ2TguYEh59gjGz/COwFifxY3+HMdqfWe9pjRaHOMBr0DNlu//b7GJrw/I1KI97P32UJiTbMubFLZnIaQQ/xEi0s9MLLcpvNPBfxZv8Scc7oGHeaEw5kMKj9vnrQnbcP6m/HlQWtds7VdLm7ztNS1mJvnvrlcJ/tZg9FnaQz1gk5jhc/QEfwDqodawc/PJQnKfmxZYtdKltAlLXMiaLBv8ckhPnj8nEPrNhw+L3PFTLdhqMflEQoknU5nzu3OOZ2hekGqRe1yj1wz0XfehMuRPzdTyzjlMqcxAKdEXVu/dfEl3z3DtvqW7alz0m6z1enemB3Y4HbokuwLlpYNY86py/u9K89PdWag8zNym+YilVXR7c/5u4mtIyHKolUwVhSJ3yjLTSrCCW63i2qwFU2U6rB1bhYLUM1gqe54Rd3xuSj+QbFOU1iF5YUDpE5I6uSsCL3/SBpqBgpvUT+k9pBZRr7g0Ge/VqPR6lpb6/TKepVOp6pX6qlCgbTHv4T2ZipDUZSFyqBquIuoDJZQpH4c8D2Pm0h9DQenatC9QMdSuJijI6aoEE9AxPAWByT361rdtoTGtKxZotmjVzVYN5t0YUaobm5Q6QGnB/ryOLMLcI6jX1D34WNEKgmsQu/r60O/QAqOC3gYhhozdzomgvLLcEfA7QnqrwCfPykL+cC8ZRxDV2g1JS5a0Qlgo22TSRthBK2EDdLbjt6ifoZf43qfIsP1FTLg1xYJQXgC2uhxjqdhwhOUP+M0BljRrYDVTK0gcCh/yvHKFK6jnqKuWlpjV1RQu+pUjUFfdA30NVOjHM7RIk4jlaNm0XGAUCGRJRCSi6SziiefVOy/Kvjo4KPB2zG08VM5VFdsEwpYQnKpyL9/P7S66nZ8O2kG+AEPehbamKk8wQ/lUSIL1/d3HHycg48TOPjpSCFL/RxGUEjOSeRwvghroAXW9u0phVVhK5rcN36OguzP0EU6FVgeV/A43gIcR3gcIYaGI5aFOB60KqbsRRTfRsGf/5wVLsRgKnSjHwEXSsoCXJSCHuCpmt9XN+CFSF/rWuUJjduHRtfEApFUXbYuOGkp0njaNR7uHXcvO/NhQV9Pg68r4VXbsg48UkEUU3JYc3wL/4inaWICS69mFtJEVJlcfWCqu3uacGAuUn1hATVXPtI77qpmv1UpKaLGCuejPH6P238SGWG25sM348Rj7lHfYGjU4RwNDnrGPKhjwxeutnn335GeSN+5392+/0sUKvyzcD41W+xP+GOKYd/i0+BZz6h3MDjqdIx0DPpG3dD/S/vb3fvvhP537Pfarv4C2SMWzkMI+oMNCRkxfxKGHn543bpr6Mt6ZmfJbrpwHvVHvoWE7KXhipIG+L3ZfT20gOwQAEcLtNASHJx+zEwA4nbpUwZ/JANy+VBL3moNtbeHrNb8OoVNrbYp1l3jNrxhcww7bG8wrp4PtCFjVZPQFNR9QPG0UYzHLOFVLvNJSdjnzr59vFU4QWImegpiYNDFFDEb3D0f6IImYVOVMaTlMFcXZtAEH5HkDPKN9CFh3530xVBjhZpz+Boh1KBz+tg5rgq0HeBOPo+QOgbq9ifQSwl4LRTKNVXUZgo6wnz3Fr0WrIkGHzBRARKD9QTbR6/dP7qFYAgdG5p715sxmTJeX9pkSvtazRKJuZUrEXuaCtj2XAo7zd4pJ1/6VX5z1OxXFW/sVR9SCXq5GOzg+zAWnMbEvu8nk2AiFK6Ai/joLuZq4R+6A22c3Yc2ct8+ClsQC/roJN+GTGTGX2pPS1aAp93akhWhhWsLv6rSKTEsfdBvvCs7HZOMU9Fl6uhWOvU9gaQu7Ne3eQA8xbgUUXOoR+nS9QQBHDBa7Eq/tXvZsiYN0xHtXiYWaYwCT8ai0nQ0y91WpVFVI2lyRvTurFQki9ndxRpXW7EmbICaKln8l+p2ba0Y01XSENMeEItxFS0LkqhcOANHwBLE5Ny/NJjkAIr8vROc8vungiiZ6N95O3oqNB0MrgomZ9+ma2ffBg0GC2/jF/EPuX1e9OPs9EIf8sX2ijV3rVx515q1d65ceefa4QuSyQuGuXJieHJy2BsXh2uNrTan06YzNwbFqdqpAzt3Pjg5+eDOnQemoumLhqPDF6WLtx07plbOuC06lSZkj9k69C0Gs5cSUFbUjr5W3JW6qDCM/kfzCxuC4vpeDufY5W3ba8HpYPnnTFmtKacjbbWma6zTGoNM7HHYGXdtXV2tG7UH10Y61wSDazoja4NWe8Yqs2bsxds1uaOMWqERjed0tTWymlqSZYAewr3c6YWCWGcAyEsZsF/uHByiWQi2uIz8kHf6ryu/4+pJ0cmoEwvGxgQYPXTC4TiB5Fdeyb68b+zee8eIFVvRFNqOn6R03M4AVrGVuQiLUxGkFZkIAbTd0NrUhAS1Qac/PJzJmE0GZ217YzzU3d/Tb7VrW82d6I6OhroWuTFkC/jUVnOr3KCyx7u+sFYhr1HKmVZC3w70NwL9WkpJtF3eLS3aJf24f3S0n1x2m81us0Ov9fn8enL5g7ZuW5ArCL44Ogvdwo2gdunRKw8ejN0J15DdPuRyD9rtg26NXaGwa7gSneUY9niGHXzZ2+rRaDytfEkibQe6iDrCx0wJnOtflu3IootQb6FAatAZUGOmdpE1CJT82s+IrkD/ik9SEhL1RXJY+4jkIgs5i7DAIif0vXQV3i+7Dk13jOCRjml0nWw/xidvwt6Emd7ddtFFbbtpc8KLuXMTKD4DFFqIfHoYayYEBsBdPhF3SRnuogGIdhvvMfYaL71G/S/XML3MPXBdeq360muMh+5R3/Pss89GPxeFkruh6s8Bn15kLZ+MiWg47ZP4sLnrCcETXc9PoD4d6oPJHu0mEnVRr+AWdB4ZNRNJYKkwE7ms7LAPmcKMOqhVMnJ9c8hhihjIi1EGL69ImxqaG8V2paZZXC9taoIHwJqgurEUG6lawMpZNv8tC40OPvMM/LqPJo8eTZJ2qBFL0Vh5vyFlnehF1Jic3+vuAByNC7FIoGUJ0zOkw10/Tv74x0n2AMG4mlqDZrGQo2wh4xIioyRHP7//fk/pt+ahhzylH0XRQMkPlJzwJKa0PCcLF1ML33guXzao1QampYUp3oFr9k/qZlmzmivQFfPPvDSHQNJvkbmIpyAuy0sudG6SfYvwPw1rPRYHuVWPKWCSCqVCxLKr0cPsQbSy7v3c+/mfLvvpwnbygAn+hNJptBIaPVxHWuTfz5HR3Uq9Qf0R7SI7s9ACGR4qrgTfqNiZQftB6gjqRY+e2v5HiVAoAdeRqF1tj3IFxY3zMDd+Qm6EOIlS7DnoxeGnkiDzcrCCUXwJxVAe3rpgPDhHJqPCmxiMDefSxI1O+bLtbU+rtrp3NMG/He6tqnT74vdIJhOB63y5bKtrhzphsSTUO1xbZfLF74lYvDce4wr+6/oN6Lf4PEpFGchKqpQD4pPy33kt4iBn9SILzONiiDDIk57euGlluntE2lvvM1nCyyOyiZ5Dfp/Pv3um/oazd11fP7NNGHMzTLuQPVdot1i8MeGfwmO16KqasUjpu1QK/6iUB+QPVn5UFhW/Z8lKuwc0OrU3kdg7FVmVkMWkU725DXUIkR08W6jfsCI+DcAY+Yhx4sCYMeW2BuLrhhLrE0PrMh02R19b8TsT1gG9du60lAuWFvCfJZYwJN+leG6px/Vsql2D8XSmtjm0rW9om6FHmQ31Di6v+eWPMHJo0Jmblw+11ytr04ZkW/e6YFcATuX7+s0xXbpGUtsx3Swk3uQvfAm30HUw70aoJK9fC3+qKAd1wjOnbV7fABEBxCItrqNI6Alx7ALQEgAAYVGGBrstBnefslMWNkoVcbvD1hEwe7t73B3GLmW73ibsm27rCrT7kFphbGtpVTuiXo1Fo1GOjtB1TSFDQOOqX0Yj3KBQDvhCI3KxYHRE0KLzOpkWqfAkavL2B7pXKSTCPrq2scNicDU1Vq/6rVCucRhdDXUUIlaCOyGayomVS/lIBFfxGJ3LscLLDo8dPnx4/xNrHxc+tuaJ/YcP33zzzTAoKMH+EHWy302spzD3nf8kPgZ+oVuUo6XnlmALM2aKOVtInzv6fjFvppS9NTeLvsfGK3NxCgU+G5GupUguGEVVUSdeoEpQPFeGvlIBPVqGHgfoqRhOVkDNZehrFRh+WYa+9AIZe4DSHtxE1YGuhoi2quYTHkP68pQtJ3bOn6mRs8OlEybBNLvxfLYcOgtSIkNuSxeTI9lwbZAVd7c3Iw0rtyWCo56qKoFrNDK8xrOxf2u009MjczevTXcmtMKqKnfOH1/vh3y613BbMWnyNpIyB6lz7zps1kDMEpTLgtZ82psyuUMRq9HeFm0LNsuD5mKqHZeJ6OEyEcleaqkVLSwD+JXV4u2DpRjxkHRRgqJsZayGrmmubrVovRqru9ZcrZFJlKp2df2GmQtxUyLAzCcu+mJCL03TBp3atLyloa1W3NjUIK0SxGtuOueSW7h4RsbiTYrh+JOLygeXZXcHJvjga/GBXulTN26f1g+3D7o6tyXS5Ati2hNvFNSk3Su0aW1Cf3GjQayw9RqNvTauxG+2dbSdfdPUmn298XMHB8+N+504POPoaPOqHJJqRePcleaMK+5Om81pd9yVMRcKfCYkZ1lVvG2epEpQPFeGvlIBPVqGHgfoqRhOnixmdlGPYAFF8/k+kOMDL9A6B/DXuNZ3cOu3E4URCuCF30InDVAswV8twl8HeC3QLMFf5uFUHbw9VoHnJIFTiGS8cXSXkdnXx2e8oTykuP0kzae2QV8+D4x4SBPvIW8V5cCIwyjmNfFKGYrnytBXKqBHy9DjryyF4eQrxPOYwi+xFNu5M6IAcMXb3cJJljfN4rE1rFoBKimdyftC0CHnSChVkEXW1q/udiQULfDYnmm9ITYqqBLgyzdKvK29Y7SIf7Qa8sx0CNLLVPIhw7hhVRAelXI5pJk1qZU1By5sEqMb4KVRraw9cKG4aV6eX5Y5f4njHKD0ueBb9ZSC6oWYsWANYJoPGhAdTz2JXyKfFimKSXCorRQo7vEOBhqFsi0xPkkuvlFRJduQTG4OkSxbb5+0Q7m1cz5J7vVidGCf0fm1njifRNfZEeiO7cqWU2+5vC2QZwt+g4pw5wbMEqljoaIkYoaP9iV2AVY6JcBbNuSjE9qgqsfq8rW2advilvWjiUw6nsvnfetTqfU+V3untt2kyfbePjBht7p1Osgoa68W1egi7uQQEuaGhnJzb8LUIExvD4e3p7uamFYTUy0SJ+ez/Y6Vs/3E/5tsP/oQ+4vTp/vBCHPZaJxtynnrfo0qQfFcGfpKBfRoGXocoKdiOEmgfM4XB23h8T5XhgKGEvQ4gfI5W/TXAdrKQVnZPPRgCYqoCui+cts52VIYChXQF8oYUAX0snLbWRnRugAMewBWDI2UhMtEEpEPjqU/xNA+dOBPWyfQFvRn9vMowX4XTbIT9V/+3rPP8hlPWXw2e5BfN3q4PK4QvHzsCWdBDgYaKyV1aXetOM2Ms2J3tJwDhi8upXul8kvPOlXj9+wspYYRWcVQbOeyTDT8quY0WWFk67Z+xYrFuWFXX41GelHbwgSxP/SCbsuYq6ivUfDO54xx46LnR1YwDz1YgiKqArqv3HZOsBSGAoHyWVkc1MTj/SyBWgA6Q/DyUERx0DBAJwFvqe3cZ5fCUCBQPsuJs4123jYCAOWzmLi2Np5acB56sARFVAV0X7ntXHApDIUgmBtA/w3yjP5WmgGEZL+15CxA855ejPmlxQA/H6CNvkkmGk4azZB4VPEIX4zFDfiLlypj5q7V/KMqVteimjBtcF6WhzSkikf8GZKDZIqr3v2mVDb3A5KXZI5xL2XeLyvzPhssZnbRd4OdK7jMPf3CIF/2HCHYvri89KLvZifUmdb112az165vzajRYyVfmvujurulpVu95+yzhSLIjzrvgTGRkPhVbXU1VlRXX7L93G17K/K8ID+qlC98mkyv/NOLM71u8kx3kVSv1AcKh9arsytANi7XiBsXDz+yJqoMPViCIqoCuq/cdg6gp2IoECifvcNBAzzeOW7tA9HvOBZQSu7UuzLlF3YoxeAuhxVRNAxJ5rkcZAF3m7wNtAhytkn2r8xuQJvnZiEfWKUa50/wEmj4o0/wvjuQTg+Qy8YwNrhQYtOq1Zs2rVq12RfxxDwRriD86VA/SvEZO6giYwel2L9/qmrauHXNRtTvRXUrTdvYp0h7A7QPAX2gjhbl7JRCnUiEQuwbl7Xq9TqDcVmwrjfaHQ+0b0AXe8MzCldLlUprUDQzoS63La4b4DKmQCYX4LQtytYJLkzlYAwLU3XOsZpNjKbV2mATd3s6sk6dwTscC3VLXA1t0NJidmCDRiZQtiikBqXR6zC2i+gqu9XT2aY0yNR6dVWrCvTZzMvP5+cgsmsMccdXFpgOUH30uw+Pd3REBZeh/j7/2++73U8+yZ0vJlAI+ui4M1wRN1cvwSARIYSYr9YKGowGf3ogGeha7mi0GMzwT6Wt9TfgI94rZS1dwVCGY8mkFeqMy2tFz/EnxQkUBxrNlKE0zvwXbHlwyQH/eiLriOvzqVyDoN5u8iWHepm2NsbQ3o4SQ4nAdLLZOdaJpLquQCgNmchCxmBghAaGyxQHDbj4jBs4X2W4jJv7E7fdG0RNUNOTPM/P7RmBn0EYIz5uAUdLJ9wsZku+4O076ayD0ZhS3d0pk8Zoz6YJGwaG4YbLZAWZu5xGR7Wgxq61+f02rb1GUO0wOrt+26KsVrZwxSENpIdouIJ85wUOu4ErTkuI+35JslU4v+IZEy1gAHXbY4Z8EpRUZzP7E0O98ez1RT1hN2SWSYmWZLoef0dq6BzoQ/irMjDE7wofoGF0Pu938o/td1VLuR3iLCeFdnF5ckt73QKfgyIEtMnp7yfzOS9xOY9ykcuBx4E0LsAIHhf6v/S4X32UwxGP42UvZcSdzuMq/Q24DUEPorWPcDffh/nbMdRzen8DGnGgwVmS/H/hb1Uf5m6IO7l2AR3wNt9ib+tJ7OF9DXgZROeXd4kf09dCH+5rRR8zFX2uamlXc8/716F5r+NyKoDzbuCK05Dpf+Vrf/sQVysUyDjTKe67DgwN6GAzOo/b1/8KN1Cl+sgS9b9Bb3P1Cqhn8JNQ/0Kxfl2x/vfcucDPQZwZ/CMu4sOJtkUkh51fyCISWdA9z7sn2umqZBXdPuHGP3reM+lFG1gJenUD8k56SF+Y+2e41QglhPNxecgCU7lIHgrJF/at47uiV1kJ3xX6XoE3o3/Hv+TmztN/xdmjMjcp9PVNLY36BpeBfxGrGvX1Lrx5+bL62oZ6a7O+/EDwPoD3QubJU9wXMjCnB5AC701y+8p/xTvQEdh71VMti//HoG/B2/PFs8sHine8QymtlSoXFf8PGBFVwP3oPrqWcI/IhHnfDv84Pn6/guTAPgF1K4t1oG1k2tE/jvvvZ0jdtXgFehb2q1Vk1QDDKLJ8sHmnfc8eO567Ubtnj5b6WG0w9S3cix6gzfz/4kMf/r/47LqAVhvQ6f1arV/fotW2wIV7NX693q/hS0+rSqZq5Qqg/wEeQ2fTVWSPhE7JQkMOpcqoiDQrROLlKjymlNUyvTKpQS6Qi2tkoBlkxzZ0Oz7Ga4YJodv9gTp87NvfJpL9B5x1HqSaySgIF+0sfRW7TtRRuYeUeJtKe8vnKzaLG0ZKO0hyyjaFN1OfAysVUS+x/04RyLl4L3UdfgogfytCduMd1A34KECO8xDY1fRTu+hagJwoQm4EiIODnCQQChUO4Ri1Ds+RWY8ufcWHEc9/yqxTyRXOCH6ySyeX+Vs18u3Q+tnCJOUrfI+sq6ULLEupUilVSuXnK6yILpyJx6nb6ItLXwclgJf+EOs8b4dn/NaiZR4q3umV98sfY3+9pJmeSoEGexR9CIW6Henx/Yso4CP3Gx67ZEkCJfyeMn7w5A/Dfx1SvL4Y/avJ5F2n8bIr6Ab07/Rl/+PYQzcsFXswdR/djJ6g932ceAD/VArFA8U73ayS1klViwouHvwD4sHXF8QD+pZiPIC6lVC3IB78oxQP3kfP0gdP9XX6YIWvnwBff+F/7usnTuvrYN0nqXVA/3TWTe+Yt24acnwK1O0C0yezV15zh4p3Ac3Z65JqnKfwyex1IQV6M7HXpQiU8NO/+ST2uhj9nWCvS2OnagpO+vc0hieS409V0xL+AyljmF+TcQuhhTsM+vesjJWhE9bgirXD/oytZnCZB9alnTEbN35qNVKQanRi7ovZ6lx/ZsLUqdcwrjZTrdtD/8u3tbIGeWurvEGmpf4bql0dbgAAAQAAAAMzdRtvox1fDzz1AAoD6AAAAADWFFDSAAAAAOOmxWr+/P8LBNkEXwAAAAYAAgAAAAAAAHjaY2BkYGBh/PeWgYFV6t+ff39YbjK/YEABjHwAtZwH3AAAAHjajdIDrFxRGATg+c+pbT9jN8+2bS9q27Yb1YhTK2qcOqptK05tezs5eajbm3yZ/1oj1+GpOiBIZSGCbPIOoWb2Q6hkwU21QqBqS3Gw4SOKSFRLHtcKNj0cNhVHYeYcG0XIWO67B1/pCzfuK5PHaKMBD/mE9vIKreU8vNR8dFTL0FuNRoLawMylUNrN9UPoLSuRJF/RTc3g/Aa9dRD3HaLD3N+nOucxsxGgktBBbYdT9Uc7PRPt1GB0UuVozmfxVU4kUSRlUwD5UzFlVm9LMPMu5PHcdFnBbUXw1c14bjTc+Y6F2geF4mve18IMx0vOW6g1cilIbjFvMtvAR25RGHwpSgl8KUq6ody4BD+5g45SikopdX2SZPSmJHGgAyXJXDQmK9a4okF6A58nATOFVAGK1FJE6UaIkduwqtXw5LNaZTmC5DIy+ExxsoUOwledMO8cQcmU+Z1e3809FEkOhshSFJltg9BGKYSq8UhQlbyGne/QG94qFm6mH7+h+yHI9CWQ/H6Ej7BRGT66btMzzs1IavvyvTj4KKbewnke3EyX2J3vme6Q6c5v6CWoZ/q0Ga0Nduo7plNkoXhKqunT7+gb1T1jr75nepUMm8xAkAyFp/SAN3WidtILvtxmlVJ2fZrZ7/e/x+lh8NSlFIdOOgqnNCknFtFGWl/NRftpSbU99FE5JYh5BXA5aRJNoEu0gnbQGRpVo/q663663p7qY0fWegyA5DVzCn236Pto8g2kN8lSAHjaVcFDANgwAADA2naqtLNt27Zt27Zt27Zt27Ztv3eHIIiBVEPGIIeQN2gitCbaGX2GVcG6Y9OwXdgV7BkO8fx4W3wJfhv/RmQjqhDdibHEJuIs8YYkyZisT44hN5DHyduUSaWmClKNqH7UOGo9dYpG6KR0I3ocfYl+wnBMzJRimjN9mSnMCeY+K7EV2XbscvYl+4crzY3jvvL1+bZ8b34kP41fx+/jT/Ev+C8CLshCGqG0UF1oLAwUxgrzhY3CXuGk8FqUxGLiQHGheFC8JD6WNCmvVEqqITWV2krXpEfSV7mVPEK+r2RUaigzlAPKJxVVRTWDWl/tos5XN6sH1TvqNy2FlkeroDXWemuTtUXaOz25Xl+fazBGKqOm0cRob/QyhhoTjNkma1Yzl5ubzL3mCfOyed98bX63SEu1ElpprOxWIausVcNaZW21DbuJPdteZm+099jH7Uv2XfuF/dlBHN6xnNgp7Ex1DjmnnKvOA+e18w3gQAIAJAJpQQ5QGJQDNcEasB18cn03qZvBze0Wcyu6Pd2F7k73sZfQy+219RZ5W33Mz+rX8Tv7c/xb/ucgaVAzaB1sC14Hv0MxDMKcYfVwcDgh3Bk+Cj9ABGowEawA28O+cBXcDPfAo/AcvA7fRXSULWoWTY0ORq+iHzETu3GxuG48Lt4Xv/1/gvT/AAfunuQAAAB42mNgZGBg5GPIYmBnSGNgBfKQATMDIwAVqADyeNqNkINSRlEURlc2Btm2XYNsu0bZv/0avUZ4nJ6nb+7szItz1jaAbB5JIC4xTbwfN2gcR3FcuXE82XG5xgkM82ScSDP3xkkUc2ucTD03xtn0YjnjGsik1bjlLWdcJ+lUG3fLJ9+4R5xu3CuCdTy4OMTNHEHdN1xyzLK0fkd/w440J7JdiE7F56Ig+vV6GaZDb0Axftm8BMXtBMQ3tDtZzmVfYZpFVRhniVVZTomy4VQN0Ma65HNC3EjjZ1uS38ngkb2SHuXpppMui6/EMogsh+hjjreYEYsa+V/1j9IvFSfw4CWG/3UjlVZxSGRxjpdffu3iMW70VvIWEXCkU92nusM6T2h/BmBnTlwAAHjabMEDbBhAAADA+66cbdu2bdu2bWa2t2C2bdtmbAx1zDZm70QAaUc1lYGQHW1DhHba66CjTjqHTLroqpvueuipl9766Kuf/gYYaJDBhhhqmLLKKa+CiiqprIqqqqmuhppqqa2Ouuqpr4GGGmmsiaaaySOvfPIroKBCCiuiqDhl5HTNda3lcl4xORSXWZRbbrvhphdeeuSxs845LtIxpWWRVXMtDTdSbi08CJFijfDHOhtstskWBx2yOkSFaNlEa2WU7JLsluyOkkoo5bn1TnhoTYixVox9nphkiqkmm26aI2b4Z6bZ5pjlt7nmW2BeiLXQIksstdhRy1y1UaLlVlplhXj3vPXaaBeNcckOY0Ocv8Z54533Pvjok8/G++KrCb7b6bIrEvzw00S//Lc/ZJYiVTpB8HDAQABAUfC/2LZtG8fUl7QXp4gszjtjECZClBhxEiRJkSZDlhx5ChQpyZQlmzIVPfXSjaquuuhBTV/qNPSjSYs2Hbr06DNgyIgxE6bMmLNgyYo1G7nZsmPPgSMnzn6nKrrAbSAGogBaZu49IsOiMOh7eFHhxFD19oHxD4me2QO6o2eO8ceWFI9+MRaCxySTAsq7kTfL/YQJmT4MS7PULuylDEYwhglMYQbzYMYghwJKGMEYJjCFGcxJnnMoP6pxbWo7tiG1r3JsSj9vZvU/cqU0+n04ICWTMIIZ5JDBPCjk++EfXXpXH2et0X/1MYa5Ls1y8eLGs6rulNqeztHshe6GIV2k4ecpZJo/m/GipdEbYqDJz0UAl0unx34vQ6E1SoH10AImYI71Ieb9vWqkFKnUcAvmzhS1) format("woff")}@font-face{font-family:"OAC Plex";font-weight:600;src:url(data:font/woff;base64,d09GRgABAAAAAF1EAA8AAAAAtJQAAQABAAAAAAAAAAAAAAAAAAAAAAAAAABHREVGAAABWAAAADEAAAA0A+gEL0dQT1MAAAGMAAAooAAAW/JyQ5naR1NVQgAAKiwAAAFYAAACYr/7r01PUy8yAAArhAAAAFoAAABga3sHlVNUQVQAACvgAAAASgAAAFpfvUE9Y21hcAAALCwAAAGzAAACfHO4jI5nYXNwAAAt4AAAAAwAAAAMAAkAG2dseWYAAC3sAAAnJAAAREgCvXQGaGVhZAAAVRAAAAA2AAAANhzPjf9oaGVhAABVSAAAACEAAAAkB/gIDmhtdHgAAFVsAAACMwAABDgdRiqubG9jYQAAV6AAAAIIAAACHucQ1M5tYXhwAABZqAAAABwAAAAgAR4A0m5hbWUAAFnEAAABDwAAAjwySVzfcG9zdAAAWtQAAAJuAAAEbRPCFc942g3BsRGAIBQFsLzPaeU8zqjzeE7BNrQ0kAguQDnFLZ69vD7x62KYWiqHtgBvbQYaAAAAeNqM0gO0HUsARNFT825sG9+2bdu2bTO2bdu2bdu27fRU7Kxavad6LASk5m1aknj40adf5uGP/vjxa2797MdPvuLyrz/4+VtykwA4cIAIhX50RtIJM06YRaEn++qTH7/lYXu3vd5e/s0HP35FQcB7gc8lnyEpKCK87ugSkr95/xvd04xPbI8Kk55UgEiJfMWwjJ5V+2Ba0nKn6qq6Kqq0iupf/a4f9bU+1ft6Uy/rWT2uB3W3blVRXa8rdbHyK6cyK62SC3azlfWsZDFzmc5ERocxlP70pHNYtqU5DalNVVWkPOVVmpIUVk7+ZiK/oujGqDfSQ7HRL+5ToryI0rFqY6/x+nvs43aOfd1eaK+399k77cf2M1szlqrub9mLvGaK++f2E3uTvd3ea9+1L9lnY9nju0pla9vk9qJYttsFXpPf3mlz2ctt/8PPuNT2Rsrs9RltPpvFXm9TBCMyoKN/TETykCRSkpoE6clGCnJwKxmoQEWuo3rIDdQJuZFGITfRJORmOtOFW+gWchtDQm5nWMgdpAPuPo9x6wlDEPW2ef3HbWYHsIs9JFekZKQ6zT/3bpQ2+CJp+Vq7tVXrtVKLNVfTNVGjNVT91TO0zqG3VXM11G7VVlWVV0kV1t/6Vd/rS32sd/W6XtTTelQNdb/u1M1h3bW6XBcqr7Iro1IHE9rtOOxnZ7iKo9Ehjq/ksDmMtWp4OOVDCjsOy1kYruuE6zq+6tEwO1zZ0dD4vwakhyB03KfYfPZS28ZeYx+3c+x99nV7kb3OPmc/tp/Zmvb9WHZYX0Wf23e8pqr77fZe+7x9yT4byx73pjajrW0vjGWh3e41uWx/r2nrfpd7afcr3Zu557H5bWp7py1gkwcj0iBSAKlDS0E6MpGKrFxNeq7lVi6jFBW4nkrU5jbq0oQHaE5nnqAbw3iVEYzhMwQktwTFQU7LGsq5OoijN57gbh20aIeUn4asZw3X5Gtwl4qWCncatMNdGxzW3a3BYd13/9zzTg7umXOfZH4zb2aerpojSyL1qmftgModk3V5N0mwu/fJan/6C8/+cS+8El7hf/4qkYTv5N0ol1uuh4jb7052A3vJk6Cgpaim1V4u0g7jEu1wruMGJxJ3NqqJVdRna0mMcbtKSxpZo6pWS1GnpanXUjRoaYo0qjSXmjYtEz1NzOXaLC6NN7vxqo1XYbzbxrttvJomLUmzlqJFS9KqpaJ6E1hv5Rixn6ceo1oVHJ+YjewbbVb7NPFk4uHEzVopUZs4LXFCfDHeE38x/mC8On5crM9nwOPedVfGir5vDqOPt7nDjNmoYioV12kJq2skyXmcb5WXaTlK7GM/2plyZgexN6yRl4IUpVGGwgrDrkfCOqMyFjYZDxtMhMCk+1NAWtWCisAYMC4TRk2pdG5hhrwUpCiNMhiWGNI7bJ4RMO+35l037w9MEDPvktFbZFT9aN4tvaGSd5ZJ0Ps9Wb1LercZBayrolgyPqhYiupaJDqC/anQu6BnnZQee/o5q31YS9qZJchLQYrSKCrJVmr+hlH3fp6B9UbHcm3Gn6e0rWKLCTnU/j8kLwUpSqOUwjxlaXNKHdJpZJeR3dJj7l5z95m33/0B4ACzfEJeClKURimRoSwd9tSluhfoM9uAGQ4z4lPyUpCiNErJHsrSFuZod92hstNjGO2xv6XH7V576SNJv/4BO0ir+lHFlt5g/ln6QY/z17OkZ5tuwLorFSwZG1QsqSixH2Xp8Dx0gcoDUalqQcU6+/9pZx3RPAI9P3flHJxJgpIRZVFBptLD97+a2Q+VY3s+6Ph5qtsqtuiTJLXhPeqkXhrEq4gDGCHHqL2NqRgP00xwCNF15n6cy0IrbWbLWe2d5KUgtWrqpF4apOh/jZJlJ7BLdku11Mh1cr3cIDHOC7dxEOeHl+zhC6v8xCo76HG713VfGLWPDvv4NLqqhkkw6hQnwldMhYVfPTHOIgn4fRnZARU7TEvH0sy6rdndm/I8D3O7diNXG3lM9HwoRM+yWnso0kiJMvus9HqrbKeDTrropode+pmM7stll/0uM06ig7wUpCiNUiJFWVJ/etXHf/Zn/yL6YMrSbf7Unyp85punRq6T6+UGiTmfVDTTZ4nTEaxbovfa7jMO2fXr99oB15KEg+4/YJWT+In0snB3G4cBeB7ze8fMd3/9MTMz342hfUwpLc3A5f2mKq79aVuG6idHsmU5FqZvlPShE5bnFL3kTjCvUkcyrCQzNMK+b8lpRzG+o8m/0qUScjLt4wJ0/epX/BRETcflJF0GkedLeuTj3Qy1ZhlgV0enaIB+pGVfCdDyxFSc48hInJZhQ54jz6e0cVQ8l/nnsQxPyLNBPWw1p/Mnfb2FC/Zq0aRdSDCI76inbbFTouc3OmrLaPc6ooc+QzoM6Bk956Ie8VUJ4KI9rTXI7RsUaIEhe5GW9QcCrtyTVOeuEhcsz3lcubRG1m2BP+ka/g9SchtbEaiQqW9OC37LT+MZQan7Mu7wr4wXcfzCn8msWHeeb6jTYEs9dIJD3XGCExLfS0L1xkjO5cKmOu7Ec0npsi3EE/zvM8LHJ/tJAc8lL2rObSTLk6wsvMS/hRaaOjnLSVz0HtvkNgeid+hbT9zisymp22UwU7amEbceddHkqqeGVtLn19UQhzfVjZjJMObp2KqlMFegrM3qjaYEn+J6PI2OyoRdON1RnDXlo+Vpup5aTdZL7vUvV0PNGNHjO3k6eQ7pxnoVJOpcK9FzTv0YQOPIRLSpqymZnlOhI19FM+yEmHmLKtW4g8+o8HbypFCZRsZqrImC7/GR1vBU8Du+VHsOOKURs43YWv3wvqw8Kt1xQ7Tlwlf13udl/Eczb/wduqa3a2u8p953zvvJBZ870TIjeiqFDxhqfA05FzwxX8hpV7H96AnDb8gvRsxU4XnVG4DLVGhLb5pjd1Iv+YZTYZ3CPkrnNIR6SbpdCdjzuUQPR89WUK38A/2HMKv8gl89VJsMFU1voxlzgpFgOqHp2/vjdPeSxq4gmd+nwFaMbTJGVEXqiWgP2xskzp8Lc3u3xOFG5DkyfbBu+yApdbWd07hw8Y24wJB8okMlr5ZUhcgNyBjaXk6PAedtH5I8fSlEVZDW6NL6I9wyA6pcM3ZepF94pMgd8dBLvJ8synNuIknNiz+bvCaczOJs5+BQdUW+ql8rK6X1cKnsO6G0v/c1L0r6+12/684ndwP1Ba1kA6IVOcGQi0X1Z4RjJ9Qap/Ec7Tyip/9TPJDdy4mWt1WQY6oc66z3jWCLjP/p0fF8ikMsRpPD+J2pNWyPJscy98BgPXx3O+NMpZkq3bSRPCH48P46xYHgN1RizUjmvQXamqMtqb/z/i7ryTTX45tG4CO2BT/lV6EP/NlL1CcZzXd8L3pWQuZlwJbSNxizByBZzigMw++Yq7HtWfUqViG27WLsFGKzlJRj27aNQmyncG32PXu2V9fnqW/cOv/wn3eZLjsxOWan9W7tlFdQHBdJESVNVu7NU5RrZZGhSoMsbVGkD4MSw6LOKGM0dEarxR4cIfcdL3bmRLGLziHtyvXcJ494gOc4gRd4gzN5iw+4SGf9LsUmPsOFg2655JDE6RHd+MnKaSc+YbNehSESeICkJEha99+Olp57ycH0dU0XYe1qRBIgxaaqQ0FMZDRRUaKsiYkCRc3syms2X1G1tSUjMYv2xeLDb8lqX2aKAx5LUDhnsTOzvBawzwJuSwAdG72tRA/gkoREQPeiQoqAcFOSawXCpAHIaC+L2LT3WRxW771UqVldcGpydBPT8YxLgpvpYqeCpChrEqJFW5MUDZqamVXXbKkSamvLN6tbLnpw47L48Vn82pcp2rnSrGeabQYHXaCdUjPGxjmDY9boTs2z2I7Vbj4ycuXI+SOh4eeH9zdWG/eKU43tjcLgp4OnGmLQPhIamD9w7cC2/d+OnN93cV+pt9L+tH1sa26r0Py1eVvz6Prz9Uvr29b9tftre1dXV86UJMpPlnct9xf3LXyZ3zP3a+7s7LPZXbND4zKVTEh4x5NeKX5Pvzue8VvTr6ef1dyfejV1aKqV+DpxZ+JmeYwwtpf9nDK8//DziZqcqoH5xvbx/+NPGtvLJdnjacP7R+ePhOT4lOz3p7LfU5pHTxzBBDkGVV09rXl0ZP9y/4Tcr+HTQ8/2LO7+sbvRleuYH7w28L3/Vt/T3h+9g5693Te7znV+75A5bNuT2OmYeo8s49R3wRJtxqixG0cyxNEcy96cLPbjdM5gf33PO5DreY5D9N3uMt7iM67Xeezb2RWb9Z+fU+KSCDzmQrymiU/SI9fDkqhcjpnLSJr/kzb/ISvXq+YSBuSxg+YbGHJ9yHyfYfMHRsyVjJrPM8Y6Tu2Ct5XsDAPwXHIuM6PUlNMso7CMwor7izbMy0G7ZIaioYlJoTIzMzOk1/I+Gs+FZVD0aIznfN87Z854YU/wiPeHjD7MCKOMMc4Ek8aeYpoZZpljngUWWWKZFeIkjJlUQ4q0eTNkyZGnQJGy+ipUqbHutQ022WJbje+/LYFdUQK7JPCP2xLYFSZw3i/OC+5oF7v/k8Afgsu6u+Jb13Tbzxt9bsBxkFuJ1CXyQ4l0JPJZieyVyD9eJpFdvUQcZ5hljnkWWGSJZVaIkzBmUk0p0sbIkCVHngJFSmpbZY06DZq0aPO8hNT8DukcCPayjxh93Y50/FMDJzw/xdluV0IdCf1bQn+XUFc67kSq6+eN1s6A4yB3dv8toW9FCW1J6DcS+quEahLaJaGOFA4EU0wzwyxzzLPAIksss0KchO8ljZkibe4MWXLkKVCkZI5V1qjToEmLNs9PoebsRh3r9O/RGvhFuAauyb6fN/jkG+U04PEgd3b/H62Dji7XdfldHX4mXANJ301R8rmy71WoUmPVa2vUadCkRZt1Y22wyRbbxnuvit01o115HzH2e/cAJzw+xfnuH52bv0SV/0nle52fPtV3g37C6j0fcBykV/16dE3/wPm53rumjT5kvmFGGGWMcSaYNO4U08wwyxzzLLDIEsusECepnhRp82fIkiNPgSIlNT0vKdao06BJi3Z0bd8pmaNhHv56q1ZOBzjh+RlZnfVaL5k/3ZbMcTvrXmkclMBGtEJ/pfNT4cocMuYwI4wyxjgTTL7qnaxzs/uyOStUqfFwtDM5o/gLYtzclTw+xc3zKnv7crQrxXodcKfP6iJagd+PzuGBl96BjDvFNDPMMsc8CyyyxDIrxLm5H5s7Q5YceQoUeW6HzpHfS3bbsEt/ztFO2NUZ717UiXNxa4U6Hzq6tUKDIFqhXw7cdXSWd352dNYXDDPCKGOMM4GuZL7TW03Gq1ClxkuuJmPfH54Pd4awOncDef8uUKG8T6myo8qOKg/1qvR4kN4O8B9V1lVYkP2Zl70DhLu5sVOkjZ0hS448BYqUjF82X4UqNVa9tkadBk1atFlXxwabbLGtngfD/J/7CyC669++z+nyiO52665PR9d1tB7d02IvlflrucPf3B/T5syQJUeeAkXKaqlQpca6mjbYZItttX042OW+stv1sZd9xOhzpe533RzgkPNxzIo4zgnvnfTNU46nPT/jqjzr/fOyuGDG8BrzOEyj+/ngmgz7CfdO19iAx4PcZU3c6xq7T3oPyP0R8w2pY5gRRhljnAkmzTfFNDPMMsejanjM/I/zBE/ytNfmvbfAIksss0KchLmSakyRVmOGLDnyFChSUufz9lOvrVGnQZMWbdy7ddNnZUQ7kOQuSea0ZI4GrlXPTkvmgGS2JNKRyLokDkoiJol/95Lw/SHjDDPCKGOMM8FjRnmcJ3iShM8njZsibdwMWXLkKVCkbOwKVWp8RLU/dt5/7rx/K9jnGHPs/W75ZXAA1QfH9HWcE9476Zo75XOnPT/jujurw3Men9fzBZlflO0l5/+y4xUr65rfk/28ITig068EAx4PEv62Ca7q+lxwn87vt27st707h5qGGWGUMcaZYFINU+afdpxhljkeVcNzU3naa/PeW2CRJZZZIU7CXB/zmY/zCT5JUu0p0mrPkCVHngJFSuovq7VClRqrXlujToMmLdps6+1D4brYzV6z7HOMOd5aI6el+x/J/i+6kk5HV5L1IqHLQUyaTWleD/p5g6vhjXbKAY8HuUvy93T/J81d1tDv7Dd/so7++JJraNJ8U47TjjPMMsdj5n6cJ3iSea8tsMgSy6wQJ6m2FGm1ZciSI0+BIiX1ldVboUqNVa+tUadBkxZtttX+zl5ShEkR/aqMkvpflNTrnpPU8ejKqt72e21HUl+4eTe8Kzgspf1S+o815/+hZNJYYRLMMMscz0vCawssssQyK8RJmjtF2twZsuTIU6BIeDdVT4UqNV7ybqq2t1k3O+rtCw6g+/CuejbcU87o/JzOY7etka9Fu2wruEsi9/hsb4fVrSqHjDXMCKOMMc4Ez+n21rk1ZoYsOfIUKPJMLXcBXUW2JWC4SK4kbRA8AdYTuhlp4wXIuGBpwZ157kr72JJxwz0t0DhtQJRRXNuy4u557u6a+dapO8kC1kv3WO76s6vqVJ29z9n7SJ26da/vGavpKA6Rfr3/Qo8Yz7WVYgwvpIb8qCR8GPvP8aGZTKQkl4dmMs6dLp9C54beUtviwzfqLYfx75joaTyDPdgrz+F8rJcd9HPwJd2ncQZn8Ua+vHdobOCXXNwcTVH2tBrIUwOj45FT6eKRsyuenQ7UXFtyGDGVPPHG44T8n8Yz2INQAtcfxwn5l6IM5ahAJapwwwwU97BzFMutIsL3RQctn4hJjoi+Id+FHqo8GvIdX+mZisx918vnKdc+jWewB0cdOyaP4xgu4tT7Db3JsPVO529mIvK7cd9LpsjgB3dvuQh9r+PjlSUen29VmlfieRw5VPe3hbZU9KaiTv8qz+v712H602vHcXpLUYZyVKASVbh+Tvfx+N5W3SWQRAojHRuFPNujyTHkWHKc1AnkRDKfRws8HZxEWgFW6i8pcavR5DPuFn6gtG3RLMyWNscspXjgz6L7ROT9eBALlXQRFktfgqVYhuXSVmClMX4V61aTa8j3SPug4+vIx1z3OJ7AsPfK7N6BndiF3SjBk9KexT7b+3EAB3EIh3EEz0t/AS/iJRxTzuM4oZylKEM5KlAJMRZVK2+NFljr/DqynmxQ9kayCc3OM1sK30dss9+O8H1Wtd9l9ArfWDX/6XVNnzGr3/4jyn7TDasPaSmZvn1wBWK8nCaKyXzxEPoD21Nc+xbbU3EH7sTdCP2Ccf4dtgutt8zALPtF8purp52H+biPhvvxIBY6ZxEWa4lLsBTLsFzaCqwUM6vxTiV/lwhYp0QPaUUPK/UjSvWYax/HE1hP7wa2bcQmbMYWbMU2/A9WObQBXlLm4zghj1KUoRwVqEQVTjrvhh4YF3ARl3AZV3AVr+BVvIbXUa2eGpSnWQ/SJv7beaBD++gke8hebb2P7Mdt0XS9dyFmGZGrUeNoLX/VkfVocFUj2YRmz1ha5NgqfaQrfzUqxAxPOWZpBdV4s1fni4QfaZ/f5uXXebhXe/x6aIvFeoF1aughTxBrRIpvpsbfSiWb0MyjrVY528RZu9jrQBe60YNebaOP7EcixNl0FNI/k7xFP3CWxSPD3iznnLBfijKUowKVqEJ1aN8jfJ8gy71otisSZBIphBi3CpALT03plT9uxW0YydpRyHNu6KXIsfbH2Z6AfBQg7p2aorfw21RMs38neTfuVSvTnR330bmZu4kojk92bcQmbMYWbMU2bKdrB3ZiF3ajBE+GsTOKnrbu8gxvu5swO9DbOL5P+n4cwEEcwmEcgdi9occ5weZSlKEcFahEFU6y/Twu4CIu4TKu4CrcOaizHOTilugP2ZGthLxk/xn9wV7Hjjl2HPnq5/NxPzHUR8R+dTZvqhf2OKcUZShHBSpRhZNv0Iaq8dtRlrhKIIkUbmHVbVpSnu0xGG97AiaaSeTLdZLZZVjjtj8V04wtd5J3o1D8xOttx6Ltrt2BndiF3SjBXvnvI/fjAA7iEA7jCJ6n6wW8iJdwjL7jGHZtm+7zuICLuITLuIKrqGaPmo5EP2urkRUV6A0L6Rvhv9UR98J9jn1W7eaGuejTWvYzqBr4B61uNAsminat1xlhtiplq1wn+rhfCV7JktfnpX0nrJU1hHVkvg3rVnO1KXoHPGdH2up/jitzcUtUpMbb1Xa1u/AONV7t6lNRvhwm0RfuBaKRavxwNBV30DZN2p2278a9epPpAxXWpy7QeJIHamkdq6zlcs6P1tO1ge6N2ITN2IKt2IYd9O115lHnHaPvOE7QV4oylKMClajCSTpPseE0zuAszjt2ARdxCZdxBVfxCrtexWt4HdXsUm/hLtczEPU+efCOMF+bDKsOvDMZU2zfoT+Ypl7jJyh9yvc1V3UpX0t0zLHjOOG8UpShHBWoRBVOuf40zuAsql13b7wCyDcJJJFCHsbAOggLaJd6b7gjb2FrP83fjPtQNV7E0mFXAOWzAzuxC7tRgn3YjwM4iEM4jCPIlGbYp1nVdE+KCtXeHGNdMX+8x5UfZNU6MtzzSa9xZq1ariPDjAeNytmkZM3K2eJ4K9qVu0O/1IkudIvIHsd6xXCf9P4wbxkt2iYqf4Exq1DNzTbnm6NOinnyXc76ILnO8bjN3KXWT9Ceoj2iPR2+sR/mW3JrpqXVdpu1l3ZR2zFQGvXZ7scHwv1xFh8lkEQKeRiDca4e7I3Yly8OjCWxp5TtLcakqZgm/U7ybsw2os4R43PFzTzMR7E6uk9d3Y8H5PMguYBcrD6X0LGUXEYud3wFVtKzGu8SCe+J1DMeUorh7r+3s3cHdmIXdqME+7AfB3AQh3AYR3Bjz5eJBmUrRRnKUYFKVOGkMp7HBVzEJVzGFVxFmE2w2xtEcRzwYHi/hnda5N0aZrrp8N5Tn7llv7K/hb9/GvePUUINfk4Nfo2va/k6N442ffw6kfdQ6B8virbbolppdWqlHg1yaiSbaGk2kreQrdLb9W4d6BzoNrdujLq14h49Xy9L+xzrl/bn0QhHs9iZQBIp5DgrF7ewfaS6GoU8x0eTY8ix5Dhz2gkwQkWT+XMKi9+ih5mKabTdSd6Ne50zXckK1d8M0owoKpLvbPnMlT4P81GsLw3vqeAB/c+D5AJyoRpYhPjtvpvjN/vI8B4LVhpVVvHfanIN+S419UErHw+ZNz7musfxBDYo50ZswmZswVZsw3a27MBO7MJulOBJ5XxG77WXvc/a3ufYfhzAQRzCYRzB88r5Al7ESxgcSdVLKcpQjgpUomrg36OTyn0eF3ARl3AZV3AV1eqqhmdrUafcwdtRFHubbDOT7UDnwKs8/K88fJWHX+HhBh6+yMNXQkxZWTISfJCVVe5GrH+JsgLejyPusyKuzxkV6i5y1nORMjuziu68eK6t/uptN8gpnmu7kxONLY63ut9pNxPpoKHT2NZNf4/9PvSjQO/53WDDnGDH6zR8Lsy/a+zXipw6rabefbQ7ingOri00ky1oldbGynCfiE50YfDNRvShH+No+ixNX4xbUKQscnwINVpILVlH1ss99Mv82UK28VEn2YVu6T00hvcanddPfigawcYsOSaQRAphZm4WnIs8+6OdM4YcR46XNhH5UTLMYCYNzsDPhzW5e5WrUETNoHkmi2d5P66I1bP1nHNoLR54VEt4NrofD2KhfBZhsTa9BEuxDMulrcAqea9B7L2quMfkmcdc8zieQJjNs20jNmEztmArtmE723dgJ3ZhN0qwD/txAAdxCIdxBGbsQ2v+ylaKMpSjApWoGjgSVStf3GdlRw1kI9ua0MyuOIJSvFArihqjDnQONPNGWdRtu0dU99LVZwzstz8mnsWEseZnaupwptQ9IaKqRHgdP9ajmb9b1WZHxr/d4NuhN2VJa1b0FkQ3yfW0HI3yYrVYH/ouLSqst0S3yXmnXE/K9WzUyJ5mtBqD27XCjmh0uOvtdl6v6Okj+1nm7pP+gjDr+kqmjbXLLZJbm/blnUnH6vRv9WjQXhvJJn1RM5tbREKrMraxsV2sdci1E122e/VzYa7A0pvVQFVoT1XO7qC/E11KGd6JJYNNculnSR6b9LuOzBH7xbxRY05WL68GeTU5o5mOFultjnfwjrGKzkRcd/AWrzIX0mUlLy6N2KlR0tC6tJYGZzRqy032m1naYruV/IRW5M1xrSWhbEkyRabpzDGzycVI5R+FPMdHk2OcM5Ycx6fj5TKB3+NvInwn9F2TbE+W8xTeGJqLnB6ai6jLOa4Pq27i5H48iMX61CVYimVY7tgKxDOrfw8tJzzjZ+9GbMJmbMFWbMN2Nu5g305yF3ajBE/S9yz22d6PAziIQziMIzgq7+eV5QW8iJdwTFmO44SylKIM5ahAJbSiN5578FWt8oQ5KEIfJ0LMO8VRndbVJUKa4talnN1kj/Eibl0NfNvF+4W8P1sNqwV+HeBXfTPZQDZJCznab4fIcPWPQ7yPHmyXxca+0B6dUaWuaslr2qTyd4jxLlq65XrN2+u2R4W+c6bU2VKLWfVB22bYmdJF8czKfiM6HOtEN+JWoV+95ttj4+U5UU7hCavonGR7ihynsWE6ewsxQylmiqVZ4qrYuHmfXvt+PIgl/7Uqa3sFPqg9ryMf4uf19BzFMXkexwn5lqIM5ahAJapQLe8a9tQ6P4xDaEAjQs2yrwXxyqh7AqXpg9GaJjNvlrrT1CpnszxzN6Kf6sy0w7Ms+hcaXqHhDA01NDTQcJmGC1ETWoy9rWYEbdpwOz9m7kRoiuK64wXagqYfhDvpWBMvsCdoifLjyHDV4AovGqIxmTlJbjxyk63K2iatHTRFXfLott2DXuf0keNp+HxmzKtQsz+l4W00jM2s8iXiWY/tRnHRpF9uJlvstyp7u0jrEsXdPNejZfWqvT7b/fL8gyiLjxJIIoU8jME4dk1h+zT1PJ1PrNRn7jJ7Y2vE6EK2LcJiq4JL2L6UXEaudO5qhNFV+uN4AtvluwM7sQu7UYJ92I8DOIhDOIwjGG6FpZot4d18eTeh2bEWMr6TC2+gh6jvUoZu+z3oZXcf2U+Oy8y1GtTnBNamMnen6XgG6VioT+292fEWstXxdld2qNNOddnFgm7bPWqkV4n7tG7PIMRCllXVBJJIIc1LOcaPXOTZH4PwTV72TRbXU+RwhzqfxjPTjVRxXfdHs2mby2PzMB/F1mDuY/H9eBALReIiLMYSHltKLiOXS1uBDxoTHmL5Y44/jiewni0b2LgRm7AZW7AV27CdbTuwE7uwGyXYh/04gIM4hMM4gqPyHG7d75SyncYZnEW1stWKj7pQ0wVqekJmbTodRy6b283CO5Tf3VhmhP4C60O/h9m8OkcNFkd58ewG8f1fUruYFrc6adar4gghRUjo6UNkSOuirUfO2sTgbGFMNFGdFZiNFbLRdx1oomWgLWh4CDXOrldPjWhCs7GhRatsDev8yfgpjbbdTxawN8cdBJudNRuhDZProslye5taGMvWO9h6F1vvjBrRhGY10yK9zbnt6EAn+7p4tTvUSm/cQ6jdfqNsIowt7JOjO1ulmji4tv//ta5v/hZm6Wboar5YNA/VkdmOllFH1qMBjWhCi36+lWzjgXZ08EwnvJ9Jy1haxtCSjp+NkL6totyFPBL8bnsO+J02mhDujxyrR6N22ARPXWj5Li3pwdmh3nXw11RSob5m2WJvVE1m6k1UvvlnL2o41G6IPnETapX2eKb3s3hWIC2e7YkVMdxCtqqb8a78kTLlhll6HMtF0XvEzAelreP/h1DD7no06Isag/5J9OcpV5QZm24euteTR7/cV0ZZckwgiRS8lzv0DRca88gxCHdhSpxPTlEH09gfvs8pOgsxQ+pMq8GznFFkvmvWc80vhbhjvubXchaL2CVYimUIv56DP2L5u/j3PfIJ0W97PZu2s2EHdmIXdqMET7Hxadqf8Wx9j9Lvc2w/DuAgDuEwjuCofE6wvRRlKEcFKlGFajpr1FqtstShXmtr4MXGMFK+PfYm2kRGh/beKXK6jHnx+tOX1Ohn5WB2dE1b0o6C129oS9pF+G0XaEtRCznUnpK/pD1lh/Y0IazVh/5Gi/4g6S41ntWR8Zw1J747dFWT7Wa5h3VT57Y5FuYR6OLTbhqDBpjx3dgf0FJ9XRm+e0N/MFSGz8ZlcOxa+xOZ/iDbp1B9ySH8bk1BXGfy96w/tN0PigIlousHdH1nqIeQf1g10ac3qf1m9rXYbiX1QZk4HxOvBtPXg17X9LGnnxx658m7bbb+JmdPzu6crTkTc7JystI/S7emr6TP5Wwl/zn9fHp3+uH02vRvp29PF6QTqe+kvpTqTB1N7UmtT/1t6o9Ti1N/mHo7xiZ/kDyTrEo+m/zL5KPJjybfnVyd9En8KPEdn6/5fCZxNPG3iT9PrE7/jL7BD727EX/opJ8FYW/wk7g97ZNODH3YEFsSf9bHH3YMfToTo5N/6be1dmZvzv5o9srsOdkzs+/Jvj37pqwvZbVmrc0qzpqcVTziC37x7uUR/65G/K6gT3hXjExpUVki5DZbeZmnCuPtT4yf43iiNy68x1Rg7LlH65zu83Z9QJGU2VGxFL/HJWWZz73RKp/p5jprfTPgnT4zonf7zOTdh/QV67Xf39Bu91rT3qd9PmAF5KTrvPekFzgfvex3c6p91ontfldkh3vWAkyLkqwcLz6892D7DsdO4TTO4CxujdL+TxRT+ZjirPX2j2K4VWnvRWKW+dNwz/yrpSeiNP3jsR5H8RbHklEKeZAS32NjEqZknpYWkdv/29/Wz9zTurYUZShHBSpRhQSNtIXvy7QHTTkZC4fsmO6OReqgxb5/o/4Knfs8+QJexEtQu/KUIiYKbWVHaf/X4yiUPU697kiRPMMReD7ov5XsX75qixHhrAm/9HlWPqbLdYaUmcr2P3k25btidExEPqxQXf8dQ5rniuV5mA/9jrFsmvOKWVij3mpRh3o0ogktaEVmPkLLFPeMJ1CKMpSjApWoQlaosSK1y6IweqpDzEJ4yo89qLbvNz5ZMTmU/vnoHUq+wf5GbMJmbMFWbMMr0l/Fa3gdWeHbOIUYodb8FwHfVssJ/k8hD6PlPWGgR32IR/s7sQu7UYJ92I8DOIhDOIwjeC4SMa59AS/iJYyICvxXRvqLaMuKJrIsH9nh3vchesx7xcl7bD2k1jrNcbusuXaTPeiVc1LNR6Hce0n1HHXYzlI3v2rkbdcvqbnBnAvgGVnIcV3waxTO3GO72bGwIop2fkxbCWuKdSPkR1+XltwrNZtfzc3RLk+/cuL/KIzFk3gWYeUe2dFD5oS1zu1yNNfe81GNfGrRgCa0oM25XWGm6hraf0C7WSN7eUUNJexHg3Fo7Ug5H5JqVT3zBv4ttjIr1s4dec0qtLIOPunfY3tvqOk5QUtEvzYc7Oy0lQjH17mqCz1IhrOaWRnmAHDUFZ22+p2bDOsWDfJuY1G4q0A6HJ3Lz/MwH8WRmkeN6+Jr3L3Y42uyn/7ccNRMLhytz6R0oos/u8l+JMz9omBTLVpCjxNanWtjy2p4rNXxEWFVNxFK02KrM2N/bri6BoPrWmhEE8JKMKk38z8Z31WiSY6t6JU+JcTeJEffoq6n4k7cjYWsX4T32f4AwvMw+4/jCYjV6JjrjuOk9PO4gIu4hMu4gqtocn67knWjJ8RCJ3v8D1FS7L9yRG2hROYqGPrtUn5WhNvN8XNDq8h7s78GynPGZXks9UmH0Tkn82ugK32SYaRORat9ktEan9TQr4TSdaMlo8iIPYUZS5KDv2K6Rp7v9RkbfsVhXMjH+oX0d/jv46xsn0QgyydHHghHvfcXuPYvCQz7JycfdcFjtuSFoC8td4SjSbnjmisTwPB/se3/CZpolWh42mJgZGBg4GKwYKhiYHFx8wlhkEquLMoBNEUPIHx1YQDGf+/9X33fbNsMs7287GbbueVa5sxsTJlDnpVbXm42bme6HZ/neQ8N3n5o626D92w8ss9gOfz4oUDIdOSKzZv3HjB/y779e83cdmjjZlP37Ny+0fh9R/ceMhKhg1AgQyDkyJQq/8X12BPrYnXMjYFeWq6v5Khl+moMJ52LLDqRRyFUal109cEnn31RInfMNmt01xGGC70RqIX8r5spDDMbV10z2I0mDXWrScPcadJwHVJ0WP43PnRtzU9uzXeR5o2WGOnUmdc+4FM6XQi1nNQmV62jr+7qdKY3Psu890nmXfLftvzeUit3XKZL4pX4y/u63BqVTsqEOZbSml/sfyUy4/2vI61rOoJ05vDcCxIbmnib3fUMIWxp/c9QXRpyz30PPPTIY088bcwtKSqdwaYm/f8TPSxFd3jaLcWxDUBAGIbh9//uLhFKC1yts4JOoVcqJNZQix3sIQqLGMEIUPA0D169WgJo0wTM33bQWpmYsuCCHHIjDEDBr66ayE58Lm/3Cb6zPGILgFKtQEQvrqMOdgAAeNodxIEGg1AYBtDz/TEDMAMwgMHMrB4mgIiKAJdePzo4Iu46PK8/6ljWljfH3Nb8ZGvTnl65eXgJ5FsjIip/MzqlMoBwApY6B5YAAHjafcwzAB1ZAAXQMzNr23hhubZte2Pbtm3btm3btm2nyo+TLrloD2IkeEIiwhPuiAvgJ5+50wNe9b7PZJJfJdVcjF6P/oynxPPiTfGWJEruSO5N0oU43BvuD0+E58JLIW3IGN4MH4SvwpA0adO0TNM67WNpn0xdvHjh4kUEr/nA5zIroLIel7U/4snXNUmS3HNTezw8E164qr0R3r+FdjcXt3CxF1zMS+qtVMbUE6n7uHD88tfuvGunnXa8Djuy7Ui749Mdz+8I2zds/3H7n9v/2JZv22/xg9EjIj+hAEqhgWZEPwBEX107QPRR9JnbJLrL/35WRj35fO4nWWRVWnk/+NK3cvnej6qqoprMvpBNbtmV9Y3DIok73Okud7tHDvnlVC66239qq6uW+goo6IDCivlHzeg+RexXQkXLrXDIEoVUd9Iyxf1rl512y2S4IYYaaZgRRhltonHGm2CqSSabYqxpZpluhjlmqmS2ReZbYKHF5umjiYYaaaaxppproa1WWmujk/Y66KilLnroqpteuqusp4H66W+AQfoabK7ezjnrjPN+8as//OZ3f14CZSaXvwAAAQACAAkACv//AA942rU7BWAbR7Y7s7ZlkO3IYra0klZsSysyySBbZmYK1E7SxOE4aZs0ubSXXpvmsHw9TI+TYtqfy6UfCr/48Zg5l58y9x959d/sSrKVuPDJ0o5238w8mvfewD5TmKqkKHSWllI0JaEoTmaR2TkZU4nu4h+7eJGW/vXtCTwDreypt7EMqygrVUVRFsbqYB0sU1AAN+FQJMJx4ZCDsRZIWLgPqpRKjoUnpVKh4oKRSBjL2o0+aREuKB2sHRgLzycn/ZwvKu8xru/fsjP0yFAw6LYb/Qa9TqYIhkbbIkmbwxNg9a2+6IbJdw9azDJzpcyqAS58wEUZcKGgbMBFWGSAcECoqrkwJ2MJPWDGkaaPPplf1hdqnq6unm4O9ZfmH3nZHDAYAuZAPD7uizQdHB+/pinsG1t6d63Cof+61qFMxKaiCQpodQEtDz4v0uJk8BGoqJQKQhWkV0aDhBShJJBSdR3JK+vnElPV1VMJrq88byEYjwdNhBw+z/+7L9x0zfj4waaIb3xtIjoVSygd2q/rHQpQP8Wm3kYXQS4dReULGiXiSLJCgBKj6oICpFk8dGixf7N6S1HQFQY5fVzZFdoF6W2HD92ajFdZPInYukhrFVPV1pbV1fn30pXsf6orVL1kyFUWJvxjCfCvoRiQYJkMWIJlmX9aUBRHKCJj74662m09Q1s4/mtNjVVxTVvlzm5rUP8jjV+aODgydDDRcVWHuzSWdJl6PWH0hDlqKyyyh81EW2oo+kGyNWRcmDBH9MUpGSVcsvne3q7k9MLCAvraxu62rk2LG/lpCmzbkPJiC95ExagkNQI8KrLqiIaXf9LKySBcHmxgHMSAOgmMN5N5itBZCyD6w5bI1fMTC9VBTyVT66iqDmxI6vxyh21wp8sZWN+ucsnKVVbrx9ePX+0MnC4rDdY3xWvv9ldX+32BgDfSzRpjDm9AUlLkr3R6C/NUfaHwgLdAInM4rihTd1eFBjz5eRK1TCHvG9MaSgzlJmsl2uJiZU74k7GuZSlVVIhqoQY+SMr3kNCeI5M8R95VJFQHFKfaikpz5ONfTUv1zLKg7yVgvmQCF7s0K6R7c1km/mxGUjLuXeCWhTDuypX+qJQxsrQPyrqO5K9paxgYP+L066pN4HT/5q5Z2MCfQQ3RGrndwH+D+HUjRVE/xC9SpZSMouTgbaK7gbAFNGC9mbXZWLg2H8Fjdr3CYLMZFHr70klcvPQuhVN/TsWE3oWUiqLU0F5RwDDhXDRdR1o6kp9O47kCb1v6dnPHJnx2GVtaFh/IUpqWJRrlJHKGlShBhrZ9n3nkmbs+1gYCtKz92PP8Yy92fyktPyqHPoViBA6Tfqi8rbnxSFtLPd60dL3Yhg6BBTgALyPjlKKS1JfrKnv3/JEj+eWJ2kh/BS4bifeMHHF5tD79Ebdb4zPg4nFXbSjsiYtajMUELaZvsiOiopQ51HKQ5wwJ4MsZESodO6SAo5wy5sYOYplsjjEibdf2urrtXd2k7OZqa7lAXR0JFyPXJBLXjIwcTGxurNtQF49D0SjG8Bj2ZOYLtchgTgyXyT90DH8Wf29sOYbzv0WO3ChOIm5seXbKl60yO9EfPuI+i8wr5yc/cuTEXNEa9uFiak1G93EMQSurdYmlxmVweuqMuHgbYLxGxhiJDRlhpvln4NEN+gAFRFUkOANHLOvHogVnJx6FSq0WVfVO9ya2z9jm87uMTCjW59w+yXXGNN3qJoeTNdvDY8PhDVLO12NxVBrU+nyJxNFS1TMpt+u6NZVGrU5fIJH2Ngf7PIS+FopB/FlKnrFhiN9kCDghenOoc6alrddpVO5dWJhra0KVG/X6yU9t5B8nfVvBUjBIrFyez4gPpBcZcIeuzy9tbQZjc/u1VaYj42z9wgbUxT8ZqamwG9AkODBgkcJQIcBSRDigObWa+B4auuv+w52chGs/gIt/e+7cb9PzDG0U6XGZhmJJMyzLSCTf+PTBsCuvumGxMZDnCl31qZsTLO1owcU/fvjhH5Nr6d0Ln/zkBQoRaXEpYCLeLgdUHKCQM4BCfvr+W7bRC8ceOn3LjrydqAih++7jl/g/PfII9CoCe8LiCNvlHF2GGVBWlObkag5VTV/9vVJbjad3rebRj0xbC95FiqXP2qtVmzoxw798FHrbQYTvpuW0hJElbFEiC/ouP4LK+T+jz/OvIc0m1Lhxjv8HYrtKKI7jc5SE8GghrDFyTi5IiY8fi/0x+rEXvyqpseRbYqdP43P8lgd37nyQzDhD0O9K6CenzJRHWD8GBZORKIMmLLgZreQyVp9zP4QSY3O2mkp1qMpYNRj61VmtTS63ac9+RWOtqLBq8LkrBsNNJrqgwhH3xaYiyPMoQK1aawUyP1xhUZvVVhlIGQKbmMNPU4bl2LH62mnDzI1dXTfOzB6y7y5vresaH++q66pYsB+RDnxp3/6vjA4M1lfVzE/tmJxrqmrsG6ewINkhkKyYUhG5smGDXRaBGeKnb+rqumn6wIFAh9PZETiAz/V9bnHxc3372P66HfV9LIUEPCbAU0LGQWZRpj/YxIfQP/NnkZX/FerA5/adXDydbi2H1kXEqzOtf3QUPc4/iRT8y0I7Ki33dSC3Y9kXcoVPxzORWSZskeHyvKJ1/UPX9/R9fHb2Y/YFeU+c6/V4+kKuVucxVLiNaxv68r5994wM9zT66zzD8V0NIx59mPXt5MGastogUsAeAVwVSvC4P/G/PHoUMUcRy/8U7OK3yLyUJPyFodiTkRoiH3Ag+Pce/smZGdQwO7sVXdi6ldeRtrrUO+j70LaCouQWGdHxcmSSMXvR+shc64Zt5QeKqp0s9wugUtw4y20a1nqDAQ5dR6W5uxMwENulJYSQTHBThP78zOzRo/lz9931FpKg+h3/Cr2/+dEf8r/kt6T7oRegXz7hkoiEXuC3HEUwAEuPZvD+WuQMMIq+D7IzEpqGuWPoli3ddNeVtxyiI5/5VJTG557+1KeeXkqi17fyf0SSXXxJVm8iZ9AHOhP3JZp7+Xsd9KHPkAJt+gxfBIzd/Rn0n0R7WBjd22B0yynLqnOiaH/ZQUbz0zd3d988PXOsu/vYDNfpdHZygS6Xq0s6dGL//hNDYrnPP1q3rX7E7x+p31Y36qfSNj4N3EkpjWhvGSNnZCs8FcyvtnkmGJxpPnNSZ1MobDp8LrKhuXlDBDX8k5zR+nXWCpHrPoFrNeUCrpUkPIf9eCXrEuXlzGPFhrbmnl0NIv+1V3a2rRAguS3R4JZO3LVFlGLT7VOlzQ+sLgeJQmVkByWXZQWBJRW90l9BkrqmmWBz86duvf5QWpaTqJR/C58Lb2hp36Liz6PSnWmRxH0ZDoBEPpBn5WwpTpc57kZEUavFmIc8kx/xTtomIw1xmdvWkpz1x3f39e93T+m6YrFahdfS3D7jbdgvbQqNub0Rr4bRFBSXhEZijTNcODha6fSweqtcIpWGBmtb5mMUIlJhjxCdKQQ2RLwJe545+jSW4balR3HbPmjTC7zOQxslaIBMitlZMbMJ6L1e3xAM1huuC++74op9ITC44Uin3d4ZQffx85tuaGy8YROgJ7MN3gF40vMjWGtUzqFjd/z+xoU43bDwUeh378WLaIQS+aLvFmkutxVLGjTPSNDQHfccbfPQwYFbBgK0t/3wN26f9GAf4HjoRz9C/WIJLrP77FmCryLtLbnzJKCq+N1P7r6NvuPTPzt/95fpL6LNaPiPf+Tv5e9GUv5t6Fe8kmcZMAIfGh2+4bXbTuAvfPp1VIG+yf8UQtQktHVA24DY1q7MTIw4sPQO2sp/E73G3764uB/9++J+vppYlhO0Wv3f8ETv5GI0ujg5tTca3TvlDWk0Ia9QSsdO7Nlzz+joPXv2nBjb6R+pOVw77PcP1x6uGfETyZ1ArHZlvJSwEGo4XMtb/77wrqF7n/vCAnr9kbZ/XXqItA5CayuZ9UQZosBG5gAmjrPOJsFW3vDzWKjeE66R7imPzye7NkeqBqtv3bnzwGPVA/5Sf6DB463qC0RmG2pnBpzXAGYNyCsDzNXEioKroJUowcZFk8o6BGnEPN5WXxOr8ndoRzSNo3XJhfr+qKuFbd7b27q2SbVB01ZbG2+Nt6EvB+0ST8Dr7LGEzL7BWGKwpEDiSQYbZjlbvbXLHampllQT8ahKKELC/FtGRjUMQwUKUTI0DcHzp4f4f0Sqr0xP3/Dsv9+4Cz3Jc5vQw/zDqJdoJwoyuKCnDR6UFgkn8r4a00QyOab5p9dIyu1RV/36mvrFoaaZRuV6TVNNXUM86oms2QbRbs+LJp8ufEUyub2RcOmMtdQURuIWeTm6CTgNAD0v0NNR3oyNxHGUK8MSdRy/j61UDexu8HVOeE8PXdVdXljqbPDWzoYbd/faQ0ZjyC6U0sS1wz0f3TVhrNu2twPrq4yhK1qS2+NXGkKOckdYrw/DT4jsxOpAW2Z8TtwbyhklQ6yau/mtN3ah87j/yEu7KVo4EfLA2OohPkeB05yTAS4oju5q+y55zhPyDu6p74mHmg/s2nWgORTvqd89VNPQUBOLx2OhmpoQXNLwTG3rqKxQPtAwsHEjFPJC2Whr7Ux4c9iv9IeFAjUEPGs81dVQBMh4e6Fg8dOiFpECtMeAFllY9a7wOsnl0we7UoX1PqLCPT2gWX6FGtEj3UcFJS62Y121kcT6bfHEtV9N6y+tTbKejYGO/gG4cFI1VBJ0yTLLDERzvV+iBhAYJLlDVpEbGHCBPbLRI7wTILbWYHm0m+veHHY0O8xVgemG6FiQbXEeKCvHX2guVJffzB+qdJfqFTpWpbBUaty2si/B6rahUcaouYloMBlWMcPV/h6fvT3gS4Q1R609jgUmrr8dzzlMknIToy6vtKsKlMY1S38tqZDeW2q2aUq8EdBpPHUj3YGfohqpfnFGzkiQ9WF2lV0qWTRntCyIYMLcpWeF+J6fHDy97oqHrxm6eXONe6guFM/Ll9ZU+zrd7k6fO1Kcf4VG7fD23jDavnfI6xnamyxUMUoFo3b5/a6BzecOHPy7heCG4zM9exo5lytQtbYtubbKV9nKv2DUDfZZxg+1Vo/ubfO27Rny/bPCIt8vN8o4V7uLoxBVS72BJtAuGCvKDrEbTfC/Q6Y3PgI1NurP2Ik2ZWqwc+mvOO/P29I1F1fUXFyqx/8o1JhSnViW+htSk09qZHwpeuvbpKYt9Q71B+puMhepc453bnfCn9vhKHGbKyrd7soKs5tKpUh7uhLaO6h2iqJYqh0Z4VdCteNaitT3A77XsIrUFwtwqhhdS/Zpqd0CHRlFRUUCEka0NSB5u9sRrZqyVJWYjM67gVR0t90SZwsceqAMOKugr4izKwdnJ7qXehSfJ1LJYcX56J496F4UI1xADfok1DioHsIdlN+HX0Q1o2coHuDLZ2JRDgxbJTD0KZe91jdW6S0x6B3oGYdJHtlmMzXYC+walclBejvQd6nf41eF3pfLIPb2FUNv/CprlId3MKa4jfQ2soQnoI1+LfDUR3iC8rdEYwQr+kfA6qD6CRxKgAsaO079jvrW6hq7zW2r8U5YfCUmnf1bTpMitGA3N9jzHRqFyQk4oS96Evo6qCEB51AGJ1WLJOgVgFB2CRuOqiVKJHH87d86rj0+eM/OewZvxKQVB60UYqtoNMxG1UoJd+219r/92+M34RtJO0IB2rwKbRzUCKEA5UVBGtL3LwJ8VICPAlw8oxqgXoIxzCenBGo4S4SVT469/eomZ8yZ8DgcHjC6B59CNv4XaJ3LpDQ5nVC40u8qAMc5EUeUoeE4JRfH2ZjrptY0iu8h5qmnllJOs8LsFAqCwZRqRb8ELrQUC1xkAh7gKVjeRZfhXKR868ZocLDqmoFhzuWLFW+TRqZDaRp/y03X1Y1wkuEv0JHaMrc/7PK6Oqtw9Qq2MSWDs6h/w0+LNO1MePVVTC5NZDpAyHlrihekkalEgnDgrweKbqD8u8/T0doyV1UEqHX5uan62tFAEf/YSklhDFP70Qz+o7DbBBnJPC2GbsaPOf9A8JrIgMfbH7kmMFCFYhtOHfMEr79zsGv4riMB97H7KZR6B/qbxf6I8MekQz7LmTAyVy0jCPZXo9j6+2/yigjuvA4QnBJ2lYBBARjAivIZmXjupXjiid7em+nrZ5YiZPec2k/9p9hCTvbO5CIN8B//engGPw8tFIAjAi3MBIegIQcThqidfnUhbrZMIBmHIhudoajbHQ05N/YY/Ab49tzMeX/k9W32eX7k5WZ+WxmxFRTm2yKW31IibTQhYpaLSldxSiHok5NuTrQLPyaHCpsyiDf16gliPTAImD2A2Usw/84SseVLCmxRs4A5P7UFfUqMSmoGcbsWkHnhTvog8T6oeUCsyYca9MAC/1uhCvSthuJafI7UMVB3bD3OXw+PqVS2poCap6AjFUm9Td+Mn4aWcvDCMInDFoLtg1ftH9zCuYjOLy79JNbrcvXGYr1OZ29MYSgrMyiU+rIyPS6N9jmdfVGxWgAphWrY6BzxTTQ3T/jEskfhtkQsbkX6h9/xPpWgl4+BHbyJ/yhqTMa9uW0bmAiFV8AlYoSXCbXwh25Bm/56GG0iPl2b2oDzQB915F2Qncz3q+xhxfXf6ltZcT3ICm3hKsicCcPCB50Pr48H51zN2kaHP6xwmTtiLcZwxOqOrIsH510t2ga3J0LANQCOMq6+NU6mvXBNoVLDhtoLZYVKdXGox2Wy92v1dqvCqCxUrvHXmHwd6jJVmy/cxUKNxgArWaOiUFleXWP2dqpK1W3/qrTqixU4n1b49CZfuQIX0EqvYD8LmBiFjJzyZwaTHDiRz1s1a6PRtTVoe8vcxtvR12o31MJ33dIa/PrSGtBgEFZ8v0vv8Oo/zB4v+j5vaG+e+/zk5OfnxLL/QDJ5oL//YDJ5cGz6yiunW4bkEyW2SpvTabM4y8YVQ9KJe3buOjExcWLXznsmGpNXd7d0X51M/0zuXbtuT12VR1fptfXYvBadx9tI5VEW5EYPp7mtompg9D+YX9gMpFf3aoZlsxu2F2PTkch0TCzdCZcr4Xa3Op2t5TVzDrtS5osz+srSsrLSSuSOzNbVzUbE0mdv8Zg8Lfb0z4GW77JGbWVhT4unpERaUgJ2p0OfxxHhtEJDrDMM5JUMsV/Yz5NIFoXNLaN+sKfrVx33NQ3V5df2Nhbk9Q/kSdDnL8RiF5Bp717+d1dO33bbtLAvQF3oJvwYVSnsC2ANuzLz4LLEgxV5B2F0U1ivlNN0ScwdahjsqTczFndpSNZV2zYwU2uxmbQmN7q9bU1ppdkWC0YjgFqn9JmdrS1fG1erpCqFUUfoO4H+EaBfQmmJtpf3Srl7pB8MTk8PDsxMDxFfsTmh1/z4+Dy5kn5XvcsvFARfFI2jLwkjaF599LKDB2P3EjdUVTXEiaWeBWfU651KpRONVw+HQ8PV1cOh8HD1mM5rMHi1Wq9B7xNOVN1ojvqZGDPljJz74mL9IppD46kUqUH3QY2D2k1WIVCK6z8L0uES/BIlJ1Ffoob1j0QtYckpBAvLnOivdhXiE9Zvoj1Tc3huai/6lvUejF+6HzfPB+iPN9x+R/zjdGC+GRP5tFDsAwp6Ip8FxpqJggEIFycRLiUjXDQA0VTlFytHzduvNWw7aB6t/JKZ3Bu3H6x86oumL545c2bo5NCZ9A8qPEkhsAY99qZPwiTkjEnOYe+mzxbcveH5HagngDT8xQDaQSSKUj/HFnQT4cdO0lVWmIlalXXYE/aYVR82q60qn7yh2l5jyT78XLGmTFFW3qGzymWlirKyDi0DWBNUI1ZiO1UCWAXLFt9cofldDz0E38Z/2PzYY5uFdjxWoo3ZHYeS96Pv8ZspDDUUYNgPGMpzccihXQbPQ6T5Aw9e+cADV/InrgR8w1QvzsdSgS5LRiVKxkiN/u4zn+nIfHvvuqvzzjs7hC9F0UCJwQrcCHcyyizykbuYyn3CCr4KffeisJay2z3pX34z//d2nVpnFwp04/K9IMsnQcofiPMQAvyyZVnhQts38+cI93Opv6B38CBplY/CSJmvzEfv8DvQLfybqCwfoVFEXf81yddyW6rDdvgg5Rwqg2a35H8UWlyfokag1VrqlxSPrid7s2iODPe7WNYF1y9hb2ZxuSxkbwbtW6gT6Ap09vL23+traemD60QSzpeSQkHax6g+YfTyhRESZNrKfwL9su9BMoJSKojn8E0UQwVE24LxENyYjIpoYDA2gkMTJ7rsLXbM2apb27F+Dfyt71ira3Wyrbp17eJz+zpdKxuoqQkEa2p2VqxZl1yvT7BsQr8+uW5NxaXP62pj8BEK4nme1CfRH8GydJSVrKMyGR+cUnyny8oigs1LWJjFZRBfUP/czMZN03MN/crZErve5CqbVo00fsPhsLN7tsqO79jx8TVbtxQ1V3E6eyH/cKFTH65uKfyNr6kUdUmbfZm3UIP46UzWTyiy8gWyJJ2To8rsHtC6KfIObqppol65XtkSrB0se/Wdd14tHaoNdmjWK+JrpaMnLtwzwtTZEp6qjobhnuHGJFeVZOLCHhMGUjiLdwsnpEKYZMF3Vlm8qIFo+qzSgi28g3VifGWisKx+R9fALsd6faM7XFcief6rCAX0aOxQRYunSFG0RRs2xWdDDbWtdltNVOtRbiksLwq3rSkknuRI3Y9dtBRm3FqqVdQtK54kqlVquBc1LeoaIBKAsHAnMkGiTpTwS6BsGACERxWam2MtgQ7toCLCyBTtvmpPOGYPzUXdNdYhhVNjbvf7vTU1tuoiWZlRD3kx5kGHApabFUOTdEl50NSldpYU0M/LtLqeQGRMJ8ufmixQGD3tWk1Z/rk1Wm1XKLrWWCGZoyVlPp3CViaVXH+yoELHaKzFxeK7bbwRnyO/dkYpRiG40kfnwshh18kbTp48uf+B22+nb/3k6f0nTx47dgwGBTWS13z848M9FBbwBCAfpoKqvCQbyyIsvlCOu6Wzs1DLkScQTifIZBK1lt5FX+OnVybdwBpfzDuk7ZQDeKaoAurFny9DK7LQl5eh+EIWevHnq2F4aQW0OQt9dQWGi1nohZ/D6BMoXYNVlBSk7SX6KlhObYxy2elaTaw8fcbMlOHVUyPBOON4OTMOzQ5Vh1ws7Mmug8w3i4XTX1fVpIJcuCQ3FCspKPL3xPrHoxsTk/6gnyRMbuhz1rpKC0qDba7BzQH+q61/QJbKNWYG0iPvIulxkCb3G5eh1xsyB/S6QOVEItppr/QEHAbIpVQ5NVpWJabVtYpZhz4h6zAMD6utZmEJIK6qLt06sOl4hzSXJCNq5tuL8krUJSY4hLEEoqXe4kqVXKv3q8tm5w9hVU6SYksb7aNputJWyVYYyzmprLRMqsnHifJP7Tp0K4lmMBYG/AbFCPypJdkjy6zDAxNi6GU50Ct9+abty74uf5sjvrOzb3c9tzYe6VQWSBs8Y/4+Ww/7ZJm+1MmQs1/GRkr8RqS6avHG3rkjDc37B7p3x8M+OrjWFYlWGTnYnZQs3W2qdcHHlP5JpcSsR8GyCkTbfIPKQiuy0JeXofhCFnoRoJdjeOmNdJ4X9TwupmgxsweyeeABWgMcKYXWdwhrtxdTaymAp74L8BagmIG/kob/DOC1QDMDfyENTxH8K/C8ROAUEnLbCN1CAIY5MbetYOBIov3ZTWISm8gDLhQ8ZI3oIX/NyCEVMMpETbyyDK3IQl9ehgJXGejFV1bD8NIrxPMUqe9iFteQEyJiBWrR7nKnWNE00wfWsGIFqDxzGs9FocNUMqFUQ9YY22poSLaq4LYbbm8M1SOM8NauMoeKE263wG1VaMQ6FoZ0Mrm8E27HuZEDCXlFfbKhplguLzwyJS1D69visSIFPEyWli7LczHL+QXCOYHSm8G3SikN1URRuUmV9uWgARuAy8/gV8mdRdp0uhti0oFiv78zKC1QTDWKOXF1U5oCxXRz95Yo/9XmZkioba3cPr2cDffTdHTgz6odWraq9VrImWt2e10+MPZsmi2ZF0Ca4/h1qlY4MWBWSRGLpuWQMWK0zzALsMz5AD6+ZTQ+Y+zWhM0Wh8luhgOgwfba+vraI729Dds7O7fVhRmP0mox1zV+fWi9w9ll0Fkq9eaSomLIaIr3l9BN9fVNS6/CzJCf3BgJb0yOlWiVBm1xsax1OavvfDarT/a/yeqj7+X//b3T+lIpMetMsEy1aNv/SWWhFVnoy8tQfCELvQjQyzG8RKAkuysN1Yt4f5mBAoYs9CKBitlZ9HMANQpQ3roMPZOBImoF9Hi27ZJ1NQypFdDzWQxoVQx/tRKtwx9NTtvKhdy9MOzrkEWZ+SCG5tCDPxq9AU1hK/9txPC/RJ18SPGJE6dPi7lN+3Ab/0txzegTMrai8PChp5ucbAu0IZu+dXBCnG9ckEgWiEm9RZVqcb7p3V2fzfbCg5nErp5xvOqcUzx2x9ZMEhiRtRiK64R8ElN6VbN6/hdZ3o719KSmybp2+uDB6k6W7aw+eO21KDyHrLmpYPfNgW6zmAuoRyh4FrPDhHGxiCMrXYaeyUARtQJ6PNt2SboahhSBivlXAtQu4v0GgeoB+nEBr13EK0AZgH5UwGsX8X5jNQwpAhXzmYS2btE26gAq5isJbT0itdgy9EwGiqgV0OPZtkux1TDAVETRAP0nyCh6LRP/88lea9U5gE57uhjxM0sBcTZA875+S3Sw0eaAFCNyO9TIOEieVK+rWILvWC8PGOAosqgQ37FOXi1VygfDM77rhiHhSKHI3uJ5/0TDLl1A8Ydbykr54qrxhl36angoLVtFor/G0jlc9LfAzjVCjp4lN8RnPScfbF+WXXjR3+IjmsbK2eM9PcdnK5sM6Cn+jOBLXUtPGGt0uhrj0ORkQQFkQl315aGCAuJXUpgb/k1SsHFy2+TG5YwuMRNKzAt+j5yuo2cuzen6SHRDU9MVURR/vgIyoLRWeSolZhUJ4xIQR9ZLZaFnMlBErYAez7ZdAujlGFIEKmbsCNCwiFdGUUiI7IW4mNKS8+6c1F7YoaSDuxrWQy6fvsoESc5l9UGTszhfA7nZ/BMRSErXkyxfyPvVKq4hY2BGCTT2wWd35/p7evr7e3v7LRqNpVKrRYn56an5+anp+S4X28m6hILwV446UauYpYMsMPmls3RQK//ahoK22qkbxlBn8vwo5Ez+EFrroHUjUAfa6JIsnUygk0hQI39+L2MyyQ2Ggr7SznhLR7OnHd3S2T9psGmwCg7Ajc5YY7C6VS/kCRWDRDHA6bkkPyeSm8DBWHOTcxZtJoNOq3avialbuESvz2zzj7Q1tCoSUtZsMDEmG3Yry/JkGrUyZLREfIwnL6/Aaw/WeYycyqxT0go5aLMC5ElmMnIQ2TNGhYMrFvSAlGP3fXZrIDBWsA51tnf/+j8SiWPHgF8D8NsOfSqhBzn3I3yuwiARIYqqzxTmSW0OrmOgu7a1ornUbjKaTHqVWdJVjs/17DQwjdGaHoElszZPra+QFH+PjDKh0QU0FJQ1M8ri22t1ZNXhfqSz39PMHOqaKMkvZh2BlsGk0WDS6c0mlBhMcOOtyuBwECuZeLimK6HXFWr1em2hTk+0rwQNBMQsG3kmy+aR9R/d14sMUONO3NxDopZZ4OcxMWqJHK2eZpPLljqXyWS/mzHY21sS7XYD4+5v1+t0eq3BoDXo9QadAWRuqLL6ivKKXWZPLOYxu4rzinzWqobfqOSFsOJRFMpVX1QriuVqtbxYoaawYI0dwBVoKfPmkuSoEK9KMybJYQB1eJqthwUlOdhAy1BbR/9doCO9wWTG3uBEQiVoydYUqu0cnNNrinR6va5Ioydel/ozGkNXiV6n/tBeV7Ca04HPAbetaLeYGbeqz63wOGjbCJSBrv2/53GdxOHs6lyHI/4GssQAI/hb9L/jb6xJ+97+ZjE5fqsuz5MpV3U3JRyPKinibyANpEamM+De099Wehtw2w49iLd9gLNx7+dtf0T29/Y2oNEFNAQ7Uv8vvK3g/ZwNkVUoCgAd8DXuUl/LeprAy1XZ/eGH9LTo+3ta2sN0aY8rWN3RWpa964vLPkc0RKywA10lasj+v/K037+Po6VSxDfohPA251+FnKN5tCDs6H+K86hMfWiV+p+jV6n0LEyz+DGo//d0/dp0vZgV810Q5/P4aSHew0k2K1HDri/KSiQsOnOhPeGk87bm57GtSfz0hWSrD43y3ehvRpGvNUn6pt6GvudI33w2qlZHWZjGJepoVI3O/CHZyublb82jnYl2qdgV/Q3fLXaFvot4Bp3HF4WZ873f3VyltleomAqZbk2VLOLQ2CpUNpnwEMYzZYXFpaWl9Vpb9obgvRMvosfxd4X3YmBOdyI3XpydJWN2LZ5Fv4B9Vymlv/S/ArmcpyfZykoWrlPpXzxr1Si1FotWqbEu3/0/YETUy7gNfZu2E+4RmS6/fbh3HX79lP1RqDsBddvSdaBtZD68bR1uOxUmdYs4ic7DXrWArBlgGCXsm4uHm66+uomuuDu4d2+Q+lBtMNDggH6z+J966P3/U8/raLLbmxzOuN0edxKLhQtzTAPLNjBi2arXmrR6oQD6rwD9g7SZkgHmy/LPkA/OEfS9Gn2hVmHBSZO+1DOgUXkMtEVRojdB7+9gFerG50XNMFHUHR8pxOf/9V+JZE+lfOjblB4+VP4lu0puxY4T1VTHpJ7i9P5RGZfRUnWJEc4xv79io7hpJLN7JOdoHXiGOgtWKqEu8D+gCGQBL1K34+8C5D/SkAE8Sz2ILwDkYhryGG6jjtN2cn6XhuwDSJMAeYlAKJS6FddRu2k1mfPozLt7GPHtNwRZk0af8ONzs06DPm6yVK6D1mdTcaoj9SxYGqXMsSyHFQS2WJ6walRgSqSg6FQf7qNO0w9m3grKAS/9PtZ506H2dZ8kluk0m+9PWyh9+JT1Uf6LuRYq3lGXU6DBHiXvQ6Hk0MZ137iEAv7+qeCj31iNQBb/fBY/eHL+++C/HblT1KUSSGZnv7MqeuILNAW+cPx/HH1oCoKOVFpap7Vlb4QYQyP0C8D7344INCK8Wa1pLuEuGxEugkc+lxMR6FtPOYSIAHXboC4nIlw8FREjwgsg4ZlVvP3M3dziIid6+48B9/n/jrezjXZ7I5vx9h8Lfm61kpJJGNVmjcGgMauNgn3/Guz70fe0b3rtrEtP7Nu8XhjvN6nTeSP/G4vNs5xiRIvVWi4pqGUK/xuLpfef4sBiVyGQxS/5X1nsqZmZ77wH/7BK9dO/ojHckdx+qoiWiy9IGevyukxYDOXuMehf8SpehV50RvrX9oXaPcU9hQHW4atr9pj1erMZNhkaUo1eXLqvq2igs33MXmcxMVUue0l1gP7Id8yqMrXRCBlbZuq/ACjNHBAAAQAAAAMzdUSncZFfDzz1AAoD6AAAAADWFFDSAAAAAOOmxWr+2/72BRkEdQAAAAYAAgAAAAAAAHjaY2BkYGBh/PeWgYE14N/tf7dZJZlfMKAARj4ApwoHEQAAAHjajdIDrF5BEAXgM7u1nm3btlXbtm3bdlArTo2oVlA7rB3U/ntyn/1u8mXmrncz8gjuKgw+qjtCqKUS+Bl5KPykL+yUB5xVALVGS7FCmliZfqlI5r5oqadzfGuKAucwcp6sYN9nuMhUOLAvWzVDMx3FddxhxbyxfONeu2GjtqGjWohodYSxO2XQNf7fREc5hBju66gOsq0xOuoIxptF/QuK4nbGQdw3m+OOoI2aC3N9gvk6WKrpaKK6wZfr+heJJHtypziKoCQKoWB1HfF6EVJlIxJ5Zm/dDN58E1cJQo4eghxJQzvmPoxhUg8F8pC8kUG+qj4yyFf8eK9GHJNgiOL5fShKYtDS8IrrfYSFdGBbB9NXKUBHipFRsKYYOYH65INNJjuQPodYmY6lQiqV59oJH22FSLkHDzUJjnIUwXwnf7mPOJ4pkGcKVMHsW893550ojrLK6FQmH6RI+qCv7Ecm83g1Ds2UC4LURL5tS67VnXebAzs1jlgfVdH9GVkvqg3nsV7KYq20JDLdpidkol8l9VJWEqwVo17L/AD3Yy0ZtVMWa8fA2qmKPgkY9XQSTQysqTKMmiIn8qKY4nqqin5WVGesq7KMuuqAljIZbtIbZtILjtIDTaQnLGUgnGUI5cNGhrN/CPvqOE73g5nOpyQ00aNxWxPPPJm20ewiH2gPsZ2Y00c6Q5cBUz6NovZ0jqbQJjpNbYsZcyuuxwiOLTsOHwCCfGGcSmU+/QZN/gOXBr2BAHjaVcFToKxAAADQNrdNtiY827Zt27Zt27Zt27Zt2+b3PQdBEAWpioxGDiKvY1GsRqxT7ClaBe2OTkN3oVfQZxjE8mNtsSXYbewbng2vgnfHx+Ab8TP4awIjfKIeMZpYTxwjbpEKmYosQDYk+5JjyXXkSfIvlYRqSI2lLlKPaZqGdFG6Id2dHkcfom8yFFOaacEsYB4xX+KF48Pib9nqbBO2I9uPHc0uZjez+9m77Ev2G8BABAqAMqAG6AYGgalgOdgM9oOHHMbl4bpz07kd3EnuFk/zWfiCfHm+Dt+EP8vf5N8IDYX+wjUxhVheHC9uF1+K3yRMSi5Vk1pL06RV0nbpkvRGhnJGuZhcU+4oj5RnyE8UqFRWJiq/VF8tp9ZUm6jt1V7qUHWC+kcrrc3RlmubtL3aCe2K9kB7o/3QCd3QIz2Nnl0vpJfV5+urDMqoYYw3ZhlLjQ3GbuOYcdG4Yzw3Phl/TcZUzezmSHObuc88aV4x75uvzK9WzAKWYUVWGiu7Vcgqay2wVlvPbMG27SR2ejuXXdRua0+119jXHM1J5zRwpjornM9uCre829Qd555xn3qmV9qr663w7npvvb+Qh6lhSdgVDoKr4RX4CH7wMV/zC/kN/fb+HH+pv87f7h/wT/oP/O9BiqBGMCLYEtwNXgc/QxDmDCuEA8ON4cOEo8T/AQd5ogN42mNgZGBg5GPIYmBnSGNgBfKQATMDIwAVqADyeNqNjzNihkEURU9sNGET27Zts4r921hO6iwhC0uVW7yYH+ae+zQzQC4PJJGQnAEcJnQbJ9CckG6cqJon4ySGeTROfleTQin3xqnUEzfOpZt5sTihjmyGjVvJp9m4nUwqjTtVU2jcJc407hbBJi4cHONkAb/0jmtOWVXUq7g8e4qcKXfFFuc45CaVveNMmXO5S2WUxa/XzSBten2c4lXOjV/cik98J9VULpVfY5ZlFphkhXVlzgmzhU6Bj5Yv++zKe9EMeSfldNFKJ+10vKMhmyb959RN+UsC4mO81lWO9Ymsk/IvnVNSNxG82O0pt1MMiGwSqsKLm1bxBHd6y991+JDjXHouDXLOGa3Pf4ZOagB42mzBA2wYQAAAwPuu1mzbtpHZXmfbtjLbWzDbtm0zNmY1VhuzdyKAtEtSZCAko3mI0EJLrbTWRtuQSTvtddBRJ5110VU33fXQUy8peuujr376K6GkUkoro6xyyqugokoqq6KqaqqroaZaaqujrnrqa6Ch7HLIKZfc8sgrn/wKiFNcFudd0ExWJxSUWSHxolx2xUWXPPTIbXccc9wBkfYrJkGiRpoYYJBsGrsZIsUa6KvlVlpjtbV22W1JiArRkkRrarBkf2zx11VFFFbUAyscdMvSEGOZGNvdNdpY44wxwXh7TfTdJFNMNdkX08ww0/QQa5bZ5ppnjn3mO2eV3xZYZLGFfrrumSeGOGWo0zYaFuJ8M9xTz73w0iuvvTHCW++M9MEmZ5z1y0efjPLZDztCvH/+Sw0J6QTBwwEDAQBFwf9i27ZtHFNf0l68TSzOO0OMOAmSpEiTIUuOPAWKlChTkSVbDlVqeuujB3XdddOLhv40acmgTYcuPfoMGDJizIQpM+YsWLJizYYtO3nZc+DIiTMXrkG3KrrAbSAGogBaZu49IsOiMOh7eFHhxFD19oHxD4me2QO6o2eO8ceWFI9+MRaCxySTAsq7kTfL/YQJmT4MS7PULuylDEYwhglMYQbzYMYghwJKGMEYJjCFGcxJnnMoP6pxbWo7tiG1r3JsSj9vZvU/cqU0+n04ICWTMIIZ5JDBPCjk++EfXXpXH2et0X/1MYa5Ls1y8eLGs6rulNqeztHshe6GIV2k4ecpZJo/m/GipdEbYqDJz0UAl0unx34vQ6E1SoH10AImYI71Ieb9vWqkFKnUcAu5ZRTlAAA=) format("woff")}.rt{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:17px;font-weight:600}.rs{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:14px;font-weight:400}.t1{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:17px;font-weight:600}.t2{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:14px;font-weight:400}.pl{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:12px;font-weight:600}.lg{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:13.5px;font-weight:400}</style><defs><marker id="arrow" viewBox="0 0 10 10" refX="8.6" refY="5" markerWidth="7" markerHeight="7" markerUnits="userSpaceOnUse" orient="auto-start-reverse"><path d="M1,1.5 L9,5 L1,8.5 Z" class="arrow"/></marker></defs><rect width="1560" height="1270" rx="18" class="canvas"/><rect x="80" y="28" width="440" height="66" rx="7" class="card"/><text x="96" y="58" class="t1">Applications / official SDK</text><text x="96" y="79" class="t2">Submit work · stream results</text><path d="M300,94 V194" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g class="pill"><rect x="247.0" y="134" width="106.1" height="22" rx="11"/><text x="300" y="149.3" text-anchor="middle" class="pl">Agents API /v1</text></g><rect x="560" y="28" width="440" height="66" rx="7" class="card"/><text x="576" y="58" class="t1">Web console / operators</text><text x="576" y="79" class="t2">Configure the platform · view status</text><path d="M780,94 V194" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g class="pill"><rect x="718.7" y="134" width="122.7" height="22" rx="11"/><text x="780" y="149.3" text-anchor="middle" class="pl">Core API /core/v1</text></g><rect x="1040" y="28" width="440" height="66" rx="7" class="card"/><text x="1056" y="58" class="t1">Nodes / Runtime connections</text><text x="1056" y="79" class="t2">Machine identity · register and connect</text><path d="M1260,94 V194" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g class="pill"><rect x="1191.8" y="134" width="136.5" height="22" rx="11"/><text x="1260" y="149.3" text-anchor="middle" class="pl">Machine API /api/v1</text></g><rect x="80" y="194" width="1400" height="260" rx="10" class="region control"/><g><path class="band" d="M80,234 V204 Q80,194 90,194 H1470 Q1480,194 1480,204 V234 Z"/><path d="M80,234 H1480" class="sep"/><text x="96" y="221" class="rt">Control server · OpenAgentCore</text><text x="1464" y="221" class="rs" text-anchor="end">Web, Core and the database can share one host or run separately</text></g><rect x="104" y="254" width="952" height="76" rx="7" class="card"/><text x="120" y="289" class="t1">Core · scheduling and state</text><text x="120" y="310" class="t2">Accepts work, selects where it runs, controls lifecycles and records results</text><rect x="1104" y="254" width="352" height="76" rx="7" class="card"/><text x="1120" y="289" class="t1">PostgreSQL</text><text x="1120" y="310" class="t2">Sessions · Turns · configuration</text><path d="M1056,292 H1104" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><rect x="104" y="362" width="420" height="64" rx="7" class="card"/><text x="120" y="391" class="t1">Sandbox Provider adapter</text><text x="120" y="412" class="t2">Create / suspend / resume compute</text><rect x="548" y="362" width="432" height="64" rx="7" class="card"/><text x="564" y="391" class="t1">Runtime connections</text><text x="564" y="412" class="t2">Dispatch work / receive events</text><rect x="1004" y="362" width="452" height="64" rx="7" class="card"/><text x="1020" y="391" class="t1">Workspace FS adapter</text><text x="1020" y="412" class="t2">Manages file storage and mount bindings on its own</text><path d="M400,454 V618" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><path d="M950,454 V618" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><path d="M1330,454 V618" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g class="pill"><rect x="285.4" y="478" width="229.2" height="22" rx="11"/><text x="400" y="493.3" text-anchor="middle" class="pl">Sandbox Provider · compute lifecycle</text></g><g class="pill"><rect x="319.2" y="517" width="161.5" height="22" rx="11"/><text x="400" y="532.3" text-anchor="middle" class="pl">Node · host management</text></g><g class="pill"><rect x="314.5" y="556" width="171.0" height="22" rx="11"/><text x="400" y="571.3" text-anchor="middle" class="pl">Runtime · work and events</text></g><g class="pill"><rect x="889.5" y="497" width="121.0" height="22" rx="11"/><text x="950" y="512.3" text-anchor="middle" class="pl">Sandbox Provider</text></g><g class="pill"><rect x="915.4" y="546" width="69.2" height="22" rx="11"/><text x="950" y="561.3" text-anchor="middle" class="pl">Runtime</text></g><g class="pill"><rect x="1295.4" y="523" width="69.2" height="22" rx="11"/><text x="1330" y="538.3" text-anchor="middle" class="pl">Runtime</text></g><rect x="80" y="618" width="640" height="302" rx="10" class="region compute"/><g><path class="band" d="M80,658 V628 Q80,618 90,618 H710 Q720,618 720,628 V658 Z"/><path d="M80,658 H720" class="sep"/><text x="96" y="645" class="rt">Compute servers × N · microsandbox</text></g><rect x="104" y="672" width="592" height="52" rx="7" class="card"/><text x="120" y="695" class="t1">sandbox node · host manager</text><text x="120" y="716" class="t2">Manages compute from outside the sandboxes</text><rect x="104" y="758" width="592" height="138" rx="10" class="region sandbox"/><g><path class="band" d="M104,798 V768 Q104,758 114,758 H686 Q696,758 696,768 V798 Z"/><path d="M104,798 H696" class="sep"/><text x="120" y="785" class="rt">microsandbox VM × N</text><text x="680" y="785" class="rs" text-anchor="end">Isolation boundary</text></g><rect x="128" y="810" width="544" height="62" rx="7" class="card"/><text x="144" y="838" class="t1">Runtime + Harness + tools</text><text x="144" y="859" class="t2">Agent loop runs in the sandbox · workspace on independent FS</text><rect x="780" y="618" width="340" height="302" rx="10" class="region managed"/><g><path class="band" d="M780,658 V628 Q780,618 790,618 H1110 Q1120,618 1120,628 V658 Z"/><path d="M780,658 H1120" class="sep"/><text x="796" y="645" class="rt">E2B managed platform</text></g><rect x="800" y="672" width="300" height="224" rx="10" class="region sandbox"/><g><path class="band" d="M800,712 V682 Q800,672 810,672 H1090 Q1100,672 1100,682 V712 Z"/><path d="M800,712 H1100" class="sep"/><text x="816" y="699" class="rt">E2B Sandbox</text></g><rect x="820" y="734" width="260" height="62" rx="7" class="card"/><text x="836" y="762" class="t1">Runtime + Harness</text><text x="836" y="783" class="t2">Agent and tools in the sandbox</text><text x="950" y="841" class="t2" text-anchor="middle">Provider-owned filesystem</text><rect x="1180" y="618" width="300" height="302" rx="10" class="region user"/><g><path class="band" d="M1180,658 V628 Q1180,618 1190,618 H1470 Q1480,618 1480,628 V658 Z"/><path d="M1180,658 H1480" class="sep"/><text x="1196" y="645" class="rt">Your machine · self_hosted</text></g><rect x="1200" y="734" width="260" height="62" rx="7" class="card"/><text x="1216" y="762" class="t1">Runtime + Harness</text><text x="1216" y="783" class="t2">You install and maintain it</text><text x="1330" y="841" class="t2" text-anchor="middle">Local files and tools</text><text x="1330" y="868" class="t2" text-anchor="middle">Core does not create or reclaim it</text><path d="M240,920 V1060" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><text x="258" y="976" class="t2">NFS · file reads, writes and mount</text><path d="M550,920 V1010 H1330 V920" class="line"/><path d="M950,920 V1060" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><circle cx="950" cy="1010" r="3.5" class="dot"/><g class="pill"><rect x="987.4" y="999" width="105.2" height="22" rx="11"/><text x="1040" y="1014.3" text-anchor="middle" class="pl">Model protocol</text></g><text x="1190" y="998" class="t2">HTTP MCP</text><rect x="80" y="1060" width="640" height="156" rx="10" class="region storage"/><g><path class="band" d="M80,1100 V1070 Q80,1060 90,1060 H710 Q720,1060 720,1070 V1100 Z"/><path d="M80,1100 H720" class="sep"/><text x="96" y="1087" class="rt">Independent storage server</text><text x="704" y="1087" class="rs" text-anchor="end">Deployed apart from compute servers</text></g><rect x="104" y="1114" width="352" height="76" rx="7" class="card"/><text x="120" y="1149" class="t1">Persistent workspaces · NFS</text><text x="120" y="1170" class="t2">Files remain after compute is released</text><rect x="472" y="1114" width="224" height="76" rx="7" class="card"/><text x="488" y="1149" class="t1">Memory snapshots</text><text x="488" y="1170" class="t2">Separate retention period</text><rect x="780" y="1060" width="700" height="156" rx="10" class="region external"/><g><path class="band" d="M780,1100 V1070 Q780,1060 790,1060 H1470 Q1480,1060 1480,1070 V1100 Z"/><path d="M780,1100 H1480" class="sep"/><text x="796" y="1087" class="rt">External services</text><text x="1464" y="1087" class="rs" text-anchor="end">Reached directly from execution environments</text></g><rect x="804" y="1114" width="312" height="76" rx="7" class="card"/><text x="820" y="1149" class="t1">Model providers</text><text x="820" y="1170" class="t2">Native model APIs</text><rect x="1140" y="1114" width="316" height="76" rx="7" class="card"/><text x="1156" y="1149" class="t1">Remote MCP servers</text><text x="1156" y="1170" class="t2">HTTP MCP</text><path d="M80,410 H40 V1148 H80" class="line dash" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g transform="translate(40 785) rotate(-90)"><g class="pill"><rect x="-157.2" y="-11" width="314.4" height="22" rx="11"/><text x="0" y="4.3" text-anchor="middle" class="pl">Workspace filesystem · storage lifecycle and binding</text></g></g><text x="80" y="1250" class="lg">Solid: communication or mount</text><text x="296.688" y="1250" class="lg">Dashed: independent storage management</text><text x="585.372" y="1250" class="lg">Outer frame: deployment location</text><text x="817.154" y="1250" class="lg">Inner frame: sandbox isolation boundary</text></svg>
diff --git a/docs/assets/architecture.svg b/docs/assets/architecture.svg
index c4f035b5d..b229a3d33 100644
--- a/docs/assets/architecture.svg
+++ b/docs/assets/architecture.svg
@@ -14,4 +14,4 @@
 .pill rect{fill:#24211c}.pl{fill:#f7f1e6}
 .line{fill:none;stroke:#5b5346;stroke-width:1.4}.dash{stroke-dasharray:6 5}
 .arrow,.dot{fill:#5b5346}
-text{text-rendering:geometricPrecision;font-kerning:normal}@font-face{font-family:"OAC Plex";font-weight:400;src:url(data:font/woff;base64,d09GRgABAAAAAFZYAA8AAAAAtIwAAQABAAAAAAAAAAAAAAAAAAAAAAAAAABHREVGAAABWAAAADEAAAA0A+gEL0dQT1MAAAGMAAAi3wAAW8iuClg1R1NVQgAAJGwAAAFYAAACYr/7r01PUy8yAAAlxAAAAFoAAABgarIHYFNUQVQAACYgAAAASwAAAF5fvkM5Y21hcAAAJmwAAAGzAAACfHO4jI5nYXNwAAAoIAAAAAwAAAAMAAkAG2dseWYAACgsAAAl/wAARGLlTIrjaGVhZAAATiwAAAA2AAAANhywjf5oaGVhAABOZAAAACEAAAAkB9kH+WhtdHgAAE6IAAACMwAABDgOoTU0bG9jYQAAULwAAAIFAAACHux72jZtYXhwAABSxAAAABwAAAAgAR4A0m5hbWUAAFLgAAABCgAAAkAy4102cG9zdAAAU+wAAAJsAAAEbROuFbN42g3BsRGAIBQFsLzPaeU8zqjzeE7BNrQ0kAguQDnFLZ69vD7x62KYWiqHtgBvbQYaAAAAeNqckgOUJUkURG9kfcxM27221dbatm3btm3btm3btsa234m1UffkrXjpDwT0YRNuILfMcquswzJbH7jXLnRsv9e2OzP3LlvusxvTkgOYMoWEIv9SZb+p+E2VIud33nav3VjGXsRusufedcu9dmZmwLPAe8k7ZIBIuO/nNxQ2qt/wlJJrcq+kbSinNyB6IZ8Y79SkM5AGU0qPDtMB2ivaLsF22kIbaR2tphW0lBZRh5o0r2bXjGpUtUpVECownpEMpi9f8Qnv8QYv8UxUj9FXBR7gLm6JGddFviK4SHtxTnAaJ3CU4BD6sh9KLekhpI6w0urOX6Tpw9OHxaHOl9nzePQxe017Rntme1Z7S/u8sDjeeUm76J4XnLeyt7YXsJvstexWe6mw6Os7jLcnh6UjnEc7T+s82P7YPVV2m91oz2zf9+Nn+SZ8uPfv4/5auyEsJoYTFejn/0SiEGT0ok9U5dRRpIGOmHM6Z7AQ5wXNXBy0cGXQytVBG3dxN+3cG3TydNDFs0E3ZcAi/6J1/KYJ/F3g+2UMZwwwjgkUlJSn95/8q9ZKhJejlF00WH31lT7Re3pDL+kZPaYHdJduiXSdrtBFOken6QQdpUO0n/bQTtpGm0XbQGtpFS2nJdSjNi2ouTVrVNOrPtZVqk+M57QNk5mswcYwNs5540ceM4FPMgyPNlCn/ch+wU7G8B1fxL4mzjU+9Wf4KE42TEapBZA67PfsL+zp7cvseezH7DXtGe1lCHOC85b2efa89hqE+dJ+wT1b2ZsQ5kTnJnstu9VeijB9nb0zk52PcB7tXO/8rj3UPtz9jfZ9hLnGeXbnQ51ncr7IeTq7yq612+wGwowCEiWIItAnUpEyquhNLfNTzoJ0MBcncjpNnMlFdHIJV7Mk13EXK3Ivz7Iez/My2yOgYIOCsfSmF1n+Hh1FKSIBvcJnkANV8hi9gj99plz328p+aMpD/M8nVuL3wGgfeK9IzokiS7MssDwrkLFSkGcV1qfAZkE1WwQ17Mne1JIo82zh2awY5LwmY+UgxyqsSmK1IM/qQYE1gjxrBgXWYm0y75V4JSiSqPBeybskr5fXF7y+6PUFry96fWKdIMe6QZ71ghzrB3nfN/N9fQb6+VsXq5ADZsmGmv7B0OCF7Krsgmy/YJtstawpmzWNTG+lO9J5aZU0rd7RY7pER2kXraUmVfMOD3EEials1DV22FAQheEJM6fOdmIGqUsq41bCG0qdzszM1IbNlr8zZjg6v2akofue4H4qjiPFqfIWdaUJ7+I9le2OB9EZ3d6nvli0Z09VxFENCpSYrHZjip3GDH+Wnau2Yp6/UO2p9EbJ+hXTJ1HMu15k7Vu1HDWoQ4ESE6Ke8Lm+GzGres4Tn49b+qqu/lM56TwN0dO+C+yizPsZzXpcyOAvsnTxjjJe0yaqYtG9Ozl/+rRGfq7jrd2oQR0KlJBpVmqmPWdhTs083TmLPeso43TWC+v/ETWoQ4ESnSJd6LWKfhUDsgcxxB9mR+zvKH/M/o67fqxLf9SgDgVKdIp0oZ+yQdkj/FH+OPtSxfeoQR0KlOgU7UKvb6qP7Zc5oDJnW8Mwf4Sm0bhltk403o1+50GIZn//ORH7n5GsRdaymcEfZ+/T+DC6YJXHma+tUJbKcfceXbsyukw83gvYi1zVLf2eRRdkeDtyDZRkXqrbOJ7teZx2oe505u1osv/NaEErvEVypzGjUz5Zdt51vmf5522vPvoPRDyg9lvUoA5N8Saa0YJWFO6VOCTNHIAkWYIwXIvem+udvVnbxmnxbNu2X+DZNgIPgWfbts2zbdvW9n2R01Fd3bs9e6iMf8tZWZlZWb01EaKPUoeDI8Dx4ARwA7gR3CSR91znZc7bec437OFvpByuRoHRlMeQj8XPxpGPx2ZyTtDgFBD33qVGxNhXIgZfj0LROEk5jS/ElfE6u/sefKqeV3dCN6trmVko8eFYiWUnqpMlal2Obq9E0huRchj6G4HNRqG7Mdh8BnNmsD73nJzM7j3SgoMFdef1ybo/EjIb24JR8Le6HUHMh88J4AZwI7gJJKEfS3T6LmsMd5AbyL12xN6Zh5v3WvR69KX6PB3dyL1ZG3IPTQzUx6jEyZZRqyTapThr9LxBzips5fH5zdmKXDGlyNfH55Es3TtcD4341ufs4MXGPQlWuatuU2kBaWVF+IMuPTrBLyTJPkSuYJuuzZadGnzBelrjtdVGnis9erZvdfRMbntyct+jL7jJCHPPrMaqnOnu+aAfV5cGH2hzT3ywVZgW1ge0ZgG9L78EIJhYxShvUruUWLnnxOo9jvg7UOfWTDAazwrpGc6tZNYHoeNVYVKg5/UyZzYYhG/TAiaKtyyQ+mJnPT1EX8h2/sZq66V3KaOAjJ6ID5ULf8AIT/twAev1alsZi8c5g1SKT4558RwujXLmYqy11LQS8q3X+tZ1twxX2aO2aLjvIGPQZuwrQdQI6XNjA7leKSWER66es1ngjxsz4zmz2QcYbVpJxw1LwxYeFogRV5ij5dHeTxyVndOSIfVUdxfp8k0lMkFaewG/W673tN7Z7Pwm+RZok7NB1tGeRL4q1EOni368+mRnW6hHw5U+iU+skeM4zlwtw7fiX2bcmE9sLdLRLFP3zAf8ZyNRein4TcrDkZu7AY1NFH9eBz6npwAfi1FiB/BnnPwVwFf0Qx+Qe0B2TA4fNxdfpBSjJcYMHWdML3X5MA4MD3hWrq+ONIbHYOcu/iw7hjMrws21ACdyjM+3P3dlWQXN5jzFEt+I3jmFO3YOxDXGSGzWWjZ2jucI0vw9AldesFDLvsF/KuiVXMcNRvj5aN9e4XTKPZRr6iOgvUY9c23Ce3Ce7x5c1c09SKvk1DxezlT8YJXmyb6Is4lvA4mFXtloxcsCEahctNVVx8QfmWtzEheIPnSvGyF7UV4E8ERV7nwur2cWXu6Xp43XBsYI7DB7efd9qNfgtYm/E7re7xAjevxO0OuH1BMk/GMjmo7pM6rIR4IxoBOsh2ZqnTBCZWjZpVek0lF65299/9cDloLIxYcAEJ8a5MURiQlojJyS930KZtOyhrZdTz4L96xn1jIjjQXCTlku2H17jXHWg79ZU2sTzra2CLe5vqFs1UffWiKp38cAfOI97rcFOvS+1uFSZOwTfQftx22Z777f8uZMHlEFrFcE5akSVUZvhaqiVgOVqjrVSFsLVKX68QZdrdqhBl6d96SHFy3VzP9sZ9F3IXSgvCEdJG9IB/Pm+RYj3uGN+iLe+37hP7zfePW7TV797kWGJHKLL4FMSimgQGVBmeigjL/8hgElIWcKebYqlHfGIhBFzlTZib7/2UW5sUMg9sthh+gIpKviMPtwOiDyfKhUkAdVs38grZXsHgTmVQgSpzyhHU1YwkfoBQihA9ulMtGLQcwjMroUhVJ9lOxbI+ISOvIR/uBSumsb2tBAlntGsqF0kaIWXaZDafTa6CUHe5DQG7pES0nkMaRMcXUfwYvqXS2kCsqxbz6ysmMQTaDFPkLYHaoRFELNqkVAK17YJDBTg6CnVCi0o6m3T1sWeknTdrLpFaKEXgyyRIemp5l2S5H4gqZc0rbx2S/FtK5+N+A3AtHmBx0Pdtzckd3+dfuJrVtb34Qub923tXLg4IGXt0IDkzuyB6wc8OiAvfuP77i53+39qvvWtgxuOb95eXNl0/Smp5vObfi64d6GvRvs+rfrj63bWnstKKz5tObgmv5Vx1cOrzi6fHr59WVflh1c1ga1ldaWZkMRECnZDM0s+RP8ST275OeSLwVvF/9YfHpxc+HIwlcLH2cM1LovcmpqP7H968J6/goNWNm6b8HCgk9b96WExB61n5i3siOb/Qkh92Dk1tR0bnwHcWIPQnVbPWo6N/fEmv5xKp+ec3X2l1lrMydnNsbKM1ZGH02faD/Z+/PI5MjAXsemPW7dmDoxhTfspE/RcIaOkTXkREGs2ELMq+cXjLP5vjiXX4SPlffqE9TV6hp1osS8k4l5X6nTJNrdR7QbQp13bLWdlruMruPIEjjek9FTYgcUmSLZgQ8+8YLXAcMyhZlpmXmdZfq0nxOzLSksdsiycNkMcsgnaJJjydYZBi14YXhG+zv39Sm995Q8Zej4/H27q7urbt26dQv6tVpEQ71Cvt7voYBanCtGnyfez0K987mY73iBiN2IRbjM+ZWi/NXuvca6+Vrny8kVk2PZStdXmQX9qOcec/1xZazBWqzDemzARmxyz2ZsQROa0YJWtKEdHehEF7qxVZ7blNGD7crtRR/6MYBBDGEH/XZiF3bjVWmv4XW8gcN0vLXEAoXcAgUWmCixQCEs0DD5CbX/bETsReSlEfPEWtosxhL3LSWXlVlkB4uMsMiXcovUscjEDBYpFC1CNqEZLWhFG9rRgU50oRtb5bmNTj3YLo9e9KEfAxjEEP6BHnuxD/txAAcxjEP4IAtdF3GlBv7l1uEf7DkLYR0scHeD9EYsxCLnYR3XFmMJDZeSy1D0mbdyC42w0GdZ6BMsNMxChfCZsAK+PSvwC3n2oKoV3LsX+7AfB3AQwziEaVag15JU4wUVPnCFeediXOnOJdKXOl6Gq50X/eBLavlW+MEq/sAHUlv9g/t2uG8ndmE39krbh/04gIMYxiG8Kq/X8DrewGH53Vz0YNSggFqc5+os1Duei4bou1/KNT9L87pi+yhxMZL25DKE9rSOPq1tVrqW9+nq3ovN2IImNKMFrWhDOzrQiS50Yxt9elDdc78+3VLYh/04gIMYxqHcc69mGf36Q6La/PDaL+WWOVtimctF1ow1ZrPAkbztJtT88mI0k74Ga7EO67EBG7Hp249kqfY7lLkTu7AbPxHtWtH3yqMSytrVcUQlRA2Qe2FeiyN5G86boQ2//b6X4rGye9GHfgxgEEOoqGG00Q+nWvoXbaRWMStb6IlLaZo81HmZhzoOD4VRJ2o202ijVmHz8Cb57cQu7MZM3rQqNDUyhHYNevMi/YKG7F2XRoHc7uUjgWeMBDR8ju0bZxwBIprLuwfb5d2LPvRjAIMYgmheadPq0V2+r+F1vIHD9PmxD5oBpFG/fKybl6LEtWD3FBG+1yN8GsuU2Ys+9GMAgxhCZTR4VVmv4XW8kXvX/dnHXDlH3WtQQC3OVcJ56j8L52uPOmkXox5zPDmXnIf5k6K96w1s3ajEsIbjsIZ2LYudk0eSZ17j3hVY6f4flc9jGQtJX4O1WIf12ICN2OSezdiCJjSjBU/gSSU/hafxDJ6T1oo2tKMDnehCN7ZmrEfHHmynYy/60I8BDGII3248XRp+wnIpAp2vhg1o9G+h9EWOozfwiytpsoS8RvoKmP8kS1TzlSc9/xSexjOI2pA92C6/XvShHwMYxBB2yHsndmE3fkm7T2j3T2Q1rhbIWjJGAJFiFmif1bnnYtS7Noec67555HxygRpe4rghVnmF4pzG8aXkZTzrCseLcaVrS+S31PEyxNzGSLECK2m/KpuX5jSPy28N1mId1mMDNmITHTYrdwvZhGa04AnXKq3ynLRW19rQjg50ogvdEOGyF9zzIl7Cy9hGtx5sp3sv+tCPAQxiCP/g+g667sQu7MZeafuwHwdwEMM4hMN0uWNq9pHvENWSpT5ST86NfYzZRX9B0V8uT/6SrElTPSlZ8xo1WU6ukHNxhniWH80wf1ZezEDIJjSjBZVWbJXWhnZ0oBNd6MY2uvWgms+FteiyE7uwG1WtRffrp8/TMAthKTIs5fhDLZVizpcqYk6BlepY6et8TtypMhertETVudlHsYQyK3pg9dFUvj/CbwpltZ+fat7o3+UVNR/Jo+xYxJTlairCpto+Lq81WIt1WI8N2IjK2qYaybMXfejHAAYxhMrISOMPmWeLiGmufT6tLihrx9nRhhEZHae2c22JUspmMlGrqXFDrapHy2rtS4+n8DSewbPV27gsymrLyjnFjG159dTYkNrTvm2ygPHBcW4FbfmJZIHvsOaVo2L5OCH/XvShHwMYxBCmzUBxFc1LPTFLmjdAzA/vS20XEWq4rO1WyVlUojVvc/4UnsYzYdtCir3VPI7dK6NJdbsr88eLHunOiL1kLVk6Rkfslb5g2visL5FTtm+MvvSjyfYzxFd5VsTXavH02xjHy/vdHxRryIdrUEAt6qRdjHpHMV8j55HzlXIJ2UA2YqEcFpGXRhtORPRY7j3dislvqu1p7fbp7DrXrnfPzZN/n92iHW7F7YjfouFu3IN7cR/ud+0BPCiCxO9VyUfIX3Xtt6SvLv/9WnVL0nsztqAJzWjBE649h1bHbWhHBzrRhW684PqLeAkvY5s69GC7evaiD/0YwCD4WHZYfd90T/yWkYxfGZLpt4PuO5YV4veIJ5yX/+70bP6Lvy9lpz0Tv/jDn8Yae3pUnBrZUjREgxZpRMQD0kp1auxHmkXhGtrEOkOJK7DKOf/MbnB8I27CLdr9VtyO1GLuuwf34j7c79oD0GLRWr+kzF/27Go1elQv+hPHf4rSVnsM1df53/4ux1ak3akqq2Tziso4VXVeMX3dMxG/CzxKnlDvEXmeJN8nx8jT7jlDjuMiEeAHs+VYxTKH8abUt/jX2+Q7CP8gj+CoXnWMPO56XXpyhRb7dp9u5Alf0T//N1/Bf0J/PBt98Wbnq1noUedvkm+FjxZKfTR+s3pCziPST+IURjGGqB05jprws2uwPB9bLoh1m3lSPtIUqq6RDkf//hhbnjP5X/G+o4ZWBce1ZPg4zWdhdj5yXIALcRFSlHJvRCnPRZTCJWgE/fLodCS7wn2LEbsH5DJcDauJND4WVxO5f9JrDdZiHdZjAzZik+c2K28L2YRmtEBkyUeoxUaoH4z50LNZHm1cb0M7OtCJLnSD706LONvp3Is+9GMAgxjCP3hmL/ZhPw7gIIZxCIeVa5TCLFygfovImAGQxk5aLU8xrTGidx4nUoyIdo2n6tgl+/DIB32q+twcP1m5T0AvPYSsx1wswCXwJiC9B4k9VOeLsQRLsQyxbxrvQfZ+6PrevKzqWv4FvIiX8DLSHlu1fVJl78U+7McBHMQwDuEwfT7OZhnNnOGcWNsux8fi/3Othe2GIu81vOXy7GkMTT4pus+JVXFd6R2uPCfXhny9shznyGtCr2ZR9joS9tC2sW91gz6lXCkFnKs3n+fJWeAJLG7OIn2+0dpeu6d3sPZIvjc7O99tG8gW40rnMZN2vAxXO76GvDaiincv5MpMv5Ff7LzJ73Flr8FarMN6bMBGbHYfz8u2ui/tSlfdgRuYvo8obR/24wAOYhiH8Cp9XsPreAOHlcduYX/vQGh/aRo3GxG7DohdB3jjpr4T+RuUkfCwWBfLa5u0HmxHL/rQjwEMYgiVb8QOe+7qqjuA9kFCA35esuP62RiRI4bSQkT6PuwARm2q+TrteYXWMoNjh5u1x6968recryZjzYc3nb/lPH05gvfUM76CkB7faGDEvTFO4hRGkcZLeY/HvGWOMhvUf6ESl8vlOufXs8nNWvKX3fVb5GrpU31mQOnzpkpXp/QNhnQlZyfcM4KTfpV/hhzHb+bjztnimINa1GMu5ns6RSOIRnTL8pYqTI0lzmMswXW4nq/cQOMbcRNupkF8x4Pb3Hs7eQd5t/zvkc+95H1kfN+DB5XzMH7Z8a9m7IxH5THjWITKsajaeFMZ+ZI30KUXfejHAAYxhJnGHLOJcj9gi/echw/I+3g+0z2tfmecj7t+hfbW6s6ircnwNO39y9o2vE3aau3+aLT1GG9rVMrlJTOgunwGpCTpx8jjzkfcexLva4VT5KjSxhyfJs+Q49L+rhgnUYMCanGeq7NwAV3r1Oti1EsXtfMdTP5By0swFTtO8In/zRZjCe9dSi5DxBE1W44VWAW9WU35iftuxE24eXJH+k7lNvneTt5B3qk2d+FuNbpHze8l7yPjOxY8KP+H8DAeQbGHvMVaP5j9uef+An+JajF5E2JnFE1oRgueUE9zmOL8xXGrtDa0owOd6EI3KndDkz+xSy/60I8BDGLIKPkP7LMX+7AfB3AQwzgEs8PifBdTrZ3lra1Xq+dJvM8Op9hv1C8Px5yf1nZnnI9Lr0lz3t+KmcrnxbMGLb9QStHjPsvjRtwxwHZWmJ5TZ3f25Cu5uuJKDr5KS2WXe9pw0mOUHCPPYBwLI3rGGhg3Kyn8mc+LmlPfvCHFLfIoGVFT+rR1ItKXjYh1IubHqKE+eazOoqRH8Sbewtt4ByJj+jLuhPP4ThCjjsc8q4ek/vnbeZS0A4ICamFmnvb5653Pcc9ccj4Zq9C0p3+WvdMMPO1IpR1n12MvNTT/BM2/lO8TPJfdittxp/vuQvQARA/A/a49gIc8/wiKrfdWHjFn8/5C9hf4S8w8m58o7rigCc1oQSva0I4OdKIL3YjVJnqqztT/NWa+4UmI1RoiVtErPAg8ORtJ3ixeqdco7xnjhREtefa4a3O18f+mlVzus8mjzMOTN8U3jTiZt+8oxnAa0bbkgqxBnjGfnDwwFXt59i/TPfZbskY5b5HrDrkOZ+/hKI7TK0Zz19/3/ChOe/4MOU67xhgzI6o7y/tYcd6glZ8m35L2ttLewbuuvUcecY3e2THyOE7QscLzlfLZ9M3t+TEnUHs1/0yxpkjfBZOhEzlO1odXFmt5Vi1nx3gV41SU/aU0TilXmYVUZm67qNmFUaOVzqI2Zb0r/7qTjNwQ33+Sf6gX+XKc7jUooBbnuhpjDdKbMunxpoyMN2WIN2XO0y8R9Doro3zcOWrc+c9sMZbwkqXkMkRvck/0Jn5yK25HfGWOexHzDmkPoDhujETPeUx5jzteg7VYh/XYgI3YRJfN2IImNKMFTyjvObQ6bkM7OtCJLnRjq7xfIF/ES3gZadWlLr3oQz8GMIihyX3ZP6jTXuzDfhzAQQzjEIrRtJDmHhHjyJj98eYR9jipjPfJU5N789nA63nvGolYd1Gszq4DKxRnMyk2522ax+QRhDeCV2RzUr/UJ0v64xcihw/qk6fwQX3y4vDSlbjO2c2042fTahd+hvBSjCJ6BVYU/QqzkH41RsZaB5dhCa5h++VKWOHaStJ6NXrULepxK27HPWlX9mz2AH4LxX29ifCTrfgo6yLrYBY9WzYOxYiHI4idUTLfGU0jm9E6n3kvN2tYmeaIbMNj7TLm/XCYRv+khLeUMKKET2TvkBFZpB3BMRx3X3HHri6tRNIYKk+l5fuhVtJTJaU1T2PRMzyVdngjqv9gyR5cVtyDI2MHDSfTesf+IKJEcoESJvIxj9coabWczPanSiDfwXti8hEYM9IO34hnT6nnqFYcIyPWOR6X/nPZOfyxBgXUoh5zMX/yG7HSXAIrzZJV5kTSZmrOWchHXLGCfDCfZ7JB2dxyk3w3Ywua0IwWtKIN7ehAJ7rQjeqrTmOC8qZGSjYlw6Y46ZjXl8+E6BWtSM5Pc63VbEbbfFXSmM8gLy/a03lEfDJmcZ5MEYLMZ0PJro+I4V9m169kNSigFjETUp9ZqHc+F8W3Wx9Pb0WuTPYey2392fCt0n32mP+LU7fidtxJo7twtx25e3jFveR95P2uPQDeUmwH9/wF/hIxy6HjGqzFOqzHBmzEJrptxhY0oRktaEUb2tGBTnShG1tn2Peb/ouzz+bWTpae1i8iFod1R4rWdd5QEvfOpl4XsxsU13+FmEelXpc8JHKPyBqegVP5exTRPc0W5ook/xO7CsXd8M+XRdhHYSSPOB0jOCImkTEXSfMBO9+xr9wQ+3B0zntO9GG6Rx9GrFrU/h286873cARHpR9z/YRnRhA+F315JPlcRAhynMfU0PezoZ8co5YNaW//+7WvH/O3PA5eFJG21EYfFsMjfiPFvbTXc3m+11M39W6EnK+Us0r5j7zdRR9o96kxD/kssWSkMDt0LhJU/D0K9nK9NuwlntE3Ykmy2+xv490LC4d1aZKsmupe+rc8yJL1VGi2ILdcIdolfFm7/6r8f0v+qxExvtSPEX7hXL1yy9WV/n2X8OEHxZ9vZjVieIGsJcWfqd8COa6XNte1BektbSYGfa24pxl7+ovpckH+JuC8bJX2/dHsnIhHpX8pRDwq+2s5d/PYiEOIOCTtAfyifIo7NWqnDBE34tAmemymxxayCc1owZMlu93P0K9VWhva0YFOdKEbEXvo3os+9GMAgxjCYbpr0RRv9LR8LDZSIloTJ6KXfSKP7GPFqECO85PGyr4U/Uirz9iXjpEz96fZ0Z8ukfun83hjxiJ1dXh4XdHDyXfwLm3eI48g4iUZOwCk/pQ8fRRRAsajnafXYbiiDhMfoQ7ZB8cD1z4u58gh5rALi+U5i/LI8GsydhvIFCGm5qopokaZJJtN+Tk5Sk5FCHb7/07OAQiSJIiiv91r27a9gfXZtu8CZ1/gGDjba+ts27Zt274XP2o2eo358WZa011drezMrJIqbZ7qO/p9ajm1vKQ8r2xdxmVc/F28Wjxc3Fuex+/NxcLikuKwYpdibNG9aFuk+Y/55/mb+fx8an5Gflp+TL5VPj7vCs2zX7O7sxuz6dlJ2RHZQdke2U4ZSn9Pf0Rfow/T+elp6QnpTsXf5dSKzvO2LW/zb/QqwxWl3QtUpJZFGVySoDOCxlf0Zto0O4m+tS5KzkkOSnZIJibDk4FJ96Ru/Hn8arxLvFHcPt4o+pQe7x6Nbles9oqQlKJIueq4P7aGDDUJUYWWjLeW4zhc7y3cjqmt+mkgV8Vg1FVDNZI5E7SRr+utmbMtGqQd0WBsnV00RLuhYdoDDXdbpxE6g+t3lKZqmjbWDM3Xplqqm7St2z3trvv0qA7QU+gQt346VIlsvUNPZYrtUSdfXpmzfFbMxmng3G/H/gAvu/O458OavNLOxne7jzXE/N2OI1URYoxnwHzo5Mz/HJpU2yrUIo8hWjqS3ws2NFt/DfnVaWjv9aHcgsnxWpewUg6y2z23VuIcT8Bfjv8t5HcRLIYlQO2quedEjhomKoRNCPMhZcxzV5jinOEwpY5ah+ylNWUQRV6q1WrjWW2ArNJaRukGxaZK1VshQ3PFHMNUkziXJ8MUONSxZNqT+O7tux0ssxzgJXgFXoWaPVKyr7foargGroXr4Hq4AW6E2DU2ktqlRH56UocwAmp5aFNDnm4je0rbe+8XEh/9cI0ex8eY/zg8AU9C7GycoRDZooxsG7VSyvHPoQk0VV2OPr5rcT4yfhFcDJfApTADZsIsmA1zYC7MgwU+Y97RIlgMSyCyJ4l9dHbdDwzZUwBJ8II0t91baE81d/zlTWxc+yb5fQfeZc0ZNS/v9zTJ9fyGo9NX2MZ9XQ1dc9WWa8TIvMZDfFzlJacyXLOAXgW8oY6TvyRvG7y+4Ol/l7mJbS97YxxTr7UxaA6XwXSovSsknCG8l9jPTSYpYwv1DOt5Fl6Al+AVeM1PWCxV/wevtiNQz1DeyM/VlHHVzkPbETHr+tCWcAM5P4Wh4LFm2UZVL/QKto80zTU90VuRrcfY5XyTodTTDwk2xTuQeamXKWXVBoj9voPdyzBWp9+5Xqv5uqDw1Ekc58kwBTZyzdv+DP/B8mbMdpJtojqeiiXnqc97TvUdhaUgxfaTy/RseLdLwlX3ayjZM+pt+yuy1ZB6b15hqOYxruN/PwMr+rVeAvtPJd/NpCxYeX7f81rfdSSWc8+ZLZ2o627QDwbAFpR+S9ib4X3B8TDGj4KjYVolo+8m5t8H98MD8CA8BA/DI4DnxW9q7Lk9LZG9D3z7LNkoRGpf8x6Vikzo483HWVF3NVYdXxVN1rk30MLP5VLboMJP5zL0BroDyvykzrUTyrQzyiu9hNZZuSShb5upGhpKktV6MeW/ifZCzbUPauH1tFTE/CGKLClBqYlRqTomQbkKs/wnM2v+xBZ1oQEeSkyECpUmdjlzU/2kgTV/XPb/Ac4YQ7YAeNpiYGRgYOBisGCoYmBxcfMJYZBKrizKATRFDyB8dWEAxn/v/V9932zbDLO9vOxm27nlWubMbEyZQ56VW15uNm5nuh2f53kPDd5+aOtug/dsPLLPYDn8+KFAyHTkis2b9x4wf8u+/XvN3HZo42ZT9+zcvtH4fUf3HjISoYNQIEMg5MiUKv/F9dgT62J1zI2BXlqur+SoZfpqDCediyw6kUchVGpddPXBJ599USJ3zDZrdNcRhgu9EaiF/K+bKQwzG1ddM9iNJg11q0nD3GnScB1SdFj+Nz50bc1Pbs13keaNlhjp1JnXPuBTOl0ItZzUJleto6/u6nSmNz7LvPdJ5l3y37b83lIrd1ymS+KV+Mv7utwalU7KhDmW0ppf7H8lMuP9ryOtazqCdObw3AsSG5p4m931DCFsaf3PUF0acs99Dzz0yGNPPG3MLSkqncGmJv3/Ez0sRXd42mNgYQpknMDAysDAtIepi4GBoQdCM95lsGE04GBk4mZlZmViZmBibmBgSAfKazFAgaeTrwLDAQaF/39ZGP+9ZWBgSWAUVmBgnA+SY2Jh2gWkFBiYALNDDncAAHjaBcGxAQFRFACwvH+ghx4AAAYCAB1Yw0CGkwihJENFhpH0OZ2f0eWzf55jJi7PzT2WkoKahgwphvEl/RBCioU9MkmKFQj+0V8IlAB42n3MMwAdWQAF0DMza9t4Ybm2bXtj27Zt27Zt27Ztp8qPky65aA9iJHhCIsIT7ogL4CefudMDXvW+z2SSXyXVXIxej/6Mp8Tz4k3xliRK7kjuTdKFONwb7g9PhOfCSyFtyBjeDB+Er8KQNGnTtEzTOu1jaZ9MXbx44eJFBK/5wOcyK6CyHpe1P+LJ1zVJktxzU3s8PBNeuKq9Ed6/hXY3F7dwsRdczEvqrVTG1BOp+7hw/PLX7rxrp512vA47su1Iu+PTHc/vCNs3bP9x+5/b/9iWb9tv8YPRIyI/oQBKoYFmRD8ARF9dO0D0UfSZ2yS6y/9+VkY9+XzuJ1lkVVp5P/jSt3L53o+qqqKazL6QTW7ZlfWNwyKJO9zpLne7Rw755VQuutt/aqurlvoKKOiAwor5R83oPkXsV0JFy61wyBKFVHfSMsX9a5eddstkuCGGGmmYEUYZbaJxxptgqkkmm2KsaWaZboY5ZqpktkXmW2Chxebpo4mGGmmmsaaaa6GtVlpro5P2OuiopS566KqbXrqrrKeB+ulvgEH6Gmyu3s4564zzfvGrP/zmd39eAmUml78AAAEAAgAJAAr//wAPeNq1OwdgG8eRt3sAIXZCICpBtEMj0TsBggWdBItAEiyiehdlx7Jky116xy1y7z1+W25KHCVWeiKnuKQnLvK39Ko4suSauIc8/OwdAIIU5fJFxO3dze5O25nZciMKUzqKQt+i6yiaElGUT6wXm/RivQ7dxT6MdOwf6brZt6L4NmhnL7yF3sdNlIFyUZSeMZgtZgtTVQUPAX8w6PMF/GbGUCWywLNXJhX7LPAmlTbLfN5gMIDed+is1VVY2LQiOLrKvWFga7Tb2St1S1en18x0Xrsj2dvhtHYxLYrG5S5Pvs+TYHyhSDvjaIuuHmWPPWI1S83tSpuKAj68wMfrwEczZQQ+AjwLHA9AV+4L+MQWQhHYMRc5QPcL5AOB3nU+37rewHCzIPcfpqjRGDUlVqzIu93xi0bHLowD1bnZqNKlf7LVrhpPTaXGCa3xwlt4OT7G0/KJ4Y+jIpM2c1QtjDTk5UgBJY6UbDwnaB4OxNb6fGtjgQG54Mrk8HDS2GU0duFj7C88rviFY6MXxd3ufJQjorK3Pql3KWEIKBfI9RuQC4QUEp1y4ojKQoAaQ/KqKiT91IUXfmporSzREHNl+vsznrQ0otxUd8sll9ySDBis9snkVGLKabeEEmVdHTudrsT/U10h/5x6obIwx/87wL+CYkCCeTIyqVQ/zz/NKUpPKCJ5ensksj2d2hxkrx/p8/Q3h5U7+m0JM2o1dNclLhwdvTAR291vViRWOm1t/jj6lTXjENU6k2bQViuozA2SNZFxYQI+oi+flJHCJd6Vz3eEh3fu3Im+l94eSKTvSbNxCuzbVrDjZThLdVBpKg88NpfVEQqUbmXllBDODzYwDmJAnQjGmym9BemyBRD94WUdO8dyW5x2s0zhtTh97qmI2iNV64Y2qrXuqc56Va3SZmfOWj854IoeUsp9XdlE9qu+aNQHVziQ0mvC1nZ3TW0to7K01Qhko8FAzlFTU62xpPWKZJt/xEFjUYtC3tSf1ppqGYXB3Y7GPT61z8MV81I2UX4qTuU+SsrTSGhZIJNkgbxLSCi1ig/kGuQL5GOLQr00L+fp5Kuq6sX1AUOFcH+dF4n9j5KgMOrglOg4jLq00hulYkZc9EAxuJ8kFcmtyXVGdBEjcTm7f9ta9uuoK5WW2vXsPcSrBymK+hJgqafEFCUBX+OdDUStogHrXqVCoVTJ5fEc3qtsrm9WcsXc5VgwNwu9UaGD672MklGUHNo3VzFMYCGa8Vww4r+kiOcyfNXcITBDXJjHVpSF5bjgZQmFfCIJQ4ukIMOKWzZ8/8UNXxgCAWxT9/2C/QkSrfgW34d6k6NN+UjgJf3ezLTZc4MuI755biPFt6GVMP5m0kbsk/JKkp+qq/LTI7mcQNwd9U1IccNQfMXKXLBT22HIBcPaMIMFeWuHp6O9h9diMsNpsajO8og0UdIF1BYirxwSwLdgRCg+cmAEOBqp1kWRA+xyoSkiRWqms3MmxZex0dFY79hYMVbwZSY3mh3NcQUfwTvw8tJsIQcGF0dwseRjR/Cf4F/k5yM4ewwJFsZwEm875ucmoXiJuYn++PH2J0hdOTv5kWBBxOV1vxYLqKaS7rsxhKyS1oXV5mi71mXr1mPBOqWtJSc3c/OMEeL048BjO+gDFBCSkdAMHFksTsxbcGnaAfbkcl5Vb2Q2MmFN1uMLW3xtrkHbzIr2mF8aEMe9Hr/PbZ3oc07UhZxOU7vdqrGLqkT6LvfQQLNJ5VZYbCYTs6yqvr/T22ehipHbh2+lJPwqIkCiNxkCHxe7fci2uc0+7lZJ+nbtmnGb0Exaqlp/Y5rdT/rmgPe/gMTS0mzG+wC/yCBP6FZBYyy2Yl0uGtGFjbm8qXPbWjTAPkNszYC2gAMDluVQ/BqwVBMOaJ9E7gtJfMi45uu56Q5hx+ohLChQhw8jirTVwrD+iafoo31yaBoqljRjsTAi0eevGQ6FcE8sk+jFgY6Bqzf1ObC9Dwv+8Oc//4Fcc7Pv3XffexQiGNBLWMD5uwRQ+Th/BxTS739z7eX0/pXfOLL2KvpmJEDUk09+wL7zs58R+mKwqD/zY2yS+OgGzIC6QhzTSLZ3xd9qW+zmthHLU7lLFMJH0Lq5K7RMQ/osrGAP5KG3HlA8XpRUH0D6gF6K9OhxdjcygfnuZf8D+RLo4nSU3UesVw7FDnyEEhEe9YxFL2IkPgknJd4xlWZfSo+/dUZsSiPUTD33HD7Crp2bnJyDGWcN9BuGfhLQlo1bQ3o5oxFJNTTnZ7TUVzb7yuc1SDux2RSQS1w2tWvE//LzRr9a7Tc+/5TepVK59PjIxlF/t0ZQhSTmqD28OoCSHyjdjIFxK5H9mNymNWhtcpAyAvGjD/+IUpejx2nWTmNT+xKJfVOTF+iT0onY9JYt04lpaUK/t27k/j17HhrP9bcFY5efsf2Mi1Ph9v4JCnOSbQHJaigZkascOCzzMjBrTkx+Op3+9OQdd0SmvN6pyB34yNC9e/bcO5T1b0jtTm30UYjDIwI8tWQcxHpp8Q+L2An0GPsYirPfQxP4SPZE9u98azQHrauJX5dafzmPHmC/hlzsUa4dVZR7J8htLnvDYuH5iMYzC3Yjxnq6fktu/PJs9qqVa/cZUop18a61fv+GuCfnueeVrZ7Y2IE95x7IjyfbO3rD21K7UtsihqQvlWXvpopSbC1KAfsEcFYoAely9v58Hm3Ioyj7AzCLX8DqME3aR6HIl6QG6kxAz3l4nj2+cSNSbNyYxs50eu5F0lYNnv0otAXflOjFRMfzsUnMbERJ33TnyKaGwZpwIBh9Ax+Z+2fnpGsqs9wRjifQoRJ3mwEDsV2YRZninIoQmj2+KZ+nN//bNnYWydDkWS8Dk9df+AH7H+yuorZ/Df2EhEsiEvo1e3ketQGNm0p4n+c5A4y874PsjIimYfZYc/YVSWHqijNHhZ0HD3YK8ZF3P/3pd+fSeHAP+wJy75n7WllvPGfQBzoT9yWaExby9OgGUqDH7p17AviauBeniPYwN7rXwOg2UvolZ0Xe/sqDjDZOX9nff+U0X3atDgRWd0XXBAJr6mBM9xwY48uB8NbUualtHR3b4LY1TBVtPAjc1VEK3t5KRs6IK1wVzE/WM+lwTPY8/TRMdkrinZ6V3V3THpSelTt0fp1DznO9muNaTrUB11ISoANOXMm6SLoE87Pb2mwj5/Xy/HftHHJVCLA27WIyyyY/+yleih13T9WO37e0HFmQo4HsoCTisiBkUVXpr0SSrklXX/KBdXc+VJTlaWRn/x0fcU71Dm5uAgO295VEQlQ7jIMYJHKAPJXzJTdhLnQ3IopcrsFETKTPX9jebZruGlihCjvDPVPOyExyxS5Lj3qsKzHUGrGHkxNtkTPqYmG/x9cX1Tu1NfWN7sFA97g9AnthZ6RDb28FkH/Q37vWTyESgbCZi84UAhsi3oTNv8//Hjfhs+duwmdnoc0U8EoisRQ0QKbF8rxY2gRM5XX93d39urzn7DVrznSBweXiq5zOVXF0mN285cre3iu3EJtvBlpDgKc0Q0rID23cenz6nCHhinMnod8D7AeoCq0vtqa3Earl1uUfzdDwQy1rHls5EMGxqfXjMTq6YuKra1b14jhgOcz+EwlRDu6zSIByc2m0GlEFbuZV8DyU5ksJ/NESBrApjv1+y+P4q+v/+NKWb+Jvok1okj2BZOwhWJaa2N9QiPTAyRL34mJXNJJ/Y/0R+sj6f6Bm9Ch7GIiuIashaKvj25qkpSkS61gBupW9DP2KPTObHcTG7ODcb4mNRUG/6k/gk/axM7zeM8byO7zeHflQXKuNh4IJrTZRN3Fg9+4Hx8cf3L37wER/50xid3J7Z+f25O7ETCeR3QfEmMrIKbKEIGBghg08Izrs+fblX8ti78OBL/IRKgWtpWT+42UIARulw5huXHY7EZaywWOeeG+sN9Ew0BCYTiTXey0px3ey2YkXHVu9dZG+pLe1bcDtXxUNTuesn+dtH70PmN3EnrxLoIUpHheX0mXXII2Ybw9mMqmOYFLWvTyY6+hcHx7uMCfaO8/IRMc7ZT0tmd7s4GB2FN0S94pCIZfVrfYb2obDidEGgcjWH4iu8jNBjbvNl+xa1p0gmjdDYedm4gYyqgEYKlCIFMxLL0Y/zrGPI+PeLVvG5xC+Oov+xkrT6A0yt4IMQ9wZzhEy0kiqp30870sxTSSToL+zzzWLxGa/Mbo22DGTjYyGpT0tsZ7MwEDGHZJllDD9su8oDBL/+iQMGs/mYKomNcgoatClhNcEUJQCRRVlL1lJNw75GrBIDsRPby2OvpmwY2Cy/czsGWmJUOzobYf4F9meccYYJubkyrrYBWPD+3dPtgRnLhrBrQ4VzN3JmUi/Ie5a5oobireiTTQCD8uIthDMu8Suq6dRLfufA+hnePdlP8tSNDfHaGB8WyBah4DXBecEPi8/wkvtwyQL3pB9xZmh4Z5QbM/27XtioZ7h0Bm5/lyun1yxVCoGV11gdTgzLl4mGY/m1sHyfFyyTDyegTVdf7xT2hnnCjQeDjQGwlzB6ZG3a16PqBn0x4AeLbAGrvA80Sl6xFJOiQM7QIlNzh4bp8R0//bwyxWKREc4NYa2gxrVTqLG1PZI7ILvLVIk6KgPdPRZ4MJKhak0aNPCzDMQWhgBRHIAgVGSJ2TguYEh59gjGz/COwFifxY3+HMdqfWe9pjRaHOMBr0DNlu//b7GJrw/I1KI97P32UJiTbMubFLZnIaQQ/xEi0s9MLLcpvNPBfxZv8Scc7oGHeaEw5kMKj9vnrQnbcP6m/HlQWtds7VdLm7ztNS1mJvnvrlcJ/tZg9FnaQz1gk5jhc/QEfwDqodawc/PJQnKfmxZYtdKltAlLXMiaLBv8ckhPnj8nEPrNhw+L3PFTLdhqMflEQoknU5nzu3OOZ2hekGqRe1yj1wz0XfehMuRPzdTyzjlMqcxAKdEXVu/dfEl3z3DtvqW7alz0m6z1enemB3Y4HbokuwLlpYNY86py/u9K89PdWag8zNym+YilVXR7c/5u4mtIyHKolUwVhSJ3yjLTSrCCW63i2qwFU2U6rB1bhYLUM1gqe54Rd3xuSj+QbFOU1iF5YUDpE5I6uSsCL3/SBpqBgpvUT+k9pBZRr7g0Ge/VqPR6lpb6/TKepVOp6pX6qlCgbTHv4T2ZipDUZSFyqBquIuoDJZQpH4c8D2Pm0h9DQenatC9QMdSuJijI6aoEE9AxPAWByT361rdtoTGtKxZotmjVzVYN5t0YUaobm5Q6QGnB/ryOLMLcI6jX1D34WNEKgmsQu/r60O/QAqOC3gYhhozdzomgvLLcEfA7QnqrwCfPykL+cC8ZRxDV2g1JS5a0Qlgo22TSRthBK2EDdLbjt6ifoZf43qfIsP1FTLg1xYJQXgC2uhxjqdhwhOUP+M0BljRrYDVTK0gcCh/yvHKFK6jnqKuWlpjV1RQu+pUjUFfdA30NVOjHM7RIk4jlaNm0XGAUCGRJRCSi6SziiefVOy/Kvjo4KPB2zG08VM5VFdsEwpYQnKpyL9/P7S66nZ8O2kG+AEPehbamKk8wQ/lUSIL1/d3HHycg48TOPjpSCFL/RxGUEjOSeRwvghroAXW9u0phVVhK5rcN36OguzP0EU6FVgeV/A43gIcR3gcIYaGI5aFOB60KqbsRRTfRsGf/5wVLsRgKnSjHwEXSsoCXJSCHuCpmt9XN+CFSF/rWuUJjduHRtfEApFUXbYuOGkp0njaNR7uHXcvO/NhQV9Pg68r4VXbsg48UkEUU3JYc3wL/4inaWICS69mFtJEVJlcfWCqu3uacGAuUn1hATVXPtI77qpmv1UpKaLGCuejPH6P238SGWG25sM348Rj7lHfYGjU4RwNDnrGPKhjwxeutnn335GeSN+5392+/0sUKvyzcD41W+xP+GOKYd/i0+BZz6h3MDjqdIx0DPpG3dD/S/vb3fvvhP537Pfarv4C2SMWzkMI+oMNCRkxfxKGHn543bpr6Mt6ZmfJbrpwHvVHvoWE7KXhipIG+L3ZfT20gOwQAEcLtNASHJx+zEwA4nbpUwZ/JANy+VBL3moNtbeHrNb8OoVNrbYp1l3jNrxhcww7bG8wrp4PtCFjVZPQFNR9QPG0UYzHLOFVLvNJSdjnzr59vFU4QWImegpiYNDFFDEb3D0f6IImYVOVMaTlMFcXZtAEH5HkDPKN9CFh3530xVBjhZpz+Boh1KBz+tg5rgq0HeBOPo+QOgbq9ifQSwl4LRTKNVXUZgo6wnz3Fr0WrIkGHzBRARKD9QTbR6/dP7qFYAgdG5p715sxmTJeX9pkSvtazRKJuZUrEXuaCtj2XAo7zd4pJ1/6VX5z1OxXFW/sVR9SCXq5GOzg+zAWnMbEvu8nk2AiFK6Ai/joLuZq4R+6A22c3Yc2ct8+ClsQC/roJN+GTGTGX2pPS1aAp93akhWhhWsLv6rSKTEsfdBvvCs7HZOMU9Fl6uhWOvU9gaQu7Ne3eQA8xbgUUXOoR+nS9QQBHDBa7Eq/tXvZsiYN0xHtXiYWaYwCT8ai0nQ0y91WpVFVI2lyRvTurFQki9ndxRpXW7EmbICaKln8l+p2ba0Y01XSENMeEItxFS0LkqhcOANHwBLE5Ny/NJjkAIr8vROc8vungiiZ6N95O3oqNB0MrgomZ9+ma2ffBg0GC2/jF/EPuX1e9OPs9EIf8sX2ijV3rVx515q1d65ceefa4QuSyQuGuXJieHJy2BsXh2uNrTan06YzNwbFqdqpAzt3Pjg5+eDOnQemoumLhqPDF6WLtx07plbOuC06lSZkj9k69C0Gs5cSUFbUjr5W3JW6qDCM/kfzCxuC4vpeDufY5W3ba8HpYPnnTFmtKacjbbWma6zTGoNM7HHYGXdtXV2tG7UH10Y61wSDazoja4NWe8Yqs2bsxds1uaOMWqERjed0tTWymlqSZYAewr3c6YWCWGcAyEsZsF/uHByiWQi2uIz8kHf6ryu/4+pJ0cmoEwvGxgQYPXTC4TiB5Fdeyb68b+zee8eIFVvRFNqOn6R03M4AVrGVuQiLUxGkFZkIAbTd0NrUhAS1Qac/PJzJmE0GZ217YzzU3d/Tb7VrW82d6I6OhroWuTFkC/jUVnOr3KCyx7u+sFYhr1HKmVZC3w70NwL9WkpJtF3eLS3aJf24f3S0n1x2m81us0Ov9fn8enL5g7ZuW5ArCL44Ogvdwo2gdunRKw8ejN0J15DdPuRyD9rtg26NXaGwa7gSneUY9niGHXzZ2+rRaDytfEkibQe6iDrCx0wJnOtflu3IootQb6FAatAZUGOmdpE1CJT82s+IrkD/ik9SEhL1RXJY+4jkIgs5i7DAIif0vXQV3i+7Dk13jOCRjml0nWw/xidvwt6Emd7ddtFFbbtpc8KLuXMTKD4DFFqIfHoYayYEBsBdPhF3SRnuogGIdhvvMfYaL71G/S/XML3MPXBdeq360muMh+5R3/Pss89GPxeFkruh6s8Bn15kLZ+MiWg47ZP4sLnrCcETXc9PoD4d6oPJHu0mEnVRr+AWdB4ZNRNJYKkwE7ms7LAPmcKMOqhVMnJ9c8hhihjIi1EGL69ImxqaG8V2paZZXC9taoIHwJqgurEUG6lawMpZNv8tC40OPvMM/LqPJo8eTZJ2qBFL0Vh5vyFlnehF1Jic3+vuAByNC7FIoGUJ0zOkw10/Tv74x0n2AMG4mlqDZrGQo2wh4xIioyRHP7//fk/pt+ahhzylH0XRQMkPlJzwJKa0PCcLF1ML33guXzao1QampYUp3oFr9k/qZlmzmivQFfPPvDSHQNJvkbmIpyAuy0sudG6SfYvwPw1rPRYHuVWPKWCSCqVCxLKr0cPsQbSy7v3c+/mfLvvpwnbygAn+hNJptBIaPVxHWuTfz5HR3Uq9Qf0R7SI7s9ACGR4qrgTfqNiZQftB6gjqRY+e2v5HiVAoAdeRqF1tj3IFxY3zMDd+Qm6EOIlS7DnoxeGnkiDzcrCCUXwJxVAe3rpgPDhHJqPCmxiMDefSxI1O+bLtbU+rtrp3NMG/He6tqnT74vdIJhOB63y5bKtrhzphsSTUO1xbZfLF74lYvDce4wr+6/oN6Lf4PEpFGchKqpQD4pPy33kt4iBn9SILzONiiDDIk57euGlluntE2lvvM1nCyyOyiZ5Dfp/Pv3um/oazd11fP7NNGHMzTLuQPVdot1i8MeGfwmO16KqasUjpu1QK/6iUB+QPVn5UFhW/Z8lKuwc0OrU3kdg7FVmVkMWkU725DXUIkR08W6jfsCI+DcAY+Yhx4sCYMeW2BuLrhhLrE0PrMh02R19b8TsT1gG9du60lAuWFvCfJZYwJN+leG6px/Vsql2D8XSmtjm0rW9om6FHmQ31Di6v+eWPMHJo0Jmblw+11ytr04ZkW/e6YFcATuX7+s0xXbpGUtsx3Swk3uQvfAm30HUw70aoJK9fC3+qKAd1wjOnbV7fABEBxCItrqNI6Alx7ALQEgAAYVGGBrstBnefslMWNkoVcbvD1hEwe7t73B3GLmW73ibsm27rCrT7kFphbGtpVTuiXo1Fo1GOjtB1TSFDQOOqX0Yj3KBQDvhCI3KxYHRE0KLzOpkWqfAkavL2B7pXKSTCPrq2scNicDU1Vq/6rVCucRhdDXUUIlaCOyGayomVS/lIBFfxGJ3LscLLDo8dPnx4/xNrHxc+tuaJ/YcP33zzzTAoKMH+EHWy302spzD3nf8kPgZ+oVuUo6XnlmALM2aKOVtInzv6fjFvppS9NTeLvsfGK3NxCgU+G5GupUguGEVVUSdeoEpQPFeGvlIBPVqGHgfoqRhOVkDNZehrFRh+WYa+9AIZe4DSHtxE1YGuhoi2quYTHkP68pQtJ3bOn6mRs8OlEybBNLvxfLYcOgtSIkNuSxeTI9lwbZAVd7c3Iw0rtyWCo56qKoFrNDK8xrOxf2u009MjczevTXcmtMKqKnfOH1/vh3y613BbMWnyNpIyB6lz7zps1kDMEpTLgtZ82psyuUMRq9HeFm0LNsuD5mKqHZeJ6OEyEcleaqkVLSwD+JXV4u2DpRjxkHRRgqJsZayGrmmubrVovRqru9ZcrZFJlKp2df2GmQtxUyLAzCcu+mJCL03TBp3atLyloa1W3NjUIK0SxGtuOueSW7h4RsbiTYrh+JOLygeXZXcHJvjga/GBXulTN26f1g+3D7o6tyXS5Ati2hNvFNSk3Su0aW1Cf3GjQayw9RqNvTauxG+2dbSdfdPUmn298XMHB8+N+504POPoaPOqHJJqRePcleaMK+5Om81pd9yVMRcKfCYkZ1lVvG2epEpQPFeGvlIBPVqGHgfoqRhOnixmdlGPYAFF8/k+kOMDL9A6B/DXuNZ3cOu3E4URCuCF30InDVAswV8twl8HeC3QLMFf5uFUHbw9VoHnJIFTiGS8cXSXkdnXx2e8oTykuP0kzae2QV8+D4x4SBPvIW8V5cCIwyjmNfFKGYrnytBXKqBHy9DjryyF4eQrxPOYwi+xFNu5M6IAcMXb3cJJljfN4rE1rFoBKimdyftC0CHnSChVkEXW1q/udiQULfDYnmm9ITYqqBLgyzdKvK29Y7SIf7Qa8sx0CNLLVPIhw7hhVRAelXI5pJk1qZU1By5sEqMb4KVRraw9cKG4aV6eX5Y5f4njHKD0ueBb9ZSC6oWYsWANYJoPGhAdTz2JXyKfFimKSXCorRQo7vEOBhqFsi0xPkkuvlFRJduQTG4OkSxbb5+0Q7m1cz5J7vVidGCf0fm1njifRNfZEeiO7cqWU2+5vC2QZwt+g4pw5wbMEqljoaIkYoaP9iV2AVY6JcBbNuSjE9qgqsfq8rW2advilvWjiUw6nsvnfetTqfU+V3untt2kyfbePjBht7p1Osgoa68W1egi7uQQEuaGhnJzb8LUIExvD4e3p7uamFYTUy0SJ+ez/Y6Vs/3E/5tsP/oQ+4vTp/vBCHPZaJxtynnrfo0qQfFcGfpKBfRoGXocoKdiOEmgfM4XB23h8T5XhgKGEvQ4gfI5W/TXAdrKQVnZPPRgCYqoCui+cts52VIYChXQF8oYUAX0snLbWRnRugAMewBWDI2UhMtEEpEPjqU/xNA+dOBPWyfQFvRn9vMowX4XTbIT9V/+3rPP8hlPWXw2e5BfN3q4PK4QvHzsCWdBDgYaKyV1aXetOM2Ms2J3tJwDhi8upXul8kvPOlXj9+wspYYRWcVQbOeyTDT8quY0WWFk67Z+xYrFuWFXX41GelHbwgSxP/SCbsuYq6ivUfDO54xx46LnR1YwDz1YgiKqArqv3HZOsBSGAoHyWVkc1MTj/SyBWgA6Q/DyUERx0DBAJwFvqe3cZ5fCUCBQPsuJs4123jYCAOWzmLi2Np5acB56sARFVAV0X7ntXHApDIUgmBtA/w3yjP5WmgGEZL+15CxA855ejPmlxQA/H6CNvkkmGk4azZB4VPEIX4zFDfiLlypj5q7V/KMqVteimjBtcF6WhzSkikf8GZKDZIqr3v2mVDb3A5KXZI5xL2XeLyvzPhssZnbRd4OdK7jMPf3CIF/2HCHYvri89KLvZifUmdb112az165vzajRYyVfmvujurulpVu95+yzhSLIjzrvgTGRkPhVbXU1VlRXX7L93G17K/K8ID+qlC98mkyv/NOLM71u8kx3kVSv1AcKh9arsytANi7XiBsXDz+yJqoMPViCIqoCuq/cdg6gp2IoECifvcNBAzzeOW7tA9HvOBZQSu7UuzLlF3YoxeAuhxVRNAxJ5rkcZAF3m7wNtAhytkn2r8xuQJvnZiEfWKUa50/wEmj4o0/wvjuQTg+Qy8YwNrhQYtOq1Zs2rVq12RfxxDwRriD86VA/SvEZO6giYwel2L9/qmrauHXNRtTvRXUrTdvYp0h7A7QPAX2gjhbl7JRCnUiEQuwbl7Xq9TqDcVmwrjfaHQ+0b0AXe8MzCldLlUprUDQzoS63La4b4DKmQCYX4LQtytYJLkzlYAwLU3XOsZpNjKbV2mATd3s6sk6dwTscC3VLXA1t0NJidmCDRiZQtiikBqXR6zC2i+gqu9XT2aY0yNR6dVWrCvTZzMvP5+cgsmsMccdXFpgOUH30uw+Pd3REBZeh/j7/2++73U8+yZ0vJlAI+ui4M1wRN1cvwSARIYSYr9YKGowGf3ogGeha7mi0GMzwT6Wt9TfgI94rZS1dwVCGY8mkFeqMy2tFz/EnxQkUBxrNlKE0zvwXbHlwyQH/eiLriOvzqVyDoN5u8iWHepm2NsbQ3o4SQ4nAdLLZOdaJpLquQCgNmchCxmBghAaGyxQHDbj4jBs4X2W4jJv7E7fdG0RNUNOTPM/P7RmBn0EYIz5uAUdLJ9wsZku+4O076ayD0ZhS3d0pk8Zoz6YJGwaG4YbLZAWZu5xGR7Wgxq61+f02rb1GUO0wOrt+26KsVrZwxSENpIdouIJ85wUOu4ErTkuI+35JslU4v+IZEy1gAHXbY4Z8EpRUZzP7E0O98ez1RT1hN2SWSYmWZLoef0dq6BzoQ/irMjDE7wofoGF0Pu938o/td1VLuR3iLCeFdnF5ckt73QKfgyIEtMnp7yfzOS9xOY9ykcuBx4E0LsAIHhf6v/S4X32UwxGP42UvZcSdzuMq/Q24DUEPorWPcDffh/nbMdRzen8DGnGgwVmS/H/hb1Uf5m6IO7l2AR3wNt9ib+tJ7OF9DXgZROeXd4kf09dCH+5rRR8zFX2uamlXc8/716F5r+NyKoDzbuCK05Dpf+Vrf/sQVysUyDjTKe67DgwN6GAzOo/b1/8KN1Cl+sgS9b9Bb3P1Cqhn8JNQ/0Kxfl2x/vfcucDPQZwZ/CMu4sOJtkUkh51fyCISWdA9z7sn2umqZBXdPuHGP3reM+lFG1gJenUD8k56SF+Y+2e41QglhPNxecgCU7lIHgrJF/at47uiV1kJ3xX6XoE3o3/Hv+TmztN/xdmjMjcp9PVNLY36BpeBfxGrGvX1Lrx5+bL62oZ6a7O+/EDwPoD3QubJU9wXMjCnB5AC701y+8p/xTvQEdh71VMti//HoG/B2/PFs8sHine8QymtlSoXFf8PGBFVwP3oPrqWcI/IhHnfDv84Pn6/guTAPgF1K4t1oG1k2tE/jvvvZ0jdtXgFehb2q1Vk1QDDKLJ8sHmnfc8eO567Ubtnj5b6WG0w9S3cix6gzfz/4kMf/r/47LqAVhvQ6f1arV/fotW2wIV7NX693q/hS0+rSqZq5Qqg/wEeQ2fTVWSPhE7JQkMOpcqoiDQrROLlKjymlNUyvTKpQS6Qi2tkoBlkxzZ0Oz7Ga4YJodv9gTp87NvfJpL9B5x1HqSaySgIF+0sfRW7TtRRuYeUeJtKe8vnKzaLG0ZKO0hyyjaFN1OfAysVUS+x/04RyLl4L3UdfgogfytCduMd1A34KECO8xDY1fRTu+hagJwoQm4EiIODnCQQChUO4Ri1Ds+RWY8ufcWHEc9/yqxTyRXOCH6ySyeX+Vs18u3Q+tnCJOUrfI+sq6ULLEupUilVSuXnK6yILpyJx6nb6ItLXwclgJf+EOs8b4dn/NaiZR4q3umV98sfY3+9pJmeSoEGexR9CIW6Henx/Yso4CP3Gx67ZEkCJfyeMn7w5A/Dfx1SvL4Y/avJ5F2n8bIr6Ab07/Rl/+PYQzcsFXswdR/djJ6g932ceAD/VArFA8U73ayS1klViwouHvwD4sHXF8QD+pZiPIC6lVC3IB78oxQP3kfP0gdP9XX6YIWvnwBff+F/7usnTuvrYN0nqXVA/3TWTe+Yt24acnwK1O0C0yezV15zh4p3Ac3Z65JqnKfwyex1IQV6M7HXpQiU8NO/+ST2uhj9nWCvS2OnagpO+vc0hieS409V0xL+AyljmF+TcQuhhTsM+vesjJWhE9bgirXD/oytZnCZB9alnTEbN35qNVKQanRi7ovZ6lx/ZsLUqdcwrjZTrdtD/8u3tbIGeWurvEGmpf4bql0dbgAAAQAAAAMzdRtvox1fDzz1AAoD6AAAAADWFFDSAAAAAOOmxWr+/P8LBNkEXwAAAAYAAgAAAAAAAHjaY2BkYGBh/PeWgYFV6t+ff39YbjK/YEABjHwAtZwH3AAAAHjajdIDrFxRGATg+c+pbT9jN8+2bS9q27Yb1YhTK2qcOqptK05tezs5eajbm3yZ/1oj1+GpOiBIZSGCbPIOoWb2Q6hkwU21QqBqS3Gw4SOKSFRLHtcKNj0cNhVHYeYcG0XIWO67B1/pCzfuK5PHaKMBD/mE9vIKreU8vNR8dFTL0FuNRoLawMylUNrN9UPoLSuRJF/RTc3g/Aa9dRD3HaLD3N+nOucxsxGgktBBbYdT9Uc7PRPt1GB0UuVozmfxVU4kUSRlUwD5UzFlVm9LMPMu5PHcdFnBbUXw1c14bjTc+Y6F2geF4mve18IMx0vOW6g1cilIbjFvMtvAR25RGHwpSgl8KUq6ody4BD+5g45SikopdX2SZPSmJHGgAyXJXDQmK9a4okF6A58nATOFVAGK1FJE6UaIkduwqtXw5LNaZTmC5DIy+ExxsoUOwledMO8cQcmU+Z1e3809FEkOhshSFJltg9BGKYSq8UhQlbyGne/QG94qFm6mH7+h+yHI9CWQ/H6Ej7BRGT66btMzzs1IavvyvTj4KKbewnke3EyX2J3vme6Q6c5v6CWoZ/q0Ga0Nduo7plNkoXhKqunT7+gb1T1jr75nepUMm8xAkAyFp/SAN3WidtILvtxmlVJ2fZrZ7/e/x+lh8NSlFIdOOgqnNCknFtFGWl/NRftpSbU99FE5JYh5BXA5aRJNoEu0gnbQGRpVo/q663663p7qY0fWegyA5DVzCn236Pto8g2kN8lSAHjaVcFDANgwAADA2naqtLNt27Zt27Zt27Zt27Ztv3eHIIiBVEPGIIeQN2gitCbaGX2GVcG6Y9OwXdgV7BkO8fx4W3wJfhv/RmQjqhDdibHEJuIs8YYkyZisT44hN5DHyduUSaWmClKNqH7UOGo9dYpG6KR0I3ocfYl+wnBMzJRimjN9mSnMCeY+K7EV2XbscvYl+4crzY3jvvL1+bZ8b34kP41fx+/jT/Ev+C8CLshCGqG0UF1oLAwUxgrzhY3CXuGk8FqUxGLiQHGheFC8JD6WNCmvVEqqITWV2krXpEfSV7mVPEK+r2RUaigzlAPKJxVVRTWDWl/tos5XN6sH1TvqNy2FlkeroDXWemuTtUXaOz25Xl+fazBGKqOm0cRob/QyhhoTjNkma1Yzl5ubzL3mCfOyed98bX63SEu1ElpprOxWIausVcNaZW21DbuJPdteZm+099jH7Uv2XfuF/dlBHN6xnNgp7Ex1DjmnnKvOA+e18w3gQAIAJAJpQQ5QGJQDNcEasB18cn03qZvBze0Wcyu6Pd2F7k73sZfQy+219RZ5W33Mz+rX8Tv7c/xb/ucgaVAzaB1sC14Hv0MxDMKcYfVwcDgh3Bk+Cj9ABGowEawA28O+cBXcDPfAo/AcvA7fRXSULWoWTY0ORq+iHzETu3GxuG48Lt4Xv/1/gvT/AAfunuQAAAB42mNgZGBg5GPIYmBnSGNgBfKQATMDIwAVqADyeNqNkINSRlEURlc2Btm2XYNsu0bZv/0avUZ4nJ6nb+7szItz1jaAbB5JIC4xTbwfN2gcR3FcuXE82XG5xgkM82ScSDP3xkkUc2ucTD03xtn0YjnjGsik1bjlLWdcJ+lUG3fLJ9+4R5xu3CuCdTy4OMTNHEHdN1xyzLK0fkd/w440J7JdiE7F56Ig+vV6GaZDb0Axftm8BMXtBMQ3tDtZzmVfYZpFVRhniVVZTomy4VQN0Ma65HNC3EjjZ1uS38ngkb2SHuXpppMui6/EMogsh+hjjreYEYsa+V/1j9IvFSfw4CWG/3UjlVZxSGRxjpdffu3iMW70VvIWEXCkU92nusM6T2h/BmBnTlwAAHjabMEDbBhAAADA+66cbdu2bdu2bWa2t2C2bdtmbAx1zDZm70QAaUc1lYGQHW1DhHba66CjTjqHTLroqpvueuipl9766Kuf/gYYaJDBhhhqmLLKKa+CiiqprIqqqqmuhppqqa2Ouuqpr4GGGmmsiaaaySOvfPIroKBCCiuiqDhl5HTNda3lcl4xORSXWZRbbrvhphdeeuSxs845LtIxpWWRVXMtDTdSbi08CJFijfDHOhtstskWBx2yOkSFaNlEa2WU7JLsluyOkkoo5bn1TnhoTYixVox9nphkiqkmm26aI2b4Z6bZ5pjlt7nmW2BeiLXQIksstdhRy1y1UaLlVlplhXj3vPXaaBeNcckOY0Ocv8Z54533Pvjok8/G++KrCb7b6bIrEvzw00S//Lc/ZJYiVTpB8HDAQABAUfC/2LZtG8fUl7QXp4gszjtjECZClBhxEiRJkSZDlhx5ChQpyZQlmzIVPfXSjaquuuhBTV/qNPSjSYs2Hbr06DNgyIgxE6bMmLNgyYo1G7nZsmPPgSMnzn6nKrrAbSAGogBaZu49IsOiMOh7eFHhxFD19oHxD4me2QO6o2eO8ceWFI9+MRaCxySTAsq7kTfL/YQJmT4MS7PULuylDEYwhglMYQbzYMYghwJKGMEYJjCFGcxJnnMoP6pxbWo7tiG1r3JsSj9vZvU/cqU0+n04ICWTMIIZ5JDBPCjk++EfXXpXH2et0X/1MYa5Ls1y8eLGs6rulNqeztHshe6GIV2k4ecpZJo/m/GipdEbYqDJz0UAl0unx34vQ6E1SoH10AImYI71Ieb9vWqkFKnUcAvmzhS1) format("woff")}@font-face{font-family:"OAC Plex";font-weight:600;src:url(data:font/woff;base64,d09GRgABAAAAAF1EAA8AAAAAtJQAAQABAAAAAAAAAAAAAAAAAAAAAAAAAABHREVGAAABWAAAADEAAAA0A+gEL0dQT1MAAAGMAAAooAAAW/JyQ5naR1NVQgAAKiwAAAFYAAACYr/7r01PUy8yAAArhAAAAFoAAABga3sHlVNUQVQAACvgAAAASgAAAFpfvUE9Y21hcAAALCwAAAGzAAACfHO4jI5nYXNwAAAt4AAAAAwAAAAMAAkAG2dseWYAAC3sAAAnJAAAREgCvXQGaGVhZAAAVRAAAAA2AAAANhzPjf9oaGVhAABVSAAAACEAAAAkB/gIDmhtdHgAAFVsAAACMwAABDgdRiqubG9jYQAAV6AAAAIIAAACHucQ1M5tYXhwAABZqAAAABwAAAAgAR4A0m5hbWUAAFnEAAABDwAAAjwySVzfcG9zdAAAWtQAAAJuAAAEbRPCFc942g3BsRGAIBQFsLzPaeU8zqjzeE7BNrQ0kAguQDnFLZ69vD7x62KYWiqHtgBvbQYaAAAAeNqM0gO0HUsARNFT825sG9+2bdu2bTO2bdu2bdu27fRU7Kxavad6LASk5m1aknj40adf5uGP/vjxa2797MdPvuLyrz/4+VtykwA4cIAIhX50RtIJM06YRaEn++qTH7/lYXu3vd5e/s0HP35FQcB7gc8lnyEpKCK87ugSkr95/xvd04xPbI8Kk55UgEiJfMWwjJ5V+2Ba0nKn6qq6Kqq0iupf/a4f9bU+1ft6Uy/rWT2uB3W3blVRXa8rdbHyK6cyK62SC3azlfWsZDFzmc5ERocxlP70pHNYtqU5DalNVVWkPOVVmpIUVk7+ZiK/oujGqDfSQ7HRL+5ToryI0rFqY6/x+nvs43aOfd1eaK+399k77cf2M1szlqrub9mLvGaK++f2E3uTvd3ea9+1L9lnY9nju0pla9vk9qJYttsFXpPf3mlz2ctt/8PPuNT2Rsrs9RltPpvFXm9TBCMyoKN/TETykCRSkpoE6clGCnJwKxmoQEWuo3rIDdQJuZFGITfRJORmOtOFW+gWchtDQm5nWMgdpAPuPo9x6wlDEPW2ef3HbWYHsIs9JFekZKQ6zT/3bpQ2+CJp+Vq7tVXrtVKLNVfTNVGjNVT91TO0zqG3VXM11G7VVlWVV0kV1t/6Vd/rS32sd/W6XtTTelQNdb/u1M1h3bW6XBcqr7Iro1IHE9rtOOxnZ7iKo9Ehjq/ksDmMtWp4OOVDCjsOy1kYruuE6zq+6tEwO1zZ0dD4vwakhyB03KfYfPZS28ZeYx+3c+x99nV7kb3OPmc/tp/Zmvb9WHZYX0Wf23e8pqr77fZe+7x9yT4byx73pjajrW0vjGWh3e41uWx/r2nrfpd7afcr3Zu557H5bWp7py1gkwcj0iBSAKlDS0E6MpGKrFxNeq7lVi6jFBW4nkrU5jbq0oQHaE5nnqAbw3iVEYzhMwQktwTFQU7LGsq5OoijN57gbh20aIeUn4asZw3X5Gtwl4qWCncatMNdGxzW3a3BYd13/9zzTg7umXOfZH4zb2aerpojSyL1qmftgModk3V5N0mwu/fJan/6C8/+cS+8El7hf/4qkYTv5N0ol1uuh4jb7052A3vJk6Cgpaim1V4u0g7jEu1wruMGJxJ3NqqJVdRna0mMcbtKSxpZo6pWS1GnpanXUjRoaYo0qjSXmjYtEz1NzOXaLC6NN7vxqo1XYbzbxrttvJomLUmzlqJFS9KqpaJ6E1hv5Rixn6ceo1oVHJ+YjewbbVb7NPFk4uHEzVopUZs4LXFCfDHeE38x/mC8On5crM9nwOPedVfGir5vDqOPt7nDjNmoYioV12kJq2skyXmcb5WXaTlK7GM/2plyZgexN6yRl4IUpVGGwgrDrkfCOqMyFjYZDxtMhMCk+1NAWtWCisAYMC4TRk2pdG5hhrwUpCiNMhiWGNI7bJ4RMO+35l037w9MEDPvktFbZFT9aN4tvaGSd5ZJ0Ps9Wb1LercZBayrolgyPqhYiupaJDqC/anQu6BnnZQee/o5q31YS9qZJchLQYrSKCrJVmr+hlH3fp6B9UbHcm3Gn6e0rWKLCTnU/j8kLwUpSqOUwjxlaXNKHdJpZJeR3dJj7l5z95m33/0B4ACzfEJeClKURimRoSwd9tSluhfoM9uAGQ4z4lPyUpCiNErJHsrSFuZod92hstNjGO2xv6XH7V576SNJv/4BO0ir+lHFlt5g/ln6QY/z17OkZ5tuwLorFSwZG1QsqSixH2Xp8Dx0gcoDUalqQcU6+/9pZx3RPAI9P3flHJxJgpIRZVFBptLD97+a2Q+VY3s+6Ph5qtsqtuiTJLXhPeqkXhrEq4gDGCHHqL2NqRgP00xwCNF15n6cy0IrbWbLWe2d5KUgtWrqpF4apOh/jZJlJ7BLdku11Mh1cr3cIDHOC7dxEOeHl+zhC6v8xCo76HG713VfGLWPDvv4NLqqhkkw6hQnwldMhYVfPTHOIgn4fRnZARU7TEvH0sy6rdndm/I8D3O7diNXG3lM9HwoRM+yWnso0kiJMvus9HqrbKeDTrropode+pmM7stll/0uM06ig7wUpCiNUiJFWVJ/etXHf/Zn/yL6YMrSbf7Unyp85punRq6T6+UGiTmfVDTTZ4nTEaxbovfa7jMO2fXr99oB15KEg+4/YJWT+In0snB3G4cBeB7ze8fMd3/9MTMz342hfUwpLc3A5f2mKq79aVuG6idHsmU5FqZvlPShE5bnFL3kTjCvUkcyrCQzNMK+b8lpRzG+o8m/0qUScjLt4wJ0/epX/BRETcflJF0GkedLeuTj3Qy1ZhlgV0enaIB+pGVfCdDyxFSc48hInJZhQ54jz6e0cVQ8l/nnsQxPyLNBPWw1p/Mnfb2FC/Zq0aRdSDCI76inbbFTouc3OmrLaPc6ooc+QzoM6Bk956Ie8VUJ4KI9rTXI7RsUaIEhe5GW9QcCrtyTVOeuEhcsz3lcubRG1m2BP+ka/g9SchtbEaiQqW9OC37LT+MZQan7Mu7wr4wXcfzCn8msWHeeb6jTYEs9dIJD3XGCExLfS0L1xkjO5cKmOu7Ec0npsi3EE/zvM8LHJ/tJAc8lL2rObSTLk6wsvMS/hRaaOjnLSVz0HtvkNgeid+hbT9zisymp22UwU7amEbceddHkqqeGVtLn19UQhzfVjZjJMObp2KqlMFegrM3qjaYEn+J6PI2OyoRdON1RnDXlo+Vpup5aTdZL7vUvV0PNGNHjO3k6eQ7pxnoVJOpcK9FzTv0YQOPIRLSpqymZnlOhI19FM+yEmHmLKtW4g8+o8HbypFCZRsZqrImC7/GR1vBU8Du+VHsOOKURs43YWv3wvqw8Kt1xQ7Tlwlf13udl/Eczb/wduqa3a2u8p953zvvJBZ870TIjeiqFDxhqfA05FzwxX8hpV7H96AnDb8gvRsxU4XnVG4DLVGhLb5pjd1Iv+YZTYZ3CPkrnNIR6SbpdCdjzuUQPR89WUK38A/2HMKv8gl89VJsMFU1voxlzgpFgOqHp2/vjdPeSxq4gmd+nwFaMbTJGVEXqiWgP2xskzp8Lc3u3xOFG5DkyfbBu+yApdbWd07hw8Y24wJB8okMlr5ZUhcgNyBjaXk6PAedtH5I8fSlEVZDW6NL6I9wyA6pcM3ZepF94pMgd8dBLvJ8synNuIknNiz+bvCaczOJs5+BQdUW+ql8rK6X1cKnsO6G0v/c1L0r6+12/684ndwP1Ba1kA6IVOcGQi0X1Z4RjJ9Qap/Ec7Tyip/9TPJDdy4mWt1WQY6oc66z3jWCLjP/p0fF8ikMsRpPD+J2pNWyPJscy98BgPXx3O+NMpZkq3bSRPCH48P46xYHgN1RizUjmvQXamqMtqb/z/i7ryTTX45tG4CO2BT/lV6EP/NlL1CcZzXd8L3pWQuZlwJbSNxizByBZzigMw++Yq7HtWfUqViG27WLsFGKzlJRj27aNQmyncG32PXu2V9fnqW/cOv/wn3eZLjsxOWan9W7tlFdQHBdJESVNVu7NU5RrZZGhSoMsbVGkD4MSw6LOKGM0dEarxR4cIfcdL3bmRLGLziHtyvXcJ494gOc4gRd4gzN5iw+4SGf9LsUmPsOFg2655JDE6RHd+MnKaSc+YbNehSESeICkJEha99+Olp57ycH0dU0XYe1qRBIgxaaqQ0FMZDRRUaKsiYkCRc3syms2X1G1tSUjMYv2xeLDb8lqX2aKAx5LUDhnsTOzvBawzwJuSwAdG72tRA/gkoREQPeiQoqAcFOSawXCpAHIaC+L2LT3WRxW771UqVldcGpydBPT8YxLgpvpYqeCpChrEqJFW5MUDZqamVXXbKkSamvLN6tbLnpw47L48Vn82pcp2rnSrGeabQYHXaCdUjPGxjmDY9boTs2z2I7Vbj4ycuXI+SOh4eeH9zdWG/eKU43tjcLgp4OnGmLQPhIamD9w7cC2/d+OnN93cV+pt9L+tH1sa26r0Py1eVvz6Prz9Uvr29b9tftre1dXV86UJMpPlnct9xf3LXyZ3zP3a+7s7LPZXbND4zKVTEh4x5NeKX5Pvzue8VvTr6ef1dyfejV1aKqV+DpxZ+JmeYwwtpf9nDK8//DziZqcqoH5xvbx/+NPGtvLJdnjacP7R+ePhOT4lOz3p7LfU5pHTxzBBDkGVV09rXl0ZP9y/4Tcr+HTQ8/2LO7+sbvRleuYH7w28L3/Vt/T3h+9g5693Te7znV+75A5bNuT2OmYeo8s49R3wRJtxqixG0cyxNEcy96cLPbjdM5gf33PO5DreY5D9N3uMt7iM67Xeezb2RWb9Z+fU+KSCDzmQrymiU/SI9fDkqhcjpnLSJr/kzb/ISvXq+YSBuSxg+YbGHJ9yHyfYfMHRsyVjJrPM8Y6Tu2Ct5XsDAPwXHIuM6PUlNMso7CMwor7izbMy0G7ZIaioYlJoTIzMzOk1/I+Gs+FZVD0aIznfN87Z854YU/wiPeHjD7MCKOMMc4Ek8aeYpoZZpljngUWWWKZFeIkjJlUQ4q0eTNkyZGnQJGy+ipUqbHutQ022WJbje+/LYFdUQK7JPCP2xLYFSZw3i/OC+5oF7v/k8Afgsu6u+Jb13Tbzxt9bsBxkFuJ1CXyQ4l0JPJZieyVyD9eJpFdvUQcZ5hljnkWWGSJZVaIkzBmUk0p0sbIkCVHngJFSmpbZY06DZq0aPO8hNT8DukcCPayjxh93Y50/FMDJzw/xdluV0IdCf1bQn+XUFc67kSq6+eN1s6A4yB3dv8toW9FCW1J6DcS+quEahLaJaGOFA4EU0wzwyxzzLPAIksss0KchO8ljZkibe4MWXLkKVCkZI5V1qjToEmLNs9PoebsRh3r9O/RGvhFuAauyb6fN/jkG+U04PEgd3b/H62Dji7XdfldHX4mXANJ301R8rmy71WoUmPVa2vUadCkRZt1Y22wyRbbxnuvit01o115HzH2e/cAJzw+xfnuH52bv0SV/0nle52fPtV3g37C6j0fcBykV/16dE3/wPm53rumjT5kvmFGGGWMcSaYNO4U08wwyxzzLLDIEsusECepnhRp82fIkiNPgSIlNT0vKdao06BJi3Z0bd8pmaNhHv56q1ZOBzjh+RlZnfVaL5k/3ZbMcTvrXmkclMBGtEJ/pfNT4cocMuYwI4wyxjgTTL7qnaxzs/uyOStUqfFwtDM5o/gLYtzclTw+xc3zKnv7crQrxXodcKfP6iJagd+PzuGBl96BjDvFNDPMMsc8CyyyxDIrxLm5H5s7Q5YceQoUeW6HzpHfS3bbsEt/ztFO2NUZ717UiXNxa4U6Hzq6tUKDIFqhXw7cdXSWd352dNYXDDPCKGOMM4GuZL7TW03Gq1ClxkuuJmPfH54Pd4awOncDef8uUKG8T6myo8qOKg/1qvR4kN4O8B9V1lVYkP2Zl70DhLu5sVOkjZ0hS448BYqUjF82X4UqNVa9tkadBk1atFlXxwabbLGtngfD/J/7CyC669++z+nyiO52665PR9d1tB7d02IvlflrucPf3B/T5syQJUeeAkXKaqlQpca6mjbYZItttX042OW+stv1sZd9xOhzpe533RzgkPNxzIo4zgnvnfTNU46nPT/jqjzr/fOyuGDG8BrzOEyj+/ngmgz7CfdO19iAx4PcZU3c6xq7T3oPyP0R8w2pY5gRRhljnAkmzTfFNDPMMsejanjM/I/zBE/ytNfmvbfAIksss0KchLmSakyRVmOGLDnyFChSUufz9lOvrVGnQZMWbdy7ddNnZUQ7kOQuSea0ZI4GrlXPTkvmgGS2JNKRyLokDkoiJol/95Lw/SHjDDPCKGOMM8FjRnmcJ3iShM8njZsibdwMWXLkKVCkbOwKVWp8RLU/dt5/7rx/K9jnGHPs/W75ZXAA1QfH9HWcE9476Zo75XOnPT/jujurw3Men9fzBZlflO0l5/+y4xUr65rfk/28ITig068EAx4PEv62Ca7q+lxwn87vt27st707h5qGGWGUMcaZYFINU+afdpxhljkeVcNzU3naa/PeW2CRJZZZIU7CXB/zmY/zCT5JUu0p0mrPkCVHngJFSuovq7VClRqrXlujToMmLdps6+1D4brYzV6z7HOMOd5aI6el+x/J/i+6kk5HV5L1IqHLQUyaTWleD/p5g6vhjXbKAY8HuUvy93T/J81d1tDv7Dd/so7++JJraNJ8U47TjjPMMsdj5n6cJ3iSea8tsMgSy6wQJ6m2FGm1ZciSI0+BIiX1ldVboUqNVa+tUadBkxZtttX+zl5ShEkR/aqMkvpflNTrnpPU8ejKqt72e21HUl+4eTe8Kzgspf1S+o815/+hZNJYYRLMMMscz0vCawssssQyK8RJmjtF2twZsuTIU6BIeDdVT4UqNV7ybqq2t1k3O+rtCw6g+/CuejbcU87o/JzOY7etka9Fu2wruEsi9/hsb4fVrSqHjDXMCKOMMc4Ez+n21rk1ZoYsOfIUKPJMLXcBXUW2JWC4SK4kbRA8AdYTuhlp4wXIuGBpwZ157kr72JJxwz0t0DhtQJRRXNuy4u557u6a+dapO8kC1kv3WO76s6vqVJ29z9n7SJ26da/vGavpKA6Rfr3/Qo8Yz7WVYgwvpIb8qCR8GPvP8aGZTKQkl4dmMs6dLp9C54beUtviwzfqLYfx75joaTyDPdgrz+F8rJcd9HPwJd2ncQZn8Ua+vHdobOCXXNwcTVH2tBrIUwOj45FT6eKRsyuenQ7UXFtyGDGVPPHG44T8n8Yz2INQAtcfxwn5l6IM5ahAJapwwwwU97BzFMutIsL3RQctn4hJjoi+Id+FHqo8GvIdX+mZisx918vnKdc+jWewB0cdOyaP4xgu4tT7Db3JsPVO529mIvK7cd9LpsjgB3dvuQh9r+PjlSUen29VmlfieRw5VPe3hbZU9KaiTv8qz+v712H602vHcXpLUYZyVKASVbh+Tvfx+N5W3SWQRAojHRuFPNujyTHkWHKc1AnkRDKfRws8HZxEWgFW6i8pcavR5DPuFn6gtG3RLMyWNscspXjgz6L7ROT9eBALlXQRFktfgqVYhuXSVmClMX4V61aTa8j3SPug4+vIx1z3OJ7AsPfK7N6BndiF3SjBk9KexT7b+3EAB3EIh3EEz0t/AS/iJRxTzuM4oZylKEM5KlAJMRZVK2+NFljr/DqynmxQ9kayCc3OM1sK30dss9+O8H1Wtd9l9ArfWDX/6XVNnzGr3/4jyn7TDasPaSmZvn1wBWK8nCaKyXzxEPoD21Nc+xbbU3EH7sTdCP2Ccf4dtgutt8zALPtF8purp52H+biPhvvxIBY6ZxEWa4lLsBTLsFzaCqwUM6vxTiV/lwhYp0QPaUUPK/UjSvWYax/HE1hP7wa2bcQmbMYWbMU2/A9WObQBXlLm4zghj1KUoRwVqEQVTjrvhh4YF3ARl3AZV3AVr+BVvIbXUa2eGpSnWQ/SJv7beaBD++gke8hebb2P7Mdt0XS9dyFmGZGrUeNoLX/VkfVocFUj2YRmz1ha5NgqfaQrfzUqxAxPOWZpBdV4s1fni4QfaZ/f5uXXebhXe/x6aIvFeoF1aughTxBrRIpvpsbfSiWb0MyjrVY528RZu9jrQBe60YNebaOP7EcixNl0FNI/k7xFP3CWxSPD3iznnLBfijKUowKVqEJ1aN8jfJ8gy71otisSZBIphBi3CpALT03plT9uxW0YydpRyHNu6KXIsfbH2Z6AfBQg7p2aorfw21RMs38neTfuVSvTnR330bmZu4kojk92bcQmbMYWbMU2bKdrB3ZiF3ajBE+GsTOKnrbu8gxvu5swO9DbOL5P+n4cwEEcwmEcgdi9occ5weZSlKEcFahEFU6y/Twu4CIu4TKu4CrcOaizHOTilugP2ZGthLxk/xn9wV7Hjjl2HPnq5/NxPzHUR8R+dTZvqhf2OKcUZShHBSpRhZNv0Iaq8dtRlrhKIIkUbmHVbVpSnu0xGG97AiaaSeTLdZLZZVjjtj8V04wtd5J3o1D8xOttx6Ltrt2BndiF3SjBXvnvI/fjAA7iEA7jCJ6n6wW8iJdwjL7jGHZtm+7zuICLuITLuIKrqGaPmo5EP2urkRUV6A0L6Rvhv9UR98J9jn1W7eaGuejTWvYzqBr4B61uNAsminat1xlhtiplq1wn+rhfCV7JktfnpX0nrJU1hHVkvg3rVnO1KXoHPGdH2up/jitzcUtUpMbb1Xa1u/AONV7t6lNRvhwm0RfuBaKRavxwNBV30DZN2p2278a9epPpAxXWpy7QeJIHamkdq6zlcs6P1tO1ge6N2ITN2IKt2IYd9O115lHnHaPvOE7QV4oylKMClajCSTpPseE0zuAszjt2ARdxCZdxBVfxCrtexWt4HdXsUm/hLtczEPU+efCOMF+bDKsOvDMZU2zfoT+Ypl7jJyh9yvc1V3UpX0t0zLHjOOG8UpShHBWoRBVOuf40zuAsql13b7wCyDcJJJFCHsbAOggLaJd6b7gjb2FrP83fjPtQNV7E0mFXAOWzAzuxC7tRgn3YjwM4iEM4jCPIlGbYp1nVdE+KCtXeHGNdMX+8x5UfZNU6MtzzSa9xZq1ariPDjAeNytmkZM3K2eJ4K9qVu0O/1IkudIvIHsd6xXCf9P4wbxkt2iYqf4Exq1DNzTbnm6NOinnyXc76ILnO8bjN3KXWT9Ceoj2iPR2+sR/mW3JrpqXVdpu1l3ZR2zFQGvXZ7scHwv1xFh8lkEQKeRiDca4e7I3Yly8OjCWxp5TtLcakqZgm/U7ybsw2os4R43PFzTzMR7E6uk9d3Y8H5PMguYBcrD6X0LGUXEYud3wFVtKzGu8SCe+J1DMeUorh7r+3s3cHdmIXdqME+7AfB3AQh3AYR3Bjz5eJBmUrRRnKUYFKVOGkMp7HBVzEJVzGFVxFmE2w2xtEcRzwYHi/hnda5N0aZrrp8N5Tn7llv7K/hb9/GvePUUINfk4Nfo2va/k6N442ffw6kfdQ6B8virbbolppdWqlHg1yaiSbaGk2kreQrdLb9W4d6BzoNrdujLq14h49Xy9L+xzrl/bn0QhHs9iZQBIp5DgrF7ewfaS6GoU8x0eTY8ix5Dhz2gkwQkWT+XMKi9+ih5mKabTdSd6Ne50zXckK1d8M0owoKpLvbPnMlT4P81GsLw3vqeAB/c+D5AJyoRpYhPjtvpvjN/vI8B4LVhpVVvHfanIN+S419UErHw+ZNz7musfxBDYo50ZswmZswVZsw3a27MBO7MJulOBJ5XxG77WXvc/a3ufYfhzAQRzCYRzB88r5Al7ESxgcSdVLKcpQjgpUomrg36OTyn0eF3ARl3AZV3AV1eqqhmdrUafcwdtRFHubbDOT7UDnwKs8/K88fJWHX+HhBh6+yMNXQkxZWTISfJCVVe5GrH+JsgLejyPusyKuzxkV6i5y1nORMjuziu68eK6t/uptN8gpnmu7kxONLY63ut9pNxPpoKHT2NZNf4/9PvSjQO/53WDDnGDH6zR8Lsy/a+zXipw6rabefbQ7ingOri00ky1oldbGynCfiE50YfDNRvShH+No+ixNX4xbUKQscnwINVpILVlH1ss99Mv82UK28VEn2YVu6T00hvcanddPfigawcYsOSaQRAphZm4WnIs8+6OdM4YcR46XNhH5UTLMYCYNzsDPhzW5e5WrUETNoHkmi2d5P66I1bP1nHNoLR54VEt4NrofD2KhfBZhsTa9BEuxDMulrcAqea9B7L2quMfkmcdc8zieQJjNs20jNmEztmArtmE723dgJ3ZhN0qwD/txAAdxCIdxBGbsQ2v+ylaKMpSjApWoGjgSVStf3GdlRw1kI9ua0MyuOIJSvFArihqjDnQONPNGWdRtu0dU99LVZwzstz8mnsWEseZnaupwptQ9IaKqRHgdP9ajmb9b1WZHxr/d4NuhN2VJa1b0FkQ3yfW0HI3yYrVYH/ouLSqst0S3yXmnXE/K9WzUyJ5mtBqD27XCjmh0uOvtdl6v6Okj+1nm7pP+gjDr+kqmjbXLLZJbm/blnUnH6vRv9WjQXhvJJn1RM5tbREKrMraxsV2sdci1E122e/VzYa7A0pvVQFVoT1XO7qC/E11KGd6JJYNNculnSR6b9LuOzBH7xbxRY05WL68GeTU5o5mOFultjnfwjrGKzkRcd/AWrzIX0mUlLy6N2KlR0tC6tJYGZzRqy032m1naYruV/IRW5M1xrSWhbEkyRabpzDGzycVI5R+FPMdHk2OcM5Ycx6fj5TKB3+NvInwn9F2TbE+W8xTeGJqLnB6ai6jLOa4Pq27i5H48iMX61CVYimVY7tgKxDOrfw8tJzzjZ+9GbMJmbMFWbMN2Nu5g305yF3ajBE/S9yz22d6PAziIQziMIzgq7+eV5QW8iJdwTFmO44SylKIM5ahAJbSiN5578FWt8oQ5KEIfJ0LMO8VRndbVJUKa4talnN1kj/Eibl0NfNvF+4W8P1sNqwV+HeBXfTPZQDZJCznab4fIcPWPQ7yPHmyXxca+0B6dUaWuaslr2qTyd4jxLlq65XrN2+u2R4W+c6bU2VKLWfVB22bYmdJF8czKfiM6HOtEN+JWoV+95ttj4+U5UU7hCavonGR7ihynsWE6ewsxQylmiqVZ4qrYuHmfXvt+PIgl/7Uqa3sFPqg9ryMf4uf19BzFMXkexwn5lqIM5ahAJapQLe8a9tQ6P4xDaEAjQs2yrwXxyqh7AqXpg9GaJjNvlrrT1CpnszxzN6Kf6sy0w7Ms+hcaXqHhDA01NDTQcJmGC1ETWoy9rWYEbdpwOz9m7kRoiuK64wXagqYfhDvpWBMvsCdoifLjyHDV4AovGqIxmTlJbjxyk63K2iatHTRFXfLott2DXuf0keNp+HxmzKtQsz+l4W00jM2s8iXiWY/tRnHRpF9uJlvstyp7u0jrEsXdPNejZfWqvT7b/fL8gyiLjxJIIoU8jME4dk1h+zT1PJ1PrNRn7jJ7Y2vE6EK2LcJiq4JL2L6UXEaudO5qhNFV+uN4AtvluwM7sQu7UYJ92I8DOIhDOIwjGG6FpZot4d18eTeh2bEWMr6TC2+gh6jvUoZu+z3oZXcf2U+Oy8y1GtTnBNamMnen6XgG6VioT+292fEWstXxdld2qNNOddnFgm7bPWqkV4n7tG7PIMRCllXVBJJIIc1LOcaPXOTZH4PwTV72TRbXU+RwhzqfxjPTjVRxXfdHs2mby2PzMB/F1mDuY/H9eBALReIiLMYSHltKLiOXS1uBDxoTHmL5Y44/jiewni0b2LgRm7AZW7AV27CdbTuwE7uwGyXYh/04gIM4hMM4gqPyHG7d75SyncYZnEW1stWKj7pQ0wVqekJmbTodRy6b283CO5Tf3VhmhP4C60O/h9m8OkcNFkd58ewG8f1fUruYFrc6adar4gghRUjo6UNkSOuirUfO2sTgbGFMNFGdFZiNFbLRdx1oomWgLWh4CDXOrldPjWhCs7GhRatsDev8yfgpjbbdTxawN8cdBJudNRuhDZProslye5taGMvWO9h6F1vvjBrRhGY10yK9zbnt6EAn+7p4tTvUSm/cQ6jdfqNsIowt7JOjO1ulmji4tv//ta5v/hZm6Wboar5YNA/VkdmOllFH1qMBjWhCi36+lWzjgXZ08EwnvJ9Jy1haxtCSjp+NkL6totyFPBL8bnsO+J02mhDujxyrR6N22ARPXWj5Li3pwdmh3nXw11RSob5m2WJvVE1m6k1UvvlnL2o41G6IPnETapX2eKb3s3hWIC2e7YkVMdxCtqqb8a78kTLlhll6HMtF0XvEzAelreP/h1DD7no06Isag/5J9OcpV5QZm24euteTR7/cV0ZZckwgiRS8lzv0DRca88gxCHdhSpxPTlEH09gfvs8pOgsxQ+pMq8GznFFkvmvWc80vhbhjvubXchaL2CVYimUIv56DP2L5u/j3PfIJ0W97PZu2s2EHdmIXdqMET7Hxadqf8Wx9j9Lvc2w/DuAgDuEwjuCofE6wvRRlKEcFKlGFajpr1FqtstShXmtr4MXGMFK+PfYm2kRGh/beKXK6jHnx+tOX1Ohn5WB2dE1b0o6C129oS9pF+G0XaEtRCznUnpK/pD1lh/Y0IazVh/5Gi/4g6S41ntWR8Zw1J747dFWT7Wa5h3VT57Y5FuYR6OLTbhqDBpjx3dgf0FJ9XRm+e0N/MFSGz8ZlcOxa+xOZ/iDbp1B9ySH8bk1BXGfy96w/tN0PigIlousHdH1nqIeQf1g10ac3qf1m9rXYbiX1QZk4HxOvBtPXg17X9LGnnxx658m7bbb+JmdPzu6crTkTc7JystI/S7emr6TP5Wwl/zn9fHp3+uH02vRvp29PF6QTqe+kvpTqTB1N7UmtT/1t6o9Ti1N/mHo7xiZ/kDyTrEo+m/zL5KPJjybfnVyd9En8KPEdn6/5fCZxNPG3iT9PrE7/jL7BD727EX/opJ8FYW/wk7g97ZNODH3YEFsSf9bHH3YMfToTo5N/6be1dmZvzv5o9srsOdkzs+/Jvj37pqwvZbVmrc0qzpqcVTziC37x7uUR/65G/K6gT3hXjExpUVki5DZbeZmnCuPtT4yf43iiNy68x1Rg7LlH65zu83Z9QJGU2VGxFL/HJWWZz73RKp/p5jprfTPgnT4zonf7zOTdh/QV67Xf39Bu91rT3qd9PmAF5KTrvPekFzgfvex3c6p91ontfldkh3vWAkyLkqwcLz6892D7DsdO4TTO4CxujdL+TxRT+ZjirPX2j2K4VWnvRWKW+dNwz/yrpSeiNP3jsR5H8RbHklEKeZAS32NjEqZknpYWkdv/29/Wz9zTurYUZShHBSpRhQSNtIXvy7QHTTkZC4fsmO6OReqgxb5/o/4Knfs8+QJexEtQu/KUIiYKbWVHaf/X4yiUPU697kiRPMMReD7ov5XsX75qixHhrAm/9HlWPqbLdYaUmcr2P3k25btidExEPqxQXf8dQ5rniuV5mA/9jrFsmvOKWVij3mpRh3o0ogktaEVmPkLLFPeMJ1CKMpSjApWoQlaosSK1y6IweqpDzEJ4yo89qLbvNz5ZMTmU/vnoHUq+wf5GbMJmbMFWbMMr0l/Fa3gdWeHbOIUYodb8FwHfVssJ/k8hD6PlPWGgR32IR/s7sQu7UYJ92I8DOIhDOIwjeC4SMa59AS/iJYyICvxXRvqLaMuKJrIsH9nh3vchesx7xcl7bD2k1jrNcbusuXaTPeiVc1LNR6Hce0n1HHXYzlI3v2rkbdcvqbnBnAvgGVnIcV3waxTO3GO72bGwIop2fkxbCWuKdSPkR1+XltwrNZtfzc3RLk+/cuL/KIzFk3gWYeUe2dFD5oS1zu1yNNfe81GNfGrRgCa0oM25XWGm6hraf0C7WSN7eUUNJexHg3Fo7Ug5H5JqVT3zBv4ttjIr1s4dec0qtLIOPunfY3tvqOk5QUtEvzYc7Oy0lQjH17mqCz1IhrOaWRnmAHDUFZ22+p2bDOsWDfJuY1G4q0A6HJ3Lz/MwH8WRmkeN6+Jr3L3Y42uyn/7ccNRMLhytz6R0oos/u8l+JMz9omBTLVpCjxNanWtjy2p4rNXxEWFVNxFK02KrM2N/bri6BoPrWmhEE8JKMKk38z8Z31WiSY6t6JU+JcTeJEffoq6n4k7cjYWsX4T32f4AwvMw+4/jCYjV6JjrjuOk9PO4gIu4hMu4gqtocn67knWjJ8RCJ3v8D1FS7L9yRG2hROYqGPrtUn5WhNvN8XNDq8h7s78GynPGZXks9UmH0Tkn82ugK32SYaRORat9ktEan9TQr4TSdaMlo8iIPYUZS5KDv2K6Rp7v9RkbfsVhXMjH+oX0d/jv46xsn0QgyydHHghHvfcXuPYvCQz7JycfdcFjtuSFoC8td4SjSbnjmisTwPB/se3/CZpolWh42mJgZGBg4GKwYKhiYHFx8wlhkEquLMoBNEUPIHx1YQDGf+/9X33fbNsMs7287GbbueVa5sxsTJlDnpVbXm42bme6HZ/neQ8N3n5o626D92w8ss9gOfz4oUDIdOSKzZv3HjB/y779e83cdmjjZlP37Ny+0fh9R/ceMhKhg1AgQyDkyJQq/8X12BPrYnXMjYFeWq6v5Khl+moMJ52LLDqRRyFUal109cEnn31RInfMNmt01xGGC70RqIX8r5spDDMbV10z2I0mDXWrScPcadJwHVJ0WP43PnRtzU9uzXeR5o2WGOnUmdc+4FM6XQi1nNQmV62jr+7qdKY3Psu890nmXfLftvzeUit3XKZL4pX4y/u63BqVTsqEOZbSml/sfyUy4/2vI61rOoJ05vDcCxIbmnib3fUMIWxp/c9QXRpyz30PPPTIY088bcwtKSqdwaYm/f8TPSxFd3jaLcWxDUBAGIbh9//uLhFKC1yts4JOoVcqJNZQix3sIQqLGMEIUPA0D169WgJo0wTM33bQWpmYsuCCHHIjDEDBr66ayE58Lm/3Cb6zPGILgFKtQEQvrqMOdgAAeNodxIEGg1AYBtDz/TEDMAMwgMHMrB4mgIiKAJdePzo4Iu46PK8/6ljWljfH3Nb8ZGvTnl65eXgJ5FsjIip/MzqlMoBwApY6B5YAAHjafcwzAB1ZAAXQMzNr23hhubZte2Pbtm3btm3btm2nyo+TLrloD2IkeEIiwhPuiAvgJ5+50wNe9b7PZJJfJdVcjF6P/oynxPPiTfGWJEruSO5N0oU43BvuD0+E58JLIW3IGN4MH4SvwpA0adO0TNM67WNpn0xdvHjh4kUEr/nA5zIroLIel7U/4snXNUmS3HNTezw8E164qr0R3r+FdjcXt3CxF1zMS+qtVMbUE6n7uHD88tfuvGunnXa8Djuy7Ui749Mdz+8I2zds/3H7n9v/2JZv22/xg9EjIj+hAEqhgWZEPwBEX107QPRR9JnbJLrL/35WRj35fO4nWWRVWnk/+NK3cvnej6qqoprMvpBNbtmV9Y3DIok73Okud7tHDvnlVC66239qq6uW+goo6IDCivlHzeg+RexXQkXLrXDIEoVUd9Iyxf1rl512y2S4IYYaaZgRRhltonHGm2CqSSabYqxpZpluhjlmqmS2ReZbYKHF5umjiYYaaaaxppproa1WWmujk/Y66KilLnroqpteuqusp4H66W+AQfoabK7ezjnrjPN+8as//OZ3f14CZSaXvwAAAQACAAkACv//AA942rU7BWAbR7Y7s7ZlkO3IYra0klZsSysyySBbZmYK1E7SxOE4aZs0ubSXXpvmsHw9TI+TYtqfy6UfCr/48Zg5l58y9x959d/sSrKVuPDJ0o5238w8mvfewD5TmKqkKHSWllI0JaEoTmaR2TkZU4nu4h+7eJGW/vXtCTwDreypt7EMqygrVUVRFsbqYB0sU1AAN+FQJMJx4ZCDsRZIWLgPqpRKjoUnpVKh4oKRSBjL2o0+aREuKB2sHRgLzycn/ZwvKu8xru/fsjP0yFAw6LYb/Qa9TqYIhkbbIkmbwxNg9a2+6IbJdw9azDJzpcyqAS58wEUZcKGgbMBFWGSAcECoqrkwJ2MJPWDGkaaPPplf1hdqnq6unm4O9ZfmH3nZHDAYAuZAPD7uizQdHB+/pinsG1t6d63Cof+61qFMxKaiCQpodQEtDz4v0uJk8BGoqJQKQhWkV0aDhBShJJBSdR3JK+vnElPV1VMJrq88byEYjwdNhBw+z/+7L9x0zfj4waaIb3xtIjoVSygd2q/rHQpQP8Wm3kYXQS4dReULGiXiSLJCgBKj6oICpFk8dGixf7N6S1HQFQY5fVzZFdoF6W2HD92ajFdZPInYukhrFVPV1pbV1fn30pXsf6orVL1kyFUWJvxjCfCvoRiQYJkMWIJlmX9aUBRHKCJj74662m09Q1s4/mtNjVVxTVvlzm5rUP8jjV+aODgydDDRcVWHuzSWdJl6PWH0hDlqKyyyh81EW2oo+kGyNWRcmDBH9MUpGSVcsvne3q7k9MLCAvraxu62rk2LG/lpCmzbkPJiC95ExagkNQI8KrLqiIaXf9LKySBcHmxgHMSAOgmMN5N5itBZCyD6w5bI1fMTC9VBTyVT66iqDmxI6vxyh21wp8sZWN+ucsnKVVbrx9ePX+0MnC4rDdY3xWvv9ldX+32BgDfSzRpjDm9AUlLkr3R6C/NUfaHwgLdAInM4rihTd1eFBjz5eRK1TCHvG9MaSgzlJmsl2uJiZU74k7GuZSlVVIhqoQY+SMr3kNCeI5M8R95VJFQHFKfaikpz5ONfTUv1zLKg7yVgvmQCF7s0K6R7c1km/mxGUjLuXeCWhTDuypX+qJQxsrQPyrqO5K9paxgYP+L066pN4HT/5q5Z2MCfQQ3RGrndwH+D+HUjRVE/xC9SpZSMouTgbaK7gbAFNGC9mbXZWLg2H8Fjdr3CYLMZFHr70klcvPQuhVN/TsWE3oWUiqLU0F5RwDDhXDRdR1o6kp9O47kCb1v6dnPHJnx2GVtaFh/IUpqWJRrlJHKGlShBhrZ9n3nkmbs+1gYCtKz92PP8Yy92fyktPyqHPoViBA6Tfqi8rbnxSFtLPd60dL3Yhg6BBTgALyPjlKKS1JfrKnv3/JEj+eWJ2kh/BS4bifeMHHF5tD79Ebdb4zPg4nFXbSjsiYtajMUELaZvsiOiopQ51HKQ5wwJ4MsZESodO6SAo5wy5sYOYplsjjEibdf2urrtXd2k7OZqa7lAXR0JFyPXJBLXjIwcTGxurNtQF49D0SjG8Bj2ZOYLtchgTgyXyT90DH8Wf29sOYbzv0WO3ChOIm5seXbKl60yO9EfPuI+i8wr5yc/cuTEXNEa9uFiak1G93EMQSurdYmlxmVweuqMuHgbYLxGxhiJDRlhpvln4NEN+gAFRFUkOANHLOvHogVnJx6FSq0WVfVO9ya2z9jm87uMTCjW59w+yXXGNN3qJoeTNdvDY8PhDVLO12NxVBrU+nyJxNFS1TMpt+u6NZVGrU5fIJH2Ngf7PIS+FopB/FlKnrFhiN9kCDghenOoc6alrddpVO5dWJhra0KVG/X6yU9t5B8nfVvBUjBIrFyez4gPpBcZcIeuzy9tbQZjc/u1VaYj42z9wgbUxT8ZqamwG9AkODBgkcJQIcBSRDigObWa+B4auuv+w52chGs/gIt/e+7cb9PzDG0U6XGZhmJJMyzLSCTf+PTBsCuvumGxMZDnCl31qZsTLO1owcU/fvjhH5Nr6d0Ln/zkBQoRaXEpYCLeLgdUHKCQM4BCfvr+W7bRC8ceOn3LjrydqAih++7jl/g/PfII9CoCe8LiCNvlHF2GGVBWlObkag5VTV/9vVJbjad3rebRj0xbC95FiqXP2qtVmzoxw798FHrbQYTvpuW0hJElbFEiC/ouP4LK+T+jz/OvIc0m1Lhxjv8HYrtKKI7jc5SE8GghrDFyTi5IiY8fi/0x+rEXvyqpseRbYqdP43P8lgd37nyQzDhD0O9K6CenzJRHWD8GBZORKIMmLLgZreQyVp9zP4QSY3O2mkp1qMpYNRj61VmtTS63ac9+RWOtqLBq8LkrBsNNJrqgwhH3xaYiyPMoQK1aawUyP1xhUZvVVhlIGQKbmMNPU4bl2LH62mnDzI1dXTfOzB6y7y5vresaH++q66pYsB+RDnxp3/6vjA4M1lfVzE/tmJxrqmrsG6ewINkhkKyYUhG5smGDXRaBGeKnb+rqumn6wIFAh9PZETiAz/V9bnHxc3372P66HfV9LIUEPCbAU0LGQWZRpj/YxIfQP/NnkZX/FerA5/adXDydbi2H1kXEqzOtf3QUPc4/iRT8y0I7Ki33dSC3Y9kXcoVPxzORWSZskeHyvKJ1/UPX9/R9fHb2Y/YFeU+c6/V4+kKuVucxVLiNaxv68r5994wM9zT66zzD8V0NIx59mPXt5MGastogUsAeAVwVSvC4P/G/PHoUMUcRy/8U7OK3yLyUJPyFodiTkRoiH3Ag+Pce/smZGdQwO7sVXdi6ldeRtrrUO+j70LaCouQWGdHxcmSSMXvR+shc64Zt5QeKqp0s9wugUtw4y20a1nqDAQ5dR6W5uxMwENulJYSQTHBThP78zOzRo/lz9931FpKg+h3/Cr2/+dEf8r/kt6T7oRegXz7hkoiEXuC3HEUwAEuPZvD+WuQMMIq+D7IzEpqGuWPoli3ddNeVtxyiI5/5VJTG557+1KeeXkqi17fyf0SSXXxJVm8iZ9AHOhP3JZp7+Xsd9KHPkAJt+gxfBIzd/Rn0n0R7WBjd22B0yynLqnOiaH/ZQUbz0zd3d988PXOsu/vYDNfpdHZygS6Xq0s6dGL//hNDYrnPP1q3rX7E7x+p31Y36qfSNj4N3EkpjWhvGSNnZCs8FcyvtnkmGJxpPnNSZ1MobDp8LrKhuXlDBDX8k5zR+nXWCpHrPoFrNeUCrpUkPIf9eCXrEuXlzGPFhrbmnl0NIv+1V3a2rRAguS3R4JZO3LVFlGLT7VOlzQ+sLgeJQmVkByWXZQWBJRW90l9BkrqmmWBz86duvf5QWpaTqJR/C58Lb2hp36Liz6PSnWmRxH0ZDoBEPpBn5WwpTpc57kZEUavFmIc8kx/xTtomIw1xmdvWkpz1x3f39e93T+m6YrFahdfS3D7jbdgvbQqNub0Rr4bRFBSXhEZijTNcODha6fSweqtcIpWGBmtb5mMUIlJhjxCdKQQ2RLwJe545+jSW4balR3HbPmjTC7zOQxslaIBMitlZMbMJ6L1e3xAM1huuC++74op9ITC44Uin3d4ZQffx85tuaGy8YROgJ7MN3gF40vMjWGtUzqFjd/z+xoU43bDwUeh378WLaIQS+aLvFmkutxVLGjTPSNDQHfccbfPQwYFbBgK0t/3wN26f9GAf4HjoRz9C/WIJLrP77FmCryLtLbnzJKCq+N1P7r6NvuPTPzt/95fpL6LNaPiPf+Tv5e9GUv5t6Fe8kmcZMAIfGh2+4bXbTuAvfPp1VIG+yf8UQtQktHVA24DY1q7MTIw4sPQO2sp/E73G3764uB/9++J+vppYlhO0Wv3f8ETv5GI0ujg5tTca3TvlDWk0Ia9QSsdO7Nlzz+joPXv2nBjb6R+pOVw77PcP1x6uGfETyZ1ArHZlvJSwEGo4XMtb/77wrqF7n/vCAnr9kbZ/XXqItA5CayuZ9UQZosBG5gAmjrPOJsFW3vDzWKjeE66R7imPzye7NkeqBqtv3bnzwGPVA/5Sf6DB463qC0RmG2pnBpzXAGYNyCsDzNXEioKroJUowcZFk8o6BGnEPN5WXxOr8ndoRzSNo3XJhfr+qKuFbd7b27q2SbVB01ZbG2+Nt6EvB+0ST8Dr7LGEzL7BWGKwpEDiSQYbZjlbvbXLHampllQT8ahKKELC/FtGRjUMQwUKUTI0DcHzp4f4f0Sqr0xP3/Dsv9+4Cz3Jc5vQw/zDqJdoJwoyuKCnDR6UFgkn8r4a00QyOab5p9dIyu1RV/36mvrFoaaZRuV6TVNNXUM86oms2QbRbs+LJp8ufEUyub2RcOmMtdQURuIWeTm6CTgNAD0v0NNR3oyNxHGUK8MSdRy/j61UDexu8HVOeE8PXdVdXljqbPDWzoYbd/faQ0ZjyC6U0sS1wz0f3TVhrNu2twPrq4yhK1qS2+NXGkKOckdYrw/DT4jsxOpAW2Z8TtwbyhklQ6yau/mtN3ah87j/yEu7KVo4EfLA2OohPkeB05yTAS4oju5q+y55zhPyDu6p74mHmg/s2nWgORTvqd89VNPQUBOLx2OhmpoQXNLwTG3rqKxQPtAwsHEjFPJC2Whr7Ux4c9iv9IeFAjUEPGs81dVQBMh4e6Fg8dOiFpECtMeAFllY9a7wOsnl0we7UoX1PqLCPT2gWX6FGtEj3UcFJS62Y121kcT6bfHEtV9N6y+tTbKejYGO/gG4cFI1VBJ0yTLLDERzvV+iBhAYJLlDVpEbGHCBPbLRI7wTILbWYHm0m+veHHY0O8xVgemG6FiQbXEeKCvHX2guVJffzB+qdJfqFTpWpbBUaty2si/B6rahUcaouYloMBlWMcPV/h6fvT3gS4Q1R609jgUmrr8dzzlMknIToy6vtKsKlMY1S38tqZDeW2q2aUq8EdBpPHUj3YGfohqpfnFGzkiQ9WF2lV0qWTRntCyIYMLcpWeF+J6fHDy97oqHrxm6eXONe6guFM/Ll9ZU+zrd7k6fO1Kcf4VG7fD23jDavnfI6xnamyxUMUoFo3b5/a6BzecOHPy7heCG4zM9exo5lytQtbYtubbKV9nKv2DUDfZZxg+1Vo/ubfO27Rny/bPCIt8vN8o4V7uLoxBVS72BJtAuGCvKDrEbTfC/Q6Y3PgI1NurP2Ik2ZWqwc+mvOO/P29I1F1fUXFyqx/8o1JhSnViW+htSk09qZHwpeuvbpKYt9Q71B+puMhepc453bnfCn9vhKHGbKyrd7soKs5tKpUh7uhLaO6h2iqJYqh0Z4VdCteNaitT3A77XsIrUFwtwqhhdS/Zpqd0CHRlFRUUCEka0NSB5u9sRrZqyVJWYjM67gVR0t90SZwsceqAMOKugr4izKwdnJ7qXehSfJ1LJYcX56J496F4UI1xADfok1DioHsIdlN+HX0Q1o2coHuDLZ2JRDgxbJTD0KZe91jdW6S0x6B3oGYdJHtlmMzXYC+walclBejvQd6nf41eF3pfLIPb2FUNv/CprlId3MKa4jfQ2soQnoI1+LfDUR3iC8rdEYwQr+kfA6qD6CRxKgAsaO079jvrW6hq7zW2r8U5YfCUmnf1bTpMitGA3N9jzHRqFyQk4oS96Evo6qCEB51AGJ1WLJOgVgFB2CRuOqiVKJHH87d86rj0+eM/OewZvxKQVB60UYqtoNMxG1UoJd+219r/92+M34RtJO0IB2rwKbRzUCKEA5UVBGtL3LwJ8VICPAlw8oxqgXoIxzCenBGo4S4SVT469/eomZ8yZ8DgcHjC6B59CNv4XaJ3LpDQ5nVC40u8qAMc5EUeUoeE4JRfH2ZjrptY0iu8h5qmnllJOs8LsFAqCwZRqRb8ELrQUC1xkAh7gKVjeRZfhXKR868ZocLDqmoFhzuWLFW+TRqZDaRp/y03X1Y1wkuEv0JHaMrc/7PK6Oqtw9Qq2MSWDs6h/w0+LNO1MePVVTC5NZDpAyHlrihekkalEgnDgrweKbqD8u8/T0doyV1UEqHX5uan62tFAEf/YSklhDFP70Qz+o7DbBBnJPC2GbsaPOf9A8JrIgMfbH7kmMFCFYhtOHfMEr79zsGv4riMB97H7KZR6B/qbxf6I8MekQz7LmTAyVy0jCPZXo9j6+2/yigjuvA4QnBJ2lYBBARjAivIZmXjupXjiid7em+nrZ5YiZPec2k/9p9hCTvbO5CIN8B//engGPw8tFIAjAi3MBIegIQcThqidfnUhbrZMIBmHIhudoajbHQ05N/YY/Ab49tzMeX/k9W32eX7k5WZ+WxmxFRTm2yKW31IibTQhYpaLSldxSiHok5NuTrQLPyaHCpsyiDf16gliPTAImD2A2Usw/84SseVLCmxRs4A5P7UFfUqMSmoGcbsWkHnhTvog8T6oeUCsyYca9MAC/1uhCvSthuJafI7UMVB3bD3OXw+PqVS2poCap6AjFUm9Td+Mn4aWcvDCMInDFoLtg1ftH9zCuYjOLy79JNbrcvXGYr1OZ29MYSgrMyiU+rIyPS6N9jmdfVGxWgAphWrY6BzxTTQ3T/jEskfhtkQsbkX6h9/xPpWgl4+BHbyJ/yhqTMa9uW0bmAiFV8AlYoSXCbXwh25Bm/56GG0iPl2b2oDzQB915F2Qncz3q+xhxfXf6ltZcT3ICm3hKsicCcPCB50Pr48H51zN2kaHP6xwmTtiLcZwxOqOrIsH510t2ga3J0LANQCOMq6+NU6mvXBNoVLDhtoLZYVKdXGox2Wy92v1dqvCqCxUrvHXmHwd6jJVmy/cxUKNxgArWaOiUFleXWP2dqpK1W3/qrTqixU4n1b49CZfuQIX0EqvYD8LmBiFjJzyZwaTHDiRz1s1a6PRtTVoe8vcxtvR12o31MJ33dIa/PrSGtBgEFZ8v0vv8Oo/zB4v+j5vaG+e+/zk5OfnxLL/QDJ5oL//YDJ5cGz6yiunW4bkEyW2SpvTabM4y8YVQ9KJe3buOjExcWLXznsmGpNXd7d0X51M/0zuXbtuT12VR1fptfXYvBadx9tI5VEW5EYPp7mtompg9D+YX9gMpFf3aoZlsxu2F2PTkch0TCzdCZcr4Xa3Op2t5TVzDrtS5osz+srSsrLSSuSOzNbVzUbE0mdv8Zg8Lfb0z4GW77JGbWVhT4unpERaUgJ2p0OfxxHhtEJDrDMM5JUMsV/Yz5NIFoXNLaN+sKfrVx33NQ3V5df2Nhbk9Q/kSdDnL8RiF5Bp717+d1dO33bbtLAvQF3oJvwYVSnsC2ANuzLz4LLEgxV5B2F0U1ivlNN0ScwdahjsqTczFndpSNZV2zYwU2uxmbQmN7q9bU1ppdkWC0YjgFqn9JmdrS1fG1erpCqFUUfoO4H+EaBfQmmJtpf3Srl7pB8MTk8PDsxMDxFfsTmh1/z4+Dy5kn5XvcsvFARfFI2jLwkjaF599LKDB2P3EjdUVTXEiaWeBWfU651KpRONVw+HQ8PV1cOh8HD1mM5rMHi1Wq9B7xNOVN1ojvqZGDPljJz74mL9IppD46kUqUH3QY2D2k1WIVCK6z8L0uES/BIlJ1Ffoob1j0QtYckpBAvLnOivdhXiE9Zvoj1Tc3huai/6lvUejF+6HzfPB+iPN9x+R/zjdGC+GRP5tFDsAwp6Ip8FxpqJggEIFycRLiUjXDQA0VTlFytHzduvNWw7aB6t/JKZ3Bu3H6x86oumL545c2bo5NCZ9A8qPEkhsAY99qZPwiTkjEnOYe+mzxbcveH5HagngDT8xQDaQSSKUj/HFnQT4cdO0lVWmIlalXXYE/aYVR82q60qn7yh2l5jyT78XLGmTFFW3qGzymWlirKyDi0DWBNUI1ZiO1UCWAXLFt9cofldDz0E38Z/2PzYY5uFdjxWoo3ZHYeS96Pv8ZspDDUUYNgPGMpzccihXQbPQ6T5Aw9e+cADV/InrgR8w1QvzsdSgS5LRiVKxkiN/u4zn+nIfHvvuqvzzjs7hC9F0UCJwQrcCHcyyizykbuYyn3CCr4KffeisJay2z3pX34z//d2nVpnFwp04/K9IMsnQcofiPMQAvyyZVnhQts38+cI93Opv6B38CBplY/CSJmvzEfv8DvQLfybqCwfoVFEXf81yddyW6rDdvgg5Rwqg2a35H8UWlyfokag1VrqlxSPrid7s2iODPe7WNYF1y9hb2ZxuSxkbwbtW6gT6Ap09vL23+traemD60QSzpeSQkHax6g+YfTyhRESZNrKfwL9su9BMoJSKojn8E0UQwVE24LxENyYjIpoYDA2gkMTJ7rsLXbM2apb27F+Dfyt71ira3Wyrbp17eJz+zpdKxuoqQkEa2p2VqxZl1yvT7BsQr8+uW5NxaXP62pj8BEK4nme1CfRH8GydJSVrKMyGR+cUnyny8oigs1LWJjFZRBfUP/czMZN03MN/crZErve5CqbVo00fsPhsLN7tsqO79jx8TVbtxQ1V3E6eyH/cKFTH65uKfyNr6kUdUmbfZm3UIP46UzWTyiy8gWyJJ2To8rsHtC6KfIObqppol65XtkSrB0se/Wdd14tHaoNdmjWK+JrpaMnLtwzwtTZEp6qjobhnuHGJFeVZOLCHhMGUjiLdwsnpEKYZMF3Vlm8qIFo+qzSgi28g3VifGWisKx+R9fALsd6faM7XFcief6rCAX0aOxQRYunSFG0RRs2xWdDDbWtdltNVOtRbiksLwq3rSkknuRI3Y9dtBRm3FqqVdQtK54kqlVquBc1LeoaIBKAsHAnMkGiTpTwS6BsGACERxWam2MtgQ7toCLCyBTtvmpPOGYPzUXdNdYhhVNjbvf7vTU1tuoiWZlRD3kx5kGHApabFUOTdEl50NSldpYU0M/LtLqeQGRMJ8ufmixQGD3tWk1Z/rk1Wm1XKLrWWCGZoyVlPp3CViaVXH+yoELHaKzFxeK7bbwRnyO/dkYpRiG40kfnwshh18kbTp48uf+B22+nb/3k6f0nTx47dgwGBTWS13z848M9FBbwBCAfpoKqvCQbyyIsvlCOu6Wzs1DLkScQTifIZBK1lt5FX+OnVybdwBpfzDuk7ZQDeKaoAurFny9DK7LQl5eh+EIWevHnq2F4aQW0OQt9dQWGi1nohZ/D6BMoXYNVlBSk7SX6KlhObYxy2elaTaw8fcbMlOHVUyPBOON4OTMOzQ5Vh1ws7Mmug8w3i4XTX1fVpIJcuCQ3FCspKPL3xPrHoxsTk/6gnyRMbuhz1rpKC0qDba7BzQH+q61/QJbKNWYG0iPvIulxkCb3G5eh1xsyB/S6QOVEItppr/QEHAbIpVQ5NVpWJabVtYpZhz4h6zAMD6utZmEJIK6qLt06sOl4hzSXJCNq5tuL8krUJSY4hLEEoqXe4kqVXKv3q8tm5w9hVU6SYksb7aNputJWyVYYyzmprLRMqsnHifJP7Tp0K4lmMBYG/AbFCPypJdkjy6zDAxNi6GU50Ct9+abty74uf5sjvrOzb3c9tzYe6VQWSBs8Y/4+Ww/7ZJm+1MmQs1/GRkr8RqS6avHG3rkjDc37B7p3x8M+OrjWFYlWGTnYnZQs3W2qdcHHlP5JpcSsR8GyCkTbfIPKQiuy0JeXofhCFnoRoJdjeOmNdJ4X9TwupmgxsweyeeABWgMcKYXWdwhrtxdTaymAp74L8BagmIG/kob/DOC1QDMDfyENTxH8K/C8ROAUEnLbCN1CAIY5MbetYOBIov3ZTWISm8gDLhQ8ZI3oIX/NyCEVMMpETbyyDK3IQl9ehgJXGejFV1bD8NIrxPMUqe9iFteQEyJiBWrR7nKnWNE00wfWsGIFqDxzGs9FocNUMqFUQ9YY22poSLaq4LYbbm8M1SOM8NauMoeKE263wG1VaMQ6FoZ0Mrm8E27HuZEDCXlFfbKhplguLzwyJS1D69visSIFPEyWli7LczHL+QXCOYHSm8G3SikN1URRuUmV9uWgARuAy8/gV8mdRdp0uhti0oFiv78zKC1QTDWKOXF1U5oCxXRz95Yo/9XmZkioba3cPr2cDffTdHTgz6odWraq9VrImWt2e10+MPZsmi2ZF0Ca4/h1qlY4MWBWSRGLpuWQMWK0zzALsMz5AD6+ZTQ+Y+zWhM0Wh8luhgOgwfba+vraI729Dds7O7fVhRmP0mox1zV+fWi9w9ll0Fkq9eaSomLIaIr3l9BN9fVNS6/CzJCf3BgJb0yOlWiVBm1xsax1OavvfDarT/a/yeqj7+X//b3T+lIpMetMsEy1aNv/SWWhFVnoy8tQfCELvQjQyzG8RKAkuysN1Yt4f5mBAoYs9CKBitlZ9HMANQpQ3roMPZOBImoF9Hi27ZJ1NQypFdDzWQxoVQx/tRKtwx9NTtvKhdy9MOzrkEWZ+SCG5tCDPxq9AU1hK/9txPC/RJ18SPGJE6dPi7lN+3Ab/0txzegTMrai8PChp5ucbAu0IZu+dXBCnG9ckEgWiEm9RZVqcb7p3V2fzfbCg5nErp5xvOqcUzx2x9ZMEhiRtRiK64R8ElN6VbN6/hdZ3o719KSmybp2+uDB6k6W7aw+eO21KDyHrLmpYPfNgW6zmAuoRyh4FrPDhHGxiCMrXYaeyUARtQJ6PNt2SboahhSBivlXAtQu4v0GgeoB+nEBr13EK0AZgH5UwGsX8X5jNQwpAhXzmYS2btE26gAq5isJbT0itdgy9EwGiqgV0OPZtkux1TDAVETRAP0nyCh6LRP/88lea9U5gE57uhjxM0sBcTZA875+S3Sw0eaAFCNyO9TIOEieVK+rWILvWC8PGOAosqgQ37FOXi1VygfDM77rhiHhSKHI3uJ5/0TDLl1A8Ydbykr54qrxhl36angoLVtFor/G0jlc9LfAzjVCjp4lN8RnPScfbF+WXXjR3+IjmsbK2eM9PcdnK5sM6Cn+jOBLXUtPGGt0uhrj0ORkQQFkQl315aGCAuJXUpgb/k1SsHFy2+TG5YwuMRNKzAt+j5yuo2cuzen6SHRDU9MVURR/vgIyoLRWeSolZhUJ4xIQR9ZLZaFnMlBErYAez7ZdAujlGFIEKmbsCNCwiFdGUUiI7IW4mNKS8+6c1F7YoaSDuxrWQy6fvsoESc5l9UGTszhfA7nZ/BMRSErXkyxfyPvVKq4hY2BGCTT2wWd35/p7evr7e3v7LRqNpVKrRYn56an5+anp+S4X28m6hILwV446UauYpYMsMPmls3RQK//ahoK22qkbxlBn8vwo5Ez+EFrroHUjUAfa6JIsnUygk0hQI39+L2MyyQ2Ggr7SznhLR7OnHd3S2T9psGmwCg7Ajc5YY7C6VS/kCRWDRDHA6bkkPyeSm8DBWHOTcxZtJoNOq3avialbuESvz2zzj7Q1tCoSUtZsMDEmG3Yry/JkGrUyZLREfIwnL6/Aaw/WeYycyqxT0go5aLMC5ElmMnIQ2TNGhYMrFvSAlGP3fXZrIDBWsA51tnf/+j8SiWPHgF8D8NsOfSqhBzn3I3yuwiARIYqqzxTmSW0OrmOgu7a1ornUbjKaTHqVWdJVjs/17DQwjdGaHoElszZPra+QFH+PjDKh0QU0FJQ1M8ri22t1ZNXhfqSz39PMHOqaKMkvZh2BlsGk0WDS6c0mlBhMcOOtyuBwECuZeLimK6HXFWr1em2hTk+0rwQNBMQsG3kmy+aR9R/d14sMUONO3NxDopZZ4OcxMWqJHK2eZpPLljqXyWS/mzHY21sS7XYD4+5v1+t0eq3BoDXo9QadAWRuqLL6ivKKXWZPLOYxu4rzinzWqobfqOSFsOJRFMpVX1QriuVqtbxYoaawYI0dwBVoKfPmkuSoEK9KMybJYQB1eJqthwUlOdhAy1BbR/9doCO9wWTG3uBEQiVoydYUqu0cnNNrinR6va5Ioydel/ozGkNXiV6n/tBeV7Ca04HPAbetaLeYGbeqz63wOGjbCJSBrv2/53GdxOHs6lyHI/4GssQAI/hb9L/jb6xJ+97+ZjE5fqsuz5MpV3U3JRyPKinibyANpEamM+De099Wehtw2w49iLd9gLNx7+dtf0T29/Y2oNEFNAQ7Uv8vvK3g/ZwNkVUoCgAd8DXuUl/LeprAy1XZ/eGH9LTo+3ta2sN0aY8rWN3RWpa964vLPkc0RKywA10lasj+v/K037+Po6VSxDfohPA251+FnKN5tCDs6H+K86hMfWiV+p+jV6n0LEyz+DGo//d0/dp0vZgV810Q5/P4aSHew0k2K1HDri/KSiQsOnOhPeGk87bm57GtSfz0hWSrD43y3ehvRpGvNUn6pt6GvudI33w2qlZHWZjGJepoVI3O/CHZyublb82jnYl2qdgV/Q3fLXaFvot4Bp3HF4WZ873f3VyltleomAqZbk2VLOLQ2CpUNpnwEMYzZYXFpaWl9Vpb9obgvRMvosfxd4X3YmBOdyI3XpydJWN2LZ5Fv4B9Vymlv/S/ArmcpyfZykoWrlPpXzxr1Si1FotWqbEu3/0/YETUy7gNfZu2E+4RmS6/fbh3HX79lP1RqDsBddvSdaBtZD68bR1uOxUmdYs4ic7DXrWArBlgGCXsm4uHm66+uomuuDu4d2+Q+lBtMNDggH6z+J966P3/U8/raLLbmxzOuN0edxKLhQtzTAPLNjBi2arXmrR6oQD6rwD9g7SZkgHmy/LPkA/OEfS9Gn2hVmHBSZO+1DOgUXkMtEVRojdB7+9gFerG50XNMFHUHR8pxOf/9V+JZE+lfOjblB4+VP4lu0puxY4T1VTHpJ7i9P5RGZfRUnWJEc4xv79io7hpJLN7JOdoHXiGOgtWKqEu8D+gCGQBL1K34+8C5D/SkAE8Sz2ILwDkYhryGG6jjtN2cn6XhuwDSJMAeYlAKJS6FddRu2k1mfPozLt7GPHtNwRZk0af8ONzs06DPm6yVK6D1mdTcaoj9SxYGqXMsSyHFQS2WJ6walRgSqSg6FQf7qNO0w9m3grKAS/9PtZ506H2dZ8kluk0m+9PWyh9+JT1Uf6LuRYq3lGXU6DBHiXvQ6Hk0MZ137iEAv7+qeCj31iNQBb/fBY/eHL+++C/HblT1KUSSGZnv7MqeuILNAW+cPx/HH1oCoKOVFpap7Vlb4QYQyP0C8D7344INCK8Wa1pLuEuGxEugkc+lxMR6FtPOYSIAHXboC4nIlw8FREjwgsg4ZlVvP3M3dziIid6+48B9/n/jrezjXZ7I5vx9h8Lfm61kpJJGNVmjcGgMauNgn3/Guz70fe0b3rtrEtP7Nu8XhjvN6nTeSP/G4vNs5xiRIvVWi4pqGUK/xuLpfef4sBiVyGQxS/5X1nsqZmZ77wH/7BK9dO/ojHckdx+qoiWiy9IGevyukxYDOXuMehf8SpehV50RvrX9oXaPcU9hQHW4atr9pj1erMZNhkaUo1eXLqvq2igs33MXmcxMVUue0l1gP7Id8yqMrXRCBlbZuq/ACjNHBAAAQAAAAMzdUSncZFfDzz1AAoD6AAAAADWFFDSAAAAAOOmxWr+2/72BRkEdQAAAAYAAgAAAAAAAHjaY2BkYGBh/PeWgYE14N/tf7dZJZlfMKAARj4ApwoHEQAAAHjajdIDrF5BEAXgM7u1nm3btlXbtm3bdlArTo2oVlA7rB3U/ntyn/1u8mXmrncz8gjuKgw+qjtCqKUS+Bl5KPykL+yUB5xVALVGS7FCmliZfqlI5r5oqadzfGuKAucwcp6sYN9nuMhUOLAvWzVDMx3FddxhxbyxfONeu2GjtqGjWohodYSxO2XQNf7fREc5hBju66gOsq0xOuoIxptF/QuK4nbGQdw3m+OOoI2aC3N9gvk6WKrpaKK6wZfr+heJJHtypziKoCQKoWB1HfF6EVJlIxJ5Zm/dDN58E1cJQo4eghxJQzvmPoxhUg8F8pC8kUG+qj4yyFf8eK9GHJNgiOL5fShKYtDS8IrrfYSFdGBbB9NXKUBHipFRsKYYOYH65INNJjuQPodYmY6lQiqV59oJH22FSLkHDzUJjnIUwXwnf7mPOJ4pkGcKVMHsW893550ojrLK6FQmH6RI+qCv7Ecm83g1Ds2UC4LURL5tS67VnXebAzs1jlgfVdH9GVkvqg3nsV7KYq20JDLdpidkol8l9VJWEqwVo17L/AD3Yy0ZtVMWa8fA2qmKPgkY9XQSTQysqTKMmiIn8qKY4nqqin5WVGesq7KMuuqAljIZbtIbZtILjtIDTaQnLGUgnGUI5cNGhrN/CPvqOE73g5nOpyQ00aNxWxPPPJm20ewiH2gPsZ2Y00c6Q5cBUz6NovZ0jqbQJjpNbYsZcyuuxwiOLTsOHwCCfGGcSmU+/QZN/gOXBr2BAHjaVcFToKxAAADQNrdNtiY827Zt27Zt27Zt27Zt2+b3PQdBEAWpioxGDiKvY1GsRqxT7ClaBe2OTkN3oVfQZxjE8mNtsSXYbewbng2vgnfHx+Ab8TP4awIjfKIeMZpYTxwjbpEKmYosQDYk+5JjyXXkSfIvlYRqSI2lLlKPaZqGdFG6Id2dHkcfom8yFFOaacEsYB4xX+KF48Pib9nqbBO2I9uPHc0uZjez+9m77Ev2G8BABAqAMqAG6AYGgalgOdgM9oOHHMbl4bpz07kd3EnuFk/zWfiCfHm+Dt+EP8vf5N8IDYX+wjUxhVheHC9uF1+K3yRMSi5Vk1pL06RV0nbpkvRGhnJGuZhcU+4oj5RnyE8UqFRWJiq/VF8tp9ZUm6jt1V7qUHWC+kcrrc3RlmubtL3aCe2K9kB7o/3QCd3QIz2Nnl0vpJfV5+urDMqoYYw3ZhlLjQ3GbuOYcdG4Yzw3Phl/TcZUzezmSHObuc88aV4x75uvzK9WzAKWYUVWGiu7Vcgqay2wVlvPbMG27SR2ejuXXdRua0+119jXHM1J5zRwpjornM9uCre829Qd555xn3qmV9qr663w7npvvb+Qh6lhSdgVDoKr4RX4CH7wMV/zC/kN/fb+HH+pv87f7h/wT/oP/O9BiqBGMCLYEtwNXgc/QxDmDCuEA8ON4cOEo8T/AQd5ogN42mNgZGBg5GPIYmBnSGNgBfKQATMDIwAVqADyeNqNjzNihkEURU9sNGET27Zts4r921hO6iwhC0uVW7yYH+ae+zQzQC4PJJGQnAEcJnQbJ9CckG6cqJon4ySGeTROfleTQin3xqnUEzfOpZt5sTihjmyGjVvJp9m4nUwqjTtVU2jcJc407hbBJi4cHONkAb/0jmtOWVXUq7g8e4qcKXfFFuc45CaVveNMmXO5S2WUxa/XzSBten2c4lXOjV/cik98J9VULpVfY5ZlFphkhXVlzgmzhU6Bj5Yv++zKe9EMeSfldNFKJ+10vKMhmyb959RN+UsC4mO81lWO9Ymsk/IvnVNSNxG82O0pt1MMiGwSqsKLm1bxBHd6y991+JDjXHouDXLOGa3Pf4ZOagB42mzBA2wYQAAAwPuu1mzbtpHZXmfbtjLbWzDbtm0zNmY1VhuzdyKAtEtSZCAko3mI0EJLrbTWRtuQSTvtddBRJ5110VU33fXQUy8peuujr376K6GkUkoro6xyyqugokoqq6KqaqqroaZaaqujrnrqa6Ch7HLIKZfc8sgrn/wKiFNcFudd0ExWJxSUWSHxolx2xUWXPPTIbXccc9wBkfYrJkGiRpoYYJBsGrsZIsUa6KvlVlpjtbV22W1JiArRkkRrarBkf2zx11VFFFbUAyscdMvSEGOZGNvdNdpY44wxwXh7TfTdJFNMNdkX08ww0/QQa5bZ5ppnjn3mO2eV3xZYZLGFfrrumSeGOGWo0zYaFuJ8M9xTz73w0iuvvTHCW++M9MEmZ5z1y0efjPLZDztCvH/+Sw0J6QTBwwEDAQBFwf9i27ZtHFNf0l68TSzOO0OMOAmSpEiTIUuOPAWKlChTkSVbDlVqeuujB3XdddOLhv40acmgTYcuPfoMGDJizIQpM+YsWLJizYYtO3nZc+DIiTMXrkG3KrrAbSAGogBaZu49IsOiMOh7eFHhxFD19oHxD4me2QO6o2eO8ceWFI9+MRaCxySTAsq7kTfL/YQJmT4MS7PULuylDEYwhglMYQbzYMYghwJKGMEYJjCFGcxJnnMoP6pxbWo7tiG1r3JsSj9vZvU/cqU0+n04ICWTMIIZ5JDBPCjk++EfXXpXH2et0X/1MYa5Ls1y8eLGs6rulNqeztHshe6GIV2k4ecpZJo/m/GipdEbYqDJz0UAl0unx34vQ6E1SoH10AImYI71Ieb9vWqkFKnUcAu5ZRTlAAA=) format("woff")}.rt{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:17px;font-weight:600}.rs{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:14px;font-weight:400}.t1{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:17px;font-weight:600}.t2{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:14px;font-weight:400}.pl{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:12px;font-weight:600}.lg{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:13.5px;font-weight:400}</style><defs><marker id="arrow" viewBox="0 0 10 10" refX="8.6" refY="5" markerWidth="7" markerHeight="7" markerUnits="userSpaceOnUse" orient="auto-start-reverse"><path d="M1,1.5 L9,5 L1,8.5 Z" class="arrow"/></marker></defs><rect width="1560" height="1270" rx="18" class="canvas"/><rect x="80" y="28" width="440" height="66" rx="7" class="card"/><text x="96" y="58" class="t1">Applications / official SDK</text><text x="96" y="79" class="t2">Submit work · stream results</text><path d="M300,94 V194" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g class="pill"><rect x="234.6" y="134" width="130.8" height="22" rx="11"/><text x="300" y="149.3" text-anchor="middle" class="pl">P1 · Agents API /v1</text></g><rect x="560" y="28" width="440" height="66" rx="7" class="card"/><text x="576" y="58" class="t1">Web console / operators</text><text x="576" y="79" class="t2">Configure the platform · view status</text><path d="M780,94 V194" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g class="pill"><rect x="706.3" y="134" width="147.4" height="22" rx="11"/><text x="780" y="149.3" text-anchor="middle" class="pl">P2 · Core API /core/v1</text></g><rect x="1040" y="28" width="440" height="66" rx="7" class="card"/><text x="1056" y="58" class="t1">Nodes / Runtime connections</text><text x="1056" y="79" class="t2">Machine identity · register and connect</text><path d="M1260,94 V194" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g class="pill"><rect x="1179.4" y="134" width="161.2" height="22" rx="11"/><text x="1260" y="149.3" text-anchor="middle" class="pl">P3 · Machine API /api/v1</text></g><rect x="80" y="194" width="1400" height="260" rx="10" class="region control"/><g><path class="band" d="M80,234 V204 Q80,194 90,194 H1470 Q1480,194 1480,204 V234 Z"/><path d="M80,234 H1480" class="sep"/><text x="96" y="221" class="rt">Control server · OpenAgentCore</text><text x="1464" y="221" class="rs" text-anchor="end">Web, Core and the database can share one host or run separately</text></g><rect x="104" y="254" width="952" height="76" rx="7" class="card"/><text x="120" y="289" class="t1">Core · scheduling and state</text><text x="120" y="310" class="t2">Accepts work, selects where it runs, controls lifecycles and records results</text><rect x="1104" y="254" width="352" height="76" rx="7" class="card"/><text x="1120" y="289" class="t1">PostgreSQL</text><text x="1120" y="310" class="t2">Sessions · Turns · configuration</text><path d="M1056,292 H1104" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><rect x="104" y="362" width="420" height="64" rx="7" class="card"/><text x="120" y="391" class="t1">Sandbox Provider adapter</text><text x="120" y="412" class="t2">Create / suspend / resume compute</text><rect x="548" y="362" width="432" height="64" rx="7" class="card"/><text x="564" y="391" class="t1">Runtime connections</text><text x="564" y="412" class="t2">Dispatch work / receive events</text><rect x="1004" y="362" width="452" height="64" rx="7" class="card"/><text x="1020" y="391" class="t1">Workspace FS adapter</text><text x="1020" y="412" class="t2">Manages file storage and mount bindings on its own</text><path d="M400,454 V618" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><path d="M950,454 V618" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><path d="M1330,454 V618" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g class="pill"><rect x="273.0" y="478" width="254.0" height="22" rx="11"/><text x="400" y="493.3" text-anchor="middle" class="pl">P4 · Sandbox Provider · compute lifecycle</text></g><g class="pill"><rect x="306.9" y="517" width="186.3" height="22" rx="11"/><text x="400" y="532.3" text-anchor="middle" class="pl">P5 · Node · host management</text></g><g class="pill"><rect x="302.1" y="556" width="195.7" height="22" rx="11"/><text x="400" y="571.3" text-anchor="middle" class="pl">P7 · Runtime · work and events</text></g><g class="pill"><rect x="877.1" y="497" width="145.7" height="22" rx="11"/><text x="950" y="512.3" text-anchor="middle" class="pl">P4 · Sandbox Provider</text></g><g class="pill"><rect x="903.0" y="546" width="94.0" height="22" rx="11"/><text x="950" y="561.3" text-anchor="middle" class="pl">P7 · Runtime</text></g><g class="pill"><rect x="1283.0" y="523" width="94.0" height="22" rx="11"/><text x="1330" y="538.3" text-anchor="middle" class="pl">P7 · Runtime</text></g><rect x="80" y="618" width="640" height="302" rx="10" class="region compute"/><g><path class="band" d="M80,658 V628 Q80,618 90,618 H710 Q720,618 720,628 V658 Z"/><path d="M80,658 H720" class="sep"/><text x="96" y="645" class="rt">Compute servers × N · microsandbox</text></g><rect x="104" y="672" width="592" height="52" rx="7" class="card"/><text x="120" y="695" class="t1">sandbox node · host manager</text><text x="120" y="716" class="t2">Manages compute from outside the sandboxes</text><rect x="104" y="758" width="592" height="138" rx="10" class="region sandbox"/><g><path class="band" d="M104,798 V768 Q104,758 114,758 H686 Q696,758 696,768 V798 Z"/><path d="M104,798 H696" class="sep"/><text x="120" y="785" class="rt">microsandbox VM × N</text><text x="680" y="785" class="rs" text-anchor="end">Isolation boundary</text></g><rect x="128" y="810" width="544" height="62" rx="7" class="card"/><text x="144" y="838" class="t1">Runtime + Harness + tools</text><text x="144" y="859" class="t2">Agent loop runs in the sandbox · workspace on independent FS</text><rect x="780" y="618" width="340" height="302" rx="10" class="region managed"/><g><path class="band" d="M780,658 V628 Q780,618 790,618 H1110 Q1120,618 1120,628 V658 Z"/><path d="M780,658 H1120" class="sep"/><text x="796" y="645" class="rt">E2B managed platform</text></g><rect x="800" y="672" width="300" height="224" rx="10" class="region sandbox"/><g><path class="band" d="M800,712 V682 Q800,672 810,672 H1090 Q1100,672 1100,682 V712 Z"/><path d="M800,712 H1100" class="sep"/><text x="816" y="699" class="rt">E2B Sandbox</text></g><rect x="820" y="734" width="260" height="62" rx="7" class="card"/><text x="836" y="762" class="t1">Runtime + Harness</text><text x="836" y="783" class="t2">Agent and tools in the sandbox</text><text x="950" y="841" class="t2" text-anchor="middle">Provider-owned filesystem</text><text x="950" y="868" class="t2" text-anchor="middle">No independent FS yet</text><rect x="1180" y="618" width="300" height="302" rx="10" class="region user"/><g><path class="band" d="M1180,658 V628 Q1180,618 1190,618 H1470 Q1480,618 1480,628 V658 Z"/><path d="M1180,658 H1480" class="sep"/><text x="1196" y="645" class="rt">Your machine · self_hosted</text></g><rect x="1200" y="734" width="260" height="62" rx="7" class="card"/><text x="1216" y="762" class="t1">Runtime + Harness</text><text x="1216" y="783" class="t2">You install and maintain it</text><text x="1330" y="841" class="t2" text-anchor="middle">Local files and tools</text><text x="1330" y="868" class="t2" text-anchor="middle">Core does not create or reclaim it</text><path d="M240,920 V1060" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><text x="258" y="976" class="t2">NFS · file reads, writes and mount</text><path d="M550,920 V1010 H1330 V920" class="line"/><path d="M950,920 V1060" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><circle cx="950" cy="1010" r="3.5" class="dot"/><g class="pill"><rect x="971.4" y="999" width="137.1" height="22" rx="11"/><text x="1040" y="1014.3" text-anchor="middle" class="pl">P13 · Model protocol</text></g><text x="1190" y="998" class="t2">HTTP MCP</text><rect x="80" y="1060" width="640" height="156" rx="10" class="region storage"/><g><path class="band" d="M80,1100 V1070 Q80,1060 90,1060 H710 Q720,1060 720,1070 V1100 Z"/><path d="M80,1100 H720" class="sep"/><text x="96" y="1087" class="rt">Independent storage server</text><text x="704" y="1087" class="rs" text-anchor="end">Deployed apart from compute servers</text></g><rect x="104" y="1114" width="352" height="76" rx="7" class="card"/><text x="120" y="1149" class="t1">Persistent workspaces · NFS</text><text x="120" y="1170" class="t2">Files remain after compute is released</text><rect x="472" y="1114" width="224" height="76" rx="7" class="card"/><text x="488" y="1149" class="t1">Memory snapshots</text><text x="488" y="1170" class="t2">Separate retention period</text><rect x="780" y="1060" width="700" height="156" rx="10" class="region external"/><g><path class="band" d="M780,1100 V1070 Q780,1060 790,1060 H1470 Q1480,1060 1480,1070 V1100 Z"/><path d="M780,1100 H1480" class="sep"/><text x="796" y="1087" class="rt">External services</text><text x="1464" y="1087" class="rs" text-anchor="end">Reached directly from execution environments</text></g><rect x="804" y="1114" width="312" height="76" rx="7" class="card"/><text x="820" y="1149" class="t1">Model providers</text><text x="820" y="1170" class="t2">Native model APIs</text><rect x="1140" y="1114" width="316" height="76" rx="7" class="card"/><text x="1156" y="1149" class="t1">Remote MCP servers</text><text x="1156" y="1170" class="t2">HTTP MCP</text><path d="M80,410 H40 V1148 H80" class="line dash" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g transform="translate(40 785) rotate(-90)"><g class="pill"><rect x="-173.2" y="-11" width="346.4" height="22" rx="11"/><text x="0" y="4.3" text-anchor="middle" class="pl">P14 · Workspace filesystem · storage lifecycle and binding</text></g></g><text x="80" y="1250" class="lg">Solid: communication or mount</text><text x="296.688" y="1250" class="lg">Dashed: independent storage management</text><text x="585.372" y="1250" class="lg">Outer frame: deployment location</text><text x="817.154" y="1250" class="lg">Inner frame: sandbox isolation boundary</text></svg>
+text{text-rendering:geometricPrecision;font-kerning:normal}@font-face{font-family:"OAC Plex";font-weight:400;src:url(data:font/woff;base64,d09GRgABAAAAAFZYAA8AAAAAtIwAAQABAAAAAAAAAAAAAAAAAAAAAAAAAABHREVGAAABWAAAADEAAAA0A+gEL0dQT1MAAAGMAAAi3wAAW8iuClg1R1NVQgAAJGwAAAFYAAACYr/7r01PUy8yAAAlxAAAAFoAAABgarIHYFNUQVQAACYgAAAASwAAAF5fvkM5Y21hcAAAJmwAAAGzAAACfHO4jI5nYXNwAAAoIAAAAAwAAAAMAAkAG2dseWYAACgsAAAl/wAARGLlTIrjaGVhZAAATiwAAAA2AAAANhywjf5oaGVhAABOZAAAACEAAAAkB9kH+WhtdHgAAE6IAAACMwAABDgOoTU0bG9jYQAAULwAAAIFAAACHux72jZtYXhwAABSxAAAABwAAAAgAR4A0m5hbWUAAFLgAAABCgAAAkAy4102cG9zdAAAU+wAAAJsAAAEbROuFbN42g3BsRGAIBQFsLzPaeU8zqjzeE7BNrQ0kAguQDnFLZ69vD7x62KYWiqHtgBvbQYaAAAAeNqckgOUJUkURG9kfcxM27221dbatm3btm3btm3btsa234m1UffkrXjpDwT0YRNuILfMcquswzJbH7jXLnRsv9e2OzP3LlvusxvTkgOYMoWEIv9SZb+p+E2VIud33nav3VjGXsRusufedcu9dmZmwLPAe8k7ZIBIuO/nNxQ2qt/wlJJrcq+kbSinNyB6IZ8Y79SkM5AGU0qPDtMB2ivaLsF22kIbaR2tphW0lBZRh5o0r2bXjGpUtUpVECownpEMpi9f8Qnv8QYv8UxUj9FXBR7gLm6JGddFviK4SHtxTnAaJ3CU4BD6sh9KLekhpI6w0urOX6Tpw9OHxaHOl9nzePQxe017Rntme1Z7S/u8sDjeeUm76J4XnLeyt7YXsJvstexWe6mw6Os7jLcnh6UjnEc7T+s82P7YPVV2m91oz2zf9+Nn+SZ8uPfv4/5auyEsJoYTFejn/0SiEGT0ok9U5dRRpIGOmHM6Z7AQ5wXNXBy0cGXQytVBG3dxN+3cG3TydNDFs0E3ZcAi/6J1/KYJ/F3g+2UMZwwwjgkUlJSn95/8q9ZKhJejlF00WH31lT7Re3pDL+kZPaYHdJduiXSdrtBFOken6QQdpUO0n/bQTtpGm0XbQGtpFS2nJdSjNi2ouTVrVNOrPtZVqk+M57QNk5mswcYwNs5540ceM4FPMgyPNlCn/ch+wU7G8B1fxL4mzjU+9Wf4KE42TEapBZA67PfsL+zp7cvseezH7DXtGe1lCHOC85b2efa89hqE+dJ+wT1b2ZsQ5kTnJnstu9VeijB9nb0zk52PcB7tXO/8rj3UPtz9jfZ9hLnGeXbnQ51ncr7IeTq7yq612+wGwowCEiWIItAnUpEyquhNLfNTzoJ0MBcncjpNnMlFdHIJV7Mk13EXK3Ivz7Iez/My2yOgYIOCsfSmF1n+Hh1FKSIBvcJnkANV8hi9gj99plz328p+aMpD/M8nVuL3wGgfeK9IzokiS7MssDwrkLFSkGcV1qfAZkE1WwQ17Mne1JIo82zh2awY5LwmY+UgxyqsSmK1IM/qQYE1gjxrBgXWYm0y75V4JSiSqPBeybskr5fXF7y+6PUFry96fWKdIMe6QZ71ghzrB3nfN/N9fQb6+VsXq5ADZsmGmv7B0OCF7Krsgmy/YJtstawpmzWNTG+lO9J5aZU0rd7RY7pER2kXraUmVfMOD3EEials1DV22FAQheEJM6fOdmIGqUsq41bCG0qdzszM1IbNlr8zZjg6v2akofue4H4qjiPFqfIWdaUJ7+I9le2OB9EZ3d6nvli0Z09VxFENCpSYrHZjip3GDH+Wnau2Yp6/UO2p9EbJ+hXTJ1HMu15k7Vu1HDWoQ4ESE6Ke8Lm+GzGres4Tn49b+qqu/lM56TwN0dO+C+yizPsZzXpcyOAvsnTxjjJe0yaqYtG9Ozl/+rRGfq7jrd2oQR0KlJBpVmqmPWdhTs083TmLPeso43TWC+v/ETWoQ4ESnSJd6LWKfhUDsgcxxB9mR+zvKH/M/o67fqxLf9SgDgVKdIp0oZ+yQdkj/FH+OPtSxfeoQR0KlOgU7UKvb6qP7Zc5oDJnW8Mwf4Sm0bhltk403o1+50GIZn//ORH7n5GsRdaymcEfZ+/T+DC6YJXHma+tUJbKcfceXbsyukw83gvYi1zVLf2eRRdkeDtyDZRkXqrbOJ7teZx2oe505u1osv/NaEErvEVypzGjUz5Zdt51vmf5522vPvoPRDyg9lvUoA5N8Saa0YJWFO6VOCTNHIAkWYIwXIvem+udvVnbxmnxbNu2X+DZNgIPgWfbts2zbdvW9n2R01Fd3bs9e6iMf8tZWZlZWb01EaKPUoeDI8Dx4ARwA7gR3CSR91znZc7bec437OFvpByuRoHRlMeQj8XPxpGPx2ZyTtDgFBD33qVGxNhXIgZfj0LROEk5jS/ElfE6u/sefKqeV3dCN6trmVko8eFYiWUnqpMlal2Obq9E0huRchj6G4HNRqG7Mdh8BnNmsD73nJzM7j3SgoMFdef1ybo/EjIb24JR8Le6HUHMh88J4AZwI7gJJKEfS3T6LmsMd5AbyL12xN6Zh5v3WvR69KX6PB3dyL1ZG3IPTQzUx6jEyZZRqyTapThr9LxBzips5fH5zdmKXDGlyNfH55Es3TtcD4341ufs4MXGPQlWuatuU2kBaWVF+IMuPTrBLyTJPkSuYJuuzZadGnzBelrjtdVGnis9erZvdfRMbntyct+jL7jJCHPPrMaqnOnu+aAfV5cGH2hzT3ywVZgW1ge0ZgG9L78EIJhYxShvUruUWLnnxOo9jvg7UOfWTDAazwrpGc6tZNYHoeNVYVKg5/UyZzYYhG/TAiaKtyyQ+mJnPT1EX8h2/sZq66V3KaOAjJ6ID5ULf8AIT/twAev1alsZi8c5g1SKT4558RwujXLmYqy11LQS8q3X+tZ1twxX2aO2aLjvIGPQZuwrQdQI6XNjA7leKSWER66es1ngjxsz4zmz2QcYbVpJxw1LwxYeFogRV5ij5dHeTxyVndOSIfVUdxfp8k0lMkFaewG/W673tN7Z7Pwm+RZok7NB1tGeRL4q1EOni368+mRnW6hHw5U+iU+skeM4zlwtw7fiX2bcmE9sLdLRLFP3zAf8ZyNRein4TcrDkZu7AY1NFH9eBz6npwAfi1FiB/BnnPwVwFf0Qx+Qe0B2TA4fNxdfpBSjJcYMHWdML3X5MA4MD3hWrq+ONIbHYOcu/iw7hjMrws21ACdyjM+3P3dlWQXN5jzFEt+I3jmFO3YOxDXGSGzWWjZ2jucI0vw9AldesFDLvsF/KuiVXMcNRvj5aN9e4XTKPZRr6iOgvUY9c23Ce3Ce7x5c1c09SKvk1DxezlT8YJXmyb6Is4lvA4mFXtloxcsCEahctNVVx8QfmWtzEheIPnSvGyF7UV4E8ERV7nwur2cWXu6Xp43XBsYI7DB7efd9qNfgtYm/E7re7xAjevxO0OuH1BMk/GMjmo7pM6rIR4IxoBOsh2ZqnTBCZWjZpVek0lF65299/9cDloLIxYcAEJ8a5MURiQlojJyS930KZtOyhrZdTz4L96xn1jIjjQXCTlku2H17jXHWg79ZU2sTzra2CLe5vqFs1UffWiKp38cAfOI97rcFOvS+1uFSZOwTfQftx22Z777f8uZMHlEFrFcE5akSVUZvhaqiVgOVqjrVSFsLVKX68QZdrdqhBl6d96SHFy3VzP9sZ9F3IXSgvCEdJG9IB/Pm+RYj3uGN+iLe+37hP7zfePW7TV797kWGJHKLL4FMSimgQGVBmeigjL/8hgElIWcKebYqlHfGIhBFzlTZib7/2UW5sUMg9sthh+gIpKviMPtwOiDyfKhUkAdVs38grZXsHgTmVQgSpzyhHU1YwkfoBQihA9ulMtGLQcwjMroUhVJ9lOxbI+ISOvIR/uBSumsb2tBAlntGsqF0kaIWXaZDafTa6CUHe5DQG7pES0nkMaRMcXUfwYvqXS2kCsqxbz6ysmMQTaDFPkLYHaoRFELNqkVAK17YJDBTg6CnVCi0o6m3T1sWeknTdrLpFaKEXgyyRIemp5l2S5H4gqZc0rbx2S/FtK5+N+A3AtHmBx0Pdtzckd3+dfuJrVtb34Qub923tXLg4IGXt0IDkzuyB6wc8OiAvfuP77i53+39qvvWtgxuOb95eXNl0/Smp5vObfi64d6GvRvs+rfrj63bWnstKKz5tObgmv5Vx1cOrzi6fHr59WVflh1c1ga1ldaWZkMRECnZDM0s+RP8ST275OeSLwVvF/9YfHpxc+HIwlcLH2cM1LovcmpqP7H968J6/goNWNm6b8HCgk9b96WExB61n5i3siOb/Qkh92Dk1tR0bnwHcWIPQnVbPWo6N/fEmv5xKp+ec3X2l1lrMydnNsbKM1ZGH02faD/Z+/PI5MjAXsemPW7dmDoxhTfspE/RcIaOkTXkREGs2ELMq+cXjLP5vjiXX4SPlffqE9TV6hp1osS8k4l5X6nTJNrdR7QbQp13bLWdlruMruPIEjjek9FTYgcUmSLZgQ8+8YLXAcMyhZlpmXmdZfq0nxOzLSksdsiycNkMcsgnaJJjydYZBi14YXhG+zv39Sm995Q8Zej4/H27q7urbt26dQv6tVpEQ71Cvt7voYBanCtGnyfez0K987mY73iBiN2IRbjM+ZWi/NXuvca6+Vrny8kVk2PZStdXmQX9qOcec/1xZazBWqzDemzARmxyz2ZsQROa0YJWtKEdHehEF7qxVZ7blNGD7crtRR/6MYBBDGEH/XZiF3bjVWmv4XW8gcN0vLXEAoXcAgUWmCixQCEs0DD5CbX/bETsReSlEfPEWtosxhL3LSWXlVlkB4uMsMiXcovUscjEDBYpFC1CNqEZLWhFG9rRgU50oRtb5bmNTj3YLo9e9KEfAxjEEP6BHnuxD/txAAcxjEP4IAtdF3GlBv7l1uEf7DkLYR0scHeD9EYsxCLnYR3XFmMJDZeSy1D0mbdyC42w0GdZ6BMsNMxChfCZsAK+PSvwC3n2oKoV3LsX+7AfB3AQwziEaVag15JU4wUVPnCFeediXOnOJdKXOl6Gq50X/eBLavlW+MEq/sAHUlv9g/t2uG8ndmE39krbh/04gIMYxiG8Kq/X8DrewGH53Vz0YNSggFqc5+os1Duei4bou1/KNT9L87pi+yhxMZL25DKE9rSOPq1tVrqW9+nq3ovN2IImNKMFrWhDOzrQiS50Yxt9elDdc78+3VLYh/04gIMYxqHcc69mGf36Q6La/PDaL+WWOVtimctF1ow1ZrPAkbztJtT88mI0k74Ga7EO67EBG7Hp249kqfY7lLkTu7AbPxHtWtH3yqMSytrVcUQlRA2Qe2FeiyN5G86boQ2//b6X4rGye9GHfgxgEEOoqGG00Q+nWvoXbaRWMStb6IlLaZo81HmZhzoOD4VRJ2o202ijVmHz8Cb57cQu7MZM3rQqNDUyhHYNevMi/YKG7F2XRoHc7uUjgWeMBDR8ju0bZxwBIprLuwfb5d2LPvRjAIMYgmheadPq0V2+r+F1vIHD9PmxD5oBpFG/fKybl6LEtWD3FBG+1yN8GsuU2Ys+9GMAgxhCZTR4VVmv4XW8kXvX/dnHXDlH3WtQQC3OVcJ56j8L52uPOmkXox5zPDmXnIf5k6K96w1s3ajEsIbjsIZ2LYudk0eSZ17j3hVY6f4flc9jGQtJX4O1WIf12ICN2OSezdiCJjSjBU/gSSU/hafxDJ6T1oo2tKMDnehCN7ZmrEfHHmynYy/60I8BDGII3248XRp+wnIpAp2vhg1o9G+h9EWOozfwiytpsoS8RvoKmP8kS1TzlSc9/xSexjOI2pA92C6/XvShHwMYxBB2yHsndmE3fkm7T2j3T2Q1rhbIWjJGAJFiFmif1bnnYtS7Noec67555HxygRpe4rghVnmF4pzG8aXkZTzrCseLcaVrS+S31PEyxNzGSLECK2m/KpuX5jSPy28N1mId1mMDNmITHTYrdwvZhGa04AnXKq3ynLRW19rQjg50ogvdEOGyF9zzIl7Cy9hGtx5sp3sv+tCPAQxiCP/g+g667sQu7MZeafuwHwdwEMM4hMN0uWNq9pHvENWSpT5ST86NfYzZRX9B0V8uT/6SrElTPSlZ8xo1WU6ukHNxhniWH80wf1ZezEDIJjSjBZVWbJXWhnZ0oBNd6MY2uvWgms+FteiyE7uwG1WtRffrp8/TMAthKTIs5fhDLZVizpcqYk6BlepY6et8TtypMhertETVudlHsYQyK3pg9dFUvj/CbwpltZ+fat7o3+UVNR/Jo+xYxJTlairCpto+Lq81WIt1WI8N2IjK2qYaybMXfejHAAYxhMrISOMPmWeLiGmufT6tLihrx9nRhhEZHae2c22JUspmMlGrqXFDrapHy2rtS4+n8DSewbPV27gsymrLyjnFjG159dTYkNrTvm2ygPHBcW4FbfmJZIHvsOaVo2L5OCH/XvShHwMYxBCmzUBxFc1LPTFLmjdAzA/vS20XEWq4rO1WyVlUojVvc/4UnsYzYdtCir3VPI7dK6NJdbsr88eLHunOiL1kLVk6Rkfslb5g2visL5FTtm+MvvSjyfYzxFd5VsTXavH02xjHy/vdHxRryIdrUEAt6qRdjHpHMV8j55HzlXIJ2UA2YqEcFpGXRhtORPRY7j3dislvqu1p7fbp7DrXrnfPzZN/n92iHW7F7YjfouFu3IN7cR/ud+0BPCiCxO9VyUfIX3Xtt6SvLv/9WnVL0nsztqAJzWjBE649h1bHbWhHBzrRhW684PqLeAkvY5s69GC7evaiD/0YwCD4WHZYfd90T/yWkYxfGZLpt4PuO5YV4veIJ5yX/+70bP6Lvy9lpz0Tv/jDn8Yae3pUnBrZUjREgxZpRMQD0kp1auxHmkXhGtrEOkOJK7DKOf/MbnB8I27CLdr9VtyO1GLuuwf34j7c79oD0GLRWr+kzF/27Go1elQv+hPHf4rSVnsM1df53/4ux1ak3akqq2Tziso4VXVeMX3dMxG/CzxKnlDvEXmeJN8nx8jT7jlDjuMiEeAHs+VYxTKH8abUt/jX2+Q7CP8gj+CoXnWMPO56XXpyhRb7dp9u5Alf0T//N1/Bf0J/PBt98Wbnq1noUedvkm+FjxZKfTR+s3pCziPST+IURjGGqB05jprws2uwPB9bLoh1m3lSPtIUqq6RDkf//hhbnjP5X/G+o4ZWBce1ZPg4zWdhdj5yXIALcRFSlHJvRCnPRZTCJWgE/fLodCS7wn2LEbsH5DJcDauJND4WVxO5f9JrDdZiHdZjAzZik+c2K28L2YRmtEBkyUeoxUaoH4z50LNZHm1cb0M7OtCJLnSD706LONvp3Is+9GMAgxjCP3hmL/ZhPw7gIIZxCIeVa5TCLFygfovImAGQxk5aLU8xrTGidx4nUoyIdo2n6tgl+/DIB32q+twcP1m5T0AvPYSsx1wswCXwJiC9B4k9VOeLsQRLsQyxbxrvQfZ+6PrevKzqWv4FvIiX8DLSHlu1fVJl78U+7McBHMQwDuEwfT7OZhnNnOGcWNsux8fi/3Othe2GIu81vOXy7GkMTT4pus+JVXFd6R2uPCfXhny9shznyGtCr2ZR9joS9tC2sW91gz6lXCkFnKs3n+fJWeAJLG7OIn2+0dpeu6d3sPZIvjc7O99tG8gW40rnMZN2vAxXO76GvDaiincv5MpMv5Ff7LzJ73Flr8FarMN6bMBGbHYfz8u2ui/tSlfdgRuYvo8obR/24wAOYhiH8Cp9XsPreAOHlcduYX/vQGh/aRo3GxG7DohdB3jjpr4T+RuUkfCwWBfLa5u0HmxHL/rQjwEMYgiVb8QOe+7qqjuA9kFCA35esuP62RiRI4bSQkT6PuwARm2q+TrteYXWMoNjh5u1x6968recryZjzYc3nb/lPH05gvfUM76CkB7faGDEvTFO4hRGkcZLeY/HvGWOMhvUf6ESl8vlOufXs8nNWvKX3fVb5GrpU31mQOnzpkpXp/QNhnQlZyfcM4KTfpV/hhzHb+bjztnimINa1GMu5ns6RSOIRnTL8pYqTI0lzmMswXW4nq/cQOMbcRNupkF8x4Pb3Hs7eQd5t/zvkc+95H1kfN+DB5XzMH7Z8a9m7IxH5THjWITKsajaeFMZ+ZI30KUXfejHAAYxhJnGHLOJcj9gi/echw/I+3g+0z2tfmecj7t+hfbW6s6ircnwNO39y9o2vE3aau3+aLT1GG9rVMrlJTOgunwGpCTpx8jjzkfcexLva4VT5KjSxhyfJs+Q49L+rhgnUYMCanGeq7NwAV3r1Oti1EsXtfMdTP5By0swFTtO8In/zRZjCe9dSi5DxBE1W44VWAW9WU35iftuxE24eXJH+k7lNvneTt5B3qk2d+FuNbpHze8l7yPjOxY8KP+H8DAeQbGHvMVaP5j9uef+An+JajF5E2JnFE1oRgueUE9zmOL8xXGrtDa0owOd6EI3KndDkz+xSy/60I8BDGLIKPkP7LMX+7AfB3AQwzgEs8PifBdTrZ3lra1Xq+dJvM8Op9hv1C8Px5yf1nZnnI9Lr0lz3t+KmcrnxbMGLb9QStHjPsvjRtwxwHZWmJ5TZ3f25Cu5uuJKDr5KS2WXe9pw0mOUHCPPYBwLI3rGGhg3Kyn8mc+LmlPfvCHFLfIoGVFT+rR1ItKXjYh1IubHqKE+eazOoqRH8Sbewtt4ByJj+jLuhPP4ThCjjsc8q4ek/vnbeZS0A4ICamFmnvb5653Pcc9ccj4Zq9C0p3+WvdMMPO1IpR1n12MvNTT/BM2/lO8TPJfdittxp/vuQvQARA/A/a49gIc8/wiKrfdWHjFn8/5C9hf4S8w8m58o7rigCc1oQSva0I4OdKIL3YjVJnqqztT/NWa+4UmI1RoiVtErPAg8ORtJ3ixeqdco7xnjhREtefa4a3O18f+mlVzus8mjzMOTN8U3jTiZt+8oxnAa0bbkgqxBnjGfnDwwFXt59i/TPfZbskY5b5HrDrkOZ+/hKI7TK0Zz19/3/ChOe/4MOU67xhgzI6o7y/tYcd6glZ8m35L2ttLewbuuvUcecY3e2THyOE7QscLzlfLZ9M3t+TEnUHs1/0yxpkjfBZOhEzlO1odXFmt5Vi1nx3gV41SU/aU0TilXmYVUZm67qNmFUaOVzqI2Zb0r/7qTjNwQ33+Sf6gX+XKc7jUooBbnuhpjDdKbMunxpoyMN2WIN2XO0y8R9Doro3zcOWrc+c9sMZbwkqXkMkRvck/0Jn5yK25HfGWOexHzDmkPoDhujETPeUx5jzteg7VYh/XYgI3YRJfN2IImNKMFTyjvObQ6bkM7OtCJLnRjq7xfIF/ES3gZadWlLr3oQz8GMIihyX3ZP6jTXuzDfhzAQQzjEIrRtJDmHhHjyJj98eYR9jipjPfJU5N789nA63nvGolYd1Gszq4DKxRnMyk2522ax+QRhDeCV2RzUr/UJ0v64xcihw/qk6fwQX3y4vDSlbjO2c2042fTahd+hvBSjCJ6BVYU/QqzkH41RsZaB5dhCa5h++VKWOHaStJ6NXrULepxK27HPWlX9mz2AH4LxX29ifCTrfgo6yLrYBY9WzYOxYiHI4idUTLfGU0jm9E6n3kvN2tYmeaIbMNj7TLm/XCYRv+khLeUMKKET2TvkBFZpB3BMRx3X3HHri6tRNIYKk+l5fuhVtJTJaU1T2PRMzyVdngjqv9gyR5cVtyDI2MHDSfTesf+IKJEcoESJvIxj9coabWczPanSiDfwXti8hEYM9IO34hnT6nnqFYcIyPWOR6X/nPZOfyxBgXUoh5zMX/yG7HSXAIrzZJV5kTSZmrOWchHXLGCfDCfZ7JB2dxyk3w3Ywua0IwWtKIN7ehAJ7rQjeqrTmOC8qZGSjYlw6Y46ZjXl8+E6BWtSM5Pc63VbEbbfFXSmM8gLy/a03lEfDJmcZ5MEYLMZ0PJro+I4V9m169kNSigFjETUp9ZqHc+F8W3Wx9Pb0WuTPYey2392fCt0n32mP+LU7fidtxJo7twtx25e3jFveR95P2uPQDeUmwH9/wF/hIxy6HjGqzFOqzHBmzEJrptxhY0oRktaEUb2tGBTnShG1tn2Peb/ouzz+bWTpae1i8iFod1R4rWdd5QEvfOpl4XsxsU13+FmEelXpc8JHKPyBqegVP5exTRPc0W5ook/xO7CsXd8M+XRdhHYSSPOB0jOCImkTEXSfMBO9+xr9wQ+3B0zntO9GG6Rx9GrFrU/h286873cARHpR9z/YRnRhA+F315JPlcRAhynMfU0PezoZ8co5YNaW//+7WvH/O3PA5eFJG21EYfFsMjfiPFvbTXc3m+11M39W6EnK+Us0r5j7zdRR9o96kxD/kssWSkMDt0LhJU/D0K9nK9NuwlntE3Ykmy2+xv490LC4d1aZKsmupe+rc8yJL1VGi2ILdcIdolfFm7/6r8f0v+qxExvtSPEX7hXL1yy9WV/n2X8OEHxZ9vZjVieIGsJcWfqd8COa6XNte1BektbSYGfa24pxl7+ovpckH+JuC8bJX2/dHsnIhHpX8pRDwq+2s5d/PYiEOIOCTtAfyifIo7NWqnDBE34tAmemymxxayCc1owZMlu93P0K9VWhva0YFOdKEbEXvo3os+9GMAgxjCYbpr0RRv9LR8LDZSIloTJ6KXfSKP7GPFqECO85PGyr4U/Uirz9iXjpEz96fZ0Z8ukfun83hjxiJ1dXh4XdHDyXfwLm3eI48g4iUZOwCk/pQ8fRRRAsajnafXYbiiDhMfoQ7ZB8cD1z4u58gh5rALi+U5i/LI8GsydhvIFCGm5qopokaZJJtN+Tk5Sk5FCHb7/07OAQiSJIiiv91r27a9gfXZtu8CZ1/gGDjba+ts27Zt274XP2o2eo358WZa011drezMrJIqbZ7qO/p9ajm1vKQ8r2xdxmVc/F28Wjxc3Fuex+/NxcLikuKwYpdibNG9aFuk+Y/55/mb+fx8an5Gflp+TL5VPj7vCs2zX7O7sxuz6dlJ2RHZQdke2U4ZSn9Pf0Rfow/T+elp6QnpTsXf5dSKzvO2LW/zb/QqwxWl3QtUpJZFGVySoDOCxlf0Zto0O4m+tS5KzkkOSnZIJibDk4FJ96Ru/Hn8arxLvFHcPt4o+pQe7x6Nbles9oqQlKJIueq4P7aGDDUJUYWWjLeW4zhc7y3cjqmt+mkgV8Vg1FVDNZI5E7SRr+utmbMtGqQd0WBsnV00RLuhYdoDDXdbpxE6g+t3lKZqmjbWDM3Xplqqm7St2z3trvv0qA7QU+gQt346VIlsvUNPZYrtUSdfXpmzfFbMxmng3G/H/gAvu/O458OavNLOxne7jzXE/N2OI1URYoxnwHzo5Mz/HJpU2yrUIo8hWjqS3ws2NFt/DfnVaWjv9aHcgsnxWpewUg6y2z23VuIcT8Bfjv8t5HcRLIYlQO2quedEjhomKoRNCPMhZcxzV5jinOEwpY5ah+ylNWUQRV6q1WrjWW2ArNJaRukGxaZK1VshQ3PFHMNUkziXJ8MUONSxZNqT+O7tux0ssxzgJXgFXoWaPVKyr7foargGroXr4Hq4AW6E2DU2ktqlRH56UocwAmp5aFNDnm4je0rbe+8XEh/9cI0ex8eY/zg8AU9C7GycoRDZooxsG7VSyvHPoQk0VV2OPr5rcT4yfhFcDJfApTADZsIsmA1zYC7MgwU+Y97RIlgMSyCyJ4l9dHbdDwzZUwBJ8II0t91baE81d/zlTWxc+yb5fQfeZc0ZNS/v9zTJ9fyGo9NX2MZ9XQ1dc9WWa8TIvMZDfFzlJacyXLOAXgW8oY6TvyRvG7y+4Ol/l7mJbS97YxxTr7UxaA6XwXSovSsknCG8l9jPTSYpYwv1DOt5Fl6Al+AVeM1PWCxV/wevtiNQz1DeyM/VlHHVzkPbETHr+tCWcAM5P4Wh4LFm2UZVL/QKto80zTU90VuRrcfY5XyTodTTDwk2xTuQeamXKWXVBoj9voPdyzBWp9+5Xqv5uqDw1Ekc58kwBTZyzdv+DP/B8mbMdpJtojqeiiXnqc97TvUdhaUgxfaTy/RseLdLwlX3ayjZM+pt+yuy1ZB6b15hqOYxruN/PwMr+rVeAvtPJd/NpCxYeX7f81rfdSSWc8+ZLZ2o627QDwbAFpR+S9ib4X3B8TDGj4KjYVolo+8m5t8H98MD8CA8BA/DI4DnxW9q7Lk9LZG9D3z7LNkoRGpf8x6Vikzo483HWVF3NVYdXxVN1rk30MLP5VLboMJP5zL0BroDyvykzrUTyrQzyiu9hNZZuSShb5upGhpKktV6MeW/ifZCzbUPauH1tFTE/CGKLClBqYlRqTomQbkKs/wnM2v+xBZ1oQEeSkyECpUmdjlzU/2kgTV/XPb/Ac4YQ7YAeNpiYGRgYOBisGCoYmBxcfMJYZBKrizKATRFDyB8dWEAxn/v/V9932zbDLO9vOxm27nlWubMbEyZQ56VW15uNm5nuh2f53kPDd5+aOtug/dsPLLPYDn8+KFAyHTkis2b9x4wf8u+/XvN3HZo42ZT9+zcvtH4fUf3HjISoYNQIEMg5MiUKv/F9dgT62J1zI2BXlqur+SoZfpqDCediyw6kUchVGpddPXBJ599USJ3zDZrdNcRhgu9EaiF/K+bKQwzG1ddM9iNJg11q0nD3GnScB1SdFj+Nz50bc1Pbs13keaNlhjp1JnXPuBTOl0ItZzUJleto6/u6nSmNz7LvPdJ5l3y37b83lIrd1ymS+KV+Mv7utwalU7KhDmW0ppf7H8lMuP9ryOtazqCdObw3AsSG5p4m931DCFsaf3PUF0acs99Dzz0yGNPPG3MLSkqncGmJv3/Ez0sRXd42mNgYQpknMDAysDAtIepi4GBoQdCM95lsGE04GBk4mZlZmViZmBibmBgSAfKazFAgaeTrwLDAQaF/39ZGP+9ZWBgSWAUVmBgnA+SY2Jh2gWkFBiYALNDDncAAHjaBcGxAQFRFACwvH+ghx4AAAYCAB1Yw0CGkwihJENFhpH0OZ2f0eWzf55jJi7PzT2WkoKahgwphvEl/RBCioU9MkmKFQj+0V8IlAB42n3MMwAdWQAF0DMza9t4Ybm2bXtj27Zt27Zt27Ztp8qPky65aA9iJHhCIsIT7ogL4CefudMDXvW+z2SSXyXVXIxej/6Mp8Tz4k3xliRK7kjuTdKFONwb7g9PhOfCSyFtyBjeDB+Er8KQNGnTtEzTOu1jaZ9MXbx44eJFBK/5wOcyK6CyHpe1P+LJ1zVJktxzU3s8PBNeuKq9Ed6/hXY3F7dwsRdczEvqrVTG1BOp+7hw/PLX7rxrp512vA47su1Iu+PTHc/vCNs3bP9x+5/b/9iWb9tv8YPRIyI/oQBKoYFmRD8ARF9dO0D0UfSZ2yS6y/9+VkY9+XzuJ1lkVVp5P/jSt3L53o+qqqKazL6QTW7ZlfWNwyKJO9zpLne7Rw755VQuutt/aqurlvoKKOiAwor5R83oPkXsV0JFy61wyBKFVHfSMsX9a5eddstkuCGGGmmYEUYZbaJxxptgqkkmm2KsaWaZboY5ZqpktkXmW2Chxebpo4mGGmmmsaaaa6GtVlpro5P2OuiopS566KqbXrqrrKeB+ulvgEH6Gmyu3s4564zzfvGrP/zmd39eAmUml78AAAEAAgAJAAr//wAPeNq1OwdgG8eRt3sAIXZCICpBtEMj0TsBggWdBItAEiyiehdlx7Jky116xy1y7z1+W25KHCVWeiKnuKQnLvK39Ko4suSauIc8/OwdAIIU5fJFxO3dze5O25nZciMKUzqKQt+i6yiaElGUT6wXm/RivQ7dxT6MdOwf6brZt6L4NmhnL7yF3sdNlIFyUZSeMZgtZgtTVQUPAX8w6PMF/GbGUCWywLNXJhX7LPAmlTbLfN5gMIDed+is1VVY2LQiOLrKvWFga7Tb2St1S1en18x0Xrsj2dvhtHYxLYrG5S5Pvs+TYHyhSDvjaIuuHmWPPWI1S83tSpuKAj68wMfrwEczZQQ+AjwLHA9AV+4L+MQWQhHYMRc5QPcL5AOB3nU+37rewHCzIPcfpqjRGDUlVqzIu93xi0bHLowD1bnZqNKlf7LVrhpPTaXGCa3xwlt4OT7G0/KJ4Y+jIpM2c1QtjDTk5UgBJY6UbDwnaB4OxNb6fGtjgQG54Mrk8HDS2GU0duFj7C88rviFY6MXxd3ufJQjorK3Pql3KWEIKBfI9RuQC4QUEp1y4ojKQoAaQ/KqKiT91IUXfmporSzREHNl+vsznrQ0otxUd8sll9ySDBis9snkVGLKabeEEmVdHTudrsT/U10h/5x6obIwx/87wL+CYkCCeTIyqVQ/zz/NKUpPKCJ5ensksj2d2hxkrx/p8/Q3h5U7+m0JM2o1dNclLhwdvTAR291vViRWOm1t/jj6lTXjENU6k2bQViuozA2SNZFxYQI+oi+flJHCJd6Vz3eEh3fu3Im+l94eSKTvSbNxCuzbVrDjZThLdVBpKg88NpfVEQqUbmXllBDODzYwDmJAnQjGmym9BemyBRD94WUdO8dyW5x2s0zhtTh97qmI2iNV64Y2qrXuqc56Va3SZmfOWj854IoeUsp9XdlE9qu+aNQHVziQ0mvC1nZ3TW0to7K01Qhko8FAzlFTU62xpPWKZJt/xEFjUYtC3tSf1ppqGYXB3Y7GPT61z8MV81I2UX4qTuU+SsrTSGhZIJNkgbxLSCi1ig/kGuQL5GOLQr00L+fp5Kuq6sX1AUOFcH+dF4n9j5KgMOrglOg4jLq00hulYkZc9EAxuJ8kFcmtyXVGdBEjcTm7f9ta9uuoK5WW2vXsPcSrBymK+hJgqafEFCUBX+OdDUStogHrXqVCoVTJ5fEc3qtsrm9WcsXc5VgwNwu9UaGD672MklGUHNo3VzFMYCGa8Vww4r+kiOcyfNXcITBDXJjHVpSF5bjgZQmFfCIJQ4ukIMOKWzZ8/8UNXxgCAWxT9/2C/QkSrfgW34d6k6NN+UjgJf3ezLTZc4MuI755biPFt6GVMP5m0kbsk/JKkp+qq/LTI7mcQNwd9U1IccNQfMXKXLBT22HIBcPaMIMFeWuHp6O9h9diMsNpsajO8og0UdIF1BYirxwSwLdgRCg+cmAEOBqp1kWRA+xyoSkiRWqms3MmxZex0dFY79hYMVbwZSY3mh3NcQUfwTvw8tJsIQcGF0dwseRjR/Cf4F/k5yM4ewwJFsZwEm875ucmoXiJuYn++PH2J0hdOTv5kWBBxOV1vxYLqKaS7rsxhKyS1oXV5mi71mXr1mPBOqWtJSc3c/OMEeL048BjO+gDFBCSkdAMHFksTsxbcGnaAfbkcl5Vb2Q2MmFN1uMLW3xtrkHbzIr2mF8aEMe9Hr/PbZ3oc07UhZxOU7vdqrGLqkT6LvfQQLNJ5VZYbCYTs6yqvr/T22ehipHbh2+lJPwqIkCiNxkCHxe7fci2uc0+7lZJ+nbtmnGb0Exaqlp/Y5rdT/rmgPe/gMTS0mzG+wC/yCBP6FZBYyy2Yl0uGtGFjbm8qXPbWjTAPkNszYC2gAMDluVQ/BqwVBMOaJ9E7gtJfMi45uu56Q5hx+ohLChQhw8jirTVwrD+iafoo31yaBoqljRjsTAi0eevGQ6FcE8sk+jFgY6Bqzf1ObC9Dwv+8Oc//4Fcc7Pv3XffexQiGNBLWMD5uwRQ+Th/BxTS739z7eX0/pXfOLL2KvpmJEDUk09+wL7zs58R+mKwqD/zY2yS+OgGzIC6QhzTSLZ3xd9qW+zmthHLU7lLFMJH0Lq5K7RMQ/osrGAP5KG3HlA8XpRUH0D6gF6K9OhxdjcygfnuZf8D+RLo4nSU3UesVw7FDnyEEhEe9YxFL2IkPgknJd4xlWZfSo+/dUZsSiPUTD33HD7Crp2bnJyDGWcN9BuGfhLQlo1bQ3o5oxFJNTTnZ7TUVzb7yuc1SDux2RSQS1w2tWvE//LzRr9a7Tc+/5TepVK59PjIxlF/t0ZQhSTmqD28OoCSHyjdjIFxK5H9mNymNWhtcpAyAvGjD/+IUpejx2nWTmNT+xKJfVOTF+iT0onY9JYt04lpaUK/t27k/j17HhrP9bcFY5efsf2Mi1Ph9v4JCnOSbQHJaigZkascOCzzMjBrTkx+Op3+9OQdd0SmvN6pyB34yNC9e/bcO5T1b0jtTm30UYjDIwI8tWQcxHpp8Q+L2An0GPsYirPfQxP4SPZE9u98azQHrauJX5dafzmPHmC/hlzsUa4dVZR7J8htLnvDYuH5iMYzC3Yjxnq6fktu/PJs9qqVa/cZUop18a61fv+GuCfnueeVrZ7Y2IE95x7IjyfbO3rD21K7UtsihqQvlWXvpopSbC1KAfsEcFYoAely9v58Hm3Ioyj7AzCLX8DqME3aR6HIl6QG6kxAz3l4nj2+cSNSbNyYxs50eu5F0lYNnv0otAXflOjFRMfzsUnMbERJ33TnyKaGwZpwIBh9Ax+Z+2fnpGsqs9wRjifQoRJ3mwEDsV2YRZninIoQmj2+KZ+nN//bNnYWydDkWS8Dk9df+AH7H+yuorZ/Df2EhEsiEvo1e3ketQGNm0p4n+c5A4y874PsjIimYfZYc/YVSWHqijNHhZ0HD3YK8ZF3P/3pd+fSeHAP+wJy75n7WllvPGfQBzoT9yWaExby9OgGUqDH7p17AviauBeniPYwN7rXwOg2UvolZ0Xe/sqDjDZOX9nff+U0X3atDgRWd0XXBAJr6mBM9xwY48uB8NbUualtHR3b4LY1TBVtPAjc1VEK3t5KRs6IK1wVzE/WM+lwTPY8/TRMdkrinZ6V3V3THpSelTt0fp1DznO9muNaTrUB11ISoANOXMm6SLoE87Pb2mwj5/Xy/HftHHJVCLA27WIyyyY/+yleih13T9WO37e0HFmQo4HsoCTisiBkUVXpr0SSrklXX/KBdXc+VJTlaWRn/x0fcU71Dm5uAgO295VEQlQ7jIMYJHKAPJXzJTdhLnQ3IopcrsFETKTPX9jebZruGlihCjvDPVPOyExyxS5Lj3qsKzHUGrGHkxNtkTPqYmG/x9cX1Tu1NfWN7sFA97g9AnthZ6RDb28FkH/Q37vWTyESgbCZi84UAhsi3oTNv8//Hjfhs+duwmdnoc0U8EoisRQ0QKbF8rxY2gRM5XX93d39urzn7DVrznSBweXiq5zOVXF0mN285cre3iu3EJtvBlpDgKc0Q0rID23cenz6nCHhinMnod8D7AeoCq0vtqa3Earl1uUfzdDwQy1rHls5EMGxqfXjMTq6YuKra1b14jhgOcz+EwlRDu6zSIByc2m0GlEFbuZV8DyU5ksJ/NESBrApjv1+y+P4q+v/+NKWb+Jvok1okj2BZOwhWJaa2N9QiPTAyRL34mJXNJJ/Y/0R+sj6f6Bm9Ch7GIiuIashaKvj25qkpSkS61gBupW9DP2KPTObHcTG7ODcb4mNRUG/6k/gk/axM7zeM8byO7zeHflQXKuNh4IJrTZRN3Fg9+4Hx8cf3L37wER/50xid3J7Z+f25O7ETCeR3QfEmMrIKbKEIGBghg08Izrs+fblX8ti78OBL/IRKgWtpWT+42UIARulw5huXHY7EZaywWOeeG+sN9Ew0BCYTiTXey0px3ey2YkXHVu9dZG+pLe1bcDtXxUNTuesn+dtH70PmN3EnrxLoIUpHheX0mXXII2Ybw9mMqmOYFLWvTyY6+hcHx7uMCfaO8/IRMc7ZT0tmd7s4GB2FN0S94pCIZfVrfYb2obDidEGgcjWH4iu8jNBjbvNl+xa1p0gmjdDYedm4gYyqgEYKlCIFMxLL0Y/zrGPI+PeLVvG5xC+Oov+xkrT6A0yt4IMQ9wZzhEy0kiqp30870sxTSSToL+zzzWLxGa/Mbo22DGTjYyGpT0tsZ7MwEDGHZJllDD9su8oDBL/+iQMGs/mYKomNcgoatClhNcEUJQCRRVlL1lJNw75GrBIDsRPby2OvpmwY2Cy/czsGWmJUOzobYf4F9meccYYJubkyrrYBWPD+3dPtgRnLhrBrQ4VzN3JmUi/Ie5a5oobireiTTQCD8uIthDMu8Suq6dRLfufA+hnePdlP8tSNDfHaGB8WyBah4DXBecEPi8/wkvtwyQL3pB9xZmh4Z5QbM/27XtioZ7h0Bm5/lyun1yxVCoGV11gdTgzLl4mGY/m1sHyfFyyTDyegTVdf7xT2hnnCjQeDjQGwlzB6ZG3a16PqBn0x4AeLbAGrvA80Sl6xFJOiQM7QIlNzh4bp8R0//bwyxWKREc4NYa2gxrVTqLG1PZI7ILvLVIk6KgPdPRZ4MJKhak0aNPCzDMQWhgBRHIAgVGSJ2TguYEh59gjGz/COwFifxY3+HMdqfWe9pjRaHOMBr0DNlu//b7GJrw/I1KI97P32UJiTbMubFLZnIaQQ/xEi0s9MLLcpvNPBfxZv8Scc7oGHeaEw5kMKj9vnrQnbcP6m/HlQWtds7VdLm7ztNS1mJvnvrlcJ/tZg9FnaQz1gk5jhc/QEfwDqodawc/PJQnKfmxZYtdKltAlLXMiaLBv8ckhPnj8nEPrNhw+L3PFTLdhqMflEQoknU5nzu3OOZ2hekGqRe1yj1wz0XfehMuRPzdTyzjlMqcxAKdEXVu/dfEl3z3DtvqW7alz0m6z1enemB3Y4HbokuwLlpYNY86py/u9K89PdWag8zNym+YilVXR7c/5u4mtIyHKolUwVhSJ3yjLTSrCCW63i2qwFU2U6rB1bhYLUM1gqe54Rd3xuSj+QbFOU1iF5YUDpE5I6uSsCL3/SBpqBgpvUT+k9pBZRr7g0Ge/VqPR6lpb6/TKepVOp6pX6qlCgbTHv4T2ZipDUZSFyqBquIuoDJZQpH4c8D2Pm0h9DQenatC9QMdSuJijI6aoEE9AxPAWByT361rdtoTGtKxZotmjVzVYN5t0YUaobm5Q6QGnB/ryOLMLcI6jX1D34WNEKgmsQu/r60O/QAqOC3gYhhozdzomgvLLcEfA7QnqrwCfPykL+cC8ZRxDV2g1JS5a0Qlgo22TSRthBK2EDdLbjt6ifoZf43qfIsP1FTLg1xYJQXgC2uhxjqdhwhOUP+M0BljRrYDVTK0gcCh/yvHKFK6jnqKuWlpjV1RQu+pUjUFfdA30NVOjHM7RIk4jlaNm0XGAUCGRJRCSi6SziiefVOy/Kvjo4KPB2zG08VM5VFdsEwpYQnKpyL9/P7S66nZ8O2kG+AEPehbamKk8wQ/lUSIL1/d3HHycg48TOPjpSCFL/RxGUEjOSeRwvghroAXW9u0phVVhK5rcN36OguzP0EU6FVgeV/A43gIcR3gcIYaGI5aFOB60KqbsRRTfRsGf/5wVLsRgKnSjHwEXSsoCXJSCHuCpmt9XN+CFSF/rWuUJjduHRtfEApFUXbYuOGkp0njaNR7uHXcvO/NhQV9Pg68r4VXbsg48UkEUU3JYc3wL/4inaWICS69mFtJEVJlcfWCqu3uacGAuUn1hATVXPtI77qpmv1UpKaLGCuejPH6P238SGWG25sM348Rj7lHfYGjU4RwNDnrGPKhjwxeutnn335GeSN+5392+/0sUKvyzcD41W+xP+GOKYd/i0+BZz6h3MDjqdIx0DPpG3dD/S/vb3fvvhP537Pfarv4C2SMWzkMI+oMNCRkxfxKGHn543bpr6Mt6ZmfJbrpwHvVHvoWE7KXhipIG+L3ZfT20gOwQAEcLtNASHJx+zEwA4nbpUwZ/JANy+VBL3moNtbeHrNb8OoVNrbYp1l3jNrxhcww7bG8wrp4PtCFjVZPQFNR9QPG0UYzHLOFVLvNJSdjnzr59vFU4QWImegpiYNDFFDEb3D0f6IImYVOVMaTlMFcXZtAEH5HkDPKN9CFh3530xVBjhZpz+Boh1KBz+tg5rgq0HeBOPo+QOgbq9ifQSwl4LRTKNVXUZgo6wnz3Fr0WrIkGHzBRARKD9QTbR6/dP7qFYAgdG5p715sxmTJeX9pkSvtazRKJuZUrEXuaCtj2XAo7zd4pJ1/6VX5z1OxXFW/sVR9SCXq5GOzg+zAWnMbEvu8nk2AiFK6Ai/joLuZq4R+6A22c3Yc2ct8+ClsQC/roJN+GTGTGX2pPS1aAp93akhWhhWsLv6rSKTEsfdBvvCs7HZOMU9Fl6uhWOvU9gaQu7Ne3eQA8xbgUUXOoR+nS9QQBHDBa7Eq/tXvZsiYN0xHtXiYWaYwCT8ai0nQ0y91WpVFVI2lyRvTurFQki9ndxRpXW7EmbICaKln8l+p2ba0Y01XSENMeEItxFS0LkqhcOANHwBLE5Ny/NJjkAIr8vROc8vungiiZ6N95O3oqNB0MrgomZ9+ma2ffBg0GC2/jF/EPuX1e9OPs9EIf8sX2ijV3rVx515q1d65ceefa4QuSyQuGuXJieHJy2BsXh2uNrTan06YzNwbFqdqpAzt3Pjg5+eDOnQemoumLhqPDF6WLtx07plbOuC06lSZkj9k69C0Gs5cSUFbUjr5W3JW6qDCM/kfzCxuC4vpeDufY5W3ba8HpYPnnTFmtKacjbbWma6zTGoNM7HHYGXdtXV2tG7UH10Y61wSDazoja4NWe8Yqs2bsxds1uaOMWqERjed0tTWymlqSZYAewr3c6YWCWGcAyEsZsF/uHByiWQi2uIz8kHf6ryu/4+pJ0cmoEwvGxgQYPXTC4TiB5Fdeyb68b+zee8eIFVvRFNqOn6R03M4AVrGVuQiLUxGkFZkIAbTd0NrUhAS1Qac/PJzJmE0GZ217YzzU3d/Tb7VrW82d6I6OhroWuTFkC/jUVnOr3KCyx7u+sFYhr1HKmVZC3w70NwL9WkpJtF3eLS3aJf24f3S0n1x2m81us0Ov9fn8enL5g7ZuW5ArCL44Ogvdwo2gdunRKw8ejN0J15DdPuRyD9rtg26NXaGwa7gSneUY9niGHXzZ2+rRaDytfEkibQe6iDrCx0wJnOtflu3IootQb6FAatAZUGOmdpE1CJT82s+IrkD/ik9SEhL1RXJY+4jkIgs5i7DAIif0vXQV3i+7Dk13jOCRjml0nWw/xidvwt6Emd7ddtFFbbtpc8KLuXMTKD4DFFqIfHoYayYEBsBdPhF3SRnuogGIdhvvMfYaL71G/S/XML3MPXBdeq360muMh+5R3/Pss89GPxeFkruh6s8Bn15kLZ+MiWg47ZP4sLnrCcETXc9PoD4d6oPJHu0mEnVRr+AWdB4ZNRNJYKkwE7ms7LAPmcKMOqhVMnJ9c8hhihjIi1EGL69ImxqaG8V2paZZXC9taoIHwJqgurEUG6lawMpZNv8tC40OPvMM/LqPJo8eTZJ2qBFL0Vh5vyFlnehF1Jic3+vuAByNC7FIoGUJ0zOkw10/Tv74x0n2AMG4mlqDZrGQo2wh4xIioyRHP7//fk/pt+ahhzylH0XRQMkPlJzwJKa0PCcLF1ML33guXzao1QampYUp3oFr9k/qZlmzmivQFfPPvDSHQNJvkbmIpyAuy0sudG6SfYvwPw1rPRYHuVWPKWCSCqVCxLKr0cPsQbSy7v3c+/mfLvvpwnbygAn+hNJptBIaPVxHWuTfz5HR3Uq9Qf0R7SI7s9ACGR4qrgTfqNiZQftB6gjqRY+e2v5HiVAoAdeRqF1tj3IFxY3zMDd+Qm6EOIlS7DnoxeGnkiDzcrCCUXwJxVAe3rpgPDhHJqPCmxiMDefSxI1O+bLtbU+rtrp3NMG/He6tqnT74vdIJhOB63y5bKtrhzphsSTUO1xbZfLF74lYvDce4wr+6/oN6Lf4PEpFGchKqpQD4pPy33kt4iBn9SILzONiiDDIk57euGlluntE2lvvM1nCyyOyiZ5Dfp/Pv3um/oazd11fP7NNGHMzTLuQPVdot1i8MeGfwmO16KqasUjpu1QK/6iUB+QPVn5UFhW/Z8lKuwc0OrU3kdg7FVmVkMWkU725DXUIkR08W6jfsCI+DcAY+Yhx4sCYMeW2BuLrhhLrE0PrMh02R19b8TsT1gG9du60lAuWFvCfJZYwJN+leG6px/Vsql2D8XSmtjm0rW9om6FHmQ31Di6v+eWPMHJo0Jmblw+11ytr04ZkW/e6YFcATuX7+s0xXbpGUtsx3Swk3uQvfAm30HUw70aoJK9fC3+qKAd1wjOnbV7fABEBxCItrqNI6Alx7ALQEgAAYVGGBrstBnefslMWNkoVcbvD1hEwe7t73B3GLmW73ibsm27rCrT7kFphbGtpVTuiXo1Fo1GOjtB1TSFDQOOqX0Yj3KBQDvhCI3KxYHRE0KLzOpkWqfAkavL2B7pXKSTCPrq2scNicDU1Vq/6rVCucRhdDXUUIlaCOyGayomVS/lIBFfxGJ3LscLLDo8dPnx4/xNrHxc+tuaJ/YcP33zzzTAoKMH+EHWy302spzD3nf8kPgZ+oVuUo6XnlmALM2aKOVtInzv6fjFvppS9NTeLvsfGK3NxCgU+G5GupUguGEVVUSdeoEpQPFeGvlIBPVqGHgfoqRhOVkDNZehrFRh+WYa+9AIZe4DSHtxE1YGuhoi2quYTHkP68pQtJ3bOn6mRs8OlEybBNLvxfLYcOgtSIkNuSxeTI9lwbZAVd7c3Iw0rtyWCo56qKoFrNDK8xrOxf2u009MjczevTXcmtMKqKnfOH1/vh3y613BbMWnyNpIyB6lz7zps1kDMEpTLgtZ82psyuUMRq9HeFm0LNsuD5mKqHZeJ6OEyEcleaqkVLSwD+JXV4u2DpRjxkHRRgqJsZayGrmmubrVovRqru9ZcrZFJlKp2df2GmQtxUyLAzCcu+mJCL03TBp3atLyloa1W3NjUIK0SxGtuOueSW7h4RsbiTYrh+JOLygeXZXcHJvjga/GBXulTN26f1g+3D7o6tyXS5Ati2hNvFNSk3Su0aW1Cf3GjQayw9RqNvTauxG+2dbSdfdPUmn298XMHB8+N+504POPoaPOqHJJqRePcleaMK+5Om81pd9yVMRcKfCYkZ1lVvG2epEpQPFeGvlIBPVqGHgfoqRhOnixmdlGPYAFF8/k+kOMDL9A6B/DXuNZ3cOu3E4URCuCF30InDVAswV8twl8HeC3QLMFf5uFUHbw9VoHnJIFTiGS8cXSXkdnXx2e8oTykuP0kzae2QV8+D4x4SBPvIW8V5cCIwyjmNfFKGYrnytBXKqBHy9DjryyF4eQrxPOYwi+xFNu5M6IAcMXb3cJJljfN4rE1rFoBKimdyftC0CHnSChVkEXW1q/udiQULfDYnmm9ITYqqBLgyzdKvK29Y7SIf7Qa8sx0CNLLVPIhw7hhVRAelXI5pJk1qZU1By5sEqMb4KVRraw9cKG4aV6eX5Y5f4njHKD0ueBb9ZSC6oWYsWANYJoPGhAdTz2JXyKfFimKSXCorRQo7vEOBhqFsi0xPkkuvlFRJduQTG4OkSxbb5+0Q7m1cz5J7vVidGCf0fm1njifRNfZEeiO7cqWU2+5vC2QZwt+g4pw5wbMEqljoaIkYoaP9iV2AVY6JcBbNuSjE9qgqsfq8rW2advilvWjiUw6nsvnfetTqfU+V3untt2kyfbePjBht7p1Osgoa68W1egi7uQQEuaGhnJzb8LUIExvD4e3p7uamFYTUy0SJ+ez/Y6Vs/3E/5tsP/oQ+4vTp/vBCHPZaJxtynnrfo0qQfFcGfpKBfRoGXocoKdiOEmgfM4XB23h8T5XhgKGEvQ4gfI5W/TXAdrKQVnZPPRgCYqoCui+cts52VIYChXQF8oYUAX0snLbWRnRugAMewBWDI2UhMtEEpEPjqU/xNA+dOBPWyfQFvRn9vMowX4XTbIT9V/+3rPP8hlPWXw2e5BfN3q4PK4QvHzsCWdBDgYaKyV1aXetOM2Ms2J3tJwDhi8upXul8kvPOlXj9+wspYYRWcVQbOeyTDT8quY0WWFk67Z+xYrFuWFXX41GelHbwgSxP/SCbsuYq6ivUfDO54xx46LnR1YwDz1YgiKqArqv3HZOsBSGAoHyWVkc1MTj/SyBWgA6Q/DyUERx0DBAJwFvqe3cZ5fCUCBQPsuJs4123jYCAOWzmLi2Np5acB56sARFVAV0X7ntXHApDIUgmBtA/w3yjP5WmgGEZL+15CxA855ejPmlxQA/H6CNvkkmGk4azZB4VPEIX4zFDfiLlypj5q7V/KMqVteimjBtcF6WhzSkikf8GZKDZIqr3v2mVDb3A5KXZI5xL2XeLyvzPhssZnbRd4OdK7jMPf3CIF/2HCHYvri89KLvZifUmdb112az165vzajRYyVfmvujurulpVu95+yzhSLIjzrvgTGRkPhVbXU1VlRXX7L93G17K/K8ID+qlC98mkyv/NOLM71u8kx3kVSv1AcKh9arsytANi7XiBsXDz+yJqoMPViCIqoCuq/cdg6gp2IoECifvcNBAzzeOW7tA9HvOBZQSu7UuzLlF3YoxeAuhxVRNAxJ5rkcZAF3m7wNtAhytkn2r8xuQJvnZiEfWKUa50/wEmj4o0/wvjuQTg+Qy8YwNrhQYtOq1Zs2rVq12RfxxDwRriD86VA/SvEZO6giYwel2L9/qmrauHXNRtTvRXUrTdvYp0h7A7QPAX2gjhbl7JRCnUiEQuwbl7Xq9TqDcVmwrjfaHQ+0b0AXe8MzCldLlUprUDQzoS63La4b4DKmQCYX4LQtytYJLkzlYAwLU3XOsZpNjKbV2mATd3s6sk6dwTscC3VLXA1t0NJidmCDRiZQtiikBqXR6zC2i+gqu9XT2aY0yNR6dVWrCvTZzMvP5+cgsmsMccdXFpgOUH30uw+Pd3REBZeh/j7/2++73U8+yZ0vJlAI+ui4M1wRN1cvwSARIYSYr9YKGowGf3ogGeha7mi0GMzwT6Wt9TfgI94rZS1dwVCGY8mkFeqMy2tFz/EnxQkUBxrNlKE0zvwXbHlwyQH/eiLriOvzqVyDoN5u8iWHepm2NsbQ3o4SQ4nAdLLZOdaJpLquQCgNmchCxmBghAaGyxQHDbj4jBs4X2W4jJv7E7fdG0RNUNOTPM/P7RmBn0EYIz5uAUdLJ9wsZku+4O076ayD0ZhS3d0pk8Zoz6YJGwaG4YbLZAWZu5xGR7Wgxq61+f02rb1GUO0wOrt+26KsVrZwxSENpIdouIJ85wUOu4ErTkuI+35JslU4v+IZEy1gAHXbY4Z8EpRUZzP7E0O98ez1RT1hN2SWSYmWZLoef0dq6BzoQ/irMjDE7wofoGF0Pu938o/td1VLuR3iLCeFdnF5ckt73QKfgyIEtMnp7yfzOS9xOY9ykcuBx4E0LsAIHhf6v/S4X32UwxGP42UvZcSdzuMq/Q24DUEPorWPcDffh/nbMdRzen8DGnGgwVmS/H/hb1Uf5m6IO7l2AR3wNt9ib+tJ7OF9DXgZROeXd4kf09dCH+5rRR8zFX2uamlXc8/716F5r+NyKoDzbuCK05Dpf+Vrf/sQVysUyDjTKe67DgwN6GAzOo/b1/8KN1Cl+sgS9b9Bb3P1Cqhn8JNQ/0Kxfl2x/vfcucDPQZwZ/CMu4sOJtkUkh51fyCISWdA9z7sn2umqZBXdPuHGP3reM+lFG1gJenUD8k56SF+Y+2e41QglhPNxecgCU7lIHgrJF/at47uiV1kJ3xX6XoE3o3/Hv+TmztN/xdmjMjcp9PVNLY36BpeBfxGrGvX1Lrx5+bL62oZ6a7O+/EDwPoD3QubJU9wXMjCnB5AC701y+8p/xTvQEdh71VMti//HoG/B2/PFs8sHine8QymtlSoXFf8PGBFVwP3oPrqWcI/IhHnfDv84Pn6/guTAPgF1K4t1oG1k2tE/jvvvZ0jdtXgFehb2q1Vk1QDDKLJ8sHmnfc8eO567Ubtnj5b6WG0w9S3cix6gzfz/4kMf/r/47LqAVhvQ6f1arV/fotW2wIV7NX693q/hS0+rSqZq5Qqg/wEeQ2fTVWSPhE7JQkMOpcqoiDQrROLlKjymlNUyvTKpQS6Qi2tkoBlkxzZ0Oz7Ga4YJodv9gTp87NvfJpL9B5x1HqSaySgIF+0sfRW7TtRRuYeUeJtKe8vnKzaLG0ZKO0hyyjaFN1OfAysVUS+x/04RyLl4L3UdfgogfytCduMd1A34KECO8xDY1fRTu+hagJwoQm4EiIODnCQQChUO4Ri1Ds+RWY8ufcWHEc9/yqxTyRXOCH6ySyeX+Vs18u3Q+tnCJOUrfI+sq6ULLEupUilVSuXnK6yILpyJx6nb6ItLXwclgJf+EOs8b4dn/NaiZR4q3umV98sfY3+9pJmeSoEGexR9CIW6Henx/Yso4CP3Gx67ZEkCJfyeMn7w5A/Dfx1SvL4Y/avJ5F2n8bIr6Ab07/Rl/+PYQzcsFXswdR/djJ6g932ceAD/VArFA8U73ayS1klViwouHvwD4sHXF8QD+pZiPIC6lVC3IB78oxQP3kfP0gdP9XX6YIWvnwBff+F/7usnTuvrYN0nqXVA/3TWTe+Yt24acnwK1O0C0yezV15zh4p3Ac3Z65JqnKfwyex1IQV6M7HXpQiU8NO/+ST2uhj9nWCvS2OnagpO+vc0hieS409V0xL+AyljmF+TcQuhhTsM+vesjJWhE9bgirXD/oytZnCZB9alnTEbN35qNVKQanRi7ovZ6lx/ZsLUqdcwrjZTrdtD/8u3tbIGeWurvEGmpf4bql0dbgAAAQAAAAMzdRtvox1fDzz1AAoD6AAAAADWFFDSAAAAAOOmxWr+/P8LBNkEXwAAAAYAAgAAAAAAAHjaY2BkYGBh/PeWgYFV6t+ff39YbjK/YEABjHwAtZwH3AAAAHjajdIDrFxRGATg+c+pbT9jN8+2bS9q27Yb1YhTK2qcOqptK05tezs5eajbm3yZ/1oj1+GpOiBIZSGCbPIOoWb2Q6hkwU21QqBqS3Gw4SOKSFRLHtcKNj0cNhVHYeYcG0XIWO67B1/pCzfuK5PHaKMBD/mE9vIKreU8vNR8dFTL0FuNRoLawMylUNrN9UPoLSuRJF/RTc3g/Aa9dRD3HaLD3N+nOucxsxGgktBBbYdT9Uc7PRPt1GB0UuVozmfxVU4kUSRlUwD5UzFlVm9LMPMu5PHcdFnBbUXw1c14bjTc+Y6F2geF4mve18IMx0vOW6g1cilIbjFvMtvAR25RGHwpSgl8KUq6ody4BD+5g45SikopdX2SZPSmJHGgAyXJXDQmK9a4okF6A58nATOFVAGK1FJE6UaIkduwqtXw5LNaZTmC5DIy+ExxsoUOwledMO8cQcmU+Z1e3809FEkOhshSFJltg9BGKYSq8UhQlbyGne/QG94qFm6mH7+h+yHI9CWQ/H6Ej7BRGT66btMzzs1IavvyvTj4KKbewnke3EyX2J3vme6Q6c5v6CWoZ/q0Ga0Nduo7plNkoXhKqunT7+gb1T1jr75nepUMm8xAkAyFp/SAN3WidtILvtxmlVJ2fZrZ7/e/x+lh8NSlFIdOOgqnNCknFtFGWl/NRftpSbU99FE5JYh5BXA5aRJNoEu0gnbQGRpVo/q663663p7qY0fWegyA5DVzCn236Pto8g2kN8lSAHjaVcFDANgwAADA2naqtLNt27Zt27Zt27Zt27Ztv3eHIIiBVEPGIIeQN2gitCbaGX2GVcG6Y9OwXdgV7BkO8fx4W3wJfhv/RmQjqhDdibHEJuIs8YYkyZisT44hN5DHyduUSaWmClKNqH7UOGo9dYpG6KR0I3ocfYl+wnBMzJRimjN9mSnMCeY+K7EV2XbscvYl+4crzY3jvvL1+bZ8b34kP41fx+/jT/Ev+C8CLshCGqG0UF1oLAwUxgrzhY3CXuGk8FqUxGLiQHGheFC8JD6WNCmvVEqqITWV2krXpEfSV7mVPEK+r2RUaigzlAPKJxVVRTWDWl/tos5XN6sH1TvqNy2FlkeroDXWemuTtUXaOz25Xl+fazBGKqOm0cRob/QyhhoTjNkma1Yzl5ubzL3mCfOyed98bX63SEu1ElpprOxWIausVcNaZW21DbuJPdteZm+099jH7Uv2XfuF/dlBHN6xnNgp7Ex1DjmnnKvOA+e18w3gQAIAJAJpQQ5QGJQDNcEasB18cn03qZvBze0Wcyu6Pd2F7k73sZfQy+219RZ5W33Mz+rX8Tv7c/xb/ucgaVAzaB1sC14Hv0MxDMKcYfVwcDgh3Bk+Cj9ABGowEawA28O+cBXcDPfAo/AcvA7fRXSULWoWTY0ORq+iHzETu3GxuG48Lt4Xv/1/gvT/AAfunuQAAAB42mNgZGBg5GPIYmBnSGNgBfKQATMDIwAVqADyeNqNkINSRlEURlc2Btm2XYNsu0bZv/0avUZ4nJ6nb+7szItz1jaAbB5JIC4xTbwfN2gcR3FcuXE82XG5xgkM82ScSDP3xkkUc2ucTD03xtn0YjnjGsik1bjlLWdcJ+lUG3fLJ9+4R5xu3CuCdTy4OMTNHEHdN1xyzLK0fkd/w440J7JdiE7F56Ig+vV6GaZDb0Axftm8BMXtBMQ3tDtZzmVfYZpFVRhniVVZTomy4VQN0Ma65HNC3EjjZ1uS38ngkb2SHuXpppMui6/EMogsh+hjjreYEYsa+V/1j9IvFSfw4CWG/3UjlVZxSGRxjpdffu3iMW70VvIWEXCkU92nusM6T2h/BmBnTlwAAHjabMEDbBhAAADA+66cbdu2bdu2bWa2t2C2bdtmbAx1zDZm70QAaUc1lYGQHW1DhHba66CjTjqHTLroqpvueuipl9766Kuf/gYYaJDBhhhqmLLKKa+CiiqprIqqqqmuhppqqa2Ouuqpr4GGGmmsiaaaySOvfPIroKBCCiuiqDhl5HTNda3lcl4xORSXWZRbbrvhphdeeuSxs845LtIxpWWRVXMtDTdSbi08CJFijfDHOhtstskWBx2yOkSFaNlEa2WU7JLsluyOkkoo5bn1TnhoTYixVox9nphkiqkmm26aI2b4Z6bZ5pjlt7nmW2BeiLXQIksstdhRy1y1UaLlVlplhXj3vPXaaBeNcckOY0Ocv8Z54533Pvjok8/G++KrCb7b6bIrEvzw00S//Lc/ZJYiVTpB8HDAQABAUfC/2LZtG8fUl7QXp4gszjtjECZClBhxEiRJkSZDlhx5ChQpyZQlmzIVPfXSjaquuuhBTV/qNPSjSYs2Hbr06DNgyIgxE6bMmLNgyYo1G7nZsmPPgSMnzn6nKrrAbSAGogBaZu49IsOiMOh7eFHhxFD19oHxD4me2QO6o2eO8ceWFI9+MRaCxySTAsq7kTfL/YQJmT4MS7PULuylDEYwhglMYQbzYMYghwJKGMEYJjCFGcxJnnMoP6pxbWo7tiG1r3JsSj9vZvU/cqU0+n04ICWTMIIZ5JDBPCjk++EfXXpXH2et0X/1MYa5Ls1y8eLGs6rulNqeztHshe6GIV2k4ecpZJo/m/GipdEbYqDJz0UAl0unx34vQ6E1SoH10AImYI71Ieb9vWqkFKnUcAvmzhS1) format("woff")}@font-face{font-family:"OAC Plex";font-weight:600;src:url(data:font/woff;base64,d09GRgABAAAAAF1EAA8AAAAAtJQAAQABAAAAAAAAAAAAAAAAAAAAAAAAAABHREVGAAABWAAAADEAAAA0A+gEL0dQT1MAAAGMAAAooAAAW/JyQ5naR1NVQgAAKiwAAAFYAAACYr/7r01PUy8yAAArhAAAAFoAAABga3sHlVNUQVQAACvgAAAASgAAAFpfvUE9Y21hcAAALCwAAAGzAAACfHO4jI5nYXNwAAAt4AAAAAwAAAAMAAkAG2dseWYAAC3sAAAnJAAAREgCvXQGaGVhZAAAVRAAAAA2AAAANhzPjf9oaGVhAABVSAAAACEAAAAkB/gIDmhtdHgAAFVsAAACMwAABDgdRiqubG9jYQAAV6AAAAIIAAACHucQ1M5tYXhwAABZqAAAABwAAAAgAR4A0m5hbWUAAFnEAAABDwAAAjwySVzfcG9zdAAAWtQAAAJuAAAEbRPCFc942g3BsRGAIBQFsLzPaeU8zqjzeE7BNrQ0kAguQDnFLZ69vD7x62KYWiqHtgBvbQYaAAAAeNqM0gO0HUsARNFT825sG9+2bdu2bTO2bdu2bdu27fRU7Kxavad6LASk5m1aknj40adf5uGP/vjxa2797MdPvuLyrz/4+VtykwA4cIAIhX50RtIJM06YRaEn++qTH7/lYXu3vd5e/s0HP35FQcB7gc8lnyEpKCK87ugSkr95/xvd04xPbI8Kk55UgEiJfMWwjJ5V+2Ba0nKn6qq6Kqq0iupf/a4f9bU+1ft6Uy/rWT2uB3W3blVRXa8rdbHyK6cyK62SC3azlfWsZDFzmc5ERocxlP70pHNYtqU5DalNVVWkPOVVmpIUVk7+ZiK/oujGqDfSQ7HRL+5ToryI0rFqY6/x+nvs43aOfd1eaK+399k77cf2M1szlqrub9mLvGaK++f2E3uTvd3ea9+1L9lnY9nju0pla9vk9qJYttsFXpPf3mlz2ctt/8PPuNT2Rsrs9RltPpvFXm9TBCMyoKN/TETykCRSkpoE6clGCnJwKxmoQEWuo3rIDdQJuZFGITfRJORmOtOFW+gWchtDQm5nWMgdpAPuPo9x6wlDEPW2ef3HbWYHsIs9JFekZKQ6zT/3bpQ2+CJp+Vq7tVXrtVKLNVfTNVGjNVT91TO0zqG3VXM11G7VVlWVV0kV1t/6Vd/rS32sd/W6XtTTelQNdb/u1M1h3bW6XBcqr7Iro1IHE9rtOOxnZ7iKo9Ehjq/ksDmMtWp4OOVDCjsOy1kYruuE6zq+6tEwO1zZ0dD4vwakhyB03KfYfPZS28ZeYx+3c+x99nV7kb3OPmc/tp/Zmvb9WHZYX0Wf23e8pqr77fZe+7x9yT4byx73pjajrW0vjGWh3e41uWx/r2nrfpd7afcr3Zu557H5bWp7py1gkwcj0iBSAKlDS0E6MpGKrFxNeq7lVi6jFBW4nkrU5jbq0oQHaE5nnqAbw3iVEYzhMwQktwTFQU7LGsq5OoijN57gbh20aIeUn4asZw3X5Gtwl4qWCncatMNdGxzW3a3BYd13/9zzTg7umXOfZH4zb2aerpojSyL1qmftgModk3V5N0mwu/fJan/6C8/+cS+8El7hf/4qkYTv5N0ol1uuh4jb7052A3vJk6Cgpaim1V4u0g7jEu1wruMGJxJ3NqqJVdRna0mMcbtKSxpZo6pWS1GnpanXUjRoaYo0qjSXmjYtEz1NzOXaLC6NN7vxqo1XYbzbxrttvJomLUmzlqJFS9KqpaJ6E1hv5Rixn6ceo1oVHJ+YjewbbVb7NPFk4uHEzVopUZs4LXFCfDHeE38x/mC8On5crM9nwOPedVfGir5vDqOPt7nDjNmoYioV12kJq2skyXmcb5WXaTlK7GM/2plyZgexN6yRl4IUpVGGwgrDrkfCOqMyFjYZDxtMhMCk+1NAWtWCisAYMC4TRk2pdG5hhrwUpCiNMhiWGNI7bJ4RMO+35l037w9MEDPvktFbZFT9aN4tvaGSd5ZJ0Ps9Wb1LercZBayrolgyPqhYiupaJDqC/anQu6BnnZQee/o5q31YS9qZJchLQYrSKCrJVmr+hlH3fp6B9UbHcm3Gn6e0rWKLCTnU/j8kLwUpSqOUwjxlaXNKHdJpZJeR3dJj7l5z95m33/0B4ACzfEJeClKURimRoSwd9tSluhfoM9uAGQ4z4lPyUpCiNErJHsrSFuZod92hstNjGO2xv6XH7V576SNJv/4BO0ir+lHFlt5g/ln6QY/z17OkZ5tuwLorFSwZG1QsqSixH2Xp8Dx0gcoDUalqQcU6+/9pZx3RPAI9P3flHJxJgpIRZVFBptLD97+a2Q+VY3s+6Ph5qtsqtuiTJLXhPeqkXhrEq4gDGCHHqL2NqRgP00xwCNF15n6cy0IrbWbLWe2d5KUgtWrqpF4apOh/jZJlJ7BLdku11Mh1cr3cIDHOC7dxEOeHl+zhC6v8xCo76HG713VfGLWPDvv4NLqqhkkw6hQnwldMhYVfPTHOIgn4fRnZARU7TEvH0sy6rdndm/I8D3O7diNXG3lM9HwoRM+yWnso0kiJMvus9HqrbKeDTrropode+pmM7stll/0uM06ig7wUpCiNUiJFWVJ/etXHf/Zn/yL6YMrSbf7Unyp85punRq6T6+UGiTmfVDTTZ4nTEaxbovfa7jMO2fXr99oB15KEg+4/YJWT+In0snB3G4cBeB7ze8fMd3/9MTMz342hfUwpLc3A5f2mKq79aVuG6idHsmU5FqZvlPShE5bnFL3kTjCvUkcyrCQzNMK+b8lpRzG+o8m/0qUScjLt4wJ0/epX/BRETcflJF0GkedLeuTj3Qy1ZhlgV0enaIB+pGVfCdDyxFSc48hInJZhQ54jz6e0cVQ8l/nnsQxPyLNBPWw1p/Mnfb2FC/Zq0aRdSDCI76inbbFTouc3OmrLaPc6ooc+QzoM6Bk956Ie8VUJ4KI9rTXI7RsUaIEhe5GW9QcCrtyTVOeuEhcsz3lcubRG1m2BP+ka/g9SchtbEaiQqW9OC37LT+MZQan7Mu7wr4wXcfzCn8msWHeeb6jTYEs9dIJD3XGCExLfS0L1xkjO5cKmOu7Ec0npsi3EE/zvM8LHJ/tJAc8lL2rObSTLk6wsvMS/hRaaOjnLSVz0HtvkNgeid+hbT9zisymp22UwU7amEbceddHkqqeGVtLn19UQhzfVjZjJMObp2KqlMFegrM3qjaYEn+J6PI2OyoRdON1RnDXlo+Vpup5aTdZL7vUvV0PNGNHjO3k6eQ7pxnoVJOpcK9FzTv0YQOPIRLSpqymZnlOhI19FM+yEmHmLKtW4g8+o8HbypFCZRsZqrImC7/GR1vBU8Du+VHsOOKURs43YWv3wvqw8Kt1xQ7Tlwlf13udl/Eczb/wduqa3a2u8p953zvvJBZ870TIjeiqFDxhqfA05FzwxX8hpV7H96AnDb8gvRsxU4XnVG4DLVGhLb5pjd1Iv+YZTYZ3CPkrnNIR6SbpdCdjzuUQPR89WUK38A/2HMKv8gl89VJsMFU1voxlzgpFgOqHp2/vjdPeSxq4gmd+nwFaMbTJGVEXqiWgP2xskzp8Lc3u3xOFG5DkyfbBu+yApdbWd07hw8Y24wJB8okMlr5ZUhcgNyBjaXk6PAedtH5I8fSlEVZDW6NL6I9wyA6pcM3ZepF94pMgd8dBLvJ8synNuIknNiz+bvCaczOJs5+BQdUW+ql8rK6X1cKnsO6G0v/c1L0r6+12/684ndwP1Ba1kA6IVOcGQi0X1Z4RjJ9Qap/Ec7Tyip/9TPJDdy4mWt1WQY6oc66z3jWCLjP/p0fF8ikMsRpPD+J2pNWyPJscy98BgPXx3O+NMpZkq3bSRPCH48P46xYHgN1RizUjmvQXamqMtqb/z/i7ryTTX45tG4CO2BT/lV6EP/NlL1CcZzXd8L3pWQuZlwJbSNxizByBZzigMw++Yq7HtWfUqViG27WLsFGKzlJRj27aNQmyncG32PXu2V9fnqW/cOv/wn3eZLjsxOWan9W7tlFdQHBdJESVNVu7NU5RrZZGhSoMsbVGkD4MSw6LOKGM0dEarxR4cIfcdL3bmRLGLziHtyvXcJ494gOc4gRd4gzN5iw+4SGf9LsUmPsOFg2655JDE6RHd+MnKaSc+YbNehSESeICkJEha99+Olp57ycH0dU0XYe1qRBIgxaaqQ0FMZDRRUaKsiYkCRc3syms2X1G1tSUjMYv2xeLDb8lqX2aKAx5LUDhnsTOzvBawzwJuSwAdG72tRA/gkoREQPeiQoqAcFOSawXCpAHIaC+L2LT3WRxW771UqVldcGpydBPT8YxLgpvpYqeCpChrEqJFW5MUDZqamVXXbKkSamvLN6tbLnpw47L48Vn82pcp2rnSrGeabQYHXaCdUjPGxjmDY9boTs2z2I7Vbj4ycuXI+SOh4eeH9zdWG/eKU43tjcLgp4OnGmLQPhIamD9w7cC2/d+OnN93cV+pt9L+tH1sa26r0Py1eVvz6Prz9Uvr29b9tftre1dXV86UJMpPlnct9xf3LXyZ3zP3a+7s7LPZXbND4zKVTEh4x5NeKX5Pvzue8VvTr6ef1dyfejV1aKqV+DpxZ+JmeYwwtpf9nDK8//DziZqcqoH5xvbx/+NPGtvLJdnjacP7R+ePhOT4lOz3p7LfU5pHTxzBBDkGVV09rXl0ZP9y/4Tcr+HTQ8/2LO7+sbvRleuYH7w28L3/Vt/T3h+9g5693Te7znV+75A5bNuT2OmYeo8s49R3wRJtxqixG0cyxNEcy96cLPbjdM5gf33PO5DreY5D9N3uMt7iM67Xeezb2RWb9Z+fU+KSCDzmQrymiU/SI9fDkqhcjpnLSJr/kzb/ISvXq+YSBuSxg+YbGHJ9yHyfYfMHRsyVjJrPM8Y6Tu2Ct5XsDAPwXHIuM6PUlNMso7CMwor7izbMy0G7ZIaioYlJoTIzMzOk1/I+Gs+FZVD0aIznfN87Z854YU/wiPeHjD7MCKOMMc4Ek8aeYpoZZpljngUWWWKZFeIkjJlUQ4q0eTNkyZGnQJGy+ipUqbHutQ022WJbje+/LYFdUQK7JPCP2xLYFSZw3i/OC+5oF7v/k8Afgsu6u+Jb13Tbzxt9bsBxkFuJ1CXyQ4l0JPJZieyVyD9eJpFdvUQcZ5hljnkWWGSJZVaIkzBmUk0p0sbIkCVHngJFSmpbZY06DZq0aPO8hNT8DukcCPayjxh93Y50/FMDJzw/xdluV0IdCf1bQn+XUFc67kSq6+eN1s6A4yB3dv8toW9FCW1J6DcS+quEahLaJaGOFA4EU0wzwyxzzLPAIksss0KchO8ljZkibe4MWXLkKVCkZI5V1qjToEmLNs9PoebsRh3r9O/RGvhFuAauyb6fN/jkG+U04PEgd3b/H62Dji7XdfldHX4mXANJ301R8rmy71WoUmPVa2vUadCkRZt1Y22wyRbbxnuvit01o115HzH2e/cAJzw+xfnuH52bv0SV/0nle52fPtV3g37C6j0fcBykV/16dE3/wPm53rumjT5kvmFGGGWMcSaYNO4U08wwyxzzLLDIEsusECepnhRp82fIkiNPgSIlNT0vKdao06BJi3Z0bd8pmaNhHv56q1ZOBzjh+RlZnfVaL5k/3ZbMcTvrXmkclMBGtEJ/pfNT4cocMuYwI4wyxjgTTL7qnaxzs/uyOStUqfFwtDM5o/gLYtzclTw+xc3zKnv7crQrxXodcKfP6iJagd+PzuGBl96BjDvFNDPMMsc8CyyyxDIrxLm5H5s7Q5YceQoUeW6HzpHfS3bbsEt/ztFO2NUZ717UiXNxa4U6Hzq6tUKDIFqhXw7cdXSWd352dNYXDDPCKGOMM4GuZL7TW03Gq1ClxkuuJmPfH54Pd4awOncDef8uUKG8T6myo8qOKg/1qvR4kN4O8B9V1lVYkP2Zl70DhLu5sVOkjZ0hS448BYqUjF82X4UqNVa9tkadBk1atFlXxwabbLGtngfD/J/7CyC669++z+nyiO52665PR9d1tB7d02IvlflrucPf3B/T5syQJUeeAkXKaqlQpca6mjbYZItttX042OW+stv1sZd9xOhzpe533RzgkPNxzIo4zgnvnfTNU46nPT/jqjzr/fOyuGDG8BrzOEyj+/ngmgz7CfdO19iAx4PcZU3c6xq7T3oPyP0R8w2pY5gRRhljnAkmzTfFNDPMMsejanjM/I/zBE/ytNfmvbfAIksss0KchLmSakyRVmOGLDnyFChSUufz9lOvrVGnQZMWbdy7ddNnZUQ7kOQuSea0ZI4GrlXPTkvmgGS2JNKRyLokDkoiJol/95Lw/SHjDDPCKGOMM8FjRnmcJ3iShM8njZsibdwMWXLkKVCkbOwKVWp8RLU/dt5/7rx/K9jnGHPs/W75ZXAA1QfH9HWcE9476Zo75XOnPT/jujurw3Men9fzBZlflO0l5/+y4xUr65rfk/28ITig068EAx4PEv62Ca7q+lxwn87vt27st707h5qGGWGUMcaZYFINU+afdpxhljkeVcNzU3naa/PeW2CRJZZZIU7CXB/zmY/zCT5JUu0p0mrPkCVHngJFSuovq7VClRqrXlujToMmLdps6+1D4brYzV6z7HOMOd5aI6el+x/J/i+6kk5HV5L1IqHLQUyaTWleD/p5g6vhjXbKAY8HuUvy93T/J81d1tDv7Dd/so7++JJraNJ8U47TjjPMMsdj5n6cJ3iSea8tsMgSy6wQJ6m2FGm1ZciSI0+BIiX1ldVboUqNVa+tUadBkxZtttX+zl5ShEkR/aqMkvpflNTrnpPU8ejKqt72e21HUl+4eTe8Kzgspf1S+o815/+hZNJYYRLMMMscz0vCawssssQyK8RJmjtF2twZsuTIU6BIeDdVT4UqNV7ybqq2t1k3O+rtCw6g+/CuejbcU87o/JzOY7etka9Fu2wruEsi9/hsb4fVrSqHjDXMCKOMMc4Ez+n21rk1ZoYsOfIUKPJMLXcBXUW2JWC4SK4kbRA8AdYTuhlp4wXIuGBpwZ157kr72JJxwz0t0DhtQJRRXNuy4u557u6a+dapO8kC1kv3WO76s6vqVJ29z9n7SJ26da/vGavpKA6Rfr3/Qo8Yz7WVYgwvpIb8qCR8GPvP8aGZTKQkl4dmMs6dLp9C54beUtviwzfqLYfx75joaTyDPdgrz+F8rJcd9HPwJd2ncQZn8Ua+vHdobOCXXNwcTVH2tBrIUwOj45FT6eKRsyuenQ7UXFtyGDGVPPHG44T8n8Yz2INQAtcfxwn5l6IM5ahAJapwwwwU97BzFMutIsL3RQctn4hJjoi+Id+FHqo8GvIdX+mZisx918vnKdc+jWewB0cdOyaP4xgu4tT7Db3JsPVO529mIvK7cd9LpsjgB3dvuQh9r+PjlSUen29VmlfieRw5VPe3hbZU9KaiTv8qz+v712H602vHcXpLUYZyVKASVbh+Tvfx+N5W3SWQRAojHRuFPNujyTHkWHKc1AnkRDKfRws8HZxEWgFW6i8pcavR5DPuFn6gtG3RLMyWNscspXjgz6L7ROT9eBALlXQRFktfgqVYhuXSVmClMX4V61aTa8j3SPug4+vIx1z3OJ7AsPfK7N6BndiF3SjBk9KexT7b+3EAB3EIh3EEz0t/AS/iJRxTzuM4oZylKEM5KlAJMRZVK2+NFljr/DqynmxQ9kayCc3OM1sK30dss9+O8H1Wtd9l9ArfWDX/6XVNnzGr3/4jyn7TDasPaSmZvn1wBWK8nCaKyXzxEPoD21Nc+xbbU3EH7sTdCP2Ccf4dtgutt8zALPtF8purp52H+biPhvvxIBY6ZxEWa4lLsBTLsFzaCqwUM6vxTiV/lwhYp0QPaUUPK/UjSvWYax/HE1hP7wa2bcQmbMYWbMU2/A9WObQBXlLm4zghj1KUoRwVqEQVTjrvhh4YF3ARl3AZV3AVr+BVvIbXUa2eGpSnWQ/SJv7beaBD++gke8hebb2P7Mdt0XS9dyFmGZGrUeNoLX/VkfVocFUj2YRmz1ha5NgqfaQrfzUqxAxPOWZpBdV4s1fni4QfaZ/f5uXXebhXe/x6aIvFeoF1aughTxBrRIpvpsbfSiWb0MyjrVY528RZu9jrQBe60YNebaOP7EcixNl0FNI/k7xFP3CWxSPD3iznnLBfijKUowKVqEJ1aN8jfJ8gy71otisSZBIphBi3CpALT03plT9uxW0YydpRyHNu6KXIsfbH2Z6AfBQg7p2aorfw21RMs38neTfuVSvTnR330bmZu4kojk92bcQmbMYWbMU2bKdrB3ZiF3ajBE+GsTOKnrbu8gxvu5swO9DbOL5P+n4cwEEcwmEcgdi9occ5weZSlKEcFahEFU6y/Twu4CIu4TKu4CrcOaizHOTilugP2ZGthLxk/xn9wV7Hjjl2HPnq5/NxPzHUR8R+dTZvqhf2OKcUZShHBSpRhZNv0Iaq8dtRlrhKIIkUbmHVbVpSnu0xGG97AiaaSeTLdZLZZVjjtj8V04wtd5J3o1D8xOttx6Ltrt2BndiF3SjBXvnvI/fjAA7iEA7jCJ6n6wW8iJdwjL7jGHZtm+7zuICLuITLuIKrqGaPmo5EP2urkRUV6A0L6Rvhv9UR98J9jn1W7eaGuejTWvYzqBr4B61uNAsminat1xlhtiplq1wn+rhfCV7JktfnpX0nrJU1hHVkvg3rVnO1KXoHPGdH2up/jitzcUtUpMbb1Xa1u/AONV7t6lNRvhwm0RfuBaKRavxwNBV30DZN2p2278a9epPpAxXWpy7QeJIHamkdq6zlcs6P1tO1ge6N2ITN2IKt2IYd9O115lHnHaPvOE7QV4oylKMClajCSTpPseE0zuAszjt2ARdxCZdxBVfxCrtexWt4HdXsUm/hLtczEPU+efCOMF+bDKsOvDMZU2zfoT+Ypl7jJyh9yvc1V3UpX0t0zLHjOOG8UpShHBWoRBVOuf40zuAsql13b7wCyDcJJJFCHsbAOggLaJd6b7gjb2FrP83fjPtQNV7E0mFXAOWzAzuxC7tRgn3YjwM4iEM4jCPIlGbYp1nVdE+KCtXeHGNdMX+8x5UfZNU6MtzzSa9xZq1ariPDjAeNytmkZM3K2eJ4K9qVu0O/1IkudIvIHsd6xXCf9P4wbxkt2iYqf4Exq1DNzTbnm6NOinnyXc76ILnO8bjN3KXWT9Ceoj2iPR2+sR/mW3JrpqXVdpu1l3ZR2zFQGvXZ7scHwv1xFh8lkEQKeRiDca4e7I3Yly8OjCWxp5TtLcakqZgm/U7ybsw2os4R43PFzTzMR7E6uk9d3Y8H5PMguYBcrD6X0LGUXEYud3wFVtKzGu8SCe+J1DMeUorh7r+3s3cHdmIXdqME+7AfB3AQh3AYR3Bjz5eJBmUrRRnKUYFKVOGkMp7HBVzEJVzGFVxFmE2w2xtEcRzwYHi/hnda5N0aZrrp8N5Tn7llv7K/hb9/GvePUUINfk4Nfo2va/k6N442ffw6kfdQ6B8virbbolppdWqlHg1yaiSbaGk2kreQrdLb9W4d6BzoNrdujLq14h49Xy9L+xzrl/bn0QhHs9iZQBIp5DgrF7ewfaS6GoU8x0eTY8ix5Dhz2gkwQkWT+XMKi9+ih5mKabTdSd6Ne50zXckK1d8M0owoKpLvbPnMlT4P81GsLw3vqeAB/c+D5AJyoRpYhPjtvpvjN/vI8B4LVhpVVvHfanIN+S419UErHw+ZNz7musfxBDYo50ZswmZswVZsw3a27MBO7MJulOBJ5XxG77WXvc/a3ufYfhzAQRzCYRzB88r5Al7ESxgcSdVLKcpQjgpUomrg36OTyn0eF3ARl3AZV3AV1eqqhmdrUafcwdtRFHubbDOT7UDnwKs8/K88fJWHX+HhBh6+yMNXQkxZWTISfJCVVe5GrH+JsgLejyPusyKuzxkV6i5y1nORMjuziu68eK6t/uptN8gpnmu7kxONLY63ut9pNxPpoKHT2NZNf4/9PvSjQO/53WDDnGDH6zR8Lsy/a+zXipw6rabefbQ7ingOri00ky1oldbGynCfiE50YfDNRvShH+No+ixNX4xbUKQscnwINVpILVlH1ss99Mv82UK28VEn2YVu6T00hvcanddPfigawcYsOSaQRAphZm4WnIs8+6OdM4YcR46XNhH5UTLMYCYNzsDPhzW5e5WrUETNoHkmi2d5P66I1bP1nHNoLR54VEt4NrofD2KhfBZhsTa9BEuxDMulrcAqea9B7L2quMfkmcdc8zieQJjNs20jNmEztmArtmE723dgJ3ZhN0qwD/txAAdxCIdxBGbsQ2v+ylaKMpSjApWoGjgSVStf3GdlRw1kI9ua0MyuOIJSvFArihqjDnQONPNGWdRtu0dU99LVZwzstz8mnsWEseZnaupwptQ9IaKqRHgdP9ajmb9b1WZHxr/d4NuhN2VJa1b0FkQ3yfW0HI3yYrVYH/ouLSqst0S3yXmnXE/K9WzUyJ5mtBqD27XCjmh0uOvtdl6v6Okj+1nm7pP+gjDr+kqmjbXLLZJbm/blnUnH6vRv9WjQXhvJJn1RM5tbREKrMraxsV2sdci1E122e/VzYa7A0pvVQFVoT1XO7qC/E11KGd6JJYNNculnSR6b9LuOzBH7xbxRY05WL68GeTU5o5mOFultjnfwjrGKzkRcd/AWrzIX0mUlLy6N2KlR0tC6tJYGZzRqy032m1naYruV/IRW5M1xrSWhbEkyRabpzDGzycVI5R+FPMdHk2OcM5Ycx6fj5TKB3+NvInwn9F2TbE+W8xTeGJqLnB6ai6jLOa4Pq27i5H48iMX61CVYimVY7tgKxDOrfw8tJzzjZ+9GbMJmbMFWbMN2Nu5g305yF3ajBE/S9yz22d6PAziIQziMIzgq7+eV5QW8iJdwTFmO44SylKIM5ahAJbSiN5578FWt8oQ5KEIfJ0LMO8VRndbVJUKa4talnN1kj/Eibl0NfNvF+4W8P1sNqwV+HeBXfTPZQDZJCznab4fIcPWPQ7yPHmyXxca+0B6dUaWuaslr2qTyd4jxLlq65XrN2+u2R4W+c6bU2VKLWfVB22bYmdJF8czKfiM6HOtEN+JWoV+95ttj4+U5UU7hCavonGR7ihynsWE6ewsxQylmiqVZ4qrYuHmfXvt+PIgl/7Uqa3sFPqg9ryMf4uf19BzFMXkexwn5lqIM5ahAJapQLe8a9tQ6P4xDaEAjQs2yrwXxyqh7AqXpg9GaJjNvlrrT1CpnszxzN6Kf6sy0w7Ms+hcaXqHhDA01NDTQcJmGC1ETWoy9rWYEbdpwOz9m7kRoiuK64wXagqYfhDvpWBMvsCdoifLjyHDV4AovGqIxmTlJbjxyk63K2iatHTRFXfLott2DXuf0keNp+HxmzKtQsz+l4W00jM2s8iXiWY/tRnHRpF9uJlvstyp7u0jrEsXdPNejZfWqvT7b/fL8gyiLjxJIIoU8jME4dk1h+zT1PJ1PrNRn7jJ7Y2vE6EK2LcJiq4JL2L6UXEaudO5qhNFV+uN4AtvluwM7sQu7UYJ92I8DOIhDOIwjGG6FpZot4d18eTeh2bEWMr6TC2+gh6jvUoZu+z3oZXcf2U+Oy8y1GtTnBNamMnen6XgG6VioT+292fEWstXxdld2qNNOddnFgm7bPWqkV4n7tG7PIMRCllXVBJJIIc1LOcaPXOTZH4PwTV72TRbXU+RwhzqfxjPTjVRxXfdHs2mby2PzMB/F1mDuY/H9eBALReIiLMYSHltKLiOXS1uBDxoTHmL5Y44/jiewni0b2LgRm7AZW7AV27CdbTuwE7uwGyXYh/04gIM4hMM4gqPyHG7d75SyncYZnEW1stWKj7pQ0wVqekJmbTodRy6b283CO5Tf3VhmhP4C60O/h9m8OkcNFkd58ewG8f1fUruYFrc6adar4gghRUjo6UNkSOuirUfO2sTgbGFMNFGdFZiNFbLRdx1oomWgLWh4CDXOrldPjWhCs7GhRatsDev8yfgpjbbdTxawN8cdBJudNRuhDZProslye5taGMvWO9h6F1vvjBrRhGY10yK9zbnt6EAn+7p4tTvUSm/cQ6jdfqNsIowt7JOjO1ulmji4tv//ta5v/hZm6Wboar5YNA/VkdmOllFH1qMBjWhCi36+lWzjgXZ08EwnvJ9Jy1haxtCSjp+NkL6totyFPBL8bnsO+J02mhDujxyrR6N22ARPXWj5Li3pwdmh3nXw11RSob5m2WJvVE1m6k1UvvlnL2o41G6IPnETapX2eKb3s3hWIC2e7YkVMdxCtqqb8a78kTLlhll6HMtF0XvEzAelreP/h1DD7no06Isag/5J9OcpV5QZm24euteTR7/cV0ZZckwgiRS8lzv0DRca88gxCHdhSpxPTlEH09gfvs8pOgsxQ+pMq8GznFFkvmvWc80vhbhjvubXchaL2CVYimUIv56DP2L5u/j3PfIJ0W97PZu2s2EHdmIXdqMET7Hxadqf8Wx9j9Lvc2w/DuAgDuEwjuCofE6wvRRlKEcFKlGFajpr1FqtstShXmtr4MXGMFK+PfYm2kRGh/beKXK6jHnx+tOX1Ohn5WB2dE1b0o6C129oS9pF+G0XaEtRCznUnpK/pD1lh/Y0IazVh/5Gi/4g6S41ntWR8Zw1J747dFWT7Wa5h3VT57Y5FuYR6OLTbhqDBpjx3dgf0FJ9XRm+e0N/MFSGz8ZlcOxa+xOZ/iDbp1B9ySH8bk1BXGfy96w/tN0PigIlousHdH1nqIeQf1g10ac3qf1m9rXYbiX1QZk4HxOvBtPXg17X9LGnnxx658m7bbb+JmdPzu6crTkTc7JystI/S7emr6TP5Wwl/zn9fHp3+uH02vRvp29PF6QTqe+kvpTqTB1N7UmtT/1t6o9Ti1N/mHo7xiZ/kDyTrEo+m/zL5KPJjybfnVyd9En8KPEdn6/5fCZxNPG3iT9PrE7/jL7BD727EX/opJ8FYW/wk7g97ZNODH3YEFsSf9bHH3YMfToTo5N/6be1dmZvzv5o9srsOdkzs+/Jvj37pqwvZbVmrc0qzpqcVTziC37x7uUR/65G/K6gT3hXjExpUVki5DZbeZmnCuPtT4yf43iiNy68x1Rg7LlH65zu83Z9QJGU2VGxFL/HJWWZz73RKp/p5jprfTPgnT4zonf7zOTdh/QV67Xf39Bu91rT3qd9PmAF5KTrvPekFzgfvex3c6p91ontfldkh3vWAkyLkqwcLz6892D7DsdO4TTO4CxujdL+TxRT+ZjirPX2j2K4VWnvRWKW+dNwz/yrpSeiNP3jsR5H8RbHklEKeZAS32NjEqZknpYWkdv/29/Wz9zTurYUZShHBSpRhQSNtIXvy7QHTTkZC4fsmO6OReqgxb5/o/4Knfs8+QJexEtQu/KUIiYKbWVHaf/X4yiUPU697kiRPMMReD7ov5XsX75qixHhrAm/9HlWPqbLdYaUmcr2P3k25btidExEPqxQXf8dQ5rniuV5mA/9jrFsmvOKWVij3mpRh3o0ogktaEVmPkLLFPeMJ1CKMpSjApWoQlaosSK1y6IweqpDzEJ4yo89qLbvNz5ZMTmU/vnoHUq+wf5GbMJmbMFWbMMr0l/Fa3gdWeHbOIUYodb8FwHfVssJ/k8hD6PlPWGgR32IR/s7sQu7UYJ92I8DOIhDOIwjeC4SMa59AS/iJYyICvxXRvqLaMuKJrIsH9nh3vchesx7xcl7bD2k1jrNcbusuXaTPeiVc1LNR6Hce0n1HHXYzlI3v2rkbdcvqbnBnAvgGVnIcV3waxTO3GO72bGwIop2fkxbCWuKdSPkR1+XltwrNZtfzc3RLk+/cuL/KIzFk3gWYeUe2dFD5oS1zu1yNNfe81GNfGrRgCa0oM25XWGm6hraf0C7WSN7eUUNJexHg3Fo7Ug5H5JqVT3zBv4ttjIr1s4dec0qtLIOPunfY3tvqOk5QUtEvzYc7Oy0lQjH17mqCz1IhrOaWRnmAHDUFZ22+p2bDOsWDfJuY1G4q0A6HJ3Lz/MwH8WRmkeN6+Jr3L3Y42uyn/7ccNRMLhytz6R0oos/u8l+JMz9omBTLVpCjxNanWtjy2p4rNXxEWFVNxFK02KrM2N/bri6BoPrWmhEE8JKMKk38z8Z31WiSY6t6JU+JcTeJEffoq6n4k7cjYWsX4T32f4AwvMw+4/jCYjV6JjrjuOk9PO4gIu4hMu4gqtocn67knWjJ8RCJ3v8D1FS7L9yRG2hROYqGPrtUn5WhNvN8XNDq8h7s78GynPGZXks9UmH0Tkn82ugK32SYaRORat9ktEan9TQr4TSdaMlo8iIPYUZS5KDv2K6Rp7v9RkbfsVhXMjH+oX0d/jv46xsn0QgyydHHghHvfcXuPYvCQz7JycfdcFjtuSFoC8td4SjSbnjmisTwPB/se3/CZpolWh42mJgZGBg4GKwYKhiYHFx8wlhkEquLMoBNEUPIHx1YQDGf+/9X33fbNsMs7287GbbueVa5sxsTJlDnpVbXm42bme6HZ/neQ8N3n5o626D92w8ss9gOfz4oUDIdOSKzZv3HjB/y779e83cdmjjZlP37Ny+0fh9R/ceMhKhg1AgQyDkyJQq/8X12BPrYnXMjYFeWq6v5Khl+moMJ52LLDqRRyFUal109cEnn31RInfMNmt01xGGC70RqIX8r5spDDMbV10z2I0mDXWrScPcadJwHVJ0WP43PnRtzU9uzXeR5o2WGOnUmdc+4FM6XQi1nNQmV62jr+7qdKY3Psu890nmXfLftvzeUit3XKZL4pX4y/u63BqVTsqEOZbSml/sfyUy4/2vI61rOoJ05vDcCxIbmnib3fUMIWxp/c9QXRpyz30PPPTIY088bcwtKSqdwaYm/f8TPSxFd3jaLcWxDUBAGIbh9//uLhFKC1yts4JOoVcqJNZQix3sIQqLGMEIUPA0D169WgJo0wTM33bQWpmYsuCCHHIjDEDBr66ayE58Lm/3Cb6zPGILgFKtQEQvrqMOdgAAeNodxIEGg1AYBtDz/TEDMAMwgMHMrB4mgIiKAJdePzo4Iu46PK8/6ljWljfH3Nb8ZGvTnl65eXgJ5FsjIip/MzqlMoBwApY6B5YAAHjafcwzAB1ZAAXQMzNr23hhubZte2Pbtm3btm3btm2nyo+TLrloD2IkeEIiwhPuiAvgJ5+50wNe9b7PZJJfJdVcjF6P/oynxPPiTfGWJEruSO5N0oU43BvuD0+E58JLIW3IGN4MH4SvwpA0adO0TNM67WNpn0xdvHjh4kUEr/nA5zIroLIel7U/4snXNUmS3HNTezw8E164qr0R3r+FdjcXt3CxF1zMS+qtVMbUE6n7uHD88tfuvGunnXa8Djuy7Ui749Mdz+8I2zds/3H7n9v/2JZv22/xg9EjIj+hAEqhgWZEPwBEX107QPRR9JnbJLrL/35WRj35fO4nWWRVWnk/+NK3cvnej6qqoprMvpBNbtmV9Y3DIok73Okud7tHDvnlVC66239qq6uW+goo6IDCivlHzeg+RexXQkXLrXDIEoVUd9Iyxf1rl512y2S4IYYaaZgRRhltonHGm2CqSSabYqxpZpluhjlmqmS2ReZbYKHF5umjiYYaaaaxppproa1WWmujk/Y66KilLnroqpteuqusp4H66W+AQfoabK7ezjnrjPN+8as//OZ3f14CZSaXvwAAAQACAAkACv//AA942rU7BWAbR7Y7s7ZlkO3IYra0klZsSysyySBbZmYK1E7SxOE4aZs0ubSXXpvmsHw9TI+TYtqfy6UfCr/48Zg5l58y9x959d/sSrKVuPDJ0o5238w8mvfewD5TmKqkKHSWllI0JaEoTmaR2TkZU4nu4h+7eJGW/vXtCTwDreypt7EMqygrVUVRFsbqYB0sU1AAN+FQJMJx4ZCDsRZIWLgPqpRKjoUnpVKh4oKRSBjL2o0+aREuKB2sHRgLzycn/ZwvKu8xru/fsjP0yFAw6LYb/Qa9TqYIhkbbIkmbwxNg9a2+6IbJdw9azDJzpcyqAS58wEUZcKGgbMBFWGSAcECoqrkwJ2MJPWDGkaaPPplf1hdqnq6unm4O9ZfmH3nZHDAYAuZAPD7uizQdHB+/pinsG1t6d63Cof+61qFMxKaiCQpodQEtDz4v0uJk8BGoqJQKQhWkV0aDhBShJJBSdR3JK+vnElPV1VMJrq88byEYjwdNhBw+z/+7L9x0zfj4waaIb3xtIjoVSygd2q/rHQpQP8Wm3kYXQS4dReULGiXiSLJCgBKj6oICpFk8dGixf7N6S1HQFQY5fVzZFdoF6W2HD92ajFdZPInYukhrFVPV1pbV1fn30pXsf6orVL1kyFUWJvxjCfCvoRiQYJkMWIJlmX9aUBRHKCJj74662m09Q1s4/mtNjVVxTVvlzm5rUP8jjV+aODgydDDRcVWHuzSWdJl6PWH0hDlqKyyyh81EW2oo+kGyNWRcmDBH9MUpGSVcsvne3q7k9MLCAvraxu62rk2LG/lpCmzbkPJiC95ExagkNQI8KrLqiIaXf9LKySBcHmxgHMSAOgmMN5N5itBZCyD6w5bI1fMTC9VBTyVT66iqDmxI6vxyh21wp8sZWN+ucsnKVVbrx9ePX+0MnC4rDdY3xWvv9ldX+32BgDfSzRpjDm9AUlLkr3R6C/NUfaHwgLdAInM4rihTd1eFBjz5eRK1TCHvG9MaSgzlJmsl2uJiZU74k7GuZSlVVIhqoQY+SMr3kNCeI5M8R95VJFQHFKfaikpz5ONfTUv1zLKg7yVgvmQCF7s0K6R7c1km/mxGUjLuXeCWhTDuypX+qJQxsrQPyrqO5K9paxgYP+L066pN4HT/5q5Z2MCfQQ3RGrndwH+D+HUjRVE/xC9SpZSMouTgbaK7gbAFNGC9mbXZWLg2H8Fjdr3CYLMZFHr70klcvPQuhVN/TsWE3oWUiqLU0F5RwDDhXDRdR1o6kp9O47kCb1v6dnPHJnx2GVtaFh/IUpqWJRrlJHKGlShBhrZ9n3nkmbs+1gYCtKz92PP8Yy92fyktPyqHPoViBA6Tfqi8rbnxSFtLPd60dL3Yhg6BBTgALyPjlKKS1JfrKnv3/JEj+eWJ2kh/BS4bifeMHHF5tD79Ebdb4zPg4nFXbSjsiYtajMUELaZvsiOiopQ51HKQ5wwJ4MsZESodO6SAo5wy5sYOYplsjjEibdf2urrtXd2k7OZqa7lAXR0JFyPXJBLXjIwcTGxurNtQF49D0SjG8Bj2ZOYLtchgTgyXyT90DH8Wf29sOYbzv0WO3ChOIm5seXbKl60yO9EfPuI+i8wr5yc/cuTEXNEa9uFiak1G93EMQSurdYmlxmVweuqMuHgbYLxGxhiJDRlhpvln4NEN+gAFRFUkOANHLOvHogVnJx6FSq0WVfVO9ya2z9jm87uMTCjW59w+yXXGNN3qJoeTNdvDY8PhDVLO12NxVBrU+nyJxNFS1TMpt+u6NZVGrU5fIJH2Ngf7PIS+FopB/FlKnrFhiN9kCDghenOoc6alrddpVO5dWJhra0KVG/X6yU9t5B8nfVvBUjBIrFyez4gPpBcZcIeuzy9tbQZjc/u1VaYj42z9wgbUxT8ZqamwG9AkODBgkcJQIcBSRDigObWa+B4auuv+w52chGs/gIt/e+7cb9PzDG0U6XGZhmJJMyzLSCTf+PTBsCuvumGxMZDnCl31qZsTLO1owcU/fvjhH5Nr6d0Ln/zkBQoRaXEpYCLeLgdUHKCQM4BCfvr+W7bRC8ceOn3LjrydqAih++7jl/g/PfII9CoCe8LiCNvlHF2GGVBWlObkag5VTV/9vVJbjad3rebRj0xbC95FiqXP2qtVmzoxw798FHrbQYTvpuW0hJElbFEiC/ouP4LK+T+jz/OvIc0m1Lhxjv8HYrtKKI7jc5SE8GghrDFyTi5IiY8fi/0x+rEXvyqpseRbYqdP43P8lgd37nyQzDhD0O9K6CenzJRHWD8GBZORKIMmLLgZreQyVp9zP4QSY3O2mkp1qMpYNRj61VmtTS63ac9+RWOtqLBq8LkrBsNNJrqgwhH3xaYiyPMoQK1aawUyP1xhUZvVVhlIGQKbmMNPU4bl2LH62mnDzI1dXTfOzB6y7y5vresaH++q66pYsB+RDnxp3/6vjA4M1lfVzE/tmJxrqmrsG6ewINkhkKyYUhG5smGDXRaBGeKnb+rqumn6wIFAh9PZETiAz/V9bnHxc3372P66HfV9LIUEPCbAU0LGQWZRpj/YxIfQP/NnkZX/FerA5/adXDydbi2H1kXEqzOtf3QUPc4/iRT8y0I7Ki33dSC3Y9kXcoVPxzORWSZskeHyvKJ1/UPX9/R9fHb2Y/YFeU+c6/V4+kKuVucxVLiNaxv68r5994wM9zT66zzD8V0NIx59mPXt5MGastogUsAeAVwVSvC4P/G/PHoUMUcRy/8U7OK3yLyUJPyFodiTkRoiH3Ag+Pce/smZGdQwO7sVXdi6ldeRtrrUO+j70LaCouQWGdHxcmSSMXvR+shc64Zt5QeKqp0s9wugUtw4y20a1nqDAQ5dR6W5uxMwENulJYSQTHBThP78zOzRo/lz9931FpKg+h3/Cr2/+dEf8r/kt6T7oRegXz7hkoiEXuC3HEUwAEuPZvD+WuQMMIq+D7IzEpqGuWPoli3ddNeVtxyiI5/5VJTG557+1KeeXkqi17fyf0SSXXxJVm8iZ9AHOhP3JZp7+Xsd9KHPkAJt+gxfBIzd/Rn0n0R7WBjd22B0yynLqnOiaH/ZQUbz0zd3d988PXOsu/vYDNfpdHZygS6Xq0s6dGL//hNDYrnPP1q3rX7E7x+p31Y36qfSNj4N3EkpjWhvGSNnZCs8FcyvtnkmGJxpPnNSZ1MobDp8LrKhuXlDBDX8k5zR+nXWCpHrPoFrNeUCrpUkPIf9eCXrEuXlzGPFhrbmnl0NIv+1V3a2rRAguS3R4JZO3LVFlGLT7VOlzQ+sLgeJQmVkByWXZQWBJRW90l9BkrqmmWBz86duvf5QWpaTqJR/C58Lb2hp36Liz6PSnWmRxH0ZDoBEPpBn5WwpTpc57kZEUavFmIc8kx/xTtomIw1xmdvWkpz1x3f39e93T+m6YrFahdfS3D7jbdgvbQqNub0Rr4bRFBSXhEZijTNcODha6fSweqtcIpWGBmtb5mMUIlJhjxCdKQQ2RLwJe545+jSW4balR3HbPmjTC7zOQxslaIBMitlZMbMJ6L1e3xAM1huuC++74op9ITC44Uin3d4ZQffx85tuaGy8YROgJ7MN3gF40vMjWGtUzqFjd/z+xoU43bDwUeh378WLaIQS+aLvFmkutxVLGjTPSNDQHfccbfPQwYFbBgK0t/3wN26f9GAf4HjoRz9C/WIJLrP77FmCryLtLbnzJKCq+N1P7r6NvuPTPzt/95fpL6LNaPiPf+Tv5e9GUv5t6Fe8kmcZMAIfGh2+4bXbTuAvfPp1VIG+yf8UQtQktHVA24DY1q7MTIw4sPQO2sp/E73G3764uB/9++J+vppYlhO0Wv3f8ETv5GI0ujg5tTca3TvlDWk0Ia9QSsdO7Nlzz+joPXv2nBjb6R+pOVw77PcP1x6uGfETyZ1ArHZlvJSwEGo4XMtb/77wrqF7n/vCAnr9kbZ/XXqItA5CayuZ9UQZosBG5gAmjrPOJsFW3vDzWKjeE66R7imPzye7NkeqBqtv3bnzwGPVA/5Sf6DB463qC0RmG2pnBpzXAGYNyCsDzNXEioKroJUowcZFk8o6BGnEPN5WXxOr8ndoRzSNo3XJhfr+qKuFbd7b27q2SbVB01ZbG2+Nt6EvB+0ST8Dr7LGEzL7BWGKwpEDiSQYbZjlbvbXLHampllQT8ahKKELC/FtGRjUMQwUKUTI0DcHzp4f4f0Sqr0xP3/Dsv9+4Cz3Jc5vQw/zDqJdoJwoyuKCnDR6UFgkn8r4a00QyOab5p9dIyu1RV/36mvrFoaaZRuV6TVNNXUM86oms2QbRbs+LJp8ufEUyub2RcOmMtdQURuIWeTm6CTgNAD0v0NNR3oyNxHGUK8MSdRy/j61UDexu8HVOeE8PXdVdXljqbPDWzoYbd/faQ0ZjyC6U0sS1wz0f3TVhrNu2twPrq4yhK1qS2+NXGkKOckdYrw/DT4jsxOpAW2Z8TtwbyhklQ6yau/mtN3ah87j/yEu7KVo4EfLA2OohPkeB05yTAS4oju5q+y55zhPyDu6p74mHmg/s2nWgORTvqd89VNPQUBOLx2OhmpoQXNLwTG3rqKxQPtAwsHEjFPJC2Whr7Ux4c9iv9IeFAjUEPGs81dVQBMh4e6Fg8dOiFpECtMeAFllY9a7wOsnl0we7UoX1PqLCPT2gWX6FGtEj3UcFJS62Y121kcT6bfHEtV9N6y+tTbKejYGO/gG4cFI1VBJ0yTLLDERzvV+iBhAYJLlDVpEbGHCBPbLRI7wTILbWYHm0m+veHHY0O8xVgemG6FiQbXEeKCvHX2guVJffzB+qdJfqFTpWpbBUaty2si/B6rahUcaouYloMBlWMcPV/h6fvT3gS4Q1R609jgUmrr8dzzlMknIToy6vtKsKlMY1S38tqZDeW2q2aUq8EdBpPHUj3YGfohqpfnFGzkiQ9WF2lV0qWTRntCyIYMLcpWeF+J6fHDy97oqHrxm6eXONe6guFM/Ll9ZU+zrd7k6fO1Kcf4VG7fD23jDavnfI6xnamyxUMUoFo3b5/a6BzecOHPy7heCG4zM9exo5lytQtbYtubbKV9nKv2DUDfZZxg+1Vo/ubfO27Rny/bPCIt8vN8o4V7uLoxBVS72BJtAuGCvKDrEbTfC/Q6Y3PgI1NurP2Ik2ZWqwc+mvOO/P29I1F1fUXFyqx/8o1JhSnViW+htSk09qZHwpeuvbpKYt9Q71B+puMhepc453bnfCn9vhKHGbKyrd7soKs5tKpUh7uhLaO6h2iqJYqh0Z4VdCteNaitT3A77XsIrUFwtwqhhdS/Zpqd0CHRlFRUUCEka0NSB5u9sRrZqyVJWYjM67gVR0t90SZwsceqAMOKugr4izKwdnJ7qXehSfJ1LJYcX56J496F4UI1xADfok1DioHsIdlN+HX0Q1o2coHuDLZ2JRDgxbJTD0KZe91jdW6S0x6B3oGYdJHtlmMzXYC+walclBejvQd6nf41eF3pfLIPb2FUNv/CprlId3MKa4jfQ2soQnoI1+LfDUR3iC8rdEYwQr+kfA6qD6CRxKgAsaO079jvrW6hq7zW2r8U5YfCUmnf1bTpMitGA3N9jzHRqFyQk4oS96Evo6qCEB51AGJ1WLJOgVgFB2CRuOqiVKJHH87d86rj0+eM/OewZvxKQVB60UYqtoNMxG1UoJd+219r/92+M34RtJO0IB2rwKbRzUCKEA5UVBGtL3LwJ8VICPAlw8oxqgXoIxzCenBGo4S4SVT469/eomZ8yZ8DgcHjC6B59CNv4XaJ3LpDQ5nVC40u8qAMc5EUeUoeE4JRfH2ZjrptY0iu8h5qmnllJOs8LsFAqCwZRqRb8ELrQUC1xkAh7gKVjeRZfhXKR868ZocLDqmoFhzuWLFW+TRqZDaRp/y03X1Y1wkuEv0JHaMrc/7PK6Oqtw9Qq2MSWDs6h/w0+LNO1MePVVTC5NZDpAyHlrihekkalEgnDgrweKbqD8u8/T0doyV1UEqHX5uan62tFAEf/YSklhDFP70Qz+o7DbBBnJPC2GbsaPOf9A8JrIgMfbH7kmMFCFYhtOHfMEr79zsGv4riMB97H7KZR6B/qbxf6I8MekQz7LmTAyVy0jCPZXo9j6+2/yigjuvA4QnBJ2lYBBARjAivIZmXjupXjiid7em+nrZ5YiZPec2k/9p9hCTvbO5CIN8B//engGPw8tFIAjAi3MBIegIQcThqidfnUhbrZMIBmHIhudoajbHQ05N/YY/Ab49tzMeX/k9W32eX7k5WZ+WxmxFRTm2yKW31IibTQhYpaLSldxSiHok5NuTrQLPyaHCpsyiDf16gliPTAImD2A2Usw/84SseVLCmxRs4A5P7UFfUqMSmoGcbsWkHnhTvog8T6oeUCsyYca9MAC/1uhCvSthuJafI7UMVB3bD3OXw+PqVS2poCap6AjFUm9Td+Mn4aWcvDCMInDFoLtg1ftH9zCuYjOLy79JNbrcvXGYr1OZ29MYSgrMyiU+rIyPS6N9jmdfVGxWgAphWrY6BzxTTQ3T/jEskfhtkQsbkX6h9/xPpWgl4+BHbyJ/yhqTMa9uW0bmAiFV8AlYoSXCbXwh25Bm/56GG0iPl2b2oDzQB915F2Qncz3q+xhxfXf6ltZcT3ICm3hKsicCcPCB50Pr48H51zN2kaHP6xwmTtiLcZwxOqOrIsH510t2ga3J0LANQCOMq6+NU6mvXBNoVLDhtoLZYVKdXGox2Wy92v1dqvCqCxUrvHXmHwd6jJVmy/cxUKNxgArWaOiUFleXWP2dqpK1W3/qrTqixU4n1b49CZfuQIX0EqvYD8LmBiFjJzyZwaTHDiRz1s1a6PRtTVoe8vcxtvR12o31MJ33dIa/PrSGtBgEFZ8v0vv8Oo/zB4v+j5vaG+e+/zk5OfnxLL/QDJ5oL//YDJ5cGz6yiunW4bkEyW2SpvTabM4y8YVQ9KJe3buOjExcWLXznsmGpNXd7d0X51M/0zuXbtuT12VR1fptfXYvBadx9tI5VEW5EYPp7mtompg9D+YX9gMpFf3aoZlsxu2F2PTkch0TCzdCZcr4Xa3Op2t5TVzDrtS5osz+srSsrLSSuSOzNbVzUbE0mdv8Zg8Lfb0z4GW77JGbWVhT4unpERaUgJ2p0OfxxHhtEJDrDMM5JUMsV/Yz5NIFoXNLaN+sKfrVx33NQ3V5df2Nhbk9Q/kSdDnL8RiF5Bp717+d1dO33bbtLAvQF3oJvwYVSnsC2ANuzLz4LLEgxV5B2F0U1ivlNN0ScwdahjsqTczFndpSNZV2zYwU2uxmbQmN7q9bU1ppdkWC0YjgFqn9JmdrS1fG1erpCqFUUfoO4H+EaBfQmmJtpf3Srl7pB8MTk8PDsxMDxFfsTmh1/z4+Dy5kn5XvcsvFARfFI2jLwkjaF599LKDB2P3EjdUVTXEiaWeBWfU651KpRONVw+HQ8PV1cOh8HD1mM5rMHi1Wq9B7xNOVN1ojvqZGDPljJz74mL9IppD46kUqUH3QY2D2k1WIVCK6z8L0uES/BIlJ1Ffoob1j0QtYckpBAvLnOivdhXiE9Zvoj1Tc3huai/6lvUejF+6HzfPB+iPN9x+R/zjdGC+GRP5tFDsAwp6Ip8FxpqJggEIFycRLiUjXDQA0VTlFytHzduvNWw7aB6t/JKZ3Bu3H6x86oumL545c2bo5NCZ9A8qPEkhsAY99qZPwiTkjEnOYe+mzxbcveH5HagngDT8xQDaQSSKUj/HFnQT4cdO0lVWmIlalXXYE/aYVR82q60qn7yh2l5jyT78XLGmTFFW3qGzymWlirKyDi0DWBNUI1ZiO1UCWAXLFt9cofldDz0E38Z/2PzYY5uFdjxWoo3ZHYeS96Pv8ZspDDUUYNgPGMpzccihXQbPQ6T5Aw9e+cADV/InrgR8w1QvzsdSgS5LRiVKxkiN/u4zn+nIfHvvuqvzzjs7hC9F0UCJwQrcCHcyyizykbuYyn3CCr4KffeisJay2z3pX34z//d2nVpnFwp04/K9IMsnQcofiPMQAvyyZVnhQts38+cI93Opv6B38CBplY/CSJmvzEfv8DvQLfybqCwfoVFEXf81yddyW6rDdvgg5Rwqg2a35H8UWlyfokag1VrqlxSPrid7s2iODPe7WNYF1y9hb2ZxuSxkbwbtW6gT6Ap09vL23+traemD60QSzpeSQkHax6g+YfTyhRESZNrKfwL9su9BMoJSKojn8E0UQwVE24LxENyYjIpoYDA2gkMTJ7rsLXbM2apb27F+Dfyt71ira3Wyrbp17eJz+zpdKxuoqQkEa2p2VqxZl1yvT7BsQr8+uW5NxaXP62pj8BEK4nme1CfRH8GydJSVrKMyGR+cUnyny8oigs1LWJjFZRBfUP/czMZN03MN/crZErve5CqbVo00fsPhsLN7tsqO79jx8TVbtxQ1V3E6eyH/cKFTH65uKfyNr6kUdUmbfZm3UIP46UzWTyiy8gWyJJ2To8rsHtC6KfIObqppol65XtkSrB0se/Wdd14tHaoNdmjWK+JrpaMnLtwzwtTZEp6qjobhnuHGJFeVZOLCHhMGUjiLdwsnpEKYZMF3Vlm8qIFo+qzSgi28g3VifGWisKx+R9fALsd6faM7XFcief6rCAX0aOxQRYunSFG0RRs2xWdDDbWtdltNVOtRbiksLwq3rSkknuRI3Y9dtBRm3FqqVdQtK54kqlVquBc1LeoaIBKAsHAnMkGiTpTwS6BsGACERxWam2MtgQ7toCLCyBTtvmpPOGYPzUXdNdYhhVNjbvf7vTU1tuoiWZlRD3kx5kGHApabFUOTdEl50NSldpYU0M/LtLqeQGRMJ8ufmixQGD3tWk1Z/rk1Wm1XKLrWWCGZoyVlPp3CViaVXH+yoELHaKzFxeK7bbwRnyO/dkYpRiG40kfnwshh18kbTp48uf+B22+nb/3k6f0nTx47dgwGBTWS13z848M9FBbwBCAfpoKqvCQbyyIsvlCOu6Wzs1DLkScQTifIZBK1lt5FX+OnVybdwBpfzDuk7ZQDeKaoAurFny9DK7LQl5eh+EIWevHnq2F4aQW0OQt9dQWGi1nohZ/D6BMoXYNVlBSk7SX6KlhObYxy2elaTaw8fcbMlOHVUyPBOON4OTMOzQ5Vh1ws7Mmug8w3i4XTX1fVpIJcuCQ3FCspKPL3xPrHoxsTk/6gnyRMbuhz1rpKC0qDba7BzQH+q61/QJbKNWYG0iPvIulxkCb3G5eh1xsyB/S6QOVEItppr/QEHAbIpVQ5NVpWJabVtYpZhz4h6zAMD6utZmEJIK6qLt06sOl4hzSXJCNq5tuL8krUJSY4hLEEoqXe4kqVXKv3q8tm5w9hVU6SYksb7aNputJWyVYYyzmprLRMqsnHifJP7Tp0K4lmMBYG/AbFCPypJdkjy6zDAxNi6GU50Ct9+abty74uf5sjvrOzb3c9tzYe6VQWSBs8Y/4+Ww/7ZJm+1MmQs1/GRkr8RqS6avHG3rkjDc37B7p3x8M+OrjWFYlWGTnYnZQs3W2qdcHHlP5JpcSsR8GyCkTbfIPKQiuy0JeXofhCFnoRoJdjeOmNdJ4X9TwupmgxsweyeeABWgMcKYXWdwhrtxdTaymAp74L8BagmIG/kob/DOC1QDMDfyENTxH8K/C8ROAUEnLbCN1CAIY5MbetYOBIov3ZTWISm8gDLhQ8ZI3oIX/NyCEVMMpETbyyDK3IQl9ehgJXGejFV1bD8NIrxPMUqe9iFteQEyJiBWrR7nKnWNE00wfWsGIFqDxzGs9FocNUMqFUQ9YY22poSLaq4LYbbm8M1SOM8NauMoeKE263wG1VaMQ6FoZ0Mrm8E27HuZEDCXlFfbKhplguLzwyJS1D69visSIFPEyWli7LczHL+QXCOYHSm8G3SikN1URRuUmV9uWgARuAy8/gV8mdRdp0uhti0oFiv78zKC1QTDWKOXF1U5oCxXRz95Yo/9XmZkioba3cPr2cDffTdHTgz6odWraq9VrImWt2e10+MPZsmi2ZF0Ca4/h1qlY4MWBWSRGLpuWQMWK0zzALsMz5AD6+ZTQ+Y+zWhM0Wh8luhgOgwfba+vraI729Dds7O7fVhRmP0mox1zV+fWi9w9ll0Fkq9eaSomLIaIr3l9BN9fVNS6/CzJCf3BgJb0yOlWiVBm1xsax1OavvfDarT/a/yeqj7+X//b3T+lIpMetMsEy1aNv/SWWhFVnoy8tQfCELvQjQyzG8RKAkuysN1Yt4f5mBAoYs9CKBitlZ9HMANQpQ3roMPZOBImoF9Hi27ZJ1NQypFdDzWQxoVQx/tRKtwx9NTtvKhdy9MOzrkEWZ+SCG5tCDPxq9AU1hK/9txPC/RJ18SPGJE6dPi7lN+3Ab/0txzegTMrai8PChp5ucbAu0IZu+dXBCnG9ckEgWiEm9RZVqcb7p3V2fzfbCg5nErp5xvOqcUzx2x9ZMEhiRtRiK64R8ElN6VbN6/hdZ3o719KSmybp2+uDB6k6W7aw+eO21KDyHrLmpYPfNgW6zmAuoRyh4FrPDhHGxiCMrXYaeyUARtQJ6PNt2SboahhSBivlXAtQu4v0GgeoB+nEBr13EK0AZgH5UwGsX8X5jNQwpAhXzmYS2btE26gAq5isJbT0itdgy9EwGiqgV0OPZtkux1TDAVETRAP0nyCh6LRP/88lea9U5gE57uhjxM0sBcTZA875+S3Sw0eaAFCNyO9TIOEieVK+rWILvWC8PGOAosqgQ37FOXi1VygfDM77rhiHhSKHI3uJ5/0TDLl1A8Ydbykr54qrxhl36angoLVtFor/G0jlc9LfAzjVCjp4lN8RnPScfbF+WXXjR3+IjmsbK2eM9PcdnK5sM6Cn+jOBLXUtPGGt0uhrj0ORkQQFkQl315aGCAuJXUpgb/k1SsHFy2+TG5YwuMRNKzAt+j5yuo2cuzen6SHRDU9MVURR/vgIyoLRWeSolZhUJ4xIQR9ZLZaFnMlBErYAez7ZdAujlGFIEKmbsCNCwiFdGUUiI7IW4mNKS8+6c1F7YoaSDuxrWQy6fvsoESc5l9UGTszhfA7nZ/BMRSErXkyxfyPvVKq4hY2BGCTT2wWd35/p7evr7e3v7LRqNpVKrRYn56an5+anp+S4X28m6hILwV446UauYpYMsMPmls3RQK//ahoK22qkbxlBn8vwo5Ez+EFrroHUjUAfa6JIsnUygk0hQI39+L2MyyQ2Ggr7SznhLR7OnHd3S2T9psGmwCg7Ajc5YY7C6VS/kCRWDRDHA6bkkPyeSm8DBWHOTcxZtJoNOq3avialbuESvz2zzj7Q1tCoSUtZsMDEmG3Yry/JkGrUyZLREfIwnL6/Aaw/WeYycyqxT0go5aLMC5ElmMnIQ2TNGhYMrFvSAlGP3fXZrIDBWsA51tnf/+j8SiWPHgF8D8NsOfSqhBzn3I3yuwiARIYqqzxTmSW0OrmOgu7a1ornUbjKaTHqVWdJVjs/17DQwjdGaHoElszZPra+QFH+PjDKh0QU0FJQ1M8ri22t1ZNXhfqSz39PMHOqaKMkvZh2BlsGk0WDS6c0mlBhMcOOtyuBwECuZeLimK6HXFWr1em2hTk+0rwQNBMQsG3kmy+aR9R/d14sMUONO3NxDopZZ4OcxMWqJHK2eZpPLljqXyWS/mzHY21sS7XYD4+5v1+t0eq3BoDXo9QadAWRuqLL6ivKKXWZPLOYxu4rzinzWqobfqOSFsOJRFMpVX1QriuVqtbxYoaawYI0dwBVoKfPmkuSoEK9KMybJYQB1eJqthwUlOdhAy1BbR/9doCO9wWTG3uBEQiVoydYUqu0cnNNrinR6va5Ioydel/ozGkNXiV6n/tBeV7Ca04HPAbetaLeYGbeqz63wOGjbCJSBrv2/53GdxOHs6lyHI/4GssQAI/hb9L/jb6xJ+97+ZjE5fqsuz5MpV3U3JRyPKinibyANpEamM+De099Wehtw2w49iLd9gLNx7+dtf0T29/Y2oNEFNAQ7Uv8vvK3g/ZwNkVUoCgAd8DXuUl/LeprAy1XZ/eGH9LTo+3ta2sN0aY8rWN3RWpa964vLPkc0RKywA10lasj+v/K037+Po6VSxDfohPA251+FnKN5tCDs6H+K86hMfWiV+p+jV6n0LEyz+DGo//d0/dp0vZgV810Q5/P4aSHew0k2K1HDri/KSiQsOnOhPeGk87bm57GtSfz0hWSrD43y3ehvRpGvNUn6pt6GvudI33w2qlZHWZjGJepoVI3O/CHZyublb82jnYl2qdgV/Q3fLXaFvot4Bp3HF4WZ873f3VyltleomAqZbk2VLOLQ2CpUNpnwEMYzZYXFpaWl9Vpb9obgvRMvosfxd4X3YmBOdyI3XpydJWN2LZ5Fv4B9Vymlv/S/ArmcpyfZykoWrlPpXzxr1Si1FotWqbEu3/0/YETUy7gNfZu2E+4RmS6/fbh3HX79lP1RqDsBddvSdaBtZD68bR1uOxUmdYs4ic7DXrWArBlgGCXsm4uHm66+uomuuDu4d2+Q+lBtMNDggH6z+J966P3/U8/raLLbmxzOuN0edxKLhQtzTAPLNjBi2arXmrR6oQD6rwD9g7SZkgHmy/LPkA/OEfS9Gn2hVmHBSZO+1DOgUXkMtEVRojdB7+9gFerG50XNMFHUHR8pxOf/9V+JZE+lfOjblB4+VP4lu0puxY4T1VTHpJ7i9P5RGZfRUnWJEc4xv79io7hpJLN7JOdoHXiGOgtWKqEu8D+gCGQBL1K34+8C5D/SkAE8Sz2ILwDkYhryGG6jjtN2cn6XhuwDSJMAeYlAKJS6FddRu2k1mfPozLt7GPHtNwRZk0af8ONzs06DPm6yVK6D1mdTcaoj9SxYGqXMsSyHFQS2WJ6walRgSqSg6FQf7qNO0w9m3grKAS/9PtZ506H2dZ8kluk0m+9PWyh9+JT1Uf6LuRYq3lGXU6DBHiXvQ6Hk0MZ137iEAv7+qeCj31iNQBb/fBY/eHL+++C/HblT1KUSSGZnv7MqeuILNAW+cPx/HH1oCoKOVFpap7Vlb4QYQyP0C8D7344INCK8Wa1pLuEuGxEugkc+lxMR6FtPOYSIAHXboC4nIlw8FREjwgsg4ZlVvP3M3dziIid6+48B9/n/jrezjXZ7I5vx9h8Lfm61kpJJGNVmjcGgMauNgn3/Guz70fe0b3rtrEtP7Nu8XhjvN6nTeSP/G4vNs5xiRIvVWi4pqGUK/xuLpfef4sBiVyGQxS/5X1nsqZmZ77wH/7BK9dO/ojHckdx+qoiWiy9IGevyukxYDOXuMehf8SpehV50RvrX9oXaPcU9hQHW4atr9pj1erMZNhkaUo1eXLqvq2igs33MXmcxMVUue0l1gP7Id8yqMrXRCBlbZuq/ACjNHBAAAQAAAAMzdUSncZFfDzz1AAoD6AAAAADWFFDSAAAAAOOmxWr+2/72BRkEdQAAAAYAAgAAAAAAAHjaY2BkYGBh/PeWgYE14N/tf7dZJZlfMKAARj4ApwoHEQAAAHjajdIDrF5BEAXgM7u1nm3btlXbtm3bdlArTo2oVlA7rB3U/ntyn/1u8mXmrncz8gjuKgw+qjtCqKUS+Bl5KPykL+yUB5xVALVGS7FCmliZfqlI5r5oqadzfGuKAucwcp6sYN9nuMhUOLAvWzVDMx3FddxhxbyxfONeu2GjtqGjWohodYSxO2XQNf7fREc5hBju66gOsq0xOuoIxptF/QuK4nbGQdw3m+OOoI2aC3N9gvk6WKrpaKK6wZfr+heJJHtypziKoCQKoWB1HfF6EVJlIxJ5Zm/dDN58E1cJQo4eghxJQzvmPoxhUg8F8pC8kUG+qj4yyFf8eK9GHJNgiOL5fShKYtDS8IrrfYSFdGBbB9NXKUBHipFRsKYYOYH65INNJjuQPodYmY6lQiqV59oJH22FSLkHDzUJjnIUwXwnf7mPOJ4pkGcKVMHsW893550ojrLK6FQmH6RI+qCv7Ecm83g1Ds2UC4LURL5tS67VnXebAzs1jlgfVdH9GVkvqg3nsV7KYq20JDLdpidkol8l9VJWEqwVo17L/AD3Yy0ZtVMWa8fA2qmKPgkY9XQSTQysqTKMmiIn8qKY4nqqin5WVGesq7KMuuqAljIZbtIbZtILjtIDTaQnLGUgnGUI5cNGhrN/CPvqOE73g5nOpyQ00aNxWxPPPJm20ewiH2gPsZ2Y00c6Q5cBUz6NovZ0jqbQJjpNbYsZcyuuxwiOLTsOHwCCfGGcSmU+/QZN/gOXBr2BAHjaVcFToKxAAADQNrdNtiY827Zt27Zt27Zt27Zt2+b3PQdBEAWpioxGDiKvY1GsRqxT7ClaBe2OTkN3oVfQZxjE8mNtsSXYbewbng2vgnfHx+Ab8TP4awIjfKIeMZpYTxwjbpEKmYosQDYk+5JjyXXkSfIvlYRqSI2lLlKPaZqGdFG6Id2dHkcfom8yFFOaacEsYB4xX+KF48Pib9nqbBO2I9uPHc0uZjez+9m77Ev2G8BABAqAMqAG6AYGgalgOdgM9oOHHMbl4bpz07kd3EnuFk/zWfiCfHm+Dt+EP8vf5N8IDYX+wjUxhVheHC9uF1+K3yRMSi5Vk1pL06RV0nbpkvRGhnJGuZhcU+4oj5RnyE8UqFRWJiq/VF8tp9ZUm6jt1V7qUHWC+kcrrc3RlmubtL3aCe2K9kB7o/3QCd3QIz2Nnl0vpJfV5+urDMqoYYw3ZhlLjQ3GbuOYcdG4Yzw3Phl/TcZUzezmSHObuc88aV4x75uvzK9WzAKWYUVWGiu7Vcgqay2wVlvPbMG27SR2ejuXXdRua0+119jXHM1J5zRwpjornM9uCre829Qd555xn3qmV9qr663w7npvvb+Qh6lhSdgVDoKr4RX4CH7wMV/zC/kN/fb+HH+pv87f7h/wT/oP/O9BiqBGMCLYEtwNXgc/QxDmDCuEA8ON4cOEo8T/AQd5ogN42mNgZGBg5GPIYmBnSGNgBfKQATMDIwAVqADyeNqNjzNihkEURU9sNGET27Zts4r921hO6iwhC0uVW7yYH+ae+zQzQC4PJJGQnAEcJnQbJ9CckG6cqJon4ySGeTROfleTQin3xqnUEzfOpZt5sTihjmyGjVvJp9m4nUwqjTtVU2jcJc407hbBJi4cHONkAb/0jmtOWVXUq7g8e4qcKXfFFuc45CaVveNMmXO5S2WUxa/XzSBten2c4lXOjV/cik98J9VULpVfY5ZlFphkhXVlzgmzhU6Bj5Yv++zKe9EMeSfldNFKJ+10vKMhmyb959RN+UsC4mO81lWO9Ymsk/IvnVNSNxG82O0pt1MMiGwSqsKLm1bxBHd6y991+JDjXHouDXLOGa3Pf4ZOagB42mzBA2wYQAAAwPuu1mzbtpHZXmfbtjLbWzDbtm0zNmY1VhuzdyKAtEtSZCAko3mI0EJLrbTWRtuQSTvtddBRJ5110VU33fXQUy8peuujr376K6GkUkoro6xyyqugokoqq6KqaqqroaZaaqujrnrqa6Ch7HLIKZfc8sgrn/wKiFNcFudd0ExWJxSUWSHxolx2xUWXPPTIbXccc9wBkfYrJkGiRpoYYJBsGrsZIsUa6KvlVlpjtbV22W1JiArRkkRrarBkf2zx11VFFFbUAyscdMvSEGOZGNvdNdpY44wxwXh7TfTdJFNMNdkX08ww0/QQa5bZ5ppnjn3mO2eV3xZYZLGFfrrumSeGOGWo0zYaFuJ8M9xTz73w0iuvvTHCW++M9MEmZ5z1y0efjPLZDztCvH/+Sw0J6QTBwwEDAQBFwf9i27ZtHFNf0l68TSzOO0OMOAmSpEiTIUuOPAWKlChTkSVbDlVqeuujB3XdddOLhv40acmgTYcuPfoMGDJizIQpM+YsWLJizYYtO3nZc+DIiTMXrkG3KrrAbSAGogBaZu49IsOiMOh7eFHhxFD19oHxD4me2QO6o2eO8ceWFI9+MRaCxySTAsq7kTfL/YQJmT4MS7PULuylDEYwhglMYQbzYMYghwJKGMEYJjCFGcxJnnMoP6pxbWo7tiG1r3JsSj9vZvU/cqU0+n04ICWTMIIZ5JDBPCjk++EfXXpXH2et0X/1MYa5Ls1y8eLGs6rulNqeztHshe6GIV2k4ecpZJo/m/GipdEbYqDJz0UAl0unx34vQ6E1SoH10AImYI71Ieb9vWqkFKnUcAu5ZRTlAAA=) format("woff")}.rt{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:17px;font-weight:600}.rs{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:14px;font-weight:400}.t1{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:17px;font-weight:600}.t2{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:14px;font-weight:400}.pl{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:12px;font-weight:600}.lg{font-family:"OAC Plex",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif;font-size:13.5px;font-weight:400}</style><defs><marker id="arrow" viewBox="0 0 10 10" refX="8.6" refY="5" markerWidth="7" markerHeight="7" markerUnits="userSpaceOnUse" orient="auto-start-reverse"><path d="M1,1.5 L9,5 L1,8.5 Z" class="arrow"/></marker></defs><rect width="1560" height="1270" rx="18" class="canvas"/><rect x="80" y="28" width="440" height="66" rx="7" class="card"/><text x="96" y="58" class="t1">Applications / official SDK</text><text x="96" y="79" class="t2">Submit work · stream results</text><path d="M300,94 V194" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g class="pill"><rect x="247.0" y="134" width="106.1" height="22" rx="11"/><text x="300" y="149.3" text-anchor="middle" class="pl">Agents API /v1</text></g><rect x="560" y="28" width="440" height="66" rx="7" class="card"/><text x="576" y="58" class="t1">Web console / operators</text><text x="576" y="79" class="t2">Configure the platform · view status</text><path d="M780,94 V194" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g class="pill"><rect x="718.7" y="134" width="122.7" height="22" rx="11"/><text x="780" y="149.3" text-anchor="middle" class="pl">Core API /core/v1</text></g><rect x="1040" y="28" width="440" height="66" rx="7" class="card"/><text x="1056" y="58" class="t1">Nodes / Runtime connections</text><text x="1056" y="79" class="t2">Machine identity · register and connect</text><path d="M1260,94 V194" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g class="pill"><rect x="1191.8" y="134" width="136.5" height="22" rx="11"/><text x="1260" y="149.3" text-anchor="middle" class="pl">Machine API /api/v1</text></g><rect x="80" y="194" width="1400" height="260" rx="10" class="region control"/><g><path class="band" d="M80,234 V204 Q80,194 90,194 H1470 Q1480,194 1480,204 V234 Z"/><path d="M80,234 H1480" class="sep"/><text x="96" y="221" class="rt">Control server · OpenAgentCore</text><text x="1464" y="221" class="rs" text-anchor="end">Web, Core and the database can share one host or run separately</text></g><rect x="104" y="254" width="952" height="76" rx="7" class="card"/><text x="120" y="289" class="t1">Core · scheduling and state</text><text x="120" y="310" class="t2">Accepts work, selects where it runs, controls lifecycles and records results</text><rect x="1104" y="254" width="352" height="76" rx="7" class="card"/><text x="1120" y="289" class="t1">PostgreSQL</text><text x="1120" y="310" class="t2">Sessions · Turns · configuration</text><path d="M1056,292 H1104" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><rect x="104" y="362" width="420" height="64" rx="7" class="card"/><text x="120" y="391" class="t1">Sandbox Provider adapter</text><text x="120" y="412" class="t2">Create / suspend / resume compute</text><rect x="548" y="362" width="432" height="64" rx="7" class="card"/><text x="564" y="391" class="t1">Runtime connections</text><text x="564" y="412" class="t2">Dispatch work / receive events</text><rect x="1004" y="362" width="452" height="64" rx="7" class="card"/><text x="1020" y="391" class="t1">Workspace FS adapter</text><text x="1020" y="412" class="t2">Manages file storage and mount bindings on its own</text><path d="M400,454 V618" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><path d="M950,454 V618" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><path d="M1330,454 V618" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g class="pill"><rect x="285.4" y="478" width="229.2" height="22" rx="11"/><text x="400" y="493.3" text-anchor="middle" class="pl">Sandbox Provider · compute lifecycle</text></g><g class="pill"><rect x="319.2" y="517" width="161.5" height="22" rx="11"/><text x="400" y="532.3" text-anchor="middle" class="pl">Node · host management</text></g><g class="pill"><rect x="314.5" y="556" width="171.0" height="22" rx="11"/><text x="400" y="571.3" text-anchor="middle" class="pl">Runtime · work and events</text></g><g class="pill"><rect x="889.5" y="497" width="121.0" height="22" rx="11"/><text x="950" y="512.3" text-anchor="middle" class="pl">Sandbox Provider</text></g><g class="pill"><rect x="915.4" y="546" width="69.2" height="22" rx="11"/><text x="950" y="561.3" text-anchor="middle" class="pl">Runtime</text></g><g class="pill"><rect x="1295.4" y="523" width="69.2" height="22" rx="11"/><text x="1330" y="538.3" text-anchor="middle" class="pl">Runtime</text></g><rect x="80" y="618" width="640" height="302" rx="10" class="region compute"/><g><path class="band" d="M80,658 V628 Q80,618 90,618 H710 Q720,618 720,628 V658 Z"/><path d="M80,658 H720" class="sep"/><text x="96" y="645" class="rt">Compute servers × N · microsandbox</text></g><rect x="104" y="672" width="592" height="52" rx="7" class="card"/><text x="120" y="695" class="t1">sandbox node · host manager</text><text x="120" y="716" class="t2">Manages compute from outside the sandboxes</text><rect x="104" y="758" width="592" height="138" rx="10" class="region sandbox"/><g><path class="band" d="M104,798 V768 Q104,758 114,758 H686 Q696,758 696,768 V798 Z"/><path d="M104,798 H696" class="sep"/><text x="120" y="785" class="rt">microsandbox VM × N</text><text x="680" y="785" class="rs" text-anchor="end">Isolation boundary</text></g><rect x="128" y="810" width="544" height="62" rx="7" class="card"/><text x="144" y="838" class="t1">Runtime + Harness + tools</text><text x="144" y="859" class="t2">Agent loop runs in the sandbox · workspace on independent FS</text><rect x="780" y="618" width="340" height="302" rx="10" class="region managed"/><g><path class="band" d="M780,658 V628 Q780,618 790,618 H1110 Q1120,618 1120,628 V658 Z"/><path d="M780,658 H1120" class="sep"/><text x="796" y="645" class="rt">E2B managed platform</text></g><rect x="800" y="672" width="300" height="224" rx="10" class="region sandbox"/><g><path class="band" d="M800,712 V682 Q800,672 810,672 H1090 Q1100,672 1100,682 V712 Z"/><path d="M800,712 H1100" class="sep"/><text x="816" y="699" class="rt">E2B Sandbox</text></g><rect x="820" y="734" width="260" height="62" rx="7" class="card"/><text x="836" y="762" class="t1">Runtime + Harness</text><text x="836" y="783" class="t2">Agent and tools in the sandbox</text><text x="950" y="841" class="t2" text-anchor="middle">Provider-owned filesystem</text><rect x="1180" y="618" width="300" height="302" rx="10" class="region user"/><g><path class="band" d="M1180,658 V628 Q1180,618 1190,618 H1470 Q1480,618 1480,628 V658 Z"/><path d="M1180,658 H1480" class="sep"/><text x="1196" y="645" class="rt">Your machine · self_hosted</text></g><rect x="1200" y="734" width="260" height="62" rx="7" class="card"/><text x="1216" y="762" class="t1">Runtime + Harness</text><text x="1216" y="783" class="t2">You install and maintain it</text><text x="1330" y="841" class="t2" text-anchor="middle">Local files and tools</text><text x="1330" y="868" class="t2" text-anchor="middle">Core does not create or reclaim it</text><path d="M240,920 V1060" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><text x="258" y="976" class="t2">NFS · file reads, writes and mount</text><path d="M550,920 V1010 H1330 V920" class="line"/><path d="M950,920 V1060" class="line" marker-start="url(#arrow)" marker-end="url(#arrow)"/><circle cx="950" cy="1010" r="3.5" class="dot"/><g class="pill"><rect x="987.4" y="999" width="105.2" height="22" rx="11"/><text x="1040" y="1014.3" text-anchor="middle" class="pl">Model protocol</text></g><text x="1190" y="998" class="t2">HTTP MCP</text><rect x="80" y="1060" width="640" height="156" rx="10" class="region storage"/><g><path class="band" d="M80,1100 V1070 Q80,1060 90,1060 H710 Q720,1060 720,1070 V1100 Z"/><path d="M80,1100 H720" class="sep"/><text x="96" y="1087" class="rt">Independent storage server</text><text x="704" y="1087" class="rs" text-anchor="end">Deployed apart from compute servers</text></g><rect x="104" y="1114" width="352" height="76" rx="7" class="card"/><text x="120" y="1149" class="t1">Persistent workspaces · NFS</text><text x="120" y="1170" class="t2">Files remain after compute is released</text><rect x="472" y="1114" width="224" height="76" rx="7" class="card"/><text x="488" y="1149" class="t1">Memory snapshots</text><text x="488" y="1170" class="t2">Separate retention period</text><rect x="780" y="1060" width="700" height="156" rx="10" class="region external"/><g><path class="band" d="M780,1100 V1070 Q780,1060 790,1060 H1470 Q1480,1060 1480,1070 V1100 Z"/><path d="M780,1100 H1480" class="sep"/><text x="796" y="1087" class="rt">External services</text><text x="1464" y="1087" class="rs" text-anchor="end">Reached directly from execution environments</text></g><rect x="804" y="1114" width="312" height="76" rx="7" class="card"/><text x="820" y="1149" class="t1">Model providers</text><text x="820" y="1170" class="t2">Native model APIs</text><rect x="1140" y="1114" width="316" height="76" rx="7" class="card"/><text x="1156" y="1149" class="t1">Remote MCP servers</text><text x="1156" y="1170" class="t2">HTTP MCP</text><path d="M80,410 H40 V1148 H80" class="line dash" marker-start="url(#arrow)" marker-end="url(#arrow)"/><g transform="translate(40 785) rotate(-90)"><g class="pill"><rect x="-157.2" y="-11" width="314.4" height="22" rx="11"/><text x="0" y="4.3" text-anchor="middle" class="pl">Workspace filesystem · storage lifecycle and binding</text></g></g><text x="80" y="1250" class="lg">Solid: communication or mount</text><text x="296.688" y="1250" class="lg">Dashed: independent storage management</text><text x="585.372" y="1250" class="lg">Outer frame: deployment location</text><text x="817.154" y="1250" class="lg">Inner frame: sandbox isolation boundary</text></svg>
diff --git a/docs/assets/console-add-node-en.webp b/docs/assets/console-add-node-en.webp
new file mode 100644
index 000000000..1375e9c80
Binary files /dev/null and b/docs/assets/console-add-node-en.webp differ
diff --git a/docs/assets/console-add-node-zh.webp b/docs/assets/console-add-node-zh.webp
new file mode 100644
index 000000000..9708c3958
Binary files /dev/null and b/docs/assets/console-add-node-zh.webp differ
diff --git a/docs/assets/console-agent-metrics-en.webp b/docs/assets/console-agent-metrics-en.webp
index dc9a4b553..a99df2b76 100644
Binary files a/docs/assets/console-agent-metrics-en.webp and b/docs/assets/console-agent-metrics-en.webp differ
diff --git a/docs/assets/console-agent-metrics-zh.webp b/docs/assets/console-agent-metrics-zh.webp
index f5a91b096..0a4e4b07c 100644
Binary files a/docs/assets/console-agent-metrics-zh.webp and b/docs/assets/console-agent-metrics-zh.webp differ
diff --git a/docs/assets/console-connect-host-en.webp b/docs/assets/console-connect-host-en.webp
new file mode 100644
index 000000000..77beb1a54
Binary files /dev/null and b/docs/assets/console-connect-host-en.webp differ
diff --git a/docs/assets/console-connect-host-zh.webp b/docs/assets/console-connect-host-zh.webp
new file mode 100644
index 000000000..f8cd0d97c
Binary files /dev/null and b/docs/assets/console-connect-host-zh.webp differ
diff --git a/docs/assets/console-default-model-en.webp b/docs/assets/console-default-model-en.webp
new file mode 100644
index 000000000..476bbda48
Binary files /dev/null and b/docs/assets/console-default-model-en.webp differ
diff --git a/docs/assets/console-default-model-zh.webp b/docs/assets/console-default-model-zh.webp
new file mode 100644
index 000000000..546b73cd3
Binary files /dev/null and b/docs/assets/console-default-model-zh.webp differ
diff --git a/docs/assets/console-getting-started-en.webp b/docs/assets/console-getting-started-en.webp
new file mode 100644
index 000000000..51a59f1ff
Binary files /dev/null and b/docs/assets/console-getting-started-en.webp differ
diff --git a/docs/assets/console-getting-started-zh.webp b/docs/assets/console-getting-started-zh.webp
new file mode 100644
index 000000000..aa89608c5
Binary files /dev/null and b/docs/assets/console-getting-started-zh.webp differ
diff --git a/docs/assets/console-issue-key-en.webp b/docs/assets/console-issue-key-en.webp
new file mode 100644
index 000000000..76982d028
Binary files /dev/null and b/docs/assets/console-issue-key-en.webp differ
diff --git a/docs/assets/console-issue-key-zh.webp b/docs/assets/console-issue-key-zh.webp
new file mode 100644
index 000000000..3bb4115f8
Binary files /dev/null and b/docs/assets/console-issue-key-zh.webp differ
diff --git a/docs/assets/console-node-ready-en.webp b/docs/assets/console-node-ready-en.webp
new file mode 100644
index 000000000..0b58ee50b
Binary files /dev/null and b/docs/assets/console-node-ready-en.webp differ
diff --git a/docs/assets/console-node-ready-zh.webp b/docs/assets/console-node-ready-zh.webp
new file mode 100644
index 000000000..a0dd81b90
Binary files /dev/null and b/docs/assets/console-node-ready-zh.webp differ
diff --git a/docs/assets/console-overview-en.webp b/docs/assets/console-overview-en.webp
index b12e17ca6..fed591883 100644
Binary files a/docs/assets/console-overview-en.webp and b/docs/assets/console-overview-en.webp differ
diff --git a/docs/assets/console-overview-zh.webp b/docs/assets/console-overview-zh.webp
index 1977d8dc0..7605cdef5 100644
Binary files a/docs/assets/console-overview-zh.webp and b/docs/assets/console-overview-zh.webp differ
diff --git a/docs/assets/console-request-log-en.webp b/docs/assets/console-request-log-en.webp
new file mode 100644
index 000000000..8407a9310
Binary files /dev/null and b/docs/assets/console-request-log-en.webp differ
diff --git a/docs/assets/console-request-log-zh.webp b/docs/assets/console-request-log-zh.webp
new file mode 100644
index 000000000..d2cbb4aac
Binary files /dev/null and b/docs/assets/console-request-log-zh.webp differ
diff --git a/docs/assets/console-session-log-en.webp b/docs/assets/console-session-log-en.webp
new file mode 100644
index 000000000..d48165c20
Binary files /dev/null and b/docs/assets/console-session-log-en.webp differ
diff --git a/docs/assets/console-session-log-zh.webp b/docs/assets/console-session-log-zh.webp
new file mode 100644
index 000000000..ae7c53972
Binary files /dev/null and b/docs/assets/console-session-log-zh.webp differ
diff --git a/docs/assets/og-image.png b/docs/assets/og-image.png
new file mode 100644
index 000000000..b524ca942
Binary files /dev/null and b/docs/assets/og-image.png differ
diff --git a/docs/assets/openagentcore-banner.jpeg b/docs/assets/openagentcore-banner.jpeg
deleted file mode 100644
index f255e7009..000000000
Binary files a/docs/assets/openagentcore-banner.jpeg and /dev/null differ
diff --git a/docs/assets/openagentcore-wordmark-dark.svg b/docs/assets/openagentcore-wordmark-dark.svg
new file mode 100644
index 000000000..e1883c2b8
--- /dev/null
+++ b/docs/assets/openagentcore-wordmark-dark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 891.6 108.8" width="892" height="109" role="img" aria-label="OpenAgentCore"><path fill="#4ade80" fill-rule="evenodd" transform="translate(-26.39 -28.00) scale(0.12986)" d="M 588.500 247.500 C 482.038 258.932, 384.992 313.332, 317.342 399.500 C 241.675 495.881, 215.170 625.903, 247.575 741.747 C 285.409 876.998, 396.299 984.807, 527.500 1013.894 C 573.849 1024.169, 627.260 1025.623, 677 1017.964 C 780.514 1002.024, 876.331 944.643, 948.289 855.500 C 967.400 831.824, 987.086 801.273, 985.647 797.522 C 984.937 795.673, 904.376 744.245, 903.572 745.128 C 903.385 745.332, 901.319 749.325, 898.980 754 C 892.404 767.143, 880.011 786.376, 870.305 798.499 C 861.349 809.685, 841.417 831, 839.911 831 C 839.456 831, 838.926 782.513, 838.732 723.250 C 838.422 628.124, 838.183 614.283, 836.696 605.117 C 816.784 482.366, 703.587 402.140, 584.478 426.362 C 501.463 443.243, 431.784 511.254, 414 592.759 C 391.575 695.536, 444.831 796.779, 540 832.292 C 593.282 852.175, 661.017 845.557, 715.796 815.117 C 727.188 808.787, 741.006 799.755, 743.477 797.025 C 744.485 795.911, 745.690 795, 746.155 795 C 746.620 795, 747 817.488, 747 844.974 L 747 894.949 744.056 896.471 C 738.990 899.091, 717.003 907.070, 705.123 910.599 C 657.494 924.751, 607.787 926.746, 561.151 916.378 C 448.026 891.230, 357.961 799.046, 338.509 688.500 C 308.967 520.602, 428.454 363.695, 600.492 344.473 C 714.005 331.789, 825.907 394.237, 886.008 503.808 C 892.987 516.532, 893.355 516.997, 895.386 515.673 C 898.015 513.958, 931.494 493.905, 955.500 479.665 C 965.400 473.792, 974.115 468.594, 974.867 468.113 C 977.865 466.193, 950.810 421.104, 933.996 400 C 864.951 313.340, 778.345 263.056, 673 248.466 C 656.745 246.215, 605.885 245.634, 588.500 247.500 M 607.585 516.107 C 555.949 523.638, 513.408 564.461, 504.530 615 C 493.290 678.986, 530.313 736.554, 592.500 751.785 C 605.725 755.025, 637.608 754.155, 652.500 750.149 C 733.815 728.273, 770.193 636.477, 724.629 568.135 C 699.042 529.755, 653.329 509.435, 607.585 516.107"/><path fill="#e8f1eb" d="M161.61256311179804 91.50999999999999Q153.0925557875793 91.50999999999999 147.1625509047668 87.21Q141.23254602195428 82.91 138.1225423598449 74.63000122070312Q135.01253869773555 66.35000244140625 135.01253869773555 54.51Q135.01253869773555 42.55000244140624 138.1225423598449 34.25000244140624Q141.23254602195428 25.95000244140624 147.1625509047668 21.630001220703114Q153.0925557875793 17.309999999999988 161.61256311179804 17.309999999999988Q170.1325704360168 17.309999999999988 176.08257653953243 21.630001220703114Q182.03258264304804 25.95000244140624 185.1225850844543 34.25000244140624Q188.21258752586056 42.55000244140624 188.21258752586056 54.51Q188.21258752586056 66.35000244140625 185.1225850844543 74.63000122070312Q182.03258264304804 82.91 176.08257653953243 87.21Q170.1325704360168 91.50999999999999 161.61256311179804 91.50999999999999ZM161.61256311179804 80.3098291015625Q166.1125020766418 80.3098291015625 169.20245568992306 77.51985717773437Q172.2924093032043 74.72988525390625 173.87238366843866 68.98992553710937Q175.45235803367305 63.2499658203125 175.45235803367305 54.51Q175.45235803367305 45.77003417968749 173.87238366843866 39.98007446289061Q172.2924093032043 34.19011474609374 169.20245568992306 31.350142822265617Q166.1125020766418 28.510170898437494 161.61256311179804 28.510170898437494Q157.15262658836053 28.510170898437494 154.04267175437616 31.350142822265617Q150.93271692039178 34.19011474609374 149.35274255515742 39.98007446289061Q147.77276818992303 45.77003417968749 147.77276818992303 54.51Q147.77276818992303 63.2499658203125 149.35274255515742 68.98992553710937Q150.93271692039178 74.72988525390625 154.04267175437616 77.51985717773437Q157.15262658836053 80.3098291015625 161.61256311179804 80.3098291015625Z M196.01246545554804 104.91V36.5099755859375H207.33268029929803L207.65268762351678 48.74999023437499L206.41268518211055 48.149990234375Q208.4526876235168 41.90998779296874 212.8826741957824 38.60998168945312Q217.31266076804803 35.309975585937494 223.65267541648555 35.309975585937494Q231.0326436782043 35.309975585937494 235.86263025046992 39.089968261718745Q240.69261682273554 42.8699609375 243.0526143813293 49.189962158203116Q245.41261193992304 55.50996337890624 245.41261193992304 63.20998779296875Q245.41261193992304 70.870009765625 243.0526143813293 77.21001220703124Q240.69261682273554 83.5500146484375 235.86263025046992 87.33000732421874Q231.0326436782043 91.11 223.65267541648555 91.11Q219.47267053367304 91.11 216.02267663718868 89.77000366210937Q212.5726827407043 88.43000732421875 210.16268518211052 85.85000244140625Q207.75268762351678 83.26999755859374 206.49266565086054 79.5099755859375L207.85267541648554 78.14997802734375V104.91ZM220.61253869773554 80.46983886718749Q226.5124776625793 80.46983886718749 229.80243737937616 76.12989135742187Q233.09239709617304 71.78994384765625 233.09239709617304 63.20998779296875Q233.09239709617304 54.63003173828125 229.80243737937616 50.290084228515624Q226.5124776625793 45.950136718749995 220.61253869773554 45.950136718749995Q216.81258752586055 45.950136718749995 213.94261682273554 47.830117187499994Q211.07264611961054 49.71009765624999 209.46266076804804 53.55006347656249Q207.85267541648554 57.39002929687499 207.85267541648554 63.20998779296875Q207.85267541648554 69.0299462890625 209.43266198875116 72.869912109375Q211.0126485610168 76.7098779296875 213.91261804343867 78.58985839843749Q216.81258752586055 80.46983886718749 220.61253869773554 80.46983886718749Z M277.97254846336057 91.11Q270.47254846336057 91.11 264.8225362563293 87.68999877929687Q259.17252404929803 84.26999755859374 256.04251306296993 77.97999511718749Q252.9125020766418 71.68999267578124 252.9125020766418 63.20998779296875Q252.9125020766418 54.84999023437499 256.0225118422668 48.589986572265616Q259.1325216078918 42.32998291015625 264.70253503562617 38.81997924804687Q270.2725484633605 35.309975585937494 277.73255822898557 35.309975585937494Q284.95257776023556 35.309975585937494 290.4925924086731 38.71998535156249Q296.03260705711057 42.12999511718749 299.17261560203247 48.43000122070312Q302.3126241469543 54.73000732421875 302.3126241469543 63.429995117187495V66.53003173828125H265.1527120375793Q265.6527120375793 73.34992919921875 269.10267541648557 76.90988403320313Q272.5526387953918 80.46983886718749 278.1725606703918 80.46983886718749Q282.4125020766418 80.46983886718749 285.26247155906367 78.45986572265625Q288.11244104148557 76.449892578125 289.2124288344543 73.12993408203124L301.29261682273557 73.98994384765625Q298.79259240867304 81.96999755859375 292.8025838637512 86.53999877929687Q286.8125753188293 91.11 277.97254846336057 91.11ZM265.27271936179807 57.889956054687495H289.55240686179803Q289.03241174461056 51.830056152343744 285.8124532485168 48.890096435546866Q282.592494752423 45.950136718749995 277.652553346173 45.950136718749995Q272.5926168227355 45.950136718749995 269.36266076804804 48.98009277343749Q266.13270471336057 52.010048828124994 265.27271936179807 57.889956054687495Z M313.21251428367304 89.91V36.5099755859375H324.03270471336054L324.41270959617304 50.770021972656245L323.1726949477356 50.0700341796875Q324.1326925063293 45.010012207031245 326.64268396140744 41.73999877929687Q329.1526754164856 38.46998535156249 332.7926717543762 36.88998046875Q336.4326680922668 35.309975585937494 340.73268029929807 35.309975585937494Q346.63266809226684 35.309975585937494 350.4226522231262 37.929970703124994Q354.21263635398554 40.549965820312494 356.1126241469543 45.07996459960937Q358.0126119399231 49.609963378906244 358.0126119399231 55.409975585937495V89.91H346.1724019789856V58.250002441406245Q346.1724019789856 51.770058593749994 343.8324361586731 48.600100097656245Q341.4924703383606 45.4301416015625 336.7325460219543 45.4301416015625Q333.51259973289183 45.4301416015625 330.8726400160949 46.940126953124995Q328.23268029929807 48.450112304687494 326.6427022719543 51.380086669921866Q325.05272424461054 54.310061035156245 325.05272424461054 58.650026855468745V89.91Z M365.73253381492304 89.91 385.89244592429804 18.909999999999997H401.3326802992981L421.4925924086731 89.91H408.8523824477356L393.61256311179807 32.950380859374995L378.37274377586056 89.91ZM378.1126241469543 73.11020751953124 381.5126485610168 62.0300439453125H405.7124776625793L409.1125020766418 73.11020751953124Z M451.27256067039184 106.11Q445.0125264907043 106.11 440.2525167250793 104.21000000000001Q435.4925069594543 102.31 432.41250818015743 98.83000122070312Q429.33250940086054 95.35000244140625 428.1925069594543 90.71L440.5927266860168 89.949990234375Q441.55271203757934 92.80993896484375 444.0426778578918 94.45990844726563Q446.5326436782043 96.1098779296875 451.27256067039184 96.1098779296875Q457.4724996352356 96.1098779296875 460.7224630141418 93.42989135742187Q463.97242639304807 90.74990478515625 463.97242639304807 85.54994140625V78.55003906249999Q462.1124288344543 82.43001953125 458.25244958640747 84.77000976562499Q454.39247033836057 87.11 448.91245324851684 87.11Q442.41246545554804 87.11 437.30247400046994 83.85000244140625Q432.19248254539184 80.5900048828125 429.3024862075012 74.81000610351562Q426.41248986961057 69.03000732421874 426.41248986961057 61.530007324218744Q426.41248986961057 53.609987792968745 429.2524862075012 47.73998046874999Q432.0924825453918 41.869973144531244 437.10247400046995 38.58997436523437Q442.1124654555481 35.309975585937494 448.5924581313293 35.309975585937494Q454.07245080711056 35.309975585937494 458.1624288344543 37.80996948242187Q462.2524068617981 40.30996337890625 464.21241662742307 44.7499658203125L464.37242639304804 36.5099755859375H475.81263635398557V84.38988281249999Q475.81263635398557 91.4699365234375 472.8126241469543 96.3199609375Q469.81261193992304 101.1699853515625 464.3125936293762 103.63999267578126Q458.8125753188293 106.11 451.27256067039184 106.11ZM451.3125753188293 77.1898828125Q456.95250451804804 77.1898828125 460.4324666762512 73.09992309570313Q463.9124288344543 69.00996337890625 463.97242639304807 61.329995117187494Q464.0324239516418 56.19001708984374 462.4624410414856 52.62004028320312Q460.8924581313293 49.05006347656249 458.0024923110168 47.18008056640625Q455.11252649070434 45.310097656249994 451.3125753188293 45.310097656249994Q445.31263635398557 45.310097656249994 442.0226705336731 49.480062255859366Q438.7327047133606 53.650026855468745 438.7327047133606 61.329995117187494Q438.7327047133606 69.00996337890625 442.08266809226683 73.09992309570313Q445.43263147117307 77.1898828125 451.3125753188293 77.1898828125Z M509.97254846336057 91.11Q502.47254846336057 91.11 496.82253625632933 87.68999877929687Q491.1725240492981 84.26999755859374 488.04251306297 77.97999511718749Q484.91250207664183 71.68999267578124 484.91250207664183 63.20998779296875Q484.91250207664183 54.84999023437499 488.0225118422668 48.589986572265616Q491.1325216078918 42.32998291015625 496.70253503562617 38.81997924804687Q502.2725484633606 35.309975585937494 509.73255822898557 35.309975585937494Q516.9525777602356 35.309975585937494 522.4925924086731 38.71998535156249Q528.0326070571106 42.12999511718749 531.1726156020325 48.43000122070312Q534.3126241469544 54.73000732421875 534.3126241469544 63.429995117187495V66.53003173828125H497.1527120375793Q497.6527120375793 73.34992919921875 501.10267541648557 76.90988403320313Q504.55263879539183 80.46983886718749 510.1725606703918 80.46983886718749Q514.4125020766418 80.46983886718749 517.2624715590637 78.45986572265625Q520.1124410414856 76.449892578125 521.2124288344543 73.12993408203124L533.2926168227356 73.98994384765625Q530.792592408673 81.96999755859375 524.8025838637511 86.53999877929687Q518.8125753188293 91.11 509.97254846336057 91.11ZM497.27271936179807 57.889956054687495H521.5524068617981Q521.0324117446106 51.830056152343744 517.8124532485168 48.890096435546866Q514.592494752423 45.950136718749995 509.6525533461731 45.950136718749995Q504.5926168227356 45.950136718749995 501.36266076804804 48.98009277343749Q498.13270471336057 52.010048828124994 497.27271936179807 57.889956054687495Z M545.212514283673 89.91V36.5099755859375H556.0327047133605L556.412709596173 50.770021972656245L555.1726949477355 50.0700341796875Q556.1326925063294 45.010012207031245 558.6426839614074 41.73999877929687Q561.1526754164855 38.46998535156249 564.7926717543762 36.88998046875Q568.4326680922668 35.309975585937494 572.7326802992981 35.309975585937494Q578.6326680922668 35.309975585937494 582.4226522231262 37.929970703124994Q586.2126363539855 40.549965820312494 588.1126241469543 45.07996459960937Q590.0126119399231 49.609963378906244 590.0126119399231 55.409975585937495V89.91H578.1724019789856V58.250002441406245Q578.1724019789856 51.770058593749994 575.8324361586731 48.600100097656245Q573.4924703383606 45.4301416015625 568.7325460219544 45.4301416015625Q565.5125997328918 45.4301416015625 562.8726400160949 46.940126953124995Q560.2326802992981 48.450112304687494 558.6427022719542 51.380086669921866Q557.0527242446105 54.310061035156245 557.0527242446105 58.650026855468745V89.91Z M633.0925435805481 89.91Q624.5124898696106 89.91 620.4124715590638 85.96997924804687Q616.3124532485168 82.02995849609374 616.3124532485168 73.869912109375V23.989968261718744H628.1526632094543V72.98985839843749Q628.1526632094543 76.6898583984375 629.9126668715637 78.47986083984375Q631.6726705336731 80.26986328125 635.2526754164855 80.26986328125H648.4126119399231V89.91ZM600.2125386977356 46.1501123046875V36.5099755859375H648.4126119399231V46.1501123046875Z M683.9725728774231 91.50999999999999Q675.3525655532043 91.50999999999999 669.3325582289856 87.03000122070313Q663.3125509047668 82.55000244140625 660.1625448012512 74.25000244140625Q657.0125386977355 65.95000244140624 657.0125386977355 54.51Q657.0125386977355 43.00999999999999 660.1625448012512 34.68999877929687Q663.3125509047668 26.369997558593745 669.3325582289856 21.839998779296867Q675.3525655532043 17.309999999999988 683.9725728774231 17.309999999999988Q694.0126119399231 17.309999999999988 700.6926168227355 23.920028076171867Q707.3726217055481 30.530056152343747 709.3326070571105 42.61012207031249L696.5723897719544 43.250124511718745Q695.2724141860168 36.030153808593745 691.9424642348449 32.270162353515616Q688.612514283673 28.510170898437494 683.9725728774231 28.510170898437494Q679.3526387953918 28.510170898437494 676.2026815200012 31.540151367187494Q673.0527242446105 34.570131835937495 671.4127462172669 40.3800927734375Q669.7727681899231 46.19005371093749 669.7727681899231 54.51Q669.7727681899231 62.7299462890625 671.4127462172669 68.50990844726562Q673.0527242446105 74.28987060546875 676.2026815200012 77.29984985351562Q679.3526387953918 80.3098291015625 683.9725728774231 80.3098291015625Q688.8524923110168 80.3098291015625 692.3324422621887 76.24984375Q695.8123922133606 72.1898583984375 696.9923726821106 64.36989990234375L709.692592408673 64.94990478515625Q707.9125997328919 77.52995849609374 701.1725972914855 84.51997924804687Q694.4325948500793 91.50999999999999 683.9725728774231 91.50999999999999Z M741.6125631117981 91.11Q734.1125509047669 91.11 728.4825399184388 87.68999877929687Q722.8525289321105 84.26999755859374 719.7325216078918 77.97747795675886Q716.612514283673 71.68495835492399 716.612514283673 63.227812010057924Q716.612514283673 54.669985351562495 719.7325216078918 48.40998168945312Q722.8525289321105 42.14997802734374 728.4825399184388 38.72997680664062Q734.1125509047669 35.309975585937494 741.6125631117981 35.309975585937494Q749.1125753188293 35.309975585937494 754.7425863051574 38.72997680664062Q760.3725972914856 42.14997802734374 763.4926046157043 48.400766109948265Q766.6126119399231 54.65155419255279 766.6126119399231 63.221183015478346Q766.6126119399231 71.68999267578124 763.4926046157043 77.97999511718749Q760.3725972914856 84.26999755859374 754.7425863051574 87.68999877929687Q749.1125753188293 91.11 741.6125631117981 91.11ZM741.6125631117981 80.46983886718749Q747.6724874282044 80.46983886718749 750.9824422621887 75.9398828125Q754.2923970961731 71.4099267578125 754.2923970961731 63.189986572265624Q754.2923970961731 54.97004638671874 750.9824422621887 50.46009155273437Q747.6724874282044 45.950136718749995 741.6125631117981 45.950136718749995Q735.5526387953918 45.950136718749995 732.2426839614075 50.46009155273437Q728.932729127423 54.97004638671874 728.932729127423 63.189986572265624Q728.932729127423 71.4099267578125 732.2426839614075 75.9398828125Q735.5526387953918 80.46983886718749 741.6125631117981 80.46983886718749Z M777.4124898696106 89.91V80.26986328125H795.7925191664856L790.5724508071106 85.42993408203125V40.93004394531249L795.7925191664856 46.1501123046875H777.4124898696106V36.5099755859375H799.5725728774231L800.6525899672669 51.990053710937495L799.6125753188293 51.15003906249999Q800.2925679946105 43.890017089843745 803.5925618910949 40.199996337890624Q806.8925557875793 36.5099755859375 813.1525899672669 36.5099755859375H824.8126363539856V46.430117187499995H813.8526265883605Q810.0326314711731 46.430117187499995 807.5026387953918 47.820107421874994Q804.9726461196105 49.21009765624999 803.6926534438294 51.920083007812494Q802.4126607680481 54.630068359374995 802.4126607680481 58.710048828125V85.42993408203125L797.2525899672668 80.26986328125H818.8926412367981V89.91Z M857.9725484633606 91.11Q850.4725484633606 91.11 844.8225362563294 87.68999877929687Q839.1725240492981 84.26999755859374 836.0425130629699 77.97999511718749Q832.9125020766418 71.68999267578124 832.9125020766418 63.20998779296875Q832.9125020766418 54.84999023437499 836.0225118422668 48.589986572265616Q839.1325216078918 42.32998291015625 844.7025350356262 38.81997924804687Q850.2725484633605 35.309975585937494 857.7325582289856 35.309975585937494Q864.9525777602356 35.309975585937494 870.4925924086731 38.71998535156249Q876.0326070571106 42.12999511718749 879.1726156020325 48.43000122070312Q882.3126241469544 54.73000732421875 882.3126241469544 63.429995117187495V66.53003173828125H845.1527120375794Q845.6527120375794 73.34992919921875 849.1026754164856 76.90988403320313Q852.5526387953918 80.46983886718749 858.1725606703918 80.46983886718749Q862.4125020766418 80.46983886718749 865.2624715590637 78.45986572265625Q868.1124410414856 76.449892578125 869.2124288344543 73.12993408203124L881.2926168227356 73.98994384765625Q878.792592408673 81.96999755859375 872.8025838637511 86.53999877929687Q866.8125753188293 91.11 857.9725484633606 91.11ZM845.2727193617981 57.889956054687495H869.5524068617981Q869.0324117446106 51.830056152343744 865.8124532485168 48.890096435546866Q862.592494752423 45.950136718749995 857.652553346173 45.950136718749995Q852.5926168227355 45.950136718749995 849.362660768048 48.98009277343749Q846.1327047133606 52.010048828124994 845.2727193617981 57.889956054687495Z"/></svg>
diff --git a/docs/assets/openagentcore-wordmark-light.svg b/docs/assets/openagentcore-wordmark-light.svg
new file mode 100644
index 000000000..1b9ea0665
--- /dev/null
+++ b/docs/assets/openagentcore-wordmark-light.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 891.6 108.8" width="892" height="109" role="img" aria-label="OpenAgentCore"><path fill="#15803d" fill-rule="evenodd" transform="translate(-26.39 -28.00) scale(0.12986)" d="M 588.500 247.500 C 482.038 258.932, 384.992 313.332, 317.342 399.500 C 241.675 495.881, 215.170 625.903, 247.575 741.747 C 285.409 876.998, 396.299 984.807, 527.500 1013.894 C 573.849 1024.169, 627.260 1025.623, 677 1017.964 C 780.514 1002.024, 876.331 944.643, 948.289 855.500 C 967.400 831.824, 987.086 801.273, 985.647 797.522 C 984.937 795.673, 904.376 744.245, 903.572 745.128 C 903.385 745.332, 901.319 749.325, 898.980 754 C 892.404 767.143, 880.011 786.376, 870.305 798.499 C 861.349 809.685, 841.417 831, 839.911 831 C 839.456 831, 838.926 782.513, 838.732 723.250 C 838.422 628.124, 838.183 614.283, 836.696 605.117 C 816.784 482.366, 703.587 402.140, 584.478 426.362 C 501.463 443.243, 431.784 511.254, 414 592.759 C 391.575 695.536, 444.831 796.779, 540 832.292 C 593.282 852.175, 661.017 845.557, 715.796 815.117 C 727.188 808.787, 741.006 799.755, 743.477 797.025 C 744.485 795.911, 745.690 795, 746.155 795 C 746.620 795, 747 817.488, 747 844.974 L 747 894.949 744.056 896.471 C 738.990 899.091, 717.003 907.070, 705.123 910.599 C 657.494 924.751, 607.787 926.746, 561.151 916.378 C 448.026 891.230, 357.961 799.046, 338.509 688.500 C 308.967 520.602, 428.454 363.695, 600.492 344.473 C 714.005 331.789, 825.907 394.237, 886.008 503.808 C 892.987 516.532, 893.355 516.997, 895.386 515.673 C 898.015 513.958, 931.494 493.905, 955.500 479.665 C 965.400 473.792, 974.115 468.594, 974.867 468.113 C 977.865 466.193, 950.810 421.104, 933.996 400 C 864.951 313.340, 778.345 263.056, 673 248.466 C 656.745 246.215, 605.885 245.634, 588.500 247.500 M 607.585 516.107 C 555.949 523.638, 513.408 564.461, 504.530 615 C 493.290 678.986, 530.313 736.554, 592.500 751.785 C 605.725 755.025, 637.608 754.155, 652.500 750.149 C 733.815 728.273, 770.193 636.477, 724.629 568.135 C 699.042 529.755, 653.329 509.435, 607.585 516.107"/><path fill="#0b1510" d="M161.61256311179804 91.50999999999999Q153.0925557875793 91.50999999999999 147.1625509047668 87.21Q141.23254602195428 82.91 138.1225423598449 74.63000122070312Q135.01253869773555 66.35000244140625 135.01253869773555 54.51Q135.01253869773555 42.55000244140624 138.1225423598449 34.25000244140624Q141.23254602195428 25.95000244140624 147.1625509047668 21.630001220703114Q153.0925557875793 17.309999999999988 161.61256311179804 17.309999999999988Q170.1325704360168 17.309999999999988 176.08257653953243 21.630001220703114Q182.03258264304804 25.95000244140624 185.1225850844543 34.25000244140624Q188.21258752586056 42.55000244140624 188.21258752586056 54.51Q188.21258752586056 66.35000244140625 185.1225850844543 74.63000122070312Q182.03258264304804 82.91 176.08257653953243 87.21Q170.1325704360168 91.50999999999999 161.61256311179804 91.50999999999999ZM161.61256311179804 80.3098291015625Q166.1125020766418 80.3098291015625 169.20245568992306 77.51985717773437Q172.2924093032043 74.72988525390625 173.87238366843866 68.98992553710937Q175.45235803367305 63.2499658203125 175.45235803367305 54.51Q175.45235803367305 45.77003417968749 173.87238366843866 39.98007446289061Q172.2924093032043 34.19011474609374 169.20245568992306 31.350142822265617Q166.1125020766418 28.510170898437494 161.61256311179804 28.510170898437494Q157.15262658836053 28.510170898437494 154.04267175437616 31.350142822265617Q150.93271692039178 34.19011474609374 149.35274255515742 39.98007446289061Q147.77276818992303 45.77003417968749 147.77276818992303 54.51Q147.77276818992303 63.2499658203125 149.35274255515742 68.98992553710937Q150.93271692039178 74.72988525390625 154.04267175437616 77.51985717773437Q157.15262658836053 80.3098291015625 161.61256311179804 80.3098291015625Z M196.01246545554804 104.91V36.5099755859375H207.33268029929803L207.65268762351678 48.74999023437499L206.41268518211055 48.149990234375Q208.4526876235168 41.90998779296874 212.8826741957824 38.60998168945312Q217.31266076804803 35.309975585937494 223.65267541648555 35.309975585937494Q231.0326436782043 35.309975585937494 235.86263025046992 39.089968261718745Q240.69261682273554 42.8699609375 243.0526143813293 49.189962158203116Q245.41261193992304 55.50996337890624 245.41261193992304 63.20998779296875Q245.41261193992304 70.870009765625 243.0526143813293 77.21001220703124Q240.69261682273554 83.5500146484375 235.86263025046992 87.33000732421874Q231.0326436782043 91.11 223.65267541648555 91.11Q219.47267053367304 91.11 216.02267663718868 89.77000366210937Q212.5726827407043 88.43000732421875 210.16268518211052 85.85000244140625Q207.75268762351678 83.26999755859374 206.49266565086054 79.5099755859375L207.85267541648554 78.14997802734375V104.91ZM220.61253869773554 80.46983886718749Q226.5124776625793 80.46983886718749 229.80243737937616 76.12989135742187Q233.09239709617304 71.78994384765625 233.09239709617304 63.20998779296875Q233.09239709617304 54.63003173828125 229.80243737937616 50.290084228515624Q226.5124776625793 45.950136718749995 220.61253869773554 45.950136718749995Q216.81258752586055 45.950136718749995 213.94261682273554 47.830117187499994Q211.07264611961054 49.71009765624999 209.46266076804804 53.55006347656249Q207.85267541648554 57.39002929687499 207.85267541648554 63.20998779296875Q207.85267541648554 69.0299462890625 209.43266198875116 72.869912109375Q211.0126485610168 76.7098779296875 213.91261804343867 78.58985839843749Q216.81258752586055 80.46983886718749 220.61253869773554 80.46983886718749Z M277.97254846336057 91.11Q270.47254846336057 91.11 264.8225362563293 87.68999877929687Q259.17252404929803 84.26999755859374 256.04251306296993 77.97999511718749Q252.9125020766418 71.68999267578124 252.9125020766418 63.20998779296875Q252.9125020766418 54.84999023437499 256.0225118422668 48.589986572265616Q259.1325216078918 42.32998291015625 264.70253503562617 38.81997924804687Q270.2725484633605 35.309975585937494 277.73255822898557 35.309975585937494Q284.95257776023556 35.309975585937494 290.4925924086731 38.71998535156249Q296.03260705711057 42.12999511718749 299.17261560203247 48.43000122070312Q302.3126241469543 54.73000732421875 302.3126241469543 63.429995117187495V66.53003173828125H265.1527120375793Q265.6527120375793 73.34992919921875 269.10267541648557 76.90988403320313Q272.5526387953918 80.46983886718749 278.1725606703918 80.46983886718749Q282.4125020766418 80.46983886718749 285.26247155906367 78.45986572265625Q288.11244104148557 76.449892578125 289.2124288344543 73.12993408203124L301.29261682273557 73.98994384765625Q298.79259240867304 81.96999755859375 292.8025838637512 86.53999877929687Q286.8125753188293 91.11 277.97254846336057 91.11ZM265.27271936179807 57.889956054687495H289.55240686179803Q289.03241174461056 51.830056152343744 285.8124532485168 48.890096435546866Q282.592494752423 45.950136718749995 277.652553346173 45.950136718749995Q272.5926168227355 45.950136718749995 269.36266076804804 48.98009277343749Q266.13270471336057 52.010048828124994 265.27271936179807 57.889956054687495Z M313.21251428367304 89.91V36.5099755859375H324.03270471336054L324.41270959617304 50.770021972656245L323.1726949477356 50.0700341796875Q324.1326925063293 45.010012207031245 326.64268396140744 41.73999877929687Q329.1526754164856 38.46998535156249 332.7926717543762 36.88998046875Q336.4326680922668 35.309975585937494 340.73268029929807 35.309975585937494Q346.63266809226684 35.309975585937494 350.4226522231262 37.929970703124994Q354.21263635398554 40.549965820312494 356.1126241469543 45.07996459960937Q358.0126119399231 49.609963378906244 358.0126119399231 55.409975585937495V89.91H346.1724019789856V58.250002441406245Q346.1724019789856 51.770058593749994 343.8324361586731 48.600100097656245Q341.4924703383606 45.4301416015625 336.7325460219543 45.4301416015625Q333.51259973289183 45.4301416015625 330.8726400160949 46.940126953124995Q328.23268029929807 48.450112304687494 326.6427022719543 51.380086669921866Q325.05272424461054 54.310061035156245 325.05272424461054 58.650026855468745V89.91Z M365.73253381492304 89.91 385.89244592429804 18.909999999999997H401.3326802992981L421.4925924086731 89.91H408.8523824477356L393.61256311179807 32.950380859374995L378.37274377586056 89.91ZM378.1126241469543 73.11020751953124 381.5126485610168 62.0300439453125H405.7124776625793L409.1125020766418 73.11020751953124Z M451.27256067039184 106.11Q445.0125264907043 106.11 440.2525167250793 104.21000000000001Q435.4925069594543 102.31 432.41250818015743 98.83000122070312Q429.33250940086054 95.35000244140625 428.1925069594543 90.71L440.5927266860168 89.949990234375Q441.55271203757934 92.80993896484375 444.0426778578918 94.45990844726563Q446.5326436782043 96.1098779296875 451.27256067039184 96.1098779296875Q457.4724996352356 96.1098779296875 460.7224630141418 93.42989135742187Q463.97242639304807 90.74990478515625 463.97242639304807 85.54994140625V78.55003906249999Q462.1124288344543 82.43001953125 458.25244958640747 84.77000976562499Q454.39247033836057 87.11 448.91245324851684 87.11Q442.41246545554804 87.11 437.30247400046994 83.85000244140625Q432.19248254539184 80.5900048828125 429.3024862075012 74.81000610351562Q426.41248986961057 69.03000732421874 426.41248986961057 61.530007324218744Q426.41248986961057 53.609987792968745 429.2524862075012 47.73998046874999Q432.0924825453918 41.869973144531244 437.10247400046995 38.58997436523437Q442.1124654555481 35.309975585937494 448.5924581313293 35.309975585937494Q454.07245080711056 35.309975585937494 458.1624288344543 37.80996948242187Q462.2524068617981 40.30996337890625 464.21241662742307 44.7499658203125L464.37242639304804 36.5099755859375H475.81263635398557V84.38988281249999Q475.81263635398557 91.4699365234375 472.8126241469543 96.3199609375Q469.81261193992304 101.1699853515625 464.3125936293762 103.63999267578126Q458.8125753188293 106.11 451.27256067039184 106.11ZM451.3125753188293 77.1898828125Q456.95250451804804 77.1898828125 460.4324666762512 73.09992309570313Q463.9124288344543 69.00996337890625 463.97242639304807 61.329995117187494Q464.0324239516418 56.19001708984374 462.4624410414856 52.62004028320312Q460.8924581313293 49.05006347656249 458.0024923110168 47.18008056640625Q455.11252649070434 45.310097656249994 451.3125753188293 45.310097656249994Q445.31263635398557 45.310097656249994 442.0226705336731 49.480062255859366Q438.7327047133606 53.650026855468745 438.7327047133606 61.329995117187494Q438.7327047133606 69.00996337890625 442.08266809226683 73.09992309570313Q445.43263147117307 77.1898828125 451.3125753188293 77.1898828125Z M509.97254846336057 91.11Q502.47254846336057 91.11 496.82253625632933 87.68999877929687Q491.1725240492981 84.26999755859374 488.04251306297 77.97999511718749Q484.91250207664183 71.68999267578124 484.91250207664183 63.20998779296875Q484.91250207664183 54.84999023437499 488.0225118422668 48.589986572265616Q491.1325216078918 42.32998291015625 496.70253503562617 38.81997924804687Q502.2725484633606 35.309975585937494 509.73255822898557 35.309975585937494Q516.9525777602356 35.309975585937494 522.4925924086731 38.71998535156249Q528.0326070571106 42.12999511718749 531.1726156020325 48.43000122070312Q534.3126241469544 54.73000732421875 534.3126241469544 63.429995117187495V66.53003173828125H497.1527120375793Q497.6527120375793 73.34992919921875 501.10267541648557 76.90988403320313Q504.55263879539183 80.46983886718749 510.1725606703918 80.46983886718749Q514.4125020766418 80.46983886718749 517.2624715590637 78.45986572265625Q520.1124410414856 76.449892578125 521.2124288344543 73.12993408203124L533.2926168227356 73.98994384765625Q530.792592408673 81.96999755859375 524.8025838637511 86.53999877929687Q518.8125753188293 91.11 509.97254846336057 91.11ZM497.27271936179807 57.889956054687495H521.5524068617981Q521.0324117446106 51.830056152343744 517.8124532485168 48.890096435546866Q514.592494752423 45.950136718749995 509.6525533461731 45.950136718749995Q504.5926168227356 45.950136718749995 501.36266076804804 48.98009277343749Q498.13270471336057 52.010048828124994 497.27271936179807 57.889956054687495Z M545.212514283673 89.91V36.5099755859375H556.0327047133605L556.412709596173 50.770021972656245L555.1726949477355 50.0700341796875Q556.1326925063294 45.010012207031245 558.6426839614074 41.73999877929687Q561.1526754164855 38.46998535156249 564.7926717543762 36.88998046875Q568.4326680922668 35.309975585937494 572.7326802992981 35.309975585937494Q578.6326680922668 35.309975585937494 582.4226522231262 37.929970703124994Q586.2126363539855 40.549965820312494 588.1126241469543 45.07996459960937Q590.0126119399231 49.609963378906244 590.0126119399231 55.409975585937495V89.91H578.1724019789856V58.250002441406245Q578.1724019789856 51.770058593749994 575.8324361586731 48.600100097656245Q573.4924703383606 45.4301416015625 568.7325460219544 45.4301416015625Q565.5125997328918 45.4301416015625 562.8726400160949 46.940126953124995Q560.2326802992981 48.450112304687494 558.6427022719542 51.380086669921866Q557.0527242446105 54.310061035156245 557.0527242446105 58.650026855468745V89.91Z M633.0925435805481 89.91Q624.5124898696106 89.91 620.4124715590638 85.96997924804687Q616.3124532485168 82.02995849609374 616.3124532485168 73.869912109375V23.989968261718744H628.1526632094543V72.98985839843749Q628.1526632094543 76.6898583984375 629.9126668715637 78.47986083984375Q631.6726705336731 80.26986328125 635.2526754164855 80.26986328125H648.4126119399231V89.91ZM600.2125386977356 46.1501123046875V36.5099755859375H648.4126119399231V46.1501123046875Z M683.9725728774231 91.50999999999999Q675.3525655532043 91.50999999999999 669.3325582289856 87.03000122070313Q663.3125509047668 82.55000244140625 660.1625448012512 74.25000244140625Q657.0125386977355 65.95000244140624 657.0125386977355 54.51Q657.0125386977355 43.00999999999999 660.1625448012512 34.68999877929687Q663.3125509047668 26.369997558593745 669.3325582289856 21.839998779296867Q675.3525655532043 17.309999999999988 683.9725728774231 17.309999999999988Q694.0126119399231 17.309999999999988 700.6926168227355 23.920028076171867Q707.3726217055481 30.530056152343747 709.3326070571105 42.61012207031249L696.5723897719544 43.250124511718745Q695.2724141860168 36.030153808593745 691.9424642348449 32.270162353515616Q688.612514283673 28.510170898437494 683.9725728774231 28.510170898437494Q679.3526387953918 28.510170898437494 676.2026815200012 31.540151367187494Q673.0527242446105 34.570131835937495 671.4127462172669 40.3800927734375Q669.7727681899231 46.19005371093749 669.7727681899231 54.51Q669.7727681899231 62.7299462890625 671.4127462172669 68.50990844726562Q673.0527242446105 74.28987060546875 676.2026815200012 77.29984985351562Q679.3526387953918 80.3098291015625 683.9725728774231 80.3098291015625Q688.8524923110168 80.3098291015625 692.3324422621887 76.24984375Q695.8123922133606 72.1898583984375 696.9923726821106 64.36989990234375L709.692592408673 64.94990478515625Q707.9125997328919 77.52995849609374 701.1725972914855 84.51997924804687Q694.4325948500793 91.50999999999999 683.9725728774231 91.50999999999999Z M741.6125631117981 91.11Q734.1125509047669 91.11 728.4825399184388 87.68999877929687Q722.8525289321105 84.26999755859374 719.7325216078918 77.97747795675886Q716.612514283673 71.68495835492399 716.612514283673 63.227812010057924Q716.612514283673 54.669985351562495 719.7325216078918 48.40998168945312Q722.8525289321105 42.14997802734374 728.4825399184388 38.72997680664062Q734.1125509047669 35.309975585937494 741.6125631117981 35.309975585937494Q749.1125753188293 35.309975585937494 754.7425863051574 38.72997680664062Q760.3725972914856 42.14997802734374 763.4926046157043 48.400766109948265Q766.6126119399231 54.65155419255279 766.6126119399231 63.221183015478346Q766.6126119399231 71.68999267578124 763.4926046157043 77.97999511718749Q760.3725972914856 84.26999755859374 754.7425863051574 87.68999877929687Q749.1125753188293 91.11 741.6125631117981 91.11ZM741.6125631117981 80.46983886718749Q747.6724874282044 80.46983886718749 750.9824422621887 75.9398828125Q754.2923970961731 71.4099267578125 754.2923970961731 63.189986572265624Q754.2923970961731 54.97004638671874 750.9824422621887 50.46009155273437Q747.6724874282044 45.950136718749995 741.6125631117981 45.950136718749995Q735.5526387953918 45.950136718749995 732.2426839614075 50.46009155273437Q728.932729127423 54.97004638671874 728.932729127423 63.189986572265624Q728.932729127423 71.4099267578125 732.2426839614075 75.9398828125Q735.5526387953918 80.46983886718749 741.6125631117981 80.46983886718749Z M777.4124898696106 89.91V80.26986328125H795.7925191664856L790.5724508071106 85.42993408203125V40.93004394531249L795.7925191664856 46.1501123046875H777.4124898696106V36.5099755859375H799.5725728774231L800.6525899672669 51.990053710937495L799.6125753188293 51.15003906249999Q800.2925679946105 43.890017089843745 803.5925618910949 40.199996337890624Q806.8925557875793 36.5099755859375 813.1525899672669 36.5099755859375H824.8126363539856V46.430117187499995H813.8526265883605Q810.0326314711731 46.430117187499995 807.5026387953918 47.820107421874994Q804.9726461196105 49.21009765624999 803.6926534438294 51.920083007812494Q802.4126607680481 54.630068359374995 802.4126607680481 58.710048828125V85.42993408203125L797.2525899672668 80.26986328125H818.8926412367981V89.91Z M857.9725484633606 91.11Q850.4725484633606 91.11 844.8225362563294 87.68999877929687Q839.1725240492981 84.26999755859374 836.0425130629699 77.97999511718749Q832.9125020766418 71.68999267578124 832.9125020766418 63.20998779296875Q832.9125020766418 54.84999023437499 836.0225118422668 48.589986572265616Q839.1325216078918 42.32998291015625 844.7025350356262 38.81997924804687Q850.2725484633605 35.309975585937494 857.7325582289856 35.309975585937494Q864.9525777602356 35.309975585937494 870.4925924086731 38.71998535156249Q876.0326070571106 42.12999511718749 879.1726156020325 48.43000122070312Q882.3126241469544 54.73000732421875 882.3126241469544 63.429995117187495V66.53003173828125H845.1527120375794Q845.6527120375794 73.34992919921875 849.1026754164856 76.90988403320313Q852.5526387953918 80.46983886718749 858.1725606703918 80.46983886718749Q862.4125020766418 80.46983886718749 865.2624715590637 78.45986572265625Q868.1124410414856 76.449892578125 869.2124288344543 73.12993408203124L881.2926168227356 73.98994384765625Q878.792592408673 81.96999755859375 872.8025838637511 86.53999877929687Q866.8125753188293 91.11 857.9725484633606 91.11ZM845.2727193617981 57.889956054687495H869.5524068617981Q869.0324117446106 51.830056152343744 865.8124532485168 48.890096435546866Q862.592494752423 45.950136718749995 857.652553346173 45.950136718749995Q852.5926168227355 45.950136718749995 849.362660768048 48.98009277343749Q846.1327047133606 52.010048828124994 845.2727193617981 57.889956054687495Z"/></svg>
diff --git a/docs/concepts.md b/docs/concepts.md
index 7a92003f6..da0cf2866 100644
--- a/docs/concepts.md
+++ b/docs/concepts.md
@@ -2,13 +2,13 @@
 title: "Concepts"
 ---
 
-A Project is the execution tenant in OpenAgentCore. Applications use its API keys; operators manage the installation with a separate Core key. The [API index](./api/index.md) maps each caller to its namespace and credential.
+A Project is the execution tenant in OpenAgentCore. Applications use its API keys; operators manage the installation with a separate Core key. [API namespaces and credentials](./api/index.md) maps each caller to its namespace and credential.
 
 ## Projects own assets
 
 A Project owns its Agents, Sessions, Environments, Skills, Files and Vaults. Its named API keys share the same principal, permissions and resources. Core has no product users, roles, memberships or read-only keys. Names are labels; stable IDs identify Projects and keys.
 
-Projects and keys live in PostgreSQL. Core returns a key's plaintext once, when it is issued. To rotate a key, issue a new one in the same Project, then revoke the old one. Revocation preserves assets, write provenance and accepted work. Archiving a Project revokes all its keys and prevents new keys; administrators retain access to inspect and delete its resources. The [administration contract](../contracts/agents-api/admin-api.md#projects-and-keys) defines these operations.
+Projects and keys live in PostgreSQL. Core returns a key's plaintext once, when it is issued; [Projects and API keys](./getting-started/operations.md#projects-and-api-keys) gives the rotation steps. Revocation preserves assets, write provenance and accepted work. Archiving a Project revokes all its keys and prevents new keys; administrators retain access to inspect and delete its resources. The [Core administration API](../contracts/agents-api/admin-api.md#projects-and-keys) defines these operations.
 
 The [Core key](./getting-started/operations.md#core-key) is a separate deployment credential. An administrator who needs to use the application API issues a Project key and uses that Project's authority. Product users, workspaces and business permissions belong to the application.
 
@@ -20,7 +20,7 @@ Application reads, writes and references are scoped to the key's Project. A reso
 
 Administrators manage Projects and keys, sandbox deployments, nodes, executor credentials and deployment default models. They inspect resources, execution history, operational counts and usage, and delete resources under their deletion rules. Archiving a hosted Session requests cancellation and sandbox reclamation; see [Session archive](../contracts/agents-api/admin-api.md#session-archive).
 
-Creating or editing application assets, starting Sessions and submitting input require a Project API key. The Core key gives no application identity and cannot read stored secrets. The [administration API](../contracts/agents-api/admin-api.md) defines its operations; the [console server](./web/console-server.md) owns Web sign-in and credential handling.
+Creating or editing application assets, starting Sessions and submitting input require a Project API key. The Core key gives no application identity and cannot read stored secrets. The [Core administration API](../contracts/agents-api/admin-api.md) defines its operations; the [Console server](./web/console-server.md) owns Web sign-in and credential handling.
 
 ## Runtime and outer isolation
 
diff --git a/docs/configuration.md b/docs/configuration.md
index 98251f93f..70eb1d2d8 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -2,7 +2,7 @@
 title: "Configuration reference"
 ---
 
-Every setting of a Core installation has exactly one home, in one of three categories:
+Every setting of a Core installation, where it lives and how to change it. The installer writes the initial values; use this reference afterwards. Each setting has exactly one home, in one of three categories:
 
 | Category | Examples | Home | Change it with | Takes effect |
 | --- | --- | --- | --- | --- |
@@ -14,37 +14,19 @@ Every setting of a Core installation has exactly one home, in one of three categ
 
 ## Process settings
 
-Installer flags in [installation options](./getting-started/install-options.md) write `.env` once. To change a setting, edit `.env` and apply it:
+Installer flags in [Installation options](./getting-started/install-options.md#flags) write `.env` once. To change a setting, edit `.env` and apply it:
 
 ```sh
 ~/.oac/core/oac apply
 ```
 
-### How oac apply works {#how-oac-apply-works}
-
-1. It runs the `init` service, which checks that the data volume belongs to the installed release and finishes initializing it if the first start stopped early.
-2. It runs `oac-core check-config` with the `.env` you edited and changes no service if a value is invalid.
-3. It runs `docker compose up -d --wait` with the images already on the host. Compose recreates only the services whose configuration changed and removes containers the release no longer defines. If a service does not become healthy, the message names it and the command that prints its log.
-
-Use `docker compose ps` to check the services. See [stop and restart](./getting-started/operations.md#stop-and-restart) for what a restart interrupts.
-
-### Changing the public URL {#changing-the-public-url}
-
-`OAC_PUBLIC_URL` is the one origin that applications, nodes, sandboxes and self-hosted executors use. Core derives the daemon WebSocket URL, the self-hosted `remote_url` and each sandbox's connection address from it. It is an http or https origin: the address browsers and nodes use. The installation serves Web over HTTP on `OAC_WEB_PORT`; a reverse proxy or hosting platform terminates HTTPS when you put one in front.
-
-To change it, point the reverse proxy at the new address first, then edit `OAC_PUBLIC_URL` and run `oac apply`. Afterwards:
-
-- Nodes on the old address get no new sandboxes: remove them in Web and add them again.
-- Existing sandboxes and executors keep working only while the old address still reaches this Core.
-- Self-hosted executors must restart with the new `remote_url`, and their installer refuses an installation made for the old address: create new self-hosted Sessions and connect their hosts again.
-
 ### Settings
 
 Model providers are not process settings; see [Default models](#default-models).
 
 | Variable | Default | Meaning |
 | --- | --- | --- |
-| `OAC_PUBLIC_URL` | Required; `compose.yaml` sets `http://localhost:` followed by `OAC_WEB_PORT` | Origin applications, nodes, sandboxes and self-hosted executors use. See [changing the public URL](#changing-the-public-url) |
+| `OAC_PUBLIC_URL` | Required; `compose.yaml` sets `http://localhost:` followed by `OAC_WEB_PORT` | Origin applications, nodes, sandboxes and self-hosted executors use. See [Change the public URL](./getting-started/public-address.md#changing-the-public-url) |
 | `OAC_HOST` | `127.0.0.1` | Web bind address published by `compose.yaml`. The installer sets `0.0.0.0` |
 | `OAC_WEB_PORT` | `8080` | Host port of Web |
 | `OAC_LOG_LEVEL` | `info` | `debug`, `info`, `warn` or `error` |
@@ -62,33 +44,13 @@ Model providers are not process settings; see [Default models](#default-models).
 
 An unset or empty value selects the default. Edit `.env`, then run `oac apply`. Core reads every process setting, and every file a setting names, once at startup and reports what it loaded at `GET /core/v1/installation`. `oac-core check-config` loads and validates the same settings and files without starting Core. The native installer catalog under `OAC_PROVIDER_ROOT` is not a setting; Core checks it only when it starts. Errors name the variable, never its value. Sensitive settings report only whether they are configured.
 
-### Runtime history file
-
-`OAC_HISTORY_SETTINGS_FILE` names a JSON file that tunes [retained history](../contracts/agents-api/runtime-observability.md#retained-history-and-optional-export) and adds an optional OTLP export. Without it, Core keeps history in its database with the defaults below. In a Compose installation, put the file in the data volume's `secrets/core/` directory, owned by UID 65532 with mode `0600`, and set `OAC_HISTORY_SETTINGS_FILE=/run/oac/<file name>`: Core mounts that directory read-only at `/run/oac`. Headers may hold export credentials; they never appear in `oac` output or in the installation report. Unknown fields are rejected.
-
-| Field | Default | Meaning |
-| --- | --- | --- |
-| `sample_interval_seconds` | `30` | Periodic sampling interval, from 5 to 300 |
-| `queue_capacity` | `256` | Records each exporter queues, at most 4096 |
-| `timeout_seconds` | `2` | Export and history query timeout, at most 30 |
-| `endpoint` | unset | Absolute OTLP/HTTP metrics URL, such as `https://collector.example/v1/metrics`. Unset, Core exports nothing and the other export fields must be unset |
-| `transport` | unset | `otlp_http`; required with `endpoint` |
-| `insecure` | `false` | `true` is required for an `http` endpoint and rejected for `https` |
-| `headers` | none | Request headers for the endpoint. `Host`, `Content-Length`, `Content-Type` and `Content-Encoding` are reserved |
-
-### Runtime resource directories
-
-The Runtime resolves its resource directories before discovering Harness adapters. `<RuntimeHome>` is the Runtime home selected by `OAC_RUNTIME_HOME`. `OAC_RUNTIME_STATE_DIRECTORY` defaults only when unset; an empty, relative or noncanonical explicit value is rejected. Directory settings have no secondary file or environment fallback.
-
-| Runtime process setting | Default | Packaged Linux images |
-| --- | --- | --- |
-| `OAC_RUNTIME_INITIALIZATION_DIRECTORY` | `<RuntimeHome>/initialization` | `/environment/initialization` |
-| `OAC_RUNTIME_PACKAGE_DIRECTORY` | `<RuntimeHome>/packages` | `/environment/packages` |
-| `OAC_RUNTIME_STATE_DIRECTORY` | `<RuntimeHome>` | `/environment/runtime-state` |
+### How oac apply works {#how-oac-apply-works}
 
-The state directory contains retained native Harness history and capability-installation completion records. It is separate from the declared workspace directory. Selecting a separate state directory does not relocate Runtime device credentials or connection identity from their instance-private paths in the Runtime home; they must not be copied with native history. [Harness onboarding](../contracts/agents-api/harness-onboarding.md#register-the-adapter) defines the adapter boundary, and [Environment preparation](../contracts/agents-api/environments.md) owns initialization and package behavior.
+1. It runs the `init` service, which checks that the data volume belongs to the installed release and finishes initializing it if the first start stopped early.
+2. It runs `oac-core check-config` with the `.env` you edited and changes no service if a value is invalid.
+3. It runs `docker compose up -d --wait` with the images already on the host. Compose recreates only the services whose configuration changed and removes containers the release no longer defines. If a service does not become healthy, the message names it and the command that prints its log.
 
-Placing state on an independent filesystem preserves those files when compute is replaced. Native continuation still requires a qualified Harness, matching ownership and confirmed stop of the previous writer. It does not preserve process memory or arbitrary files on the compute root disk.
+Use `docker compose ps` to check the services. See [stop and restart](./getting-started/operations.md#stop-and-restart) for what a restart interrupts.
 
 ## Runtime settings: Web
 
@@ -97,10 +59,10 @@ Runtime settings live in Core's database. Change them in Web; scripts use the sa
 | Setting | Where in Web | Core API | Notes |
 | --- | --- | --- | --- |
 | Sandbox backend: Docker, microsandbox or E2B | **Settings** → **Sandbox and scheduling**: the setup wizard, ending with **Save configuration** | `/core/v1/sandbox/deployment` | One backend per installation, chosen after the first sign-in. Another backend needs **Reset deployment** first; see [change the sandbox configuration](./getting-started/nodes.md#change-the-sandbox-configuration) |
-| Sandbox size, Runtime release, E2B key and template build | **Settings** → **Sandbox and scheduling** → **Change resources** | `/core/v1/sandbox/deployment` | Web proposes the [default size the Provider declares](./sandbox-provider.md#register-the-provider-kind). Existing sandboxes keep their size and release. The E2B key is write-only and encrypted |
-| Nodes and their capacity | **Nodes**: **Add node**, **Edit node** and removal | `/core/v1/sandbox/enrollment-tokens`, `/core/v1/sandbox/nodes` | See [Node capacity](#node-capacity) and the [nodes guide](./getting-started/nodes.md) |
+| Sandbox size, E2B key and template build | **Settings** → **Sandbox and scheduling** → **Change resources** | `/core/v1/sandbox/deployment` | Web proposes the [default size the Provider declares](./sandbox-provider.md#register-the-provider-kind). Existing sandboxes keep their size. The E2B key is write-only and encrypted |
+| Nodes and their capacity | **Nodes**: **Add node**, **Edit node** and removal | `/core/v1/sandbox/enrollment-tokens`, `/core/v1/sandbox/nodes` | See [Node capacity](#node-capacity) and [Add and manage nodes](./getting-started/nodes.md) |
 | Idle suspension | **Settings** → **Sandbox and scheduling** → **Automatic suspension** → **Idle before suspension (seconds)** → **Save** | `PATCH /core/v1/sandbox/deployment` | Deployment-wide; see [suspension policy](../contracts/agents-api/sandbox-deployment.md#suspension-policy) |
-| Independent workspace storage and tenant capacity | **Settings → Workspace storage** | `/core/v1/workspace-storage` | See [independent workspace storage](#independent-workspace-storage); existing workspaces retain their configuration |
+| Independent workspace storage and tenant capacity | **Settings → Workspace storage** | `/core/v1/workspace-storage` | See [Set up workspace storage](./getting-started/workspace-storage.md); existing workspaces retain their configuration |
 | Projects and API keys | **Projects and keys**: **Create project**, **Rename**, **Issue key**, **Revoke**, **Archive** | `/core/v1/projects` | Keys are shown once; Core stores digests |
 | Default model per Harness | **Settings** → **Models and credentials**: **Set** | `/core/v1/harnesses/{harness}/model-configuration` | See [Default models](#default-models) |
 | Executor credentials of a self-hosted Session | **Session log**, then the **Session** page: **Executor credentials** | `/core/v1/projects/{project_id}/environments/{environment_id}/executor-credentials` | See [self-hosted executors](./getting-started/self-hosted.md) |
@@ -111,88 +73,17 @@ Which Harnesses are enabled, and the default one, are process settings (`OAC_HAR
 
 Set `OAC_SANDBOX_MAX_ACTIVE` and `OAC_SANDBOX_MAX_RETAINED` in `.env`, then run `oac apply`. Core uses these limits for direct Providers with suspension enabled. Every unreleased allocation consumes retained capacity. Lowering a limit stops no existing sandbox; new allocations wait until usage falls below both limits. These settings are independent of `OAC_EXECUTION_CONCURRENCY` and enrolled node capacity.
 
-### Independent workspace storage
-
-The initial supported independent filesystem combination is microsandbox with the [kernel NFS adapter](./workspace-provider.md#kernel-nfs-adapter). For a new installation, prepare storage and service accounts first, expose the mount to Core, select storage, configure microsandbox, then enroll nodes. Mount the same NFSv4.2 export on the Linux Core host and every participating node before starting their services, at the same absolute path, for example `/srv/oac-workspaces`. The operator manages the export, mount availability and service startup ordering. Use a trusted-client AUTH_SYS export with `root_squash`; do not enable `no_root_squash` or broaden permissions to make a check pass. Prepare the namespace and service principals according to the adapter's [ownership requirements](./workspace-provider.md#kernel-nfs-adapter).
-
-Core's Compose service already runs as UID 65532. Before adding a node, prepare `oac-node` with the same UID, home `/var/lib/oac-node`, a nologin shell and a nonzero primary group. Its supplementary groups may contain only its primary group, `docker` and `kvm`; an existing home must belong to that account. The installer adopts this account. Without a precreated account it allocates a system UID, which need not match Core. Resolve an existing UID or account conflict as a host administration task before enrollment; changing a running account's UID is not part of storage setup.
-
-For a Compose deployment, add a read-write bind mount to the existing `core` service's `volumes` through the deployment platform's Compose customization. Keep the existing service volumes and user unchanged. The host source must already be the NFS mount; `create_host_path: false` prevents creating a missing source directory but does not establish that NFS is mounted. Mount before creating the container; after a host unmount or remount, recreate it so its mount namespace uses the intended mount.
-
-```yaml
-services:
-  core:
-    volumes:
-      - type: bind
-        source: /srv/oac-workspaces
-        target: /srv/oac-workspaces
-        read_only: false
-        bind:
-          create_host_path: false
-```
+### Node capacity
 
-Select storage in **Settings → Workspace storage → Select new configuration**, or use `PUT /core/v1/workspace-storage` with the Core key as described in the [administration API](../contracts/agents-api/admin-api.md#workspace-storage). For first-time setup, generate separate canonical UUIDs for the immutable configuration `id` and the namespace marker, then submit this shape with your actual values. Restores retain their existing identities. Selection runs the adapter's availability, ownership and xattr checks in Core; it does not prove that every node can resolve the mount:
-
-```json
-{
-  "id": "11111111-1111-4111-8111-111111111111",
-  "adapter": "nfs",
-  "parameters": {
-    "root": "/srv/oac-workspaces",
-    "namespace_id": "22222222-2222-4222-8222-222222222222",
-    "uid": 65532
-  },
-  "tenant_capacity_mib": 0
-}
-```
+A node's capacity is **Sandboxes at once** (`max_active`) and, for microsandbox only, **Retained sandboxes** (`max_retained`), with `max_retained >= max_active >= 1`. **Add node** keeps the recommended limits by default, which Core [derives from the host](../contracts/agents-api/sandbox-deployment.md#recommended-capacity) when the node registers, or you enter both numbers. Docker never suspends sandboxes, so Web doesn't ask for it and Core keeps `max_retained` equal to `max_active`. Change them later on **Nodes** with **Edit node**, which shows the recommendation and fills it in on request. Reservations and cleanup that is not confirmed count against capacity; full retained slots can [end an idle checkpoint's retention early](sandbox-provider.md#cold-replacement-after-checkpoint-retention); lowering a limit stops no running sandbox. A node's own files can't change its capacity, size or Runtime.
 
-This configuration enforces no per-workspace quota, so `tenant_capacity_mib` must be `0`. For bounded workspaces, prepare the [quota mode storage server](#quota-mode-storage-server) and select a quota mode configuration with a [tenant capacity](#tenant-capacity) instead.
-
-Then create or update the microsandbox deployment through the [sandbox deployment API](../contracts/agents-api/sandbox-deployment.md#routes), retaining the required compute resources, Runtime and provider configuration. `resources.environment_disk_mib` is each new workspace's capacity: `0` without quota mode, where a positive value is rejected, and at least 1024 MiB in quota mode, where `0` is refused at workspace admission. Existing workspaces keep the capacity they were admitted with when the deployment changes. Deployment workspace requirements and each Session's attachment are derived from the selected database configuration; do not add a filesystem field to the deployment or a second storage configuration to node files.
-
-The storage form accepts the adapter identifier, its parameters as a JSON object and an optional write-only credential JSON object. Core validates these adapter-owned values; Web does not define provider-specific storage fields. **Edit tenant capacity** keeps the selected immutable configuration. Selecting another configuration requires a new ID and does not migrate existing workspaces.
-
-After the filesystem and deployment are selected, use **Nodes → Add node** to enroll the prepared hosts. Connected, ready compute alone does not qualify an external filesystem; validate actual Session creation and access through each participating node before admitting application traffic. Include the independent namespace in the [stopped-write backup and restore procedure](./getting-started/operations.md#back-up).
-
-#### Quota mode storage server
-
-Quota mode bounds each workspace's allocated bytes and inodes with an XFS project quota on the NFS server, set by the `oac-workspace-quota` command that Core calls over a restricted SSH forced command. [Quota mode](./workspace-provider.md#quota-mode) owns the protocol and enforcement semantics. Prepare the storage server as its administrator:
-
-1. Put the export on a local XFS filesystem mounted with enforcing project quotas (`prjquota`, not `pqnoenforce`). The export root must be a subdirectory of that mount, for example mount `/srv/xfs` and export `/srv/xfs/oac-workspaces`; the command keeps its journal in `/srv/xfs/.oac-quota`, outside the export. Prepare the namespace root and marker as above.
-2. Install `xfsprogs` and Python 3.9 or newer. Install `storage/oac-workspace-quota` from the matching distribution as `/usr/local/sbin/oac-workspace-quota`, owned by root with mode `0755`.
-3. Write `/etc/oac/workspace-quota.json`, owned by root and not writable by group or others: `{"export_root": "/srv/xfs/oac-workspaces", "mount_point": "/srv/xfs"}`.
-4. Reserve a project ID range that no other project on this filesystem uses, then initialize the journal once: `oac-workspace-quota --config /etc/oac/workspace-quota.json init --projid-start 100000 --projid-end 199999`. It refuses to run over an existing journal; never initialize restored storage.
-5. Generate a dedicated key pair, for example `ssh-keygen -t ed25519 -N '' -f oac-workspace-quota`. Authorize its public key for one account with a working shell, such as `oac-quota`, in that account's `authorized_keys`: `restrict,from="<Core address>",command="sudo -n /usr/local/sbin/oac-workspace-quota --config /etc/oac/workspace-quota.json serve" ssh-ed25519 AAAA...`, with the sudoers entry `oac-quota ALL=(root) NOPASSWD: /usr/local/sbin/oac-workspace-quota --config /etc/oac/workspace-quota.json serve`. Alternatively authorize the key for root with the same options and the command without `sudo -n` under `PermitRootLogin forced-commands-only`. Keep `PermitUserEnvironment no`.
-6. Read the server's public host key from `/etc/ssh/` on the server itself, not from an unauthenticated network scan.
-
-Select the quota mode configuration with the private key as its write-only credential. Delete the local private key file after a successful selection; Core keeps it encrypted with `secrets/core/credential.key`:
-
-```json
-{
-  "id": "33333333-3333-4333-8333-333333333333",
-  "adapter": "nfs",
-  "parameters": {
-    "root": "/srv/oac-workspaces",
-    "namespace_id": "22222222-2222-4222-8222-222222222222",
-    "uid": 65532,
-    "quota": {
-      "endpoint": "storage.internal:22",
-      "user": "oac-quota",
-      "host_key": "ssh-ed25519 AAAA..."
-    }
-  },
-  "credential": {
-    "ssh_private_key": "-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----\n"
-  },
-  "tenant_capacity_mib": 65536
-}
-```
+`OAC_EXECUTION_CONCURRENCY` is unrelated: it limits concurrent execution work in Core.
 
-Selection calls the command's read-only check through the pinned host key. Then update the deployment with the per-workspace capacity in `resources.environment_disk_mib`. Until that update, an installation that switched from a configuration without quotas refuses new workspaces; existing workspaces continue with their own configuration. The credential belongs to the immutable configuration. To rotate it, authorize a new key, select a new configuration ID with it, and keep the old key authorized until no workspace bound to the old configuration is still being created.
+### Default models
 
-Supported recovery for quota mode is a block-level copy of the XFS filesystem; see [back up](./getting-started/operations.md#back-up).
+Set a default in **Settings** → **Models and credentials**, or use `PUT /core/v1/harnesses/{harness}/model-configuration`. Core encrypts provider keys with `secrets/core/credential.key` and never returns them. [Model execution](../contracts/agents-api/model-execution.md#deployment-defaults) owns the request fields and replacement rules, and [precedence](../contracts/agents-api/model-execution.md#saved-defaults-and-precedence) says which Sessions use a default.
 
-#### Tenant capacity
+### Tenant capacity
 
 `tenant_capacity_mib` is the installation's single tenant capacity policy, written only together with the selection by `PUT /core/v1/workspace-storage` and stored in Core's database. A positive value requires a quota mode configuration, and a quota mode configuration requires a positive value. It bounds the sum of admitted capacities of one tenant's workspaces that are not yet confirmed deleted, across configuration changes; [capability validation](./workspace-provider.md#capability-validation) owns the counting rules. Lowering the value refuses new workspaces only; deleting Sessions frees capacity once their storage is removed.
 
@@ -202,16 +93,6 @@ Workspaces created without quota mode remain unbounded; nothing resizes or migra
 
 The policy bounds what each tenant can commit, not the filesystem. Size the XFS filesystem for the number of tenants times the policy plus headroom for unbounded workspaces, identities, deletion markers, the journal and XFS metadata, or oversubscribe knowingly and monitor free space. Keep each node's `checkpoint_root` on separate storage. Capacity bounds provide no I/O fairness.
 
-### Node capacity
-
-Core approves a node's capacity when you generate its Add node command: **Sandboxes at once** (`max_active`, default 2) and, for microsandbox only, **Retained sandboxes** (`max_retained`, default 8), with `max_retained >= max_active >= 1`. Docker never suspends sandboxes, so Web doesn't ask for it and Core keeps `max_retained` equal to `max_active`. Change them later on **Nodes** with **Edit node**. Reservations and cleanup that is not confirmed count against capacity; lowering a limit stops no running sandbox. A node's own files can't change its capacity, size or Runtime.
-
-`OAC_EXECUTION_CONCURRENCY` is unrelated: it limits concurrent execution work in Core.
-
-### Default models
-
-Set a default in **Settings** → **Models and credentials**, or use `PUT /core/v1/harnesses/{harness}/model-configuration`. Core encrypts provider keys with `secrets/core/credential.key` and never returns them. [Model execution](../contracts/agents-api/model-execution.md#deployment-defaults) owns the request fields and replacement rules, and [precedence](../contracts/agents-api/model-execution.md#saved-defaults-and-precedence) says which Sessions use a default.
-
 ## Compose installations
 
 The [standalone Compose file](./getting-started/install-options.md#docker-compose-and-hosting-platforms) takes process settings from the platform's environment. Set [`OAC_PUBLIC_URL`](#settings) to the exact public origin, without a trailing slash, and recreate Core and Web before adding nodes or executors. The platform terminates TLS and routes to `web:8080`.
@@ -233,12 +114,12 @@ The named Docker volume `<project>_data` contains these paths. Docker manages Li
 
 ## Docker node configuration
 
-The node installer writes Docker’s host settings into the `native` object of the node’s configuration file, which only the Docker adapter reads. Deployment resources, the Runtime release and capacity remain in [Core’s database](#runtime-settings-web).
+The node installer writes Docker’s host settings into the `native` object of the node’s configuration file, which only the Docker adapter reads. Deployment resources and capacity remain in [Core’s database](#runtime-settings-web).
 
 | Field | Installer value | Meaning |
 | --- | --- | --- |
 | `host` | `unix:///var/run/docker.sock` | Explicit Docker Engine socket |
-| `image` | The Runtime image’s local ID after loading | The release’s `image_id` or `image_manifest_digest`. The host’s image store decides which digest names the loaded image, so the value is node-local; the adapter accepts only these two |
+| `image` | The Runtime image’s local ID after loading | The installation’s Runtime image. The host’s image store decides whether its local ID is the manifest’s `image_id` or `image_manifest_digest`, so the value is node-local |
 | `network` | `oac-node-<installation-id>` | Runtime container network |
 | `seccomp_file` | `<node-root>/runtime/seccomp.json` | Matched distribution’s seccomp profile |
 | `nested_sandbox` | `true` | Enables the Docker adapter’s init process and proc-mask configuration |
@@ -252,13 +133,17 @@ The installer creates `~/.oac/core` by default (`$HOME/.oac/core` on Windows). I
 | Path | Content | Changed by |
 | --- | --- | --- |
 | `.env` | Process settings and the stable Compose project name | You, then `oac apply` |
-| `compose.yaml` | Verified release service definition | The installer, when it installs or [upgrades](./getting-started/operations.md#upgrade) |
-| `compose.override.yaml` | Optional local Compose entries. For a source bundle it is JSON and also holds the four service images and Web's `/node-payload` bind | You. `install.py` replaces only its own entries and requires JSON |
+| `compose.yaml` | Verified release service definition | The installer, when it installs |
+| `compose.override.yaml` | Optional local Compose entries. For a source bundle it is JSON and also holds Web's `/node-payload` bind and Core's native installer bind | You. `install.py` replaces only its own entries and requires JSON |
 | `oac` (`oac.exe` on Windows) | Native management command | The installer |
 
 The sibling `<install-dir>.lock` directory remains for synchronization; `<install-dir>.staging` holds unpublished installation files. Neither contains service data. On Unix the installer creates private directories with mode `0700` and configuration files with mode `0600`.
 
-The Compose project is named `oac-<10 hex digits>`. Its services are `init`, `database`, `core` and `web`. Core applies database migrations when it starts. Web serves the console and forwards `/v1` and `/api/v1` to Core; it is the only service with a published port, `OAC_WEB_PORT`. No service receives a Docker socket.
+The Compose project is named `oac-<10 hex digits>`. Its services are `init`, `database`, `core` and `web`. Core applies database migrations when it starts. Web serves the console and is the only service with a published port, `OAC_WEB_PORT`; see [Request boundary](./web/console-server.md#request-boundary) for what it forwards. No service receives a Docker socket, and Web and Core have no KVM access.
+
+## Independent workspace storage {#independent-workspace-storage}
+
+microsandbox requires independent workspace storage, and the only supported combination is with the [kernel NFS adapter](./workspace-provider.md#kernel-nfs-adapter). Select it in **Settings → Workspace storage** (`/core/v1/workspace-storage`, see the [Core administration API](../contracts/agents-api/admin-api.md#workspace-storage)); the selection and its tenant capacity apply to new workspaces, and existing workspaces keep their configuration. [Set up workspace storage](./getting-started/workspace-storage.md) covers the NFS export, the Compose mount, the selection payloads and the quota mode storage server.
 
 ## Appendix: Core environment without the installer
 
@@ -294,3 +179,31 @@ Compose sets these for Web. Set them yourself only when you run the console with
 | `OAC_WEB_NODE_PAYLOAD_DIR` | unset | Absolute path of the matched distribution's node payload (the installer's `node-payload/`). Unset, `/node-install/*` is not served and Add node is unavailable |
 
 An unset or empty variable selects its default. An invalid value stops the console at startup with a message naming the variable. The console also reads the three log [process settings](#settings) and rejects the values Core rejects. Use HTTPS for any browser that is not on the same machine.
+
+## Appendix: Runtime history file {#runtime-history-file}
+
+`OAC_HISTORY_SETTINGS_FILE` names a JSON file that tunes [retained history](../contracts/agents-api/runtime-observability.md#retained-history-and-optional-export) and adds an optional OTLP export. Without it, Core keeps history in its database with the defaults below. In a Compose installation, put the file in the data volume's `secrets/core/` directory, owned by UID 65532 with mode `0600`, and set `OAC_HISTORY_SETTINGS_FILE=/run/oac/<file name>`: Core mounts that directory read-only at `/run/oac`. Headers may hold export credentials; they never appear in `oac` output or in the installation report. Unknown fields are rejected.
+
+| Field | Default | Meaning |
+| --- | --- | --- |
+| `sample_interval_seconds` | `30` | Periodic sampling interval, from 5 to 300 |
+| `queue_capacity` | `256` | Records each exporter queues, at most 4096 |
+| `timeout_seconds` | `2` | Export and history query timeout, at most 30 |
+| `endpoint` | unset | Absolute OTLP/HTTP metrics URL, such as `https://collector.example/v1/metrics`. Unset, Core exports nothing and the other export fields must be unset |
+| `transport` | unset | `otlp_http`; required with `endpoint` |
+| `insecure` | `false` | `true` is required for an `http` endpoint and rejected for `https` |
+| `headers` | none | Request headers for the endpoint. `Host`, `Content-Length`, `Content-Type` and `Content-Encoding` are reserved |
+
+## Appendix: Runtime resource directories {#runtime-resource-directories}
+
+The Runtime resolves its resource directories before discovering Harness adapters. `<RuntimeHome>` is the Runtime home selected by `OAC_RUNTIME_HOME`. `OAC_RUNTIME_STATE_DIRECTORY` defaults only when unset; an empty, relative or noncanonical explicit value is rejected. Directory settings have no secondary file or environment fallback.
+
+| Runtime process setting | Default | Packaged Linux images |
+| --- | --- | --- |
+| `OAC_RUNTIME_INITIALIZATION_DIRECTORY` | `<RuntimeHome>/initialization` | `/environment/initialization` |
+| `OAC_RUNTIME_PACKAGE_DIRECTORY` | `<RuntimeHome>/packages` | `/environment/packages` |
+| `OAC_RUNTIME_STATE_DIRECTORY` | `<RuntimeHome>` | `/environment/runtime-state` |
+
+The state directory contains retained native Harness history and capability-installation completion records. It is separate from the declared workspace directory. Selecting a separate state directory does not relocate Runtime device credentials or connection identity from their instance-private paths in the Runtime home; they must not be copied with native history. [Harness onboarding](../contracts/agents-api/harness-onboarding.md#register-the-adapter) defines the adapter boundary, and [Environment preparation](../contracts/agents-api/environments.md) owns initialization and package behavior.
+
+Placing state on an independent filesystem preserves those files when compute is replaced. Native continuation still requires a qualified Harness, matching ownership and confirmed stop of the previous writer. It does not preserve process memory or arbitrary files on the compute root disk.
diff --git a/docs/development.md b/docs/development.md
index 8bd2d8677..e4bad1ea7 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -2,7 +2,7 @@
 title: "Develop OpenAgentCore"
 ---
 
-Set up a checkout, build a component and validate your changes. To use an installation, start with the [getting started guide](./getting-started/index.md). Read the [contributor rules](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md) before changing code.
+Set up a checkout, build a component and validate your changes. To use an installation, start with the [Overview](./getting-started/index.md). Read the [contributor rules](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md) before changing code.
 
 For component responsibilities and execution flow, read [Architecture](./architecture.md).
 
@@ -11,7 +11,7 @@ For component responsibilities and execution flow, read [Architecture](./archite
 Work from an isolated worktree so experiments and validation do not disturb another checkout. From an existing clone with an up-to-date `main`:
 
 ```sh
-git worktree add ../openagentcore-change -b codex/my-change main
+git worktree add ../openagentcore-change -b fix-session-timeout main
 cd ../openagentcore-change
 ```
 
@@ -38,7 +38,7 @@ export OAC_TEST_OFFICIAL_SDK_PYTHON="$PWD/.venv/bin/python"
 
 ### Node dependency boundaries
 
-Each pnpm module owns a `pnpm-lock.yaml` beside its `package.json`. Website and Claude SDK adapter are independent pnpm projects with their own workspace boundaries. The Web/example/client workspace uses `sharedWorkspaceLockfile: false`: it links declared workspace dependencies without sharing dependency resolution or a virtual store. Root scripts only orchestrate module commands and have no installed tool dependencies. Declare build and test tools in the module that imports or executes them. The MiniMax companion uses its own npm manifest and `package-lock.json` and is outside the pnpm workspace.
+Each pnpm module owns a `pnpm-lock.yaml` beside its `package.json`. Website and the Claude Code adapter are independent pnpm projects with their own workspace boundaries. The Web/example/client workspace uses `sharedWorkspaceLockfile: false`: it links declared workspace dependencies without sharing dependency resolution or a virtual store. Root scripts only orchestrate module commands and have no installed tool dependencies. Declare build and test tools in the module that imports or executes them. The MiniMax companion has no dependencies and is outside the pnpm workspace.
 
 Install one module with `pnpm --dir website install --frozen-lockfile`, or include its workspace dependencies with `pnpm --filter @oac/web... install --frozen-lockfile`. Add or update dependencies through the same package filter and commit that module's manifest and lockfile. `make node-deps` installs all pnpm modules for full local validation. Web and the example share `packages/agents-client` through explicit `workspace:*` dependencies; their checks install that client too. Component Make targets use filtered installs and checks. CI caches use only the job's dependency locks; the [CI selection policy](./maintainers.md#continuous-integration) owns which checks a change selects.
 
@@ -70,23 +70,11 @@ python3 "$bundle/install.py" \
   --public-url http://YOUR_CORE_HOST:8080
 ```
 
-Replace `YOUR_CORE_HOST` with an address reachable by your browser and sandbox nodes. Use your HTTPS origin behind a reverse proxy when needed; [installation options](./getting-started/install-options.md) owns ingress configuration. A new installation prints the Core key for signing in; a rerun prints the command that shows it. It creates the standard Compose installation plus a read-only `node-payload` directory containing the bundle's public node artifacts. Allow disk space for both the extracted bundle and this installed copy. No Docker socket is passed to Core or Web.
+Replace `YOUR_CORE_HOST` with an address reachable by your browser and sandbox nodes. [Installation options](./getting-started/install-options.md#offline-hosts) describes the `install.py` options, reruns and recovery. The build also creates `oac-<commit>-linux-amd64-offline.tar.gz` for installing on another Linux amd64 Docker host.
 
-The build also creates `oac-<commit>-linux-amd64-offline.tar.gz`. Copy and extract that archive on another Linux amd64 Docker host, then run its `install.py`; no checkout, Go, Node or pnpm is needed on that host, only Python 3.9+ and Docker. Keep the extracted bundle until installation completes. The installed services and node downloads do not depend on its original location afterward.
+In Web, configure a model provider, create a sandbox deployment and add nodes with the command shown in [Add and manage nodes](./getting-started/nodes.md). Node prerequisites still apply, including KVM for microsandbox. The command downloads the matching execution artifacts directly from this installation. This path builds all three managed Harnesses; optional self-hosted native installers are unavailable unless you supply their [native installer catalog](./maintainers.md#native-installers). It does not create a placeholder catalog.
 
-In Web, configure a model provider, create a sandbox deployment and add nodes with the command shown in [Nodes](./getting-started/nodes.md). Node prerequisites still apply, including KVM for microsandbox. The command downloads the matching execution artifacts directly from this installation. This path builds all three managed Harnesses; optional self-hosted native installers are unavailable unless you supply their [native installer catalog](./maintainers.md#native-installers). It does not create a placeholder catalog.
-
-For a startup failure or a stopped installation, use the saved configuration instead of reinstalling:
-
-```sh
-cd "$HOME/.oac/local"
-docker compose logs --tail 100
-# Retry without downloading release images or replacing saved configuration.
-docker compose up -d --wait --pull never
-./oac core-key --show
-```
-
-Rerunning the same bundle's `install.py` on its installation directory resumes the installation with the saved settings; `--public-url` is required only for a new directory. A bundle from another commit refuses an existing installation unless you pass `--upgrade`, which [upgrades it in place](./getting-started/operations.md#upgrade). If a new installation fails before it starts the services, it leaves the installation directory as it found it; fix the cause and rerun the same command. Use the [operator commands](./getting-started/operations.md) for configuration, keys and stopping services.
+Use the [operator commands](./getting-started/operations.md) for configuration, keys and stopping services.
 
 ## Build and run components
 
@@ -107,20 +95,20 @@ For frontend development, run `pnpm dev:web` using the fixture or Core connectio
 
 | Location | Responsibility | Read next |
 | --- | --- | --- |
-| `services/core/internal/api` | Public, administrator and machine HTTP boundaries | [API index](./api/index.md) |
+| `services/core/internal/api` | Public, administrator and machine HTTP boundaries | [API namespaces and credentials](./api/index.md) |
 | `services/core/internal/persistence`, `services/core/internal/db` and `services/core/migrations` | Core's PostgreSQL adapters, transactions, queries and migrations | [Service guide](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/README.md#database) |
 | `services/core/tests/integration` | Tests that drive the HTTP boundaries, the execution Worker and the PostgreSQL adapters together | [Service guide](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/README.md#tests) |
 | `services/core/internal/execution` | Durable Turn dispatch and scheduling | [Runtime protocol](./runtime-protocol.md) |
-| `services/core/internal/engine` | Pure qualification of Harness operations and placements | [Harness onboarding](../contracts/agents-api/harness-onboarding.md) |
+| `internal/harnessconfig` | One declaration per Harness, read by Core admission and the Runtime | [Harness protocol](../contracts/agents-api/harness-onboarding.md) |
 | `internal/agentdaemon/proto` | Core–Runtime wire types and validators | [Runtime protocol](./runtime-protocol.md) |
 | `internal/runtimebootstrap` | Provider-to-Runtime startup input | [Runtime bootstrap](./runtime-bootstrap.md) |
 | `apps/daemon/internal/dispatch` | Runtime preparation, Executor reuse, Turn and cleanup ownership | [Harness lifecycle](../contracts/agents-api/harness-onboarding.md#required-adapter-interfaces) |
 | `apps/daemon/internal/agent` | Native Harness adapters | [Native references](../contracts/agents-api/harness-onboarding.md#native-references) |
-| `services/core/internal/sandbox` | Provider interfaces and managed compute lifecycle | [Provider onboarding](./sandbox-provider.md) |
+| `services/core/internal/sandbox` | Provider interfaces and managed compute lifecycle | [Sandbox Provider protocol](./sandbox-provider.md) |
 | `services/web` | Console login and the server-side management proxy | [Console server](./web/console-server.md) |
 | `apps/web` and `packages/agents-client` | Console UI and typed clients | [Web guide](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/web/README.md) |
-| `deploy` and `scripts` | Distribution, installation and validation tools | [Maintainers](./maintainers.md) |
-| `contracts/agents-api` | Pinned schema, semantic contracts and coverage ledger | [Coverage ledger](../contracts/agents-api/index.md) |
+| `deploy` and `scripts` | Distribution, installation and validation tools | [Build and release OpenAgentCore](./maintainers.md) |
+| `contracts/agents-api` | Pinned schema, semantic contracts and compatibility record | [OpenAI compatibility](../contracts/agents-api/index.md) |
 
 ## Choose an extension boundary
 
@@ -137,12 +125,12 @@ Choose focused checks for the current diff and its directly affected behavior us
 | Public schema, Core extensions or internal handler annotations | `make openapi`, `make check-openapi`; inspect generated types and all three namespace schemas |
 | Shared Runtime protocol | `make check-runtime-contract` |
 | Provider integration | `make check-sandbox-provider-contract` and the provider's native checks |
-| Claude SDK bridge and artifact | `make check-claude-sdk` |
+| Claude Code adapter and artifact | `make check-claude-sdk` |
 | Web UI and clients | `make check-web` |
 | Distribution or installer | `make check-distribution` |
-| Documentation | `make check-names`; `make check-distribution` validates Markdown links and bundled docs |
+| Documentation | `make check-docs` (Markdown links and anchors) and `pnpm --dir website check-translations` for Chinese mirrors |
 
-Fixture browser acceptance uses loopback ports 18092 and 4174. Select unused ports with `AGENTS_FIXTURE_PORT` and `AGENTS_WEB_PORT` when running parallel validation. Keep databases, ports and containers separate between validation workers. Compilation, fixture success and live model/provider acceptance establish different facts; report skipped or unavailable checks explicitly. Follow the [independent blind review workflow](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#review) after validation.
+Fixture browser acceptance uses loopback ports 18092 and 4174. Select unused ports with `AGENTS_FIXTURE_PORT` and `AGENTS_WEB_PORT` when running parallel validation. Keep databases, ports and containers separate between validation workers. Compilation, fixture success and live model/provider acceptance establish different facts; report skipped or unavailable checks explicitly. Follow the [review workflow](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#review) after validation.
 
 ## Change documentation
 
diff --git a/docs/examples.md b/docs/examples.md
index 67fd2c34a..1e61981fb 100644
--- a/docs/examples.md
+++ b/docs/examples.md
@@ -2,11 +2,7 @@
 title: "Examples"
 ---
 
-Complete applications built on the [Agents API](./api/public-agent-api.md). Each one runs against a real Core installation with a Project API key.
-
-| Example | What it shows |
-| --- | --- |
-| [Parsar Agent workbench](#parsar-agent-workbench) | A product UI: models, Skills, MCP, reusable Agents, and Sessions on any runtime |
+Complete applications built on the [Agents API guide](./api/public-agent-api.md), each running against a real Core installation with a Project API key.
 
 ## Parsar Agent workbench
 
@@ -23,15 +19,13 @@ Each feature maps to one part of the API. Read the code next to the guide sectio
 | Feature | API used | Guide | Code |
 | --- | --- | --- | --- |
 | Server-side key and headers | Bearer key, `OpenAI-Beta`, route allowlist | [Before you start](./api/public-agent-api.md#before-you-start) | [`server.mjs`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/server.mjs) |
-| Agents with a Harness and model | `x_agents_core.harness`, `model_provider` | [Core extensions](./api/public-agent-api.md#core-extensions-x_agents_core) | [`server/sessions.mjs`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/server/sessions.mjs) |
+| Agents with a Harness and model | `x_agents_core.harness`, `model_provider` | [Core extensions](./api/public-agent-api.md#core-extensions) | [`server/sessions.mjs`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/server/sessions.mjs) |
 | Sessions on three runtimes | `openai_hosted`, `none`, `self_hosted` with `workspace_directory` | [Create a Session](./api/public-agent-api.md#create-a-session) | [`server/sessions.mjs`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/server/sessions.mjs) |
 | Crash-safe Session creation | `Idempotency-Key`, recovery from a lost response | [Idempotency](./api/public-agent-api.md#idempotency) | [`server/sessions.mjs`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/server/sessions.mjs) |
 | Live replies | Event stream, text deltas, reconnect and reconcile | [Stream events](./api/public-agent-api.md#stream-events) | [`src/lib/live-session.ts`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/src/lib/live-session.ts) |
 | Follow-ups and cancel | Input events with idempotency keys | [Send input](./api/public-agent-api.md#send-input) | [`src/Composer.tsx`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/src/Composer.tsx) |
 | History | Paging Turns and Items | [Pagination](./api/public-agent-api.md#pagination) | [`src/lib/api.ts`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/src/lib/api.ts) |
 | Skills and versions | `/skills`, default version | [Skills](./api/public-agent-api.md#skills) | [`src/Skills.tsx`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/src/Skills.tsx) |
-| Connect your own machine | `x_agents_core.installation`, Environment status | [Self-hosted execution](./getting-started/self-hosted.md) | [`src/ConnectMachine.tsx`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/src/ConnectMachine.tsx) |
-
-## Add an example
+| Connect your own machine | `x_agents_core.installation`, Environment status | [Run self-hosted Sessions](./getting-started/self-hosted.md) | [`src/ConnectMachine.tsx`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/src/ConnectMachine.tsx) |
 
-Create a directory under `example/` with a README explaining how to run it and which API features it demonstrates, then add a row to this index. Follow the [application example boundary](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#optional-application-example).
+To contribute an example, follow the [application example boundary](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#optional-application-example).
diff --git a/docs/getting-started/index.md b/docs/getting-started/index.md
index f4f3bd1ce..856596abe 100644
--- a/docs/getting-started/index.md
+++ b/docs/getting-started/index.md
@@ -2,31 +2,24 @@
 title: "Overview"
 ---
 
-OpenAgentCore runs AI agents on your own infrastructure behind the OpenAI Agents API. The [architecture overview](../architecture.md) explains its parts. Pick the guides for your role.
+OpenAgentCore runs AI agents on your own infrastructure behind the OpenAI Agents API. Operators install it and add sandbox capacity; application developers call it with the official OpenAI SDK. [Concepts](../concepts.md) defines its terms and [Architecture](../architecture.md) shows its parts.
 
-## Operators
+## Run an installation
 
-Operators install Core and Web, add sandbox capacity and issue Project API keys.
+1. [Install Core and Web](./install.md)
+2. [Configure the public address](./public-address.md)
+3. [Choose a sandbox backend](./sandbox-backends.md), then [Set up workspace storage](./workspace-storage.md) and [Add and manage nodes](./nodes.md)
+4. [Operations](./operations.md) and [Troubleshooting](./troubleshooting.md)
 
-| Guide | Covers |
-| --- | --- |
-| [Install Core and Web](./install.md) | The default installation, from an empty host to the first Project API key |
-| [Installation options](./install-options.md) | Installer flags, existing reverse proxies, offline hosts |
-| [Nodes](./nodes.md) | Adding, changing, removing and troubleshooting sandbox nodes |
-| [Operations](./operations.md) | The `oac` command, the Core key, backups, uninstall, upgrades and troubleshooting |
-| [Configuration reference](../configuration.md) | Every setting, file and environment variable |
-| [Web console](../web/index.md) | What the console shows and manages |
+Every setting is in the [Configuration reference](../configuration.md). Administrators watch and manage the installation in the [Web console](../web/index.md).
 
-## Application developers
+## Build an application
 
-Application developers call the API with a Project API key, and can run Sessions on machines they own.
+1. [Run your first Session](./quickstart.md)
+2. [Agents API guide](../api/public-agent-api.md)
+3. [Run self-hosted Sessions](./self-hosted.md) on your own machine
+4. [Examples](../examples.md)
 
-| Guide | Covers |
-| --- | --- |
-| [Quickstart](./quickstart.md) | From a Project API key to a finished Session |
-| [Agents API guide](../api/public-agent-api.md) | Common tasks, Harness and model choice, and every resource with SDK and HTTP examples |
-| [Self-hosted execution](./self-hosted.md) | Running a Session on your own machine |
-| [Examples](../examples.md) | Complete applications built on the API |
-| [API index](../api/index.md) | All three namespaces and their credentials |
+[API namespaces and credentials](../api/index.md) lists the three API namespaces and the credential each one takes.
 
-Contributors start with the [developer guide](../development.md) and [CONTRIBUTING.md](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md).
+Contributors start with [Develop OpenAgentCore](../development.md) and [CONTRIBUTING.md](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md).
diff --git a/docs/getting-started/install-options.md b/docs/getting-started/install-options.md
index 3219ca165..00326e29d 100644
--- a/docs/getting-started/install-options.md
+++ b/docs/getting-started/install-options.md
@@ -2,19 +2,45 @@
 title: "Installation options"
 ---
 
-The [default installation](./install.md) needs no options. Use this page to set installation options, deploy with Compose or configure a reverse proxy.
+Reference for the installer's flags, and how to install differently from the default: behind an existing reverse proxy, with Docker Compose on a hosting platform, or on a host without internet access. The [default installation](./install.md) needs no options.
 
-Pass options to the downloaded script:
+## Pass flags {#pass-flags}
 
-```sh
-./install.sh --public-url https://core.example
+::: code-group
+
+```sh [macOS / Linux]
+curl -fsSL https://openagentcore.dev/install.sh | bash -s -- --public-url https://core.example
+```
+
+```powershell [Windows]
+& ([scriptblock]::Create((irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1))) --public-url https://core.example
 ```
 
-On Windows, `irm … | iex` cannot pass flags and the default execution policy blocks a downloaded `.ps1` file, so run the script as a script block: `& ([scriptblock]::Create((irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1))) --public-url https://core.example`. With the Unix one-line command, append them after `bash -s --`. `--version TAG` selects a published release; otherwise the script selects the latest stable release and verifies the native command and Compose files against their SHA-256 checksums.
+:::
+
+On Windows, `irm … | iex` cannot pass flags and the default execution policy blocks a downloaded `.ps1` file, so run the script as a script block. The script selects the latest stable release unless you pass `--version`, and verifies the native command and Compose files against their SHA-256 checksums.
+
+## Flags
+
+| Flag | Default | Written to `.env` as | Effect |
+| --- | --- | --- | --- |
+| `--public-url` | Derived from the host's private address, or `http://localhost:<web port>`; see [Choose the public URL](./public-address.md#choose-the-public-url) | `OAC_PUBLIC_URL` | The origin applications, nodes and executors use |
+| `--host` | `0.0.0.0` | `OAC_HOST` | The address Web binds; see [Listeners and access](./public-address.md#listeners-and-access) |
+| `--web-port` | `8080` | `OAC_WEB_PORT` | The host port of Web; see [Ports](./public-address.md#ports) |
+| `--install-dir` | `~/.oac/core` | | Absolute installation directory. Use an empty or missing directory for a new installation, or an existing one to [retry](./install.md#install) |
+| `--version` | `latest` | | A published release tag |
+
+The flags that map to `.env` are written once. After installation, edit that file and run `oac apply`. Rerunning the installer on an existing installation ignores them, names those that differ from the saved settings, and starts it with the saved settings.
+
+Several installations can share a machine when they use distinct installation directories and ports. Use distinct IP addresses or a shared reverse proxy for more. Each installation has its own database, Core key and nodes.
+
+## Reverse proxy and HTTPS
+
+Install with `--host 127.0.0.1`, point your reverse proxy at Web and set `--public-url` to its HTTPS origin. [Configure the public address](./public-address.md#https-and-the-reverse-proxy) has the proxy requirements, Caddy and nginx examples and the routing check, and covers `--host`, `--web-port` and the port check.
 
 ## Docker Compose and hosting platforms
 
-Use the `compose.yaml` from a release on any [supported Core host](./install.md#prerequisites). The release pins its initialization, Core, Web and PostgreSQL images and source revision. PostgreSQL 16 is the official image, pinned by digest and mirrored to GHCR with the other images. It starts PostgreSQL, Core and Web. Web forwards `/v1` and `/api/v1` to Core. Data lives in a named Docker volume. The one-time initialization service generates random secrets there and prepares the node installer; Core applies database migrations when it starts. [Compose configuration](../configuration.md#compose-installations) owns the settings and the data directory.
+Use the `compose.yaml` from a release on any [supported Core host](./install.md#prerequisites). The release pins its initialization, Core, Web and PostgreSQL images and source revision. PostgreSQL 16 is the official image, pinned by digest and mirrored to GHCR with the other images. It starts PostgreSQL, Core and Web. Data lives in a named Docker volume. The one-time initialization service generates random secrets there and prepares the node installer; Core applies database migrations when it starts. [Compose configuration](../configuration.md#compose-installations) owns the settings and the data directory.
 
 For a local trial, download `compose.yaml` from a release into an empty directory, then run:
 
@@ -31,107 +57,56 @@ You can deploy before choosing a domain: leave `OAC_PUBLIC_URL` unset or empty,
 
 ### Dokploy
 
-Create a Docker Compose application and paste `compose.yaml`. Set `OAC_PUBLIC_URL` to the public HTTPS origin, enable isolated deployment, and add a domain for service `web`, port `8080`. Enable **HTTPS** and select a certificate provider such as **Let's Encrypt** for that domain before deploying. Remove the `ports` block from service `web` before deploying so Dokploy routes to its container port without publishing a host port. The [template metadata](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/dokploy.toml) supplies the generated domain and environment when packaging this Compose file for Dokploy's template catalog; HTTPS and its certificate provider still need to be enabled after import.
-
-### Coolify
-
-Create a **Docker Compose Empty** service and paste `compose.yaml`. Set `OAC_PUBLIC_URL` to the public HTTPS origin and assign that domain to `web` on port `8080`. Add Coolify's `exclude_from_hc: true` to the `init` service definition so completed initialization does not affect its overall health. Remove the `ports` block from service `web`, then save and deploy; Coolify routes to its container port and supplies HTTPS.
-
-On either platform, open its server terminal and run `docker compose ls` to find the deployed project name and Compose file. Using those exact values and the deployment's `OAC_PUBLIC_URL`, run `docker compose -p <project-name> -f <compose-file> exec web oac-web core-key`, then sign in at the configured origin. The [Dokploy domain guide](https://docs.dokploy.com/docs/core/docker-compose/domains) and [Coolify Compose guide](https://coolify.io/docs/services/configuration/docker-compose) describe their domain and service controls. These are importable deployment files; no hosted marketplace listing is published by this repository.
-
-After signing in, choose the sandbox backend and add nodes using [Nodes](./nodes.md). The Compose stack deploys the control plane; execution machines remain separate.
-
-Stop with `docker compose stop` using the same files and environment. Back up the data volume and configuration together while the services are stopped. To upgrade, back up first, then deploy the new release's `compose.yaml` with the same project, environment and data volume: initialization upgrades the volume and Core migrates the database. [Upgrade](./operations.md#upgrade) describes what is kept and why an older release is refused.
-
-## Process settings
-
-These flags are written to `.env` once. After installation, edit that file and run `oac apply`. Rerunning the installer on an existing installation ignores these flags, names those that differ from the saved settings, and starts it with the saved settings.
-
-| Flag | `.env` variable |
-| --- | --- |
-| `--public-url` | `OAC_PUBLIC_URL` |
-| `--host` | `OAC_HOST` |
-| `--web-port` | `OAC_WEB_PORT` |
-
-
-## Installation actions
+1. Create a Docker Compose application and paste `compose.yaml`.
+2. Set `OAC_PUBLIC_URL` to the public HTTPS origin and enable isolated deployment.
+3. Add a domain for service `web`, port `8080`. Enable **HTTPS** and select a certificate provider such as **Let's Encrypt** for that domain.
+4. Remove the `ports` block from service `web`, so Dokploy routes to its container port without publishing a host port.
+5. Deploy.
 
-`--install-dir` chooses where the installation is created. Neither option is a process setting.
+The [template metadata](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/dokploy.toml) supplies the generated domain and environment when packaging this Compose file for Dokploy's template catalog; HTTPS and its certificate provider still need to be enabled after import.
 
-| Option | Purpose |
-| --- | --- |
-| `--install-dir DIR` | Absolute installation directory; defaults to `~/.oac/core`. Use an empty or missing directory for a new installation, or an existing installation directory to [retry](./install.md#install) or upgrade |
-| `--upgrade` | Upgrade the existing installation in `--install-dir` to the installer's release; see [Upgrade](./operations.md#upgrade) |
-
-Several installations can share a machine when they use distinct installation directories and ports. Use distinct IP addresses or a shared reverse proxy for more. Each installation has its own database, Core key and nodes.
-
-## Sandbox backend
-
-The installer saves no sandbox backend. After signing in, open **Settings** → **Sandbox and scheduling** and choose Docker, microsandbox or E2B; Web proposes the [default size the Provider declares](../sandbox-provider.md#register-the-provider-kind) as Standard. The choice is stored in Core's database. To change it later, [reset the deployment](./nodes.md#change-the-sandbox-configuration). Docker shares each node's kernel with its sandboxes, and its node service account is [root-equivalent](./nodes.md#what-the-installer-sets-up). E2B needs a public HTTPS URL that is not loopback, because E2B's sandboxes call Core from E2B's cloud. Prepare an E2B template with the [E2B guide](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/e2b/README.md).
-
-## Listeners and access
-
-The default installation publishes Web on `--web-port` (8080) at `--host 0.0.0.0`. Core and PostgreSQL stay private. `--host` is an IPv4 or IPv6 address, without a port, scheme or zone. Use a concrete server IP in the browser, not a wildcard.
-
-`--public-url` sets `OAC_PUBLIC_URL`, the origin applications, nodes and executors use. Behind a reverse proxy, set it to the HTTPS origin the proxy serves. Without it, the installer uses `http://<address>:<web port>` when `--host` is `0.0.0.0` and the host's default route has a private-network address, and `http://localhost:<web port>` otherwise. [Changing the public URL](../configuration.md#changing-the-public-url) lists the accepted origins.
-
-### Ports
-
-The installer checks `--web-port` before it downloads images.
-
-- `--host` is the address that port binds. `0.0.0.0` publishes Web on every IPv4 interface. `127.0.0.1` keeps Web on this machine.
-- A busy port stops installation. It does not move to another port.
+### Coolify
 
-`oac apply` recreates Web when `OAC_HOST` or `OAC_WEB_PORT` changes.
+1. Create a **Docker Compose Empty** service and paste `compose.yaml`.
+2. Set `OAC_PUBLIC_URL` to the public HTTPS origin and assign that domain to `web` on port `8080`.
+3. Add Coolify's `exclude_from_hc: true` to the `init` service definition so completed initialization does not affect its overall health.
+4. Remove the `ports` block from service `web`, then save and deploy. Coolify routes to its container port and supplies HTTPS.
 
-## HTTPS and the reverse proxy
+On either platform, open its server terminal and run `docker compose ls` to find the deployed project name and Compose file. Using those exact values and the deployment's `OAC_PUBLIC_URL`, run `docker compose -p <project-name> -f <compose-file> exec web oac-web core-key`, then sign in at the configured origin. The [Dokploy domain guide](https://docs.dokploy.com/docs/core/docker-compose/domains) and [Coolify Compose guide](https://coolify.io/docs/services/configuration/docker-compose) describe their domain and service controls.
 
-Install with `--host 127.0.0.1` and point your reverse proxy at Web, `127.0.0.1:8080` by default. Web routes `/v1`, `/api/v1` and `/docs` to Core and serves everything else itself.
+After signing in, [choose a sandbox backend](./sandbox-backends.md) and add nodes using [Add and manage nodes](./nodes.md). The Compose stack deploys the control plane; execution machines remain separate.
 
-The proxy must:
+Stop with `docker compose stop` using the same files and environment. Back up the data volume and configuration together while the services are stopped. To move to another release, remove the stack with its data volume (`docker compose down --volumes`), then deploy the new release.
 
-- **Preserve Host.** Web accepts only the host of `OAC_PUBLIC_URL`.
-- **Pass WebSocket upgrades** on `/api/v1`.
-- **Not buffer or time out streams.** `/v1` streams Session events.
-- **Accept large uploads.** Source files may reach 512 MiB; Core enforces the limits.
+## Offline hosts
 
-**Caddy** obtains the certificate itself and passes Host and WebSockets by default:
+The installer downloads release files from GitHub Releases with this shell's network settings, including `HTTPS_PROXY`. Docker pulls the images through its daemon, which does not read the shell's proxy variables. Every image, PostgreSQL included, comes from GHCR (`ghcr.io`); Docker Hub is not needed. When GHCR is reachable only through a proxy or mirror, configure [the daemon's proxy](https://docs.docker.com/engine/daemon/proxy/) or a [registry mirror](https://docs.docker.com/docker-hub/image-library/mirror/), then rerun the installer.
 
-```caddyfile
-core.example {
-	reverse_proxy 127.0.0.1:8080
-}
-```
+A Linux amd64 host without that access installs from the release asset `oac-<commit>-linux-amd64-offline.tar.gz`, which contains every image and node artifact and the Linux amd64 self-hosted installer with every Harness. Self-hosted machines on macOS and Windows download their installer from GitHub Releases. Copy it to the host, extract it and run its `install.py` with Python 3.9 or newer and Docker. No checkout, Go, Node or pnpm is needed on that host. Keep the extracted bundle until installation completes; the installed services and node downloads do not depend on its original location afterward. The same archive is what [Develop OpenAgentCore](../development.md#install-a-checkout-without-publishing-a-release) builds from a checkout.
 
-Then set `OAC_PUBLIC_URL=https://core.example` in `~/.oac/core/.env` and run `~/.oac/core/oac apply`. Check the routing:
+### `install.py` options
 
 ```sh
-curl -s -o /dev/null -w '%{http_code}\n' -H 'OpenAI-Beta: agents=v1' https://core.example/v1/agents
+python3 oac-<commit>-linux-amd64/install.py --install-dir "$HOME/.oac/local" --host 0.0.0.0 --public-url http://YOUR_CORE_HOST:8080
 ```
 
-`401` means `/v1` reached Core, which asks for a key. `404` means it reached Web: fix the proxy, or application calls and every node connection will fail.
+| Option | Default | Effect |
+| --- | --- | --- |
+| `--install-dir` | `~/.oac/local` | Absolute installation directory |
+| `--host` | `127.0.0.1` | The address Web binds. Unlike `oac install`, `install.py` defaults to loopback: pass `0.0.0.0` for access from other machines |
+| `--web-port` | `8080` | The host port of Web |
+| `--public-url` | | The origin browsers and nodes use. Required for a new installation |
 
-TLS verification stays on everywhere. With a private certificate authority, node hosts, self-hosted machines and the Runtime image must trust it.
+Replace `YOUR_CORE_HOST` with an address your browser and sandbox nodes can reach, or use your HTTPS origin behind a reverse proxy. A new installation prints the Core key; a rerun prints the command that shows it. The installation is the standard Compose installation plus a read-only `node-payload` directory holding the bundle's public node artifacts. Allow disk space for both the extracted bundle and the installed copy.
 
-### Try it locally with a quick tunnel
+Rerunning the same bundle's `install.py` on its installation directory resumes the installation with the saved settings. A bundle from another commit refuses an existing installation. If a new installation fails before it starts the services, it leaves the installation directory as it found it; fix the cause and rerun the same command.
 
-A [Cloudflare quick tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/) gives a trial installation with external ingress a temporary public HTTPS address. It forwards to one port, so put a local proxy with the same routes in front:
+For a startup failure or a stopped installation, use the saved configuration instead of reinstalling:
 
-```caddyfile
-http://:8443 {
-	bind 127.0.0.1
-	reverse_proxy 127.0.0.1:8080
-}
+```sh
+cd "$HOME/.oac/local"
+docker compose logs --tail 100
+# Retry without downloading release images or replacing saved configuration.
+docker compose up -d --wait --pull never
+./oac core-key --show
 ```
-
-1. Start the proxy: `caddy run --config Caddyfile`.
-2. Start the tunnel: `cloudflared tunnel --url http://127.0.0.1:8443`. It prints an address such as `https://random-words.trycloudflare.com`.
-3. Set that address as `OAC_PUBLIC_URL` in `~/.oac/core/.env` and run `~/.oac/core/oac apply`.
-
-The address changes whenever `cloudflared` restarts; nodes bound to the old address must then be added again. Throughput is low, so a node's first Runtime download (about 500 MB) can be slow; see [slow links](./nodes.md#rerun-expiry-and-slow-links).
-
-## Offline hosts
-
-The installer downloads release files from GitHub Releases with this shell's network settings, including `HTTPS_PROXY`. Docker pulls the images through its daemon, which does not read the shell's proxy variables. Every image, PostgreSQL included, comes from GHCR (`ghcr.io`); Docker Hub is not needed. When GHCR is reachable only through a proxy or mirror, configure [the daemon's proxy](https://docs.docker.com/engine/daemon/proxy/) or a [registry mirror](https://docs.docker.com/docker-hub/image-library/mirror/), then rerun the installer.
-
-A Linux amd64 host without that access installs from the release asset `oac-<commit>-linux-amd64-offline.tar.gz`, which contains every image and node artifact. Copy it to the host, extract it and run its `install.py` with Python 3.9 or newer; [source installation](../development.md#install-a-checkout-without-publishing-a-release) describes its options.
diff --git a/docs/getting-started/install.md b/docs/getting-started/install.md
index 0804e9736..ca7401a54 100644
--- a/docs/getting-started/install.md
+++ b/docs/getting-started/install.md
@@ -2,70 +2,66 @@
 title: "Install Core and Web"
 ---
 
-One command installs Core, the Web console and PostgreSQL on Linux, macOS or Windows. Sign in to Web with the Core key, set a default model and issue Project API keys. Applications call Core with those keys. Sessions run in sandboxes on nodes you add, or on E2B.
+This guide takes an operator from an empty host to a working installation: Core, the Web console and PostgreSQL running under Docker, a sandbox backend, a default model and a first Project API key. Web's **Overview** tracks the same steps in its **Getting started** checklist.
 
 1. [Check the prerequisites](#prerequisites).
 2. [Run the installer](#install).
 3. [Sign in to Web](#sign-in-to-web).
-4. [Configure the public address](#configure-the-domain-and-https).
+4. [Add sandbox capacity](#add-sandbox-capacity).
 5. [Set a default model](#set-a-default-model).
 6. [Issue a Project API key](#issue-a-project-api-key).
-7. [Add sandbox capacity](#add-sandbox-capacity).
 
-This page follows the default path. Every flag, existing reverse proxies and offline hosts are in [installation options](./install-options.md).
+Every installer flag, existing reverse proxies and offline hosts are in [Installation options](./install-options.md).
 
 ## Prerequisites
 
-- Linux amd64/arm64 or macOS Intel/Apple Silicon with curl; Windows x64 with PowerShell.
-- Docker Engine 26 or newer and Docker Compose 2.26.0 or newer. On macOS and Windows, install and start Docker Desktop using Linux containers.
-- An account that can run `docker` and write to its home directory. On Linux, add it to the `docker` group and log in again, or use rootless Docker. Run the installer and `oac` as that account, never with `sudo`: a `sudo` run leaves files in `~/.oac` that belong to root and stop later runs.
-- Access to the container registries from the Docker daemon, which does not use this shell's proxy variables. See [offline hosts](./install-options.md#offline-hosts).
-- Free port 8080 for Web. See [ports](./install-options.md#ports). Docker must be able to publish it; the installer does not change host policy.
-- For anything off this machine, the origin in `OAC_PUBLIC_URL` must be the address browsers, nodes and executors use. You can sign in on this machine first.
+| | Linux | macOS | Windows |
+| --- | --- | --- | --- |
+| Host | amd64 or arm64, with curl | Intel or Apple Silicon, with curl | x64, with PowerShell |
+| Docker | Docker Engine, running | Docker Desktop, running | Docker Desktop, running Linux containers |
+| Account | A member of the `docker` group, or rootless Docker | Your user | Your user |
 
-Sandbox nodes run on Linux amd64. When Core runs on macOS or Windows, connect a Linux node or use E2B.
+- Docker Engine 26 or newer and Docker Compose 2.26.0 or newer, on every platform. Docker Desktop must be recent enough to include them.
+- The Docker daemon can reach the container registries. It does not read this shell's proxy variables; see [offline hosts](./install-options.md#offline-hosts). Release downloads also require access to GitHub.
+- Port 8080 is free, and Docker can publish it; see [ports](./public-address.md#ports). The installer does not change host policy.
+
+> [!WARNING]
+> Run the installer and `oac` as that account, never with `sudo`. A `sudo` run leaves files in `~/.oac` owned by root, and later runs fail.
 
 ## Install
 
-Linux and macOS:
+::: code-group
 
-```sh
+```sh [macOS / Linux]
 curl -fsSL https://openagentcore.dev/install.sh | bash
 ```
 
-The domain entry downloads and runs the latest GitHub Release installer, forwarding all arguments. Release downloads still require access to GitHub.
-
-Windows PowerShell:
-
-```powershell
+```powershell [Windows]
 irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1 | iex
 ```
 
-To pass flags on Windows, see [Install options](./install-options.md).
-
-When binding to all IPv4 addresses, the installer uses the private address of the default route if available; otherwise the console address is `http://localhost:8080`. To choose another reachable origin, pass `--public-url`; if a reverse proxy already serves this host, use its HTTPS address:
+:::
 
-```sh
-curl -fsSL https://openagentcore.dev/install.sh | bash -s -- --public-url https://core.example
-```
+The installer checks Docker and the port, writes the [installation directory](../configuration.md#installation-directory) `~/.oac/core` with its `.env` and the `oac` command (`oac.exe` on Windows), and starts the services. Web serves the console on port 8080 and [forwards API requests to Core](./public-address.md#listeners-and-access). Downloads and configuration checks finish before the installation directory is created, so a failed new installation leaves nothing behind. It prints the console address and, on a fresh installation, the Core key; a rerun prints `oac core-key --show` instead.
 
-The script downloads that release's Compose files, checks their SHA-256, and:
+The console address defaults to this host's private IP on the default route, or `http://localhost:8080` when there is none. Browsers must open exactly that address. To choose it yourself, for example the HTTPS address of an existing reverse proxy, pass `--public-url`. To pass flags on Windows, see [Pass flags](./install-options.md#pass-flags).
 
-1. checks Docker is running Linux containers, meets the required versions, and can publish the chosen port;
-2. prepares the [installation directory](../configuration.md#installation-directory), `~/.oac/core`, with `.env` and the native `oac` command (`oac.exe` on Windows);
-3. starts the services with Docker Compose. Web serves the console on port 8080 and forwards `/v1`, `/api/v1` and `/docs` to Core. Core and PostgreSQL are not published.
+::: code-group
 
-The installer prints the console address and, on a fresh install only, the Core key; a rerun or upgrade prints `oac core-key --show` instead. When the installer chose the console address itself, it adds that browsers must open exactly that address and how to change it with `OAC_PUBLIC_URL`. After signing in, configure execution resources and create Projects in Web.
-
-Downloads and configuration checks happen before the installation directory is published. After that, failures preserve the configuration and data. A rejected setting or data volume is reported by itself: fix it as the message says. A service that does not become healthy within three minutes is named together with the `docker compose logs --tail 50` command for it; fix the cause and rerun the same command. Ctrl-C prints `Interrupted; rerun the installer to continue.` and leaves the installation ready for that rerun. Rerun the same command, or specify the installation directory:
+```sh [macOS / Linux]
+curl -fsSL https://openagentcore.dev/install.sh | bash -s -- --public-url https://core.example
+```
 
-```bash
-curl -fsSL https://openagentcore.dev/install.sh | bash -s -- --install-dir "$HOME/.oac/core"
+```powershell [Windows]
+& ([scriptblock]::Create((irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1))) --public-url https://core.example
 ```
 
-Use your chosen directory if it differs. A rerun uses the saved Compose file and settings; installation flags only apply to new directories, and the installer names the ones it ignored. Existing images and containers are reused; missing images are downloaded. To change settings, edit `.env` and run `oac apply`. To move to a newer release, follow [Upgrade](./operations.md#upgrade).
+:::
+
+> [!TIP]
+> Rerunning is safe. If the installer stops on a failed check, on a service that is not healthy within three minutes, or on Ctrl-C, fix what the message names and run the same command again. A rerun keeps the configuration and data and reuses existing images. `--public-url`, `--host` and `--web-port` apply only to a new installation; to change them later, edit `.env` and run `oac apply`. On Linux and macOS the launcher also resumes an unfinished download. [Troubleshooting](./troubleshooting.md#installation) lists the messages.
 
-For insufficient space or quota, free space on the filesystem named by the error. Image-loading failures can also require space in Docker's storage, which may be on a different filesystem.
+To move to a newer release, reinstall: [uninstall](./operations.md#uninstall) the installation, then run the installer again.
 
 ## Sign in to Web
 
@@ -78,30 +74,32 @@ For insufficient space or quota, free space on the filesystem named by the error
 
    On Windows, use `& "$HOME/.oac/core/oac.exe" core-key --show`. The same command arguments work on every platform.
 
-## Configure the public address {#configure-the-domain-and-https}
-
-Applications, nodes and sandboxes reach Core at one address, the public URL. HTTP is enough on the local network. When you expose Core beyond it, put a reverse proxy in front and set the public URL to the HTTPS origin it serves. E2B guests reach Core from the internet, so they need a public URL that is not loopback.
+## Add sandbox capacity
 
-1. Point your reverse proxy at Web.
-2. Set `OAC_PUBLIC_URL` to the HTTPS origin it serves, then run `oac apply`. See [changing the public URL](../configuration.md#changing-the-public-url).
+The installer selects no sandbox backend. [Choose a sandbox backend](./sandbox-backends.md): microsandbox on your own Linux nodes with workspace storage from [Set up workspace storage](./workspace-storage.md) is the recommended self-managed deployment, and E2B needs no nodes. Applications can also run [self-hosted Sessions](./self-hosted.md) on their own machines.
 
 ## Set a default model
 
-Core-hosted Sessions without their own model provider use their Harness's default model. In **Settings → Models and credentials**, under **Default model configuration**, find the Harness marked **Default** (Codex unless you changed `OAC_DEFAULT_HARNESS`); it shows **Model provider not set**. Choose **Set** and enter the model ID, the protocol, and the provider's base URL and API key. MiniMax Code also needs the context window and max output tokens. The Harness then shows **Ready**. See [default models](../configuration.md#default-models).
+Core-hosted Sessions that bring no model provider use their Harness's default model. See [default models](../configuration.md#default-models).
+
+1. Open **Settings → Models and credentials**. Under **Default model configuration**, the Harness marked **Default** shows **Model provider not set**. It is Codex unless you changed `OAC_DEFAULT_HARNESS`; see [settings](../configuration.md#settings).
+2. Choose **Set** and enter the model ID, the protocol, and the provider's base URL and API key.
+3. Save. The Harness shows **Ready**.
 
 ## Issue a Project API key
 
 1. On **Projects and keys**, choose **Create project**, then **Issue key**. The dialog shows the key once: copy it and keep it safe. Its **How to call** card shows the API base URL and sample requests.
-2. Give the key and the API base URL to the application developer. They continue with the [quickstart](./quickstart.md).
-
-Web's **Overview** tracks these steps in a **Getting started** checklist.
+2. Give the key and the API base URL to the application developer. They continue with [Run your first Session](./quickstart.md).
 
-## Add sandbox capacity
+## Reach Core from other machines {#configure-the-domain-and-https}
 
-The installer selects no sandbox backend. Choose the deployment that fits your infrastructure:
+This step is optional for a trial on one machine. Applications, nodes and sandboxes reach Core at one address, the public URL. HTTP is enough on the local network; beyond it, put a reverse proxy in front and set the public URL to the HTTPS origin it serves. [Configure the public address](./public-address.md) covers the reverse proxy, ports and changing the address later.
 
-- **Recommended: microsandbox with independent workspace storage.** Prepare the [NFS filesystem and service accounts](../configuration.md#independent-workspace-storage) first, then choose **Own machines** and **microsandbox** in **Settings** → **Sandbox and scheduling**, and [add Linux nodes](./nodes.md) from **Nodes**. The [nodes guide](./nodes.md#before-you-add-a-node) also covers the private checkpoint store needed for memory recovery across compatible nodes.
-- **Managed compute: E2B.** Select E2B and configure its credential and template through the same sandbox configuration flow. No execution nodes are needed; see [deployment setup](../../contracts/agents-api/sandbox-deployment.md#initial-setup-and-same-provider-changes).
-- **Other supported placements.** Docker nodes remain available. Applications can also connect [self-hosted machines](./self-hosted.md). The [provider comparison](../../contracts/agents-api/sandbox-deployment.md#what-each-field-means-per-sandbox-provider) distinguishes filesystem and suspension support.
+## Next steps
 
-Day-to-day operation, backups and upgrades are in [Operations](./operations.md).
+| Next | Where |
+| --- | --- |
+| Make an API call | [Run your first Session](./quickstart.md) |
+| Add Linux nodes | [Add and manage nodes](./nodes.md) |
+| Back up and uninstall | [Operations](./operations.md) |
+| Flags, Compose and offline hosts | [Installation options](./install-options.md) |
diff --git a/docs/getting-started/nodes.md b/docs/getting-started/nodes.md
index 339d06f80..5e2b12f69 100644
--- a/docs/getting-started/nodes.md
+++ b/docs/getting-started/nodes.md
@@ -2,31 +2,40 @@
 title: "Add and manage nodes"
 ---
 
-A node is a Linux host that runs sandboxes for Core-hosted Sessions when the sandbox backend is microsandbox (recommended) or Docker. Core places each new Session on a node with free capacity; the node creates the sandbox, and the sandbox connects back to Core. E2B needs no nodes. Machines that applications connect for their own Sessions are [self-hosted executors](./self-hosted.md), not nodes.
+A node is a Linux host that runs sandboxes for Core-hosted Sessions. This guide is for operators who add, change and remove nodes when the sandbox backend (see [Choose a sandbox backend](./sandbox-backends.md)) is microsandbox or Docker; E2B needs no nodes.
 
-You add a node by generating a command in Web and running it on the host. The [sandbox deployment contract](../../contracts/agents-api/sandbox-deployment.md) defines the sandbox settings and their change rules, and the [node protocol](../../contracts/agents-api/node-generation-protocol.md) defines how nodes prepare and keep Runtime generations.
+Core places each new Session on a node with free capacity; the node creates the sandbox, and the sandbox connects back to Core. Machines that applications connect for their own Sessions are [self-hosted executors](./self-hosted.md), not nodes. You add a node by generating a command in Web and running it on the host. The [sandbox deployment contract](../../contracts/agents-api/sandbox-deployment.md) defines the sandbox settings and their change rules, and the [node protocol](../../contracts/agents-api/node-generation-protocol.md) defines how nodes prepare and keep Runtime generations.
 
 ## Before you add a node
 
-- **Core has a public URL** that the host and its sandboxes can reach. Nodes download from Core's console and connect to Core at `public_url`. Until it is set, Add node says *Set a public address other machines can reach before adding nodes*; see [Configure the public address](./install.md#configure-the-domain-and-https).
-- **The sandbox configuration is saved.** Open **Settings** → **Sandbox and scheduling**, choose **Own machines**, the backend and a sandbox size, and **Save configuration**. To change the backend, choose **Reset deployment** first. Every node of an installation uses that backend.
+- **The sandbox configuration is saved.** Open **Settings** → **Sandbox and scheduling**, choose **Own machines**, the backend and a sandbox size, and **Save configuration**; see [Choose a sandbox backend](./sandbox-backends.md). To change the backend, choose **Reset deployment** first. Every node of an installation uses that backend.
+- **Core has a public URL** that the host and its sandboxes can reach. Nodes download from Core's console and connect to Core at `public_url`. Until it is set, Add node says *Set a public address other machines can reach before adding nodes*; see [Configure the public address](./public-address.md).
 - **The console can serve the node files.** Nodes download their Runtime and provider files from the console, which redirects to the release for files it does not hold, and check each file's size and SHA-256 against the release manifest. Node hosts therefore need access to the release. Without the files, Add node says *This console has no node files for …*.
+- **The host meets the requirements below.**
+- **For microsandbox,** the NFS mount for workspace storage is ready on this host; see [Set up workspace storage](./workspace-storage.md). The node receives the selected immutable filesystem configuration with each binding; do not author a separate node storage setting.
+- **For checkpoint recovery across microsandbox nodes,** see [Checkpoint recovery across nodes](#checkpoint-recovery-across-nodes).
 
-For microsandbox checkpoint recovery across nodes, add `--checkpoint-root /absolute/private/shared-store` to the installer command on each participating node. Mount the same private store at those paths before installation and grant only the node service account access. The default is a private node-local store and supports recovery on that node. The checkpoint store is separate from workspace storage and must never be guest-accessible; the [checkpoint transfer contract](../sandbox-provider.md#checkpoint-transfer) owns compatibility and retention requirements.
-
-Microsandbox includes the host kernel and CPU profile in its checkpoint execution compatibility. An OS or CPU-profile change can therefore make retained checkpoints incompatible even on their original node. Before maintenance, keep a node with the matching execution class and the same ready generation available for those checkpoints; otherwise their requests wait under the [checkpoint retention policy](../sandbox-provider.md#checkpoint-transfer).
+The Core host joins like any other host: to run sandboxes on it, add it as a node.
 
-For microsandbox with independent workspace storage, complete the [NFS mount and service-account setup](../configuration.md#independent-workspace-storage) on this host before enrollment. The node receives the selected immutable filesystem configuration with each binding; do not author a separate node storage setting.
+### Host requirements
 
-The Core host joins like any other host: to run sandboxes on it, add it as a node.
+- Linux amd64 with systemd; Python 3.9+, `curl`, `sha256sum` and `flock`; root or sudo.
+- SELinux not enforcing. The installer does not support hosts with enforcing SELinux.
+- Docker: rootful Docker Engine running, its socket `/var/run/docker.sock` owned by the `docker` group with mode `0660`, enforcing CPU and memory limits (cgroup v2).
+- microsandbox: `/dev/kvm` in the `kvm` group (hardware or nested virtualization), and the libraries microsandbox links (glibc).
+- CPUs and memory for at least one sandbox of the installation's size, and about 3 GB of free disk while the Runtime image installs: its download and unpacked copy sit under `/var/lib/oac-node` until the import finishes, and the image takes about 1.5 GB in Docker's storage or the microsandbox store. The installer checks the space before it downloads and deletes the archives after the import, so the node keeps the image and under 0.2 GB of programs.
+- Access to the console and Core at the public URL; sandboxes reach Core too.
 
 ## Add a node
 
 1. In Web, open **Nodes** and choose **Add node**.
-2. Set **Sandboxes at once** and, with microsandbox, **Retained sandboxes**: the node's [capacity](../configuration.md#node-capacity). You can change them later with **Edit node**.
+2. Keep **Recommended** limits, or choose **Custom** and set **Sandboxes at once** and, with microsandbox, **Retained sandboxes**: the node's [capacity](../configuration.md#node-capacity). **Edit node** shows the recommendation for the host and fills it in with **Use recommended**.
 3. Choose **Generate command** and copy the command. It registers one node, once, and only if it runs within an hour; Web counts down and offers **Generate new command** when it expires.
 4. Run it on the host. Web follows the node from registered to connected to ready.
 
+> [!NOTE]
+> The enrollment token is single-use, expires after an hour and only registers the node. The installer takes it only on standard input and refuses it in the environment, where `sudo VAR=… python3` would record it in sudo's log. A sudoers policy with `log_input` records standard input, and so the token.
+
 The command downloads the node installer from your console, checks its SHA-256 and runs it with a one-time enrollment token. The installer downloads the node files and checks each against the release manifest, imports the Runtime image, registers the node, starts its service and waits until Core reports the node connected and ready. It never installs software, and it stops with a one-line hint before changing anything when a prerequisite is missing.
 
 Node installation and removal require root. Web's command uses `sudo` unless the shell is already root. The installer creates an `oac-node` service user and a system service; the node runs as that user, not as root. Running the installer as an ordinary user fails before it reads the enrollment token or changes the host.
@@ -41,15 +50,6 @@ Copy the current command from **Nodes → Add node**. It includes this installat
 
 The installer shows each phase as it runs and, once Core confirms the node, a summary with status and log commands. `export NO_COLOR=1` disables colors; the command passes this through sudo as `--no-color`. It never prints tokens.
 
-### Host requirements
-
-- Linux amd64 with systemd; Python 3.9+, `curl`, `sha256sum` and `flock`; root or sudo.
-- SELinux not enforcing. The installer does not support hosts with enforcing SELinux.
-- Docker: rootful Docker Engine running, its socket `/var/run/docker.sock` owned by the `docker` group with mode `0660`, enforcing CPU and memory limits (cgroup v2).
-- microsandbox: `/dev/kvm` in the `kvm` group (hardware or nested virtualization), and the libraries microsandbox links (glibc).
-- CPUs and memory for at least one sandbox of the installation's size, and about 3 GB of free disk while the Runtime image installs: its download and unpacked copy sit under `/var/lib/oac-node` until the import finishes, and the image takes about 1.5 GB in Docker's storage or the microsandbox store. The installer checks the space before it downloads and deletes the archives after the import, so the node keeps the image and under 0.2 GB of programs.
-- Access to the console and Core at the public URL; sandboxes reach Core too.
-
 ### Download through a proxy
 
 Export `http_proxy`, `https_proxy` and `no_proxy` before running the generated command. Uppercase `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` work too; lowercase takes precedence when both are set, even when empty. Use an HTTP proxy URL, optionally with URL-encoded credentials, and comma-separated host exclusions in `no_proxy`. A proxy for HTTPS downloads must support CONNECT.
@@ -62,7 +62,7 @@ The node service keeps the proxy settings of the latest run, so it reaches Core
 
 | Item | Detail |
 | --- | --- |
-| Service user | System user `oac-node`, home `/var/lib/oac-node`, no login shell. An existing account with that home and a nologin shell is adopted; any other account named `oac-node` is refused |
+| Service user | System user `oac-node` with UID 65532, the UID of Core's service, home `/var/lib/oac-node` and no login shell. An existing account with that UID, that home and a nologin shell is adopted; any other account named `oac-node` is refused. If another account holds UID 65532, the installer stops and changes nothing |
 | Group | The group that owns `/var/run/docker.sock` (Docker) or `/dev/kvm` (microsandbox): `docker` or `kvm`, nothing else |
 | Service | `/etc/systemd/system/oac-node-<installation-id>.service`, a root-owned system unit with `User=oac-node`, enabled at boot. It restarts every 5 seconds while Core is unreachable and stops for good once Core no longer accepts the node |
 | Node state | `/var/lib/oac-node/.oac/nodes/<installation-id>/`: identity, configuration, node files. microsandbox keeps its images and sandboxes under `/var/lib/oac-node/.oac/m/` |
@@ -70,22 +70,22 @@ The node service keeps the proxy settings of the latest run, so it reaches Core
 | Docker | The Runtime image, imported once, and a network `oac-node-<installation-id>` |
 | microsandbox network policy | Sandboxes may reach Core, DNS on the host and public addresses, and nothing else: no inbound connections and no private networks |
 
-Root only prepares the account, the group and the unit; everything else, the Docker network included, runs as `oac-node`, in its own session without a terminal. The installer never installs Docker, KVM or packages, never starts Docker, never changes device permissions, sudoers, firewall or SELinux settings, and never touches other accounts.
+Root only prepares the account, the group and the unit; everything else, the Docker network included, runs as `oac-node`, in its own session without a terminal. The installer never installs Docker, KVM or packages, never starts Docker, never changes device permissions, sudoers, firewall or SELinux settings, and never touches other accounts. The node connects out to Core; Core needs no SSH or Docker TCP access to the host.
 
-**Docker mode is root-equivalent.** Membership in the `docker` group lets `oac-node`, and so anything that controls the node, act as root on the host. Containers also share the host kernel, so a container escape reaches the host. Add Docker nodes only on hosts dedicated to sandboxes. microsandbox nodes need only the `kvm` group and run each sandbox in its own microVM.
+> [!CAUTION]
+> Docker mode is root-equivalent. Membership in the `docker` group lets `oac-node`, and so anything that controls the node, act as root on the host, and containers share the host kernel. Add Docker nodes only on hosts dedicated to sandboxes. microsandbox nodes need only the `kvm` group and run each sandbox in its own microVM.
 
-**microsandbox blocks private endpoints.** A sandbox can't reach a model provider or MCP server at a private address. Sandbox DNS queries go to the nameservers listed in the host's `/etc/resolv.conf`, and DNS rebind protection discards any answer that contains a private address, so a name those nameservers resolve to a private address doesn't resolve in the sandbox at all, even for a public service such as a model API behind a cloud VPC resolver. The Turn then fails once the Harness stops retrying. Installer-added nodes have no setting to change this. Make those nameservers return the service's public addresses; microsandbox doesn't read the host's `/etc/hosts`, so an entry there helps only when `/etc/resolv.conf` points at a local stub resolver that serves it, such as systemd-resolved at `127.0.0.53`. Otherwise use a Docker node, which doesn't filter sandbox traffic, or [register the node manually](#register-a-node-manually) with a `network` policy that also allows the private range in a rule without a port, because rebind protection ignores port-scoped rules.
+> [!WARNING]
+> microsandbox sandboxes cannot reach private addresses; see [Sandboxes cannot reach a private endpoint](./troubleshooting.md#sandboxes-cannot-reach-a-private-endpoint).
 
 **One Core per host.** Nodes share the `oac-node` account, so a host serves one Core; a command from a second Core is refused.
 
-**Node software.** A node keeps the host program of the console that added it; an upgrade of Core doesn't replace it. A release that changes the node protocol lists the actions it requires; see [protocol changes](./operations.md#protocol-changes).
-
-**The token.** It is single-use, expires after an hour and only registers the node. The installer takes it only on standard input and refuses it in the environment, where `sudo VAR=… python3` would record it in sudo's log. A sudoers policy with `log_input` records standard input, and so the token.
+**Node software.** A node runs the host program and Runtime of the installation that added it. Another installation's command is refused on that host until you [remove the node](#remove-a-node) and add it again.
 
 ## Rerun, expiry and slow links
 
-- Rerunning the same command is safe. Once the node is registered, a rerun uses the node's own credential, changes nothing that already matches and needs no token. It changes nothing and says why when the node's retained identity belongs to another Core address or installation, when the sandbox configuration has changed since the node registered (the node prepares it itself; see [Change the sandbox configuration](#change-the-sandbox-configuration)), or when Core was upgraded and serves a newer node program: choose **Remove node** on **Nodes**, uninstall the node on the host, then add it again with **Add node**.
-- A run that fails before the node registers leaves nothing that Core knows. The next command, even after a configuration change or a Core upgrade, replaces the earlier attempt's configuration and any downloaded file that no longer matches, keeps the files that match and continues.
+- Rerunning the same command is safe. Once the node is registered, a rerun uses the node's own credential, changes nothing that already matches and needs no token. It changes nothing and says why when the node's retained identity or node program belongs to another Core address or installation, or when the sandbox configuration has changed since the node registered (the node prepares it itself; see [Change the sandbox configuration](#change-the-sandbox-configuration)): choose **Remove node** on **Nodes**, uninstall the node on the host, then add it again with **Add node**.
+- A run that fails before the node registers leaves nothing that Core knows. The next command, even after a configuration change, replaces the earlier attempt's configuration and any downloaded file that no longer matches, keeps the files that match and continues.
 - A command that already expired, or was used on another host, fails at once with `The enrollment command expired or was already used`: generate a new command and run it within an hour.
 - If the command expires during a slow download, registration fails with `The enrollment command expired or was already used`. The downloaded files are kept: generate a new command in Web and run it, and the download continues where it stopped.
 - Every file shows its progress. Failed or interrupted downloads keep what arrived, and a rerun resumes each partial file where it stopped (`Resuming …`), reuses verified complete files and downloads the rest. If the server cannot resume, the file starts again from the beginning. A transfer that brings less than 64 KiB in a minute stops; check the network and rerun the command.
@@ -102,13 +102,18 @@ Run `sudo journalctl -u oac-node-<installation-id>.service`. In a root shell, om
 
 Sandbox settings apply to the whole installation; nodes follow them.
 
-- **Size, Runtime release, E2B key or template build.** Open **Settings** → **Sandbox and scheduling** → **Change resources**, edit and save. Existing sandboxes keep their configuration. Each node prepares the new one while it keeps serving the old one, and **Nodes** shows its progress: **Preparing target**, **Ready for target** or **Preparation failed** with the [reason](#readiness-codes). Core places new Sessions on nodes ready for the new configuration first, and on nodes still serving an older one when those have no room. E2B changes apply at once.
-- **The installation's Runtime.** When the saved Runtime differs from the one the installation serves, **Settings** → **Sandbox and scheduling** shows a **Runtime** row with both source commits. **Use this installation's Runtime** opens **Change resources** on its review with that Runtime, and **Save configuration** starts the same node preparation. Other changes keep the saved Runtime. When the console serves no Runtime manifest, enter the release under **Advanced settings**.
-- **Capacity and idle suspension.** On **Nodes**, use **Edit node** for a node's active and retained limits. In **Settings** → **Sandbox and scheduling**, use **Automatic suspension** → **Idle before suspension (seconds)** → **Save** for the deployment-wide [idle policy](../../contracts/agents-api/sandbox-deployment.md#suspension-policy).
+- **Size, E2B key or template build.** Open **Settings** → **Sandbox and scheduling** → **Change resources**, edit and save. Existing sandboxes keep their configuration. Each node prepares the new one while it keeps serving the old one, and **Nodes** shows its progress: **Preparing target**, **Ready for target** or **Preparation failed** with the [reason](#readiness-codes). Core places new Sessions on nodes ready for the new configuration first, and on nodes still serving an older one when those have no room. E2B changes apply at once.
+- **Capacity and idle suspension.** On **Nodes**, use **Edit node** for a node's active and retained limits, or **Use recommended** to fill in the recommendation. In **Settings** → **Sandbox and scheduling**, use **Automatic suspension** → **Idle before suspension (seconds)** → **Save** for the deployment-wide [idle policy](../../contracts/agents-api/sandbox-deployment.md#suspension-policy).
 - **Backend.** On the same page, choose **Reset deployment**. Auto reset archives idle hosted Sessions at once and lets running work finish until the deadline you set; force cancels it now. Offline nodes must come back so Core can confirm their cleanup. When the reset completes, Core has retired every node and unused command: set up the new backend, then add nodes again. **Cancel reset** stops the remaining work; archived Sessions stay archived.
 
 The [reset contract](../../contracts/agents-api/sandbox-deployment.md#generation-ownership-and-rollout) describes what reset archives and keeps. To archive a single hosted Session, use the [Core API](../../contracts/agents-api/admin-api.md#session-archive).
 
+## Checkpoint recovery across nodes
+
+For microsandbox checkpoint recovery across nodes, add `--checkpoint-root /absolute/private/shared-store` to the installer command on each participating node. Mount the same private store at those paths before installation and grant only the node service account access. The default is a private node-local store and supports recovery on that node. The checkpoint store is separate from workspace storage and must never be guest-accessible; the [checkpoint transfer contract](../sandbox-provider.md#checkpoint-transfer) owns compatibility and retention requirements.
+
+microsandbox includes the host kernel and CPU profile in its checkpoint execution compatibility. An OS or CPU-profile change can therefore make retained checkpoints incompatible even on their original node. Before maintenance, keep a node with the matching execution class and the same ready generation available for those checkpoints; otherwise their requests wait under the [checkpoint retention policy](../sandbox-provider.md#checkpoint-transfer).
+
 ## Remove a node
 
 1. In Web, open **Nodes** and choose **Remove node** on the node's page, or **Remove** in its list row, then **Confirm removal**. Core refuses while the node still holds sandboxes, snapshots or pending cleanup; let them finish, or archive their Sessions. Removal is permanent: the host can come back only as a new node. Removing every node keeps the sandbox configuration.
@@ -118,93 +123,28 @@ Uninstall first asks Core, at the address the node enrolled with, whether the no
 
 It never deletes Docker images or volumes. It keeps the Runtime image and prints the `sudo docker image rm` command. For microsandbox, once Core has confirmed the removal, it also deletes the node's store under `/var/lib/oac-node/.oac/m/` (about 1.5 GB), and with it the created account. With `--force` Core isn't asked, so the store is kept and the output prints the command that deletes it (`sudo -u oac-node rm -rf <store>`); microVMs may still use it, so check `pgrep -u oac-node` first, then rerun uninstall to finish removing the account. The output lists what was deleted and what was kept. Uninstall can be rerun until it completes.
 
-## Register a node manually
-
-Use manual registration when you manage the node's files and service yourself instead of running Web's command. A manually registered node serves only the configuration it registered with: after a size or Runtime change, **Nodes** shows it as **Node software incompatible**, and it keeps serving the old configuration until you remove it and register the host again.
-
-1. Take `oac-node` from the same release as Core.
-2. Get an enrollment token: the token in a command from **Add node**, or `POST /core/v1/sandbox/enrollment-tokens` with the Core key. It is single-use and carries the node's approved capacity; the response's `expires_at` says when it expires. Save it in a `0600` file on the host.
-3. Read the node configuration with the token, which does not consume it: `GET /api/v1/sandbox-node/configuration` with `Authorization: Bearer <token>`.
-4. Write a private provider file. Copy `provider`, `installation_id`, `core_url`, `generation` and `specification` from the response, and add a `native` object with the host settings of that provider. The adapter reads sandbox size, the Runtime image and artifact hashes from `specification`:
-   - Docker: the [Docker node configuration](../configuration.md#docker-node-configuration) fields, with `host` an explicit Unix socket, `image` the local ID of the imported Runtime image and `seccomp_file` absolute.
-   - microsandbox: absolute `helper_path`, `runtime_path` and `firmware_path`, a `network` policy, an explicit `checkpoint_root` for private checkpoint archives, and `runtime_home`: a private directory, which the helper creates with mode `0700` when it is missing. microsandbox places Unix sockets under it, so keep its path within 48 bytes; the installer refuses a longer one for its own nodes.
-   Before the first microsandbox registration, initialize the empty `checkpoint_root` as the node service account using the same release's source checkout: `PYTHONPATH=deploy/node python3 -c 'from node_install import prepare_checkpoint_root; prepare_checkpoint_root("/absolute/private/checkpoints")'`. This reuses the installer's exclusive UUID-marker initialization and ownership checks. Initialize a shared store once; other nodes use the existing marker. Never replace the marker or initialize over restored or nonempty unowned storage.
-5. Register, then run the node under the host's service supervisor, with real absolute paths:
-
-   ```sh
-   oac-node register \
-     --config /var/lib/oac/provider.json \
-     --state-dir /var/lib/oac/node \
-     --core-url https://core.example \
-     --name worker-1 \
-     --enrollment-token-file /var/lib/oac/enrollment-token
-   oac-node run \
-     --config /var/lib/oac/provider.json \
-     --state-dir /var/lib/oac/node
-   ```
-
-`oac-node run` exits with status 78 once Core rejects its credential, after the node is removed; configure the supervisor not to restart it then (systemd: `RestartPreventExitStatus=78`).
-
-The node connects out to Core; Core needs no SSH or Docker TCP access to the host. Registration writes the node's identity to the state directory before contacting Core, so a lost response can be retried under the same identity. Keep the state directory on persistent storage, private to the node's account and used by one process at a time. Never copy it to another directory or host: Core refuses a second connection for a node while the first is open. The provider file can't change the node's capacity or sandbox configuration. Core compares its digest at registration and on every connection, and a node whose file differs takes no work until the approved configuration is restored.
-
 ## When a node host fails
 
 A restarted node service keeps its identity and finds its existing sandboxes again. Core does not take over an active or unconfirmed writer merely because its node is unreachable or its sandbox is missing: those resources show as **Node disconnected** or **Sandbox resource missing** while ownership remains unresolved. Restart a crashed or hung host rather than removing its node: after the node reconnects, a running sandbox that the node confirms gone is released under the [confirmed compute loss](../sandbox-provider.md#confirmed-compute-loss) rules, and the Session's next input continues on new compute; any other missing sandbox keeps **Sandbox resource missing**. A host that never returns keeps its Sessions' compute ownership. A settled retained checkpoint can follow the [checkpoint transfer contract](../sandbox-provider.md#checkpoint-transfer), and confirmed release can permit [cold replacement](../sandbox-provider.md#cold-replacement-after-checkpoint-retention). A lost node state directory is a recovery incident: restore it from its [backup](./operations.md#back-up) together with the database and the provider storage, rather than registering the host again over existing resources.
 
 ## Troubleshooting
 
-### Readiness codes
+Connection failures and installer messages are in [Troubleshooting](./troubleshooting.md#nodes).
 
-When a node is online but its sandbox provider is not ready, **Nodes** and **Overview** show it as **Provider not ready**. Where the reason appears depends on how the node was added:
+### Readiness codes
 
-- **Nodes added with Web's command** report a failed check of the current sandbox configuration as **Preparation failed** in the node's target status, with the reason in a help tip (`rollout.diagnostic` in `GET /core/v1/sandbox/nodes`). The tip beside **Provider not ready** only says *Sandbox provider unavailable*.
-- **Manually registered nodes** show the reason in the help tip beside **Provider not ready** (`diagnostic`).
+When a node is online but its sandbox provider is not ready, **Nodes** and **Overview** show it as **Provider not ready**. A node reports a failed check of the current sandbox configuration as **Preparation failed** in the node's target status, with the reason in a help tip (`rollout.diagnostic` in `GET /core/v1/sandbox/nodes`). The tip beside **Provider not ready** only says *Sandbox provider unavailable*.
 
-Each code is a Provider-neutral class; the local error behind it stays on the node. A manually registered node logs it. For a node added with Web's command, rerun the command on the host: the installer checks the host requirements first and names what to fix ([Installer messages](#installer-messages)).
+Each code is a Provider-neutral class; the local error behind it stays on the node. Rerun the command on the host: the installer checks the host requirements first and names what to fix ([Installer messages](./troubleshooting.md#installer-messages)).
 
-A node reports only its first failed check, in this order: the Docker daemon or KVM, Docker's limit support, host capacity, then the installed Runtime files. An unreachable Docker daemon therefore hides a missing image. The next heartbeat, about ten seconds after a fix, clears or replaces the code. An offline node keeps its last code, which Web hides until the node reconnects.
+A node reports only its first failed check, in this order: the Docker daemon or KVM, Docker's limit support, host capacity, then the installed Runtime files. An unreachable Docker daemon therefore hides a missing image. The next preparation attempt after a fix clears or replaces the code.
 
 | Code | Help tip | Cause | Fix |
 | --- | --- | --- | --- |
-| `provider_unavailable` | Sandbox provider unavailable | The provider's service is unreachable or fails a request, such as a stopped Docker daemon, or a failure without a class | Rerun the node's command, or read a manually registered node's log |
-| `host_unsupported` | Host unsupported | The host lacks a capability the provider requires, such as Docker CPU and memory limits (cgroup v2) or read-write access to `/dev/kvm` | Rerun the node's command, or read a manually registered node's log |
+| `provider_unavailable` | Sandbox provider unavailable | The provider's service is unreachable or fails a request, such as a stopped Docker daemon, or a failure without a class | Rerun the node's command |
+| `host_unsupported` | Host unsupported | The host lacks a capability the provider requires, such as Docker CPU and memory limits (cgroup v2) or read-write access to `/dev/kvm` | Rerun the node's command |
 | `capacity_insufficient` | Host too small | The host has fewer CPUs or less memory than one sandbox | Use a larger host, or change the sandbox size |
-| `runtime_image_unavailable` | Runtime image missing | The provider does not have the pinned Runtime image | A node added with Web's command downloads it again by itself; otherwise load the image from the matching release |
-| `artifacts_unavailable` | Provider files missing | A pinned provider file, such as the microsandbox Runtime, firmware or helper, is missing or fails its SHA-256 check | A node added with Web's command downloads the missing files by itself; otherwise restore them from the matching release |
-| `runtime_download_failed` | Runtime download failed | While preparing a new configuration, the node could not download or verify the Runtime files | Check the node's HTTPS access to the console and the release. The node retries with growing delays, up to 30 minutes apart |
+| `runtime_image_unavailable` | Runtime image missing | The provider does not have the installation's Runtime image | Rerun the node's command to download it again; otherwise load the image from the matching release |
+| `artifacts_unavailable` | Provider files missing | A pinned provider file, such as the microsandbox Runtime, firmware or helper, is missing or fails its SHA-256 check | Rerun the node's command to download the missing files; otherwise restore them from the matching release |
 
 A new group membership applies only to a new process. Restart the node service: `sudo systemctl restart oac-node-<installation-id>.service`.
-
-### Connection failures
-
-A registered node that can't connect to Core says why in its [log](#logs): `sandbox node connection to Core failed; retrying` with a `cause`, once for each cause however often it retries, then `sandbox node connected to Core` when it connects. A node service that starts while Core is unreachable logs `cannot confirm approved node capacity:` followed by the cause.
-
-| Cause | Fix |
-| --- | --- |
-| `HTTP 400 on the WebSocket upgrade` | The reverse proxy in front of Core doesn't pass WebSocket upgrades on `/api/v1`; see [HTTPS and the reverse proxy](./install-options.md#https-and-the-reverse-proxy) |
-| Another status, such as `HTTP 404 on the WebSocket upgrade` or `HTTP 502 …` | The reverse proxy doesn't route `/api/v1` to Core or doesn't preserve Host, or Core is not running |
-| `dial tcp: …`, such as `connection refused`, `i/o timeout` or `no such host` | The host can't reach Core at the public URL. Check DNS and firewalls; the node service uses the [proxy](#download-through-a-proxy) the installer ran with, so rerun the command with the right settings if the proxy changed |
-| `tls: …`, or `TLS certificate expired or not yet valid` | The host doesn't trust Core's certificate, or the public URL uses `https` on a port that doesn't serve it |
-| `Core did not accept the node: …` | Core closed the connection after the node introduced itself. After a Core upgrade, apply the release's [protocol changes](./operations.md#protocol-changes); otherwise read Core's log |
-
-### Installer messages
-
-| Message | Fix |
-| --- | --- |
-| `The enrollment command expired or was already used` | Generate a new command in Web and run it within an hour |
-| `Core rejected the node configuration read (HTTP …)` | Check the Core URL and the reverse proxy in front of it, then rerun |
-| `Not enough disk space under …` or `The disk is full` | Free the space it names, then rerun; the download resumes |
-| This host's node program differs from the one this console serves | Core was upgraded after the node was added. Choose **Remove node**, uninstall it on the host, then add it again with **Add node** |
-| Another node installation is running, or this node is preparing a new sandbox configuration | Retry once **Nodes** no longer shows **Preparing target** |
-| A sandbox provider check failed before registering, such as `This host lacks a capability …` | Fix what it names (see [Readiness codes](#readiness-codes)) and rerun; the token was not used |
-| Core's public URL changed after this command was generated | Generate a new command in Web and run it |
-| This host's node uses `<address>`, but this command uses `<address>` | The node was added under an older public URL. Remove it in Web, uninstall it, then add it again |
-| Docker Engine is not installed, or Docker is not running | Install Docker Engine, or `sudo systemctl enable --now docker`, then rerun |
-| Docker on this host does not enforce CPU and memory limits | Use cgroup v2, then rerun |
-| KVM is unavailable, or `/dev/kvm` must be group-accessible | Enable virtualization; your distribution's KVM package sets `root:kvm 0660` |
-| This host has N CPUs and M MiB of memory; each sandbox needs … | Use a larger host, or change the sandbox size |
-| SELinux is enforcing on this host | Use a host supported by the installer; it does not change SELinux settings |
-| This host already runs a sudo-mode node for another Core | Remove that node and uninstall it first |
-| Node installation and removal require root | Run Web's command with sudo, or from a root shell |
-| Core still lists this node | Remove it on the Nodes page first |
-| Core no longer accepts this node | It was removed, or a reset retired it. Uninstall it, then add the host with a new command |
diff --git a/docs/getting-started/operations.md b/docs/getting-started/operations.md
index 1048b0ac1..98fa5cdb1 100644
--- a/docs/getting-started/operations.md
+++ b/docs/getting-started/operations.md
@@ -2,28 +2,27 @@
 title: "Operations"
 ---
 
-The installation operator owns the Core host, its storage and its availability. Node hosts run their own services; see [Nodes](./nodes.md). Settings are described in the [configuration reference](../configuration.md).
+Day-to-day tasks for the operator of a Core installation: the `oac` command, service health, the Core key, backups and uninstalling. Nodes have [their own guide](./nodes.md), and [Troubleshooting](./troubleshooting.md) lists installer and access messages. Settings are in the [Configuration reference](../configuration.md).
 
 ## The oac command
 
-Each installation has its own native management command in its directory: `oac` on Unix, `oac.exe` on Windows. It needs Docker access and no root privileges:
-
-```sh
-docker compose -f ~/.oac/core/compose.yaml ps
-```
+Each installation has its own `oac` command in its directory (`oac.exe` on Windows). Run it as the account that installed Core; it needs Docker access, not root. The examples use the default installation directory `~/.oac/core`; on Windows, invoke the command with `& "$HOME/.oac/core/oac.exe"` followed by the same arguments. For a custom directory, replace the path.
 
 | Command | What it does |
 | --- | --- |
-| `docker compose ps` | Shows the services. Run it in the installation directory |
-| `docker compose start` | Starts the services |
-| `docker compose stop` | Stops the services. Data, nodes and sandboxes are kept |
+| `oac install` | Installs an installation or resumes one that stopped before it started; the installer scripts run it |
 | `oac apply` | Checks the data volume and `.env`, then starts the services and recreates those whose configuration changed; see [how oac apply works](../configuration.md#how-oac-apply-works). A failed check changes no service. On success it prints `Services are running with the current settings.` |
 | `oac core-key [--show]` | Identifies the key location in the data volume, or prints the key with `--show` |
 | `oac rotate-core-key` | Replaces the Core key and restarts Core and Web, then says how to read the new key |
-| `docker compose down` | Removes the containers. Data is kept |
 | `oac uninstall` | Deletes the installation and its data after confirmation; see [Uninstall](#uninstall) |
 
-The examples use the default installation directory. On Windows, invoke the management command with `& "$HOME/.oac/core/oac.exe"` followed by the same arguments. For a custom installation directory, replace the path in each command.
+Docker Compose commands manage the services; run them against the installation's Compose file. [Stop and restart](#stop-and-restart) covers `stop` and `start`.
+
+| Command | What it does |
+| --- | --- |
+| `docker compose -f ~/.oac/core/compose.yaml ps` | Shows the services |
+| `docker compose -f ~/.oac/core/compose.yaml logs --tail 200 core` | Shows a service's log |
+| `docker compose -f ~/.oac/core/compose.yaml down` | Removes the containers. Data is kept |
 
 After local credentials and enrollment are resolved, Runtime Harness discovery and the authenticated bootstrap HTTP request run concurrently. Both must succeed before the Runtime opens its connection or publishes capabilities. Failure cancels the sibling operation and waits for cleanup. The executor remains owned by the connection lifetime. Runtime startup changes require a rebuilt, qualified Runtime template.
 
@@ -51,7 +50,7 @@ Use these observations for different questions:
 | Environment connection | The Runtime transport is connected |
 | A finished Turn and its results | The task's recorded outcome |
 
-Service health does not show that a Harness or a model works. Use Session, Turn, Items and Usage reads for execution, and Web's **Nodes** page for node connection, readiness and placement. For local diagnosis, use the installation's own Compose file:
+Only Web is a listener; see [Configure the public address](./public-address.md#listeners-and-access). Service health does not show that a Harness or a model works. Use Session, Turn, Items and Usage reads for execution, and Web's **Nodes** page for node connection, readiness and placement. For local diagnosis, use the installation's own Compose file:
 
 ```sh
 docker compose -f "$HOME/.oac/core/compose.yaml" ps --all
@@ -86,7 +85,7 @@ docker compose -f ~/.oac/core/compose.yaml start
 
 Stopping Core stops no node and no sandbox. Node services, their microVMs and Docker containers keep running; stopping is not a way to reclaim compute. A Core restart does not continue an interrupted native tool call transparently. After reconnecting, query the same Session; don't create a new Session to replay uncertain work. Session event streams are live only; recover through Session, Turn and Items reads.
 
-A Web restart, including one caused by `oac apply`, signs everyone out of the console. Web sign-ins otherwise last 12 hours.
+A Web restart, including one caused by `oac apply`, signs everyone out of the console; see [sign-in](../web/console-server.md#sign-in).
 
 ## Core key
 
@@ -100,7 +99,7 @@ Keep it private. Web reads `secrets/web/core.key`. Core reads only its SHA-256 f
 
 ### Script the Core API
 
-Core publishes no host port. On the Core host, this helper runs `curl` in Core's network namespace and passes the key on stdin, keeping it off the command line:
+On the Core host, this helper runs `curl` in Core's network namespace and passes the key on stdin, keeping it off the command line:
 
 ```sh
 core() (  # core METHOD PATH [JSON body]
@@ -148,7 +147,7 @@ Core records which key made each public resource write; the retention of that hi
 
 ## Back up
 
-A recoverable backup contains one consistent, stopped-write set. A database dump or Core volume export alone does not include independent workspace storage or node compute state. Restore the data volume together with the installation directory from the same backup, which holds the release that wrote it; a newer release can [upgrade](#upgrade) the restored installation afterward.
+A recoverable backup contains one consistent, stopped-write set. A database dump or Core volume export alone does not include independent workspace storage or node compute state. Restore the data volume together with the installation directory from the same backup, which holds the release that wrote it.
 
 ### Single-host backup and restore {#single-host-backup}
 
@@ -188,7 +187,7 @@ An installation with independent workspace storage or nodes needs the full proce
 - For a [quota mode](../workspace-provider.md#quota-mode) namespace, the entire XFS filesystem holding the export as one block-level copy: a storage or LVM snapshot, or an image of the frozen or unmounted device. Only such a copy keeps project IDs, quota limits, inode identities, the filesystem UUID and the `oac-workspace-quota` journal consistent. A file-level copy, `tar`, `rsync` or `xfsdump` loses them; the command then refuses the restored objects instead of serving them unbounded.
 - Each node's state directory, `/var/lib/oac-node/.oac/nodes/<installation-id>/`, and its provider storage: Docker volumes or microsandbox's store. Include all compute and snapshot resources still referenced by the database. See [when a node host fails](./nodes.md#when-a-node-host-fails).
 
-- Each private `checkpoint_root` in its entirety, including `.oac-checkpoint-store`, archives, operation journals, lock files and tombstones, together with the matching Core database. It is separate from the native SDK store and independent workspace namespace. Preserve its identity and private ownership; the [checkpoint transfer contract](../sandbox-provider.md#checkpoint-transfer) owns its lifecycle.
+- Each private `checkpoint_root` in its entirety, including `.oac-checkpoint-store`, checkpoints, operation journals, lock files and tombstones, together with the matching Core database. It is separate from the native SDK store and independent workspace namespace. Preserve its identity and private ownership; the [checkpoint transfer contract](../sandbox-provider.md#checkpoint-transfer) owns its lifecycle.
 
 ### Establish a stopped-write window
 
@@ -204,7 +203,7 @@ For a logical database copy during the stopped-write window, leave only the data
 
 ```sh
 docker compose -f "$HOME/.oac/core/compose.yaml" exec -T database \
-  pg_dump -U agents_api agents_api > oac-backup.sql
+  pg_dump -U oac oac > oac-backup.sql
 ```
 
 A logical dump still needs the matching secrets, state, independent filesystems and required node resources. Docker Desktop's **Volumes** export is a way to copy a stopped data volume; it does not coordinate these other components.
@@ -213,60 +212,16 @@ A logical dump still needs the matching secrets, state, independent filesystems
 
 Keep application ingress and Core/node services stopped while restoring. Fence or shut down every old writer before exposing the restored filesystem; an unreachable old host is not a fence. A rehearsal must use an isolated installation and storage copy that cannot connect to the original nodes or share their writable namespace.
 
-Restore matching secrets and database state, the complete independent filesystem namespaces and any required node identities/provider stores before starting Core. Preserve the database's configuration and namespace UUIDs, object identities and deletion markers; do not run first-time namespace initialization over restored storage. Restore a quota mode filesystem by writing its block-level copy to the backing device and mounting it with `prjquota` at the configured mount point; never run `oac-workspace-quota init` over it, and do not mount the copy beside the original, which has the same filesystem UUID. Reestablish the configured mount paths and service UIDs, then validate the mounted filesystem, ownership and xattrs from each participating service context. [Independent workspace storage](../configuration.md#independent-workspace-storage) owns deployment setup.
+Restore matching secrets and database state, the complete independent filesystem namespaces and any required node identities/provider stores before starting Core. Preserve the database's configuration and namespace UUIDs, object identities and deletion markers; do not run first-time namespace initialization over restored storage. Restore a quota mode filesystem by writing its block-level copy to the backing device and mounting it with `prjquota` at the configured mount point; never run `oac-workspace-quota init` over it, and do not mount the copy beside the original, which has the same filesystem UUID. Reestablish the configured mount paths and service UIDs, then validate the mounted filesystem, ownership and xattrs from each participating service context. [Set up workspace storage](./workspace-storage.md) owns deployment setup.
 
 The cold released baseline resumes only qualified native history after new compute admission. A backup containing retained checkpoints also depends on the matching native runtime, node identity, provider store and external filesystem identities. File-level restore can change inode identity and prevent strict checkpoint restore even when file bytes match. This procedure does not promise portable memory snapshots or restoration onto an arbitrary replacement node; preserve unresolved ownership rather than substituting a new sandbox.
 
 Start the database, Core and node services only after their restored dependencies are complete; keep ingress restricted while checking them. In an isolated rehearsal, verify a retained Session's files and native continuation on fresh compute where qualified, confirm that deleted objects cannot be reopened, and check that no old writer can access the restored namespace. Record the results before relying on the backup for recovery.
 
-## Upgrade {#upgrade}
-
-An installation of v0.0.10 or later upgrades in place to a newer release. It keeps its database, data volume, `.env`, secrets, Core key, installation ID and the entries you added to `compose.override.yaml`. An older installation can't upgrade: install the new release into a new directory. Downgrades are refused.
-
-1. Read the target release's notes for [protocol changes](#protocol-changes) and the actions they require.
-2. [Back up](#single-host-backup) the installation. The upgrade takes no backup, and after it the backup is the only way back to the previous release.
-3. Run the target release's installer with `--upgrade` and the installation directory:
-
-   ```sh
-   curl -fsSL https://openagentcore.dev/install.sh | bash -s -- --upgrade --install-dir "$HOME/.oac/core"
-   ```
-
-   `--version TAG` selects a release other than the latest. On Windows, run `& ([scriptblock]::Create((irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1))) --upgrade --install-dir "$HOME\.oac\core"`. For an installation from a [source bundle](../development.md#install-a-checkout-without-publishing-a-release), run the new bundle's installer: `python3 <bundle>/install.py --install-dir <dir> --upgrade`.
-4. When you are ready, [apply the release's Runtime](#runtime-after-an-upgrade).
-
-Without `--upgrade`, another release's installer changes nothing and stops with `This installation runs release <old>; this installer is <new>. Back up the installation (Upgrade in the operations guide), then rerun with --upgrade.` (`install.py` says `this bundle is`). The installed release's installer resumes the installation, with or without the flag. Installation and mutating `oac` commands share the [installation lock](../configuration.md#installation-directory); if another command is running, wait for it to finish before retrying.
-
-### What the upgrade does
-
-The installer downloads the release's `compose.yaml` and pulls missing images. Before it replaces any file, it runs the new release's configuration check and initialization with the installation's `.env` and Compose overrides. Initialization upgrades the data volume, or refuses a downgrade. The installer then puts the new `compose.yaml` and `oac` in place and starts the services, recreating those that changed; Core migrates the database as it starts. [Deployment](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/README.md#installation) describes each step. The restart interrupts work as any [Core restart](#stop-and-restart) does; nodes and sandboxes keep running and reconnect.
-
-On success the installer prints the console address, `oac core-key --show` in place of the key, and the line `Upgraded from <old> to <new>. Settings → Sandbox and scheduling offers this release's Runtime; sandboxes keep their current Runtime until you apply it.`
-
-If a check fails, the installer prints `Upgrade stopped; the running services are unchanged` with Docker's output, and the previous release keeps serving. Fix the cause and rerun the command. Once initialization has upgraded the data volume, the previous release can no longer start on it: if a later step fails, for example with `startup failed; data retained, rerun the installer`, rerun the same command, which repeats every step safely, or [roll back](#roll-back).
-
-### Runtime after an upgrade
-
-The upgrade leaves the sandbox configuration unchanged: nodes keep serving the saved Runtime, and new Sessions use it. To move to the release's Runtime, open **Settings** → **Sandbox and scheduling**, choose **Use this installation's Runtime** in the **Runtime** row, review the change and choose **Save configuration**. Nodes then prepare the new generation, and existing sandboxes keep theirs until they are released; see [Change the sandbox configuration](./nodes.md#change-the-sandbox-configuration). An E2B deployment has no **Runtime** row; its template keeps working unless the release changes the Core–Runtime protocol.
-
-### Protocol changes
-
-Three connections require the same protocol version on both sides: Core and its nodes, a node and its microsandbox helper, and Core and the Runtime. The upgrade changes no node host and no running sandbox. A release that changes one of these protocols says so in its release notes and names which of these actions it requires:
-
-- reinstall each node: [remove it](./nodes.md#remove-a-node), clean up the host, then add the host again with **Add node**. Core refuses to remove a node that still holds sandboxes, so archive those Sessions before you upgrade;
-- apply the release's Runtime right after the upgrade; sandboxes on earlier generations stop working;
-- [build a new E2B template](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/e2b/README.md#build-a-template) and select it in [the sandbox configuration](./nodes.md#change-the-sandbox-configuration);
-- reconnect [self-hosted machines](./self-hosted.md#reconnect-an-existing-session).
-
-### Downgrades
-
-Initialization refuses a release that is not newer than the installed one, with `This installation runs release <installed> (<date>); this release, <own> (<date>), is not newer. Downgrades are not supported: run that release or a newer one, or restore the backup taken before the upgrade.` The installer reports it as a stopped upgrade, and the installation keeps running. Core refuses a database that a newer release migrated, with `Agents API database schema version N is newer than this Core supports (M). Downgrades are not supported: run the release that upgraded this database or a newer one, or restore the backup taken before the upgrade.` To return to an earlier release, [roll back](#roll-back).
-
-### Roll back
-
-A rollback restores the backup taken before the upgrade: stop the services, [restore](#restore-and-rehearse) the data volume and the installation directory, then start them. Restore before you apply the release's Runtime if you can: once nodes have prepared it, the restored database doesn't know their new generation, so also [remove every node](./nodes.md#remove-a-node) and add it again. Sessions and data created after the backup are lost.
-
 ## Uninstall
 
+Remove nodes first; see [Remove a node](./nodes.md#remove-a-node).
+
 ```sh
 ~/.oac/core/oac uninstall
 ```
@@ -277,7 +232,7 @@ All data goes with it: Projects and API keys, Session history, stored credential
 
 Uninstall stops no sandbox: node sandboxes keep running on their nodes, and E2B sandboxes keep running, and billing, at E2B. While Core is still up, archive their Sessions or [reset the deployment](./nodes.md#change-the-sandbox-configuration) and let it complete.
 
-Nodes on other hosts keep running. To uninstall them the usual way, remove them in Web first, as in [Remove a node](./nodes.md#remove-a-node). After the installation is gone, their Core is gone: on each node host, run the node uninstall command with `--force`, using the installer the original command left in `~/.oac/node-bootstrap/`, as in [Remove a node](./nodes.md#remove-a-node), and the installation ID that `oac uninstall` printed. If you didn't note it, read it from the node's unit name `oac-node-<installation-id>.service`.
+If Core is already gone, run the node uninstall command with `--force` on each node host, as described there, using the installation ID that `oac uninstall` printed or the one in the node's unit name `oac-node-<installation-id>.service`.
 
 If the installation directory was deleted by hand, its containers keep running and keep the Web port. Find the project and remove it without any installation file:
 
@@ -288,38 +243,6 @@ docker compose -p <project> down --volumes --remove-orphans
 
 The project is the `oac-…` name from the list. Then delete `~/.oac/core.lock` (on Windows also `~/.oac/.core.lock.runtime.lock`) if it is still there.
 
-## Troubleshooting
-
-| Symptom | Cause and fix |
-| --- | --- |
-| `Web port unavailable; choose --web-port` | Another program holds that port. Stop it, or choose another `--web-port`. The installer does not move to a different port. When the message names a Compose project `oac-…`, an earlier installation whose directory is gone still runs: remove it as in [Uninstall](#uninstall) |
-| `incomplete installation: preserve … and choose another directory` | Preserve the directory and choose another `--install-dir` |
-| `configuration check failed; no service was changed` | `.env` has a value Core rejects. The message names the variable and not the value. Fix `.env` and run `oac apply` again |
-| `data volume check failed; no service was changed` | Initialization refused the data volume; the message names the cause, such as a volume a newer release upgraded. See [downgrades](#downgrades) |
-| `This installation runs release …` | The installer or initialization belongs to another release. To move to a newer one, follow [Upgrade](#upgrade); downgrades are refused |
-| `This account cannot use Docker` | Add the account to the `docker` group and log in again, or use Docker Desktop or rootless Docker. Do not run the installer with `sudo` |
-| `This account cannot access …` | An earlier run with `sudo` left files owned by root. Run the `sudo chown` command the message prints, then rerun as your own account |
-| `Docker Compose 2.26 or newer is required` | Install or update the Docker Compose plugin |
-| `Docker could not pull …` | The Docker daemon cannot reach the registry. Configure its proxy or a registry mirror, or use the [offline archive](./install-options.md#offline-hosts) |
-| `startup failed; data retained, rerun the installer` | The message lists the services that are not healthy and the `docker compose logs --tail 50` command for them. Fix the cause, then [resume installation](./install.md#install); keep the data. After `oac apply`, the same message says to run `oac apply` again |
-| Web answers 403 `Forbidden` | The browser host is not `OAC_PUBLIC_URL`. Open that origin; a reverse proxy must pass the original Host |
-| Web shows that Core is unavailable (502) | Core is stopped or failing: `docker compose ps`, then Core's log |
-| Session creation returns 400 `model_provider_required` | No model provider: set a [default model](../configuration.md#default-models) for the Harness, or pass one; self-hosted Sessions always pass their own |
-| Add node shows no command | See [Before you add a node](./nodes.md#before-you-add-a-node) |
-| A node is not ready | See [node troubleshooting](./nodes.md#troubleshooting) |
-
-## Exposure and network policy
-
-| Listener | Host installation | Behind a reverse proxy |
-| --- | --- | --- |
-| Web and the API | Web publishes `OAC_WEB_PORT` (8080) on `OAC_HOST` | Web publishes `OAC_WEB_PORT` on `OAC_HOST`. Your proxy should use `127.0.0.1` |
-| Core | No published port. Web forwards `/v1`, `/api/v1` and `/docs` | No published port. Web forwards `/v1`, `/api/v1` and `/docs` |
-| PostgreSQL | No published port | No published port |
-
-Web signs administrators in with the Core key, checks the origin of every request, and forwards signed-in `/core/v1` requests to Core with the Core key, which stays on the server. It forwards `/v1` and `/api/v1` to Core unchanged, with the caller's own credential, serves only the non-secret node payload at `/node-install/`, and has no Docker or KVM access. Machine routes under `/api/v1` use their own enrollment and connection credentials. No service receives a Docker socket.
-
-Sandboxes are the isolation boundary ([Runtime and outer isolation](../concepts.md#runtime-and-outer-isolation)). Docker sandboxes share the node's kernel, and a Docker node is [root-equivalent](./nodes.md#what-the-installer-sets-up) on its host; microsandbox gives each sandbox a microVM with an explicit [network policy](./nodes.md#what-the-installer-sets-up). Core itself has no Docker socket or KVM access.
-
 ## Execution latency
 
 Use the `environment input reserved` log to connect the submitting HTTP trace to `reservation_id` and `execution_trace_id`. The worker derives its diagnostic execution trace from the durable reservation identity, so observer disconnection and owner restart do not require a process-local trace map. This is an explicit link between the HTTP and execution traces, not continuation of the original HTTP span. Follow `environment input selected`, `execution preparation requested` and `environment input admitted` to connect the reservation to the Session, Environment, device, preparation request, Executor and Turn. `preparation_request_id` identifies the control request and is distinct from an HTTP `request_id`. For inputs included in Session creation, join `session initial input origin` to the worker reservation with the same `session_id` and `is_initial=true`; this covers both regular and streaming creation without an extra store query.
diff --git a/docs/getting-started/public-address.md b/docs/getting-started/public-address.md
new file mode 100644
index 000000000..f4defced5
--- /dev/null
+++ b/docs/getting-started/public-address.md
@@ -0,0 +1,126 @@
+---
+title: "Configure the public address"
+---
+
+Set the one origin that browsers, nodes, sandboxes and applications use to reach Core, and put a reverse proxy with HTTPS in front of it. This guide is for operators who expose Core beyond the machine it runs on.
+
+## Choose the public URL
+
+`OAC_PUBLIC_URL` is the origin applications, nodes, sandboxes and self-hosted executors use. Web accepts only its host. Core derives the daemon WebSocket URL, the self-hosted `remote_url` and each sandbox's connection address from it. It is an http or https origin without a path.
+
+| Situation | Public URL |
+| --- | --- |
+| Trial on this machine | `http://localhost:8080`, the default when `--host` is not `0.0.0.0` or the host has no private address |
+| Local network | `http://<private address>:8080`, which the installer picks when `--host` is `0.0.0.0` and the default route has a private-network address |
+| Beyond the local network | The HTTPS origin your reverse proxy serves, for example `https://core.example` |
+| E2B backend | An HTTPS origin reachable from the internet and not loopback, because E2B's sandboxes call Core from E2B's cloud |
+
+Pass the origin as `--public-url` when you install, or change it later as described in [Change the public URL](#changing-the-public-url). To install with a flag, see [Installation options](./install-options.md#pass-flags).
+
+## Listeners and access {#listeners-and-access}
+
+The default installation publishes Web on `--web-port` (8080) at `--host` `0.0.0.0`. Core and PostgreSQL publish no port. `--host` is an IPv4 or IPv6 address, without a port, scheme or zone. Use a concrete server IP in the browser, not a wildcard.
+
+| Service | Reachable from outside |
+| --- | --- |
+| Web | `OAC_WEB_PORT` on `OAC_HOST`. Behind a reverse proxy, install with `--host 127.0.0.1` |
+| Core | Only through Web. `/v1`, `/api/v1` and `/docs` pass through unchanged; signed-in console requests to `/core/v1` carry the Core key. Web serves everything else itself; see [Request boundary](../web/console-server.md#request-boundary) |
+| PostgreSQL | No |
+
+Sandboxes are the isolation boundary; see [Runtime and outer isolation](../concepts.md#runtime-and-outer-isolation).
+
+### Ports
+
+The installer checks `--web-port` before it downloads images.
+
+- `--host` is the address that port binds. `0.0.0.0` publishes Web on every IPv4 interface. `127.0.0.1` keeps Web on this machine.
+- A busy port stops installation. It does not move to another port.
+
+`oac apply` recreates Web when `OAC_HOST` or `OAC_WEB_PORT` changes.
+
+## Put Core behind HTTPS {#https-and-the-reverse-proxy}
+
+Install with `--host 127.0.0.1` and point your reverse proxy at Web, `127.0.0.1:8080` by default. The proxy must:
+
+- **Preserve Host.** Web accepts only the host of `OAC_PUBLIC_URL`.
+- **Pass WebSocket upgrades** on `/api/v1`. Nodes, sandbox Runtimes (E2B included) and self-hosted executors connect there.
+- **Not buffer or time out streams.** `/v1` streams Session events.
+- **Accept large uploads.** Source files may reach 512 MiB plus multipart overhead; Core enforces the limits.
+
+::: code-group
+
+```caddyfile [Caddy]
+core.example {
+	reverse_proxy 127.0.0.1:8080
+}
+```
+
+```nginx [nginx]
+map $http_upgrade $connection_upgrade {
+	default upgrade;
+	''      close;
+}
+
+server {
+	listen 443 ssl;
+	server_name core.example;
+	ssl_certificate     /etc/ssl/core.example/fullchain.pem;
+	ssl_certificate_key /etc/ssl/core.example/privkey.pem;
+
+	client_max_body_size 513m;
+
+	location / {
+		proxy_pass http://127.0.0.1:8080;
+		proxy_http_version 1.1;
+		proxy_set_header Host $http_host;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_buffering off;
+		proxy_read_timeout 1h;
+		proxy_send_timeout 1h;
+	}
+}
+```
+
+:::
+
+Caddy obtains the certificate itself and passes Host and WebSockets by default. The nginx server block goes in the `http` context and needs a certificate you provide.
+
+Then set `OAC_PUBLIC_URL=https://core.example` in `~/.oac/core/.env` and run `~/.oac/core/oac apply`.
+
+### Verify the routing
+
+```sh
+curl -s -o /dev/null -w '%{http_code}\n' -H 'OpenAI-Beta: agents=v1' https://core.example/v1/agents
+```
+
+`401` means `/v1` reached Core, which asks for a key. `404` means it reached Web: fix the proxy, or application calls and every node connection will fail. A node that logs `HTTP 400 on the WebSocket upgrade` sits behind a proxy that does not pass upgrades on `/api/v1`; see [Troubleshooting](./troubleshooting.md#nodes).
+
+TLS verification stays on everywhere. With a private certificate authority, node hosts, self-hosted machines and the Runtime image must trust it.
+
+### Try it locally with a quick tunnel {#try-it-locally-with-a-quick-tunnel}
+
+A [Cloudflare quick tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/) gives a trial installation with external ingress a temporary public HTTPS address. It forwards to one port, so put a local proxy with the same routes in front:
+
+```caddyfile
+http://:8443 {
+	bind 127.0.0.1
+	reverse_proxy 127.0.0.1:8080
+}
+```
+
+1. Start the proxy: `caddy run --config Caddyfile`.
+2. Start the tunnel: `cloudflared tunnel --url http://127.0.0.1:8443`. It prints an address such as `https://random-words.trycloudflare.com`.
+3. Set that address as `OAC_PUBLIC_URL` in `~/.oac/core/.env` and run `~/.oac/core/oac apply`.
+
+The address changes whenever `cloudflared` restarts; nodes bound to the old address must then be added again. Throughput is low, so a node's first Runtime download (about 500 MB) can be slow; see [slow links](./nodes.md#rerun-expiry-and-slow-links).
+
+## Change the public URL {#changing-the-public-url}
+
+Point the reverse proxy at the new address first, then edit `OAC_PUBLIC_URL` in `~/.oac/core/.env` and run `oac apply`. Afterwards:
+
+- Nodes on the old address get no new sandboxes: remove them in Web and add them again.
+- Existing sandboxes and executors keep working only while the old address still reaches this Core.
+- Self-hosted executors must restart with the new `remote_url`, and their installer refuses an installation made for the old address: create new self-hosted Sessions and connect their hosts again.
+
+The setting is listed in the [Configuration reference](../configuration.md#settings).
diff --git a/docs/getting-started/quickstart.md b/docs/getting-started/quickstart.md
index a3028a577..d20363f93 100644
--- a/docs/getting-started/quickstart.md
+++ b/docs/getting-started/quickstart.md
@@ -2,10 +2,12 @@
 title: "Run your first Session"
 ---
 
-This walkthrough takes you from a Project API key to an agent that has created a file and reported back. You need:
+Run an agent through Core with the official OpenAI Python SDK: connect with a Project API key, start a Session that writes a file, and read the result. You need the key and the API base URL from your administrator.
 
-- a Project API key and the API base URL, from your administrator ([Issue a Project API key](./install.md#issue-a-project-api-key));
-- a ready node or E2B backend, so Core has somewhere to run the agent ([Nodes](./nodes.md));
+Before you start, have:
+
+- a Project API key and the API base URL ([Issue a Project API key](./install.md#issue-a-project-api-key));
+- a ready node or E2B backend, so Core has somewhere to run the agent ([Add and manage nodes](./nodes.md));
 - Python 3.9 or newer;
 - a model: the installation's default model, or your own provider's model ID, base URL and API key. [Model execution](../../contracts/agents-api/model-execution.md#saved-defaults-and-precedence) says which one a Session uses and which protocols each Harness speaks.
 
@@ -30,25 +32,29 @@ read -rs OPENAI_API_KEY && export OPENAI_API_KEY   # paste the key; it is not ec
 
 Check access. This runs no model and creates no sandbox:
 
-```python
+::: code-group
+
+```python [Python]
 from openai import OpenAI
 
 client = OpenAI()  # reads OPENAI_BASE_URL and OPENAI_API_KEY
 print(client.beta.agents.list().data)
 ```
 
-An empty list means you are connected. The same check with curl:
-
-```sh
+```sh [curl]
 curl "$OPENAI_BASE_URL/agents" -H "OpenAI-Beta: agents=v1" \
   -H @<(printf 'Authorization: Bearer %s\n' "$OPENAI_API_KEY")
 ```
 
+:::
+
+An empty list (`[]`) means you are connected.
+
 ## 2. Start a Session
 
 A Session is one agent conversation with its own workspace. With `openai_hosted`, Core creates a sandbox for it on a node or E2B and starts the Harness inside.
 
-With the installation's default model, skip this. To use your own provider:
+To use your own provider instead of the installation's default model, export its settings and run the second tab:
 
 ```sh
 export MODEL_NAME='your-model-id'
@@ -56,29 +62,40 @@ export MODEL_BASE_URL='https://your-provider.example/v1'
 read -rs MODEL_API_KEY && export MODEL_API_KEY
 ```
 
-```python
-import os
+::: code-group
 
-extra = {"agent": {"x_agents_core": {"harness": "codex"}}}
-if os.environ.get("MODEL_API_KEY"):
-    extra["agent"]["model"] = os.environ["MODEL_NAME"]
-    extra["x_agents_core"] = {"model_provider": {
-        "protocol": "responses",
-        "base_url": os.environ["MODEL_BASE_URL"],
-        "api_key": os.environ["MODEL_API_KEY"],
-    }}
+```python [Default model]
+session = client.beta.agents.sessions.create(
+    environment={"type": "openai_hosted"},
+    input="Create /workspace/hello.txt with a short greeting, then describe it.",
+    extra_body={"agent": {"x_agents_core": {"harness": "codex"}}},
+)
+print(session.id)
+```
+
+```python [Your own provider]
+import os
 
 session = client.beta.agents.sessions.create(
     environment={"type": "openai_hosted"},
     input="Create /workspace/hello.txt with a short greeting, then describe it.",
-    extra_body=extra,
+    extra_body={
+        "agent": {"model": os.environ["MODEL_NAME"], "x_agents_core": {"harness": "codex"}},
+        "x_agents_core": {"model_provider": {
+            "protocol": "responses",
+            "base_url": os.environ["MODEL_BASE_URL"],
+            "api_key": os.environ["MODEL_API_KEY"],
+        }},
+    },
 )
 print(session.id)
 ```
 
+:::
+
 This makes a real model request and may incur charges.
 
-- `x_agents_core` holds Core's additions to the OpenAI API; see [Core extensions](../api/public-agent-api.md#core-extensions-x_agents_core).
+- `x_agents_core` holds Core's additions to the OpenAI API; see [Core extensions](../api/public-agent-api.md#core-extensions).
 - Keep the whole `agent` object in `extra_body`. SDK 3.13.0 replaces a body field with the matching `extra_body` field instead of merging them.
 
 ## 3. Wait for the result
@@ -102,7 +119,14 @@ else:
     raise TimeoutError(f"Session {session.id} is still running; inspect it before retrying")
 ```
 
-Success is a `completed` Turn whose Items describe the new file. A timeout neither cancels the work nor proves it failed.
+It prints:
+
+```text
+Turn: 00000000-0000-4000-8000-000000000003 completed
+[…the Turn's Items, including the assistant message that describes /workspace/hello.txt…]
+```
+
+A `completed` Turn whose Items describe the new file means the agent ran. A timeout neither cancels the work nor proves it failed.
 
 ## Next steps
 
@@ -110,5 +134,5 @@ Success is a `completed` Turn whose Items describe the new file. A timeout neith
 | --- | --- |
 | Stream output, send follow-up messages, upload files, add Skills or MCP, cancel | [Agents API guide](../api/public-agent-api.md#common-tasks) |
 | See every resource with request and response examples | [Agents API guide](../api/public-agent-api.md) |
-| Run the agent on your own machine | [Self-hosted execution](./self-hosted.md) |
+| Run the agent on your own machine | [Run self-hosted Sessions](./self-hosted.md) |
 | See a complete application | [Examples](../examples.md) |
diff --git a/docs/getting-started/sandbox-backends.md b/docs/getting-started/sandbox-backends.md
new file mode 100644
index 000000000..acf1069d4
--- /dev/null
+++ b/docs/getting-started/sandbox-backends.md
@@ -0,0 +1,49 @@
+---
+title: "Choose a sandbox backend"
+---
+
+Compare microsandbox, Docker and E2B, then select one in Web. This guide is for operators who finished [Install Core and Web](./install.md) and need compute for Core-hosted Sessions.
+
+The installer selects no backend. One installation uses one backend. To change it later, reset the deployment first; see [Change the sandbox configuration](./nodes.md#change-the-sandbox-configuration).
+
+## Compare the backends
+
+| | microsandbox (recommended) | Docker | E2B |
+| --- | --- | --- | --- |
+| Where sandboxes run | A microVM on your Linux nodes | A container on your Linux nodes | E2B's cloud |
+| Nodes to add | Yes | Yes | None |
+| You provide | Linux amd64 hosts with systemd and `/dev/kvm` | Linux amd64 hosts with systemd and rootful Docker Engine | An E2B API key and a template; a public HTTPS URL for Core |
+| Isolation | Each sandbox has its own kernel | Containers share the node's kernel | E2B's |
+| Idle sandboxes suspend and resume | Yes, with checkpoints | No | No |
+| Workspace storage | Required, on NFS | Own disk | Own disk |
+| Disk limits | Root disk and workspace quota | None | Set by the template |
+
+The field-level differences are in the [deployment contract](../../contracts/agents-api/sandbox-deployment.md#what-each-field-means-per-sandbox-provider). Host requirements for nodes are in [Add and manage nodes](./nodes.md#host-requirements).
+
+Docker nodes are [root-equivalent](./nodes.md#what-the-installer-sets-up) on their host: add them only on hosts dedicated to sandboxes.
+
+Sandbox nodes run on Linux amd64. When Core runs on macOS or Windows, connect a Linux node or use E2B. Applications can also run [self-hosted Sessions](./self-hosted.md) on their own machines, with no backend.
+
+## Select the backend in Web
+
+1. Open **Settings → Sandbox and scheduling**. The setup wizard asks where sandboxes run: **Own machines** (microsandbox or Docker) or **E2B cloud**.
+2. Choose the backend and the sandbox size. Web proposes the [default size the Provider declares](../sandbox-provider.md#register-the-provider-kind) as **Standard**.
+3. Choose **Save configuration**. The choice is stored in Core's database.
+
+For **Own machines**, continue with [Add and manage nodes](./nodes.md). For microsandbox, first [Set up workspace storage](./workspace-storage.md). For checkpoint recovery across microsandbox nodes, see [Checkpoint recovery across nodes](./nodes.md#checkpoint-recovery-across-nodes).
+
+## Use E2B
+
+E2B needs no nodes, but its sandboxes call Core from E2B's cloud, so Core needs a public HTTPS URL that is not loopback; see [Configure the public address](./public-address.md).
+
+1. Build a template from the Runtime image with [Build a template](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/e2b/README.md#build-a-template). Its output records the immutable `templateID:build_UUID` value.
+2. In the setup wizard, choose **E2B cloud**, enter the **E2B API key**, and select the template build or enter its `templateID:build_UUID`. The key must belong to the team that owns the template.
+3. Choose **Save configuration**. Core stores the key encrypted and never returns it.
+
+The key and template rules, including key replacement, are in [Initial setup and same-provider changes](../../contracts/agents-api/sandbox-deployment.md#initial-setup-and-same-provider-changes).
+
+## Next steps
+
+- microsandbox or Docker: [Add and manage nodes](./nodes.md).
+- Workspaces on NFS: [Set up workspace storage](./workspace-storage.md).
+- Models and keys: continue with [Install Core and Web](./install.md#set-a-default-model).
diff --git a/docs/getting-started/self-hosted.md b/docs/getting-started/self-hosted.md
index b0c9de429..9462b1c8d 100644
--- a/docs/getting-started/self-hosted.md
+++ b/docs/getting-started/self-hosted.md
@@ -1,10 +1,13 @@
 ---
-title: "Self-hosted executors"
+title: "Run self-hosted Sessions"
 ---
 
-A `self_hosted` Session runs on a machine your application owns: a workstation, a VM or a sandbox you manage. The application creates the Session through `/v1` and receives a command that installs `oac-daemon`, starts it and connects it to Core. Web shows the same command on the Session's page; it is optional. Core never creates, stops or reclaims the machine.
+A `self_hosted` Session runs on a machine your application owns, such as a workstation, VM or container, instead of a sandbox Core manages. This guide is for application developers who connect such a machine with `oac-daemon` and keep it running.
 
-**The daemon is not a sandbox.** Tools run with the permissions of the account that starts it and can reach whatever that account can. Use a container or VM when you need isolation; see [Runtime and outer isolation](../concepts.md#runtime-and-outer-isolation). The daemon does not restrict network access, so a Template that requires a network policy is rejected for a self-hosted Session.
+The application creates the Session through `/v1` and receives a command that installs `oac-daemon`, starts it and connects it to Core. Web shows the same command on the Session's page; it is optional. Core never creates, stops or reclaims the machine.
+
+> [!WARNING]
+> The daemon is not a sandbox. Tools run with the permissions of the account that starts it and can reach whatever that account can. Use a container or VM when you need isolation; see [Runtime and outer isolation](../concepts.md#runtime-and-outer-isolation).
 
 The Session brings its own model provider; the installation default never applies ([why](../../contracts/agents-api/model-execution.md#saved-defaults-and-precedence)). The machine gets an executor credential that works for this one Environment and nothing else.
 
@@ -18,16 +21,23 @@ The Session brings its own model provider; the installation default never applie
 
 The installer brings its own pinned Node.js and Harness versions (listed in [`scripts/build-native-installer.mjs`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/scripts/build-native-installer.mjs)) and leaves other installations of those tools untouched. On a platform without a matching installer, the command fails.
 
-The download is about 320 MiB. At its peak the installation needs about 2 GiB free on the disk that holds the Runtime home and the installation directory with one Harness selected (archive 316 MiB, unpacked installer 907 MiB, installed files about 560 MiB), and about 2.2 GiB with all three; the unpacked copy is removed when the command ends and the archive when the installation completes. The finished installation takes about 560 MiB with one Harness and about 940 MiB with all three.
+The download depends on the Harnesses you install. The installer (9 MiB) and Node.js (59 MiB) are always needed, plus 121 MiB for Codex, 99 MiB for Claude Code or 23 MiB for MiniMax Code, so a Session with one Harness downloads 90 to 189 MiB. Free space is needed on the disk that holds the Runtime home and the installation directory:
+
+| | One Harness | All three |
+| --- | --- | --- |
+| Free space at the peak | about 0.7 GiB | about 1.1 GiB |
+| Installed size, once per machine and version | about 560 MiB | about 940 MiB |
+
+Components install once per machine and version, in `components/<version>` under the Runtime home, and every Session of that version on the machine shares them. They are read-only, which prevents accidental changes; all Sessions run as the same account, so `start` verifies the components and refuses changed ones. Another Session of the same release downloads only the 9 MiB installer, installs no component again and adds only its own small directory. The peak is the installed size plus the archive being unpacked (121 MiB for Codex); each archive is deleted once its component is installed.
 
 The machine needs:
 
-- HTTP or HTTPS access to Core, and to the release download host unless Core carries an offline copy of the installers;
+- HTTP or HTTPS access to Core, and to the release download host unless Core carries an offline copy of this platform's installer (an offline installation carries only Linux amd64);
 - Bash for environment setup and MiniMax Code tools; on Windows, Git Bash, which Claude Code also requires;
 - Python and pip when the Session's packages need them;
 - any system packages your setup needs. The daemon never runs apt, sudo or another elevation command, so install them through the host's normal administration.
 
-No administrator privileges or Docker are needed. The Unix download command also uses `curl`, `tar`, `gzip`, a SHA-256 tool and the system file-lock command (`flock` on Linux, `lockf` on macOS). Windows needs its system `tar.exe`; the command checks for it before downloading. The Runtime home must allow executable files to run. On a Unix `noexec` mount, choose another absolute directory with `OAC_RUNTIME_HOME` before running the command.
+No administrator privileges or Docker are needed. The Unix download command also uses `curl`, `tar`, `gzip` and a SHA-256 tool. Windows needs its system `tar.exe`; the command checks for it before downloading. The Runtime home must allow executable files to run. On a Unix `noexec` mount, choose another absolute directory with `OAC_RUNTIME_HOME` before running the command.
 
 ## Connect a machine
 
@@ -56,11 +66,13 @@ No administrator privileges or Docker are needed. The Unix download command also
    print(installation["commands"]["posix"])  # use "powershell" on Windows
    ```
 
-2. Run the command on the target machine with the account that should run the tools. It downloads the installer matched to this Core, verifies its checksum, asks which Harnesses to install and where, installs them, creates the workspace if needed, starts the daemon and checks its connection.
+2. Run the command on the target machine with the account that should run the tools. It downloads the installer matched to this Core, verifies its checksum, asks which Harnesses to install and where, downloads Node.js and the selected Harnesses, installs them, creates the workspace if needed, starts the daemon and checks its connection.
 3. Send a Turn. A connected machine proves only authentication; the first Turn checks the Harness and the model.
 
 In Web, open the Session and copy the command under **Connect a host**.
 
+![Connect a host on a Session's page in Web](../assets/console-connect-host-en.webp)
+
 Keep the command private: it carries a short-lived [installation grant](../../contracts/agents-api/environment-executor-credentials.md#installation-grant) that claims the machine's credential. The command passes the grant in the `OAC_INSTALL_GRANT` environment variable, never as an argument. On Linux and macOS it starts with a space so shells that skip space-prefixed commands leave it out of history. PowerShell has no such rule: its history file (`ConsoleHost_history.txt`) keeps the whole command, grant included, until you clear it, although the grant stops working after 30 minutes. When it has expired, read the Session again or copy a fresh command from Web.
 
 The installer reports three results:
@@ -71,7 +83,12 @@ The installer reports three results:
 | **Daemon connection** | Core confirmed the daemon's authenticated connection |
 | **Model configuration** | Not checked; the first Turn uses the Session's model provider |
 
-The installer checks the grant before it downloads anything, so an expired command costs no download. The archive download resumes after a reset, fails only when it stalls (no data for 60 seconds) and gives up after five attempts; rerun the command to continue where it stopped. A verified archive is kept in `native-download` under the Runtime home until the installation completes, so a rerun after a failure needs no new download; it is checked against Core's checksum on every run and discarded if it fails. Disk space is checked before downloading, extracting and copying components. If a download or installation is interrupted, rerun the command: it clears unfinished temporary copies while preserving completed components, credentials and the workspace. The small `download.lock` file in `native-download` remains for concurrency control. An active download or installation is never cleared by another run. If the command expires, copy a fresh one from the Session.
+<details>
+<summary>If the download stops</summary>
+
+The installer checks the grant before it downloads a Harness, so an expired command costs only the 9 MiB installer. Each archive download resumes after a reset, fails only when it stalls (no data for 60 seconds) and gives up after five attempts; rerun the command to continue where it stopped. An unfinished archive stays in `native-download/<version>` under the Runtime home until a later run completes it, and downloads of other versions are removed. A component already installed on this machine is not downloaded again. Installations on one machine take turns installing components: the later one prints a waiting line and fails after 10 minutes. If a shared component was modified, `install` and `start` fail and name its directory: stop the installations that use it, delete that directory (the files are read-only: `chmod -R u+w <directory> && rm -rf <directory>`, or `Remove-Item -Recurse -Force <directory>` in PowerShell) and run the install command again. Disk space is checked before downloading, extracting and copying components. If a download or installation is interrupted, rerun the command: it clears unfinished temporary copies while preserving completed components, credentials and the workspace. If the command expires, copy a fresh one from the Session.
+
+</details>
 
 If the connection is not confirmed within 45 seconds, the installer prints the path of the daemon's log. The daemon keeps reconnecting. Fix the cause and run the install command again with the same installation directory, copying a fresh one from Web if it has expired: completed components and the credential are kept and a running daemon is reused. Do not remove the workspace or the Session to retry.
 
@@ -89,37 +106,6 @@ Append these to the command:
 
 The workspace is fixed when the Session is created. For a different workspace, create another Session.
 
-## Local capability directories
-
-A self-hosted Session may supply `capability_directories` alongside its workspace:
-
-```python
-environment = {
-    "type": "self_hosted",
-    "workspace_directory": os.environ["EXECUTOR_WORKSPACE"],
-    "capability_directories": [os.environ["EXECUTOR_CAPABILITIES"]],
-}
-```
-
-Paths are absolute in the machine's own syntax (Unix, Windows drive or UNC); the daemon checks them, not Core. Fill these directories before the daemon connects. They are ordinary paths visible to the daemon; naming one does not mount it or create a sandbox.
-
-Use `x_agents_core.environment` for the same Project-owned Skills, Plugin archives, files, packages, setup commands or Template used by a managed Session:
-
-```python
-session = client.beta.agents.sessions.create(
-    agent_id=agent_id,
-    environment=environment,
-    extra_body={"x_agents_core": {
-        "model_provider": model_provider,
-        "environment": {"environment_template_id": template_id},
-    }},
-)
-```
-
-The same extension works with `environment={"type": "openai_hosted"}`. Do not repeat a field in both `environment` and the extension. Setup runs with the daemon's account permissions. Deployment model keys are never sent to your machine.
-
-Before the first Turn the daemon copies these sources into a snapshot. Reconnecting reuses the snapshot even after you edit the sources; a new Session takes a new snapshot. The [preparation contract](../../contracts/agents-api/environments.md#runtime-capability-preparation) lists fields, merge rules, snapshot behavior and failures.
-
 ## Operate the installation
 
 The installation's `bin/oac-daemon` finds its own installation. Use it for:
@@ -138,6 +124,31 @@ To add a Harness, run the install command again (a fresh copy from Web if it has
 
 Stopping the daemon, cancelling a Turn or deleting the Session never removes the machine's workspace, native history or capability snapshot. An installation from another daemon version, or one whose files were changed, is refused. The installer never upgrades, repairs or migrates it. To use the Session on a new directory, [reconnect it](#reconnect-an-existing-session).
 
+## Rotate or revoke
+
+In Web, the Session's **Executor credentials** list the machine's credential:
+
+| Action | Effect |
+| --- | --- |
+| **Rotate** | The credential gets a new secret; the old secret stops working at once. On a revoked credential the action is **Restore** |
+| **Revoke** | The credential stops working at once |
+
+To reconnect after a rotation, stop the daemon with `oac-daemon stop`, replace the JSON at its configured credential-file path with the new credential, and run `oac-daemon start`. Do not run `install` again over the existing installation, and rotate the existing credential rather than issuing a second one, which [cannot connect](../../contracts/agents-api/environment-executor-credentials.md#revoked-or-rotated-credential).
+
+In an archived Project, credentials cannot be issued or rotated; revocation remains available. Operators can manage credentials with the Core key; see the [credential contract](../../contracts/agents-api/environment-executor-credentials.md#core-key-routes).
+
+## Reconnect an existing Session {#reconnect-an-existing-session}
+
+The install command claims the Session's machine credential once, and a second claim ends in `This Session's machine credential is already claimed by another installation`. That happens when you run the command in a different directory, on another machine, after the installation directory was lost, or when the directory holds an installation of another Core build or Session, which the installer refuses to change. Rerunning the command in the original directory always works.
+
+To reconnect the Session without the original directory, rotate its credential and install from an extracted distribution into a new directory:
+
+1. In Web, open the Session and choose **Rotate** in **Executor credentials**. Save the credential JSON it returns.
+2. Download `<base>/<platform>.tar.gz` and `<base>/<platform>-<component>.tar.gz` for `node` and each Harness you install (`codex`, `claude` or `minimax`), and extract them into one directory. `<base>` is the first URL of the install command (it ends with the Core version) and `<platform>` is `linux-amd64`, `darwin-arm64` or `windows-amd64`, matching the rows of [Platforms](#platforms).
+3. Run the installer as in [Install from an extracted distribution](#install-from-an-extracted-distribution) with the Session's `remote_url`, Environment ID, workspace and the saved credential file.
+
+Or create a new Session and run its command.
+
 ## Remove a machine {#remove-a-machine}
 
 Run the installation's own command:
@@ -152,7 +163,7 @@ On Windows PowerShell:
 & "$HOME\.oac\environments\<environment-id>\bin\oac-daemon.exe" uninstall
 ```
 
-It stops the daemon, lists what it deletes and asks for confirmation. It deletes only what an installation owns inside its directory (`bin`, `daemon`, `components`, `capabilities`, `runtime`, `initialization` and `packages`, with their credential file, native history and Harnesses) and then the directory itself if nothing else is left in it. Anything else in the directory stays, and so do the workspace and any credential file or capability directory outside the installation; the command names each one it keeps. The `native-download` directory and its `download.lock` are never touched. Where nothing is installed it says so and exits 0. If a file cannot be deleted, the command names it and can be run again once it is released. On Windows, the final deletion finishes a few seconds after the command exits.
+It stops the daemon, lists what it deletes and asks for confirmation. It deletes only what an installation owns inside its directory (`bin`, `daemon`, `capabilities`, `runtime`, `initialization` and `packages`, with their credential file and native history) and then the directory itself if nothing else is left in it. Anything else in the directory stays, and so do the workspace and any credential file or capability directory outside the installation; the command names each one it keeps. The shared components in the Runtime home are deleted with the last installation of that version on the machine; otherwise the command says how many other installations still use them. An installation directory deleted by hand is forgotten, and components nothing uses are removed, at the next install or uninstall on the machine. Unfinished downloads in `native-download` are never touched; delete that directory to reclaim the space. Where nothing is installed it says so and exits 0. If a file cannot be deleted, the command names it and can be run again once it is released. On Windows, the final deletion finishes a few seconds after the command exits.
 
 Then, in Web, open the Session and choose **Revoke** in **Executor credentials**, or **Delete** the Session; Core keeps accepting the machine's credential until you do.
 
@@ -160,32 +171,40 @@ The Session's install command cannot connect the machine again: its credential s
 
 After a Session is deleted or its credential is revoked or rotated, the daemon started with `start` prints why in `connect.log` (see `oac-daemon logs`) and exits. Starting it again prints the same reason. To reconnect it, follow [Rotate or revoke](#rotate-or-revoke) or [Reconnect an existing Session](#reconnect-an-existing-session); to remove it, run `uninstall`.
 
-## Rotate or revoke
-
-In Web, the Session's **Executor credentials** list the machine's credential:
+## Reference {#reference}
 
-| Action | Effect |
-| --- | --- |
-| **Rotate** | The credential gets a new secret; the old secret stops working at once. On a revoked credential the action is **Restore** |
-| **Revoke** | The credential stops working at once |
+### Local capability directories {#local-capability-directories}
 
-To reconnect after a rotation, stop the daemon with `oac-daemon stop`, replace the JSON at its configured credential-file path with the new credential, and run `oac-daemon start`. Do not run `install` again over the existing installation, and rotate the existing credential rather than issuing a second one, which [cannot connect](../../contracts/agents-api/environment-executor-credentials.md#revoked-or-rotated-credential).
+A self-hosted Session may supply `capability_directories` alongside its workspace:
 
-In an archived Project, credentials cannot be issued or rotated; revocation remains available. Operators can manage credentials with the Core key; see the [credential contract](../../contracts/agents-api/environment-executor-credentials.md#core-key-routes).
+```python
+environment = {
+    "type": "self_hosted",
+    "workspace_directory": os.environ["EXECUTOR_WORKSPACE"],
+    "capability_directories": [os.environ["EXECUTOR_CAPABILITIES"]],
+}
+```
 
-## Reconnect an existing Session {#reconnect-an-existing-session}
+Paths are absolute in the machine's own syntax (Unix, Windows drive or UNC); the daemon checks them, not Core. Fill these directories before the daemon connects. They are ordinary paths visible to the daemon; naming one does not mount it or create a sandbox.
 
-The install command claims the Session's machine credential once, and a second claim ends in `This Session's machine credential is already claimed by another installation`. That happens when you run the command in a different directory, on another machine, after the installation directory was lost, or when the directory holds an installation of another Core build or Session, which the installer refuses to change. Rerunning the command in the original directory always works.
+Use `x_agents_core.environment` for the same Project-owned Skills, Plugin archives, files, packages, setup commands or Template used by a managed Session:
 
-To reconnect the Session without the original directory, rotate its credential and install from an extracted distribution into a new directory:
+```python
+session = client.beta.agents.sessions.create(
+    agent_id=agent_id,
+    environment=environment,
+    extra_body={"x_agents_core": {
+        "model_provider": model_provider,
+        "environment": {"environment_template_id": template_id},
+    }},
+)
+```
 
-1. In Web, open the Session and choose **Rotate** in **Executor credentials**. Save the credential JSON it returns.
-2. Download `<base>/<platform>.tar.gz` and extract it, where `<base>` is the first URL of the install command (it ends with the Core version) and `<platform>` is `linux-amd64`, `linux-arm64`, `darwin-arm64` or `windows-amd64`.
-3. Run the installer as in [Install from an extracted distribution](#install-from-an-extracted-distribution) with the Session's `remote_url`, Environment ID, workspace and the saved credential file.
+The same extension works with `environment={"type": "openai_hosted"}`. Do not repeat a field in both `environment` and the extension. Setup runs with the daemon's account permissions. Deployment model keys are never sent to your machine.
 
-Or create a new Session and run its command.
+Before the first Turn the daemon copies these sources into a snapshot. Reconnecting reuses the snapshot even after you edit the sources; a new Session takes a new snapshot. The [preparation contract](../../contracts/agents-api/environments.md#runtime-capability-preparation) lists fields, merge rules, snapshot behavior and failures.
 
-## Install from an extracted distribution
+### Install from an extracted distribution {#install-from-an-extracted-distribution}
 
 The same installer accepts an already extracted distribution and a credential file issued by an operator, without the install command:
 
@@ -199,4 +218,4 @@ The same installer accepts an already extracted distribution and a credential fi
 "$HOME/.oac/my-runtime/bin/oac-daemon" start
 ```
 
-Use the Session's `remote_url` and Environment ID. The distribution is the archive named in [Reconnect an existing Session](#reconnect-an-existing-session). In PowerShell, run `.\oac-daemon.exe` with native absolute paths. The installation directory must be missing, empty or hold an installation. This mode needs an existing workspace and does not start the daemon until you run `start`.
+Use the Session's `remote_url` and Environment ID. The distribution is the directory described in [Reconnect an existing Session](#reconnect-an-existing-session): `oac-daemon` and `bundle.json` from the platform archive, and `components/` from the archives of `node` and each selected Harness. A component not yet installed on this machine is copied from the distribution, and one that is already installed is used as it is. A component missing from both fails with the name of the archive to extract; this mode never downloads. In PowerShell, run `.\oac-daemon.exe` with native absolute paths. The installation directory must be missing, empty or hold an installation. This mode needs an existing workspace and does not start the daemon until you run `start`.
diff --git a/docs/getting-started/troubleshooting.md b/docs/getting-started/troubleshooting.md
new file mode 100644
index 000000000..f631fd636
--- /dev/null
+++ b/docs/getting-started/troubleshooting.md
@@ -0,0 +1,79 @@
+---
+title: "Troubleshooting"
+---
+
+Find the symptom, its cause and the fix for installation, access, nodes and Sessions. This page is for operators of a Core installation.
+
+For a failing request or Turn, start with Web's **Monitor → Request log** and **Session log**; see [Request diagnosis](./operations.md#request-diagnosis) and [Service health](./operations.md#service-health).
+
+## Installation
+
+| Symptom | Cause and fix |
+| --- | --- |
+| `Web port unavailable; choose --web-port` | Another program holds that port. Stop it, or choose another `--web-port`. The installer does not move to a different port. When the message names a Compose project `oac-…`, an earlier installation whose directory is gone still runs: remove it as in [Uninstall](./operations.md#uninstall) |
+| `incomplete installation: preserve … and choose another directory` | Preserve the directory and choose another `--install-dir` |
+| `configuration check failed; no service was changed` | `.env` has a value Core rejects. The message names the variable and not the value. Fix `.env` and run `oac apply` again |
+| `data volume check failed; no service was changed` | Initialization refused the data volume; the message names the cause, such as a volume that belongs to another release (`existing data belongs to release …`). To use this release, [uninstall](./operations.md#uninstall) the installation, which deletes its data, then install again |
+| `This installation runs release …` | The installer or initialization belongs to another release. To use this release, [uninstall](./operations.md#uninstall) the installation, which deletes its data, then install again |
+| `This account cannot use Docker` | Add the account to the `docker` group and log in again, or use Docker Desktop or rootless Docker. Do not run the installer with `sudo` |
+| `This account cannot access …` | An earlier run with `sudo` left files owned by root. Run the `sudo chown` command the message prints, then rerun as your own account |
+| `Docker Compose 2.26 or newer is required` | Install or update the Docker Compose plugin |
+| `Docker could not pull …` | The Docker daemon cannot reach the registry. Configure its proxy or a registry mirror, or use the [offline archive](./install-options.md#offline-hosts) |
+| `Interrupted; rerun the installer to continue.` | Ctrl-C stopped the installer and left the installation ready for a rerun. Run the same command again. On Linux and macOS the launcher keeps an unfinished `oac` download in `${TMPDIR:-/tmp}/oac-install-<uid>` and the rerun resumes it; delete that directory to start the download over |
+| `startup failed; data retained, rerun the installer` | The message lists the services that are not healthy and the `docker compose logs --tail 50` command for them. Fix the cause, then [resume installation](./install.md#install); keep the data. After `oac apply`, the same message says to run `oac apply` again |
+
+If an installer step reports insufficient space or quota, free space on the filesystem named by the error. Image-loading failures can also require space in Docker's storage, which may be on a different filesystem.
+
+## Web and API access
+
+| Symptom | Cause and fix |
+| --- | --- |
+| Web answers 403 `Forbidden` | The browser host is not `OAC_PUBLIC_URL`. Open that origin; a reverse proxy must pass the original Host |
+| Web shows that Core is unavailable (502) | Core is stopped or failing: `docker compose ps`, then Core's log |
+| Session creation returns 400 `model_provider_required` | No model provider: set a [default model](../configuration.md#default-models) for the Harness, or pass one; self-hosted Sessions always pass their own |
+
+For a request that reached Core, see [Diagnose a failure](../api/public-agent-api.md#diagnose-a-failure) in the Agents API guide. A Session that failed to execute has [Session diagnostics](../../contracts/agents-api/session-diagnostics.md), which name the failure category.
+
+## Nodes
+
+Add node shows no command: see [Before you add a node](./nodes.md#before-you-add-a-node). A node that is online but not ready reports a code; see [Readiness codes](./nodes.md#readiness-codes).
+
+### Sandboxes cannot reach a private endpoint
+
+A microsandbox sandbox cannot reach a model provider or MCP server at a private address, and the Turn fails once the Harness stops retrying. Sandbox DNS queries go to the nameservers listed in the host's `/etc/resolv.conf`, and DNS rebind protection discards any answer that contains a private address. A name those nameservers resolve to a private address therefore does not resolve in the sandbox at all, even for a public service such as a model API behind a cloud VPC resolver.
+
+Nodes have no setting to change this. Make those nameservers return the service's public addresses. microsandbox does not read the host's `/etc/hosts`, so an entry there helps only when `/etc/resolv.conf` points at a local stub resolver that serves it, such as systemd-resolved at `127.0.0.53`. Otherwise use a Docker node, which does not filter sandbox traffic.
+
+### Connection failures
+
+A registered node that can't connect to Core says why in its [log](./nodes.md#logs): `sandbox node connection to Core failed; retrying` with a `cause`, once for each cause however often it retries, then `sandbox node connected to Core` when it connects. A node service that starts while Core is unreachable logs `cannot confirm approved node capacity:` followed by the cause.
+
+| Cause | Fix |
+| --- | --- |
+| `HTTP 400 on the WebSocket upgrade` | The reverse proxy in front of Core doesn't pass WebSocket upgrades on `/api/v1`; see [Put Core behind HTTPS](./public-address.md#https-and-the-reverse-proxy) |
+| Another status, such as `HTTP 404 on the WebSocket upgrade` or `HTTP 502 …` | The reverse proxy doesn't route `/api/v1` to Core or doesn't preserve Host, or Core is not running |
+| `dial tcp: …`, such as `connection refused`, `i/o timeout` or `no such host` | The host can't reach Core at the public URL. Check DNS and firewalls; the node service uses the [proxy](./nodes.md#download-through-a-proxy) the installer ran with, so rerun the command with the right settings if the proxy changed |
+| `tls: …`, or `TLS certificate expired or not yet valid` | The host doesn't trust Core's certificate, or the public URL uses `https` on a port that doesn't serve it |
+| `Core did not accept the node: …` | Core closed the connection after the node introduced itself. Read Core's log |
+
+### Installer messages
+
+| Message | Fix |
+| --- | --- |
+| `The enrollment command expired or was already used` | Generate a new command in Web and run it within an hour |
+| `Core rejected the node configuration read (HTTP …)` | Check the Core URL and the reverse proxy in front of it, then rerun |
+| `Not enough disk space under …` or `The disk is full` | Free the space it names, then rerun; the download resumes |
+| This host's node was added with another Core address, release or provider | Choose **Remove node**, uninstall it on the host, then add it again with **Add node** |
+| Another node installation is running, or this node is preparing a new sandbox configuration | Retry once **Nodes** no longer shows **Preparing target** |
+| A sandbox provider check failed before registering, such as `This host lacks a capability …` | Fix what it names (see [Readiness codes](./nodes.md#readiness-codes)) and rerun; the token was not used |
+| Core's public URL changed after this command was generated | Generate a new command in Web and run it |
+| This host's node uses `<address>`, but this command uses `<address>` | The node was added under an older public URL. Remove it in Web, uninstall it, then add it again |
+| Docker Engine is not installed, or Docker is not running | Install Docker Engine, or `sudo systemctl enable --now docker`, then rerun |
+| Docker on this host does not enforce CPU and memory limits | Use cgroup v2, then rerun |
+| KVM is unavailable, or `/dev/kvm` must be group-accessible | Enable virtualization; your distribution's KVM package sets `root:kvm 0660` |
+| This host has N CPUs and M MiB of memory; each sandbox needs … | Use a larger host, or change the sandbox size |
+| SELinux is enforcing on this host | Use a host supported by the installer; it does not change SELinux settings |
+| This host already runs a sudo-mode node for another Core | Remove that node and uninstall it first |
+| Node installation and removal require root | Run Web's command with sudo, or from a root shell |
+| Core still lists this node | Remove it on the **Nodes** page first |
+| Core no longer accepts this node | It was removed, or a reset retired it. Uninstall it, then add the host with a new command |
diff --git a/docs/getting-started/workspace-storage.md b/docs/getting-started/workspace-storage.md
new file mode 100644
index 000000000..db15e059e
--- /dev/null
+++ b/docs/getting-started/workspace-storage.md
@@ -0,0 +1,118 @@
+---
+title: "Set up workspace storage"
+---
+
+Keep Session workspaces on an NFS filesystem outside the sandbox nodes, with or without per-workspace quotas. microsandbox runs every Environment on this storage, so select it before you configure the microsandbox backend.
+
+The supported combination is microsandbox with the [kernel NFS adapter](../workspace-provider.md#kernel-nfs-adapter). Docker and E2B keep their own disks and do not support it; see [Choose a sandbox backend](./sandbox-backends.md). The [Configuration reference](../configuration.md#independent-workspace-storage) lists where the setting lives.
+
+```mermaid
+flowchart LR
+  A[Prepare NFS export] --> C[Mount into Core]
+  C --> D[Select the storage]
+  D --> E[Configure microsandbox]
+  E --> F[Add nodes]
+  F --> G[Validate with a Session]
+```
+
+## Prepare the NFS export
+
+Mount the same NFSv4.2 export on the Linux Core host and on every participating node before starting their services, at the same absolute path, for example `/srv/oac-workspaces`. You manage the export, mount availability and service startup ordering. Use a trusted-client AUTH_SYS export with `root_squash`.
+
+> [!WARNING]
+> Do not enable `no_root_squash` or broaden permissions to make a check pass.
+
+Prepare the namespace and service principals according to the adapter's [ownership requirements](../workspace-provider.md#kernel-nfs-adapter).
+
+## Mount the export into Core
+
+Add a read-write bind mount to the existing `core` service's `volumes` through the deployment platform's Compose customization, for example in `compose.override.yaml`. Keep the existing service volumes and user unchanged.
+
+```yaml
+services:
+  core:
+    volumes:
+      - type: bind
+        source: /srv/oac-workspaces
+        target: /srv/oac-workspaces
+        read_only: false
+        bind:
+          create_host_path: false
+```
+
+The host source must already be the NFS mount. `create_host_path: false` prevents creating a missing source directory but does not establish that NFS is mounted. Mount before creating the container; after a host unmount or remount, recreate it so its mount namespace uses the intended mount.
+
+## Select the storage
+
+Open **Settings → Workspace storage** and choose **Select new configuration**, or use `PUT /core/v1/workspace-storage` with the Core key as described in the [Core administration API](../../contracts/agents-api/admin-api.md#workspace-storage). The form accepts the adapter identifier, its parameters as a JSON object and an optional write-only credential JSON object. Core validates these adapter-owned values; Web defines no provider-specific storage fields.
+
+For first-time setup, generate separate canonical UUIDs for the immutable configuration `id` and the namespace marker, then submit this shape with your actual values. Restores retain their existing identities.
+
+```json
+{
+  "id": "11111111-1111-4111-8111-111111111111",
+  "adapter": "nfs",
+  "parameters": {
+    "root": "/srv/oac-workspaces",
+    "namespace_id": "22222222-2222-4222-8222-222222222222",
+    "uid": 65532
+  },
+  "tenant_capacity_mib": 0
+}
+```
+
+Selection runs the adapter's availability, ownership and xattr checks in Core. It does not prove that every node can resolve the mount. This configuration enforces no per-workspace quota, so `tenant_capacity_mib` must be `0`. For bounded workspaces, set up [quota mode](#quota-mode-storage-server) and select a quota mode configuration with a [tenant capacity](../configuration.md#tenant-capacity) instead.
+
+**Edit tenant capacity** keeps the selected immutable configuration. Selecting another configuration requires a new ID and does not migrate existing workspaces.
+
+## Configure microsandbox and add nodes
+
+Create or update the microsandbox deployment through the [sandbox deployment API](../../contracts/agents-api/sandbox-deployment.md#routes), keeping the required compute resources, Runtime and provider configuration. `resources.environment_disk_mib` is each new workspace's capacity quota request: `0` (the default) without quota mode, where a positive value is rejected, and at least 1024 MiB in quota mode, where `0` is refused at workspace admission. A deployment saved before storage is selected returns `workspace_storage_required`. Existing workspaces keep the capacity they were admitted with when the deployment changes.
+
+Deployment workspace requirements and each Session's attachment come from the selected database configuration. The selected configuration is the only storage setting.
+
+Then use **Nodes → Add node** on each prepared host; see [Add and manage nodes](./nodes.md).
+
+## Validate with a Session
+
+Connected, ready compute alone does not qualify an external filesystem. Create a Session and read and write files through each participating node before admitting application traffic. Include the independent namespace in the [stopped-write backup and restore procedure](./operations.md#back-up).
+
+## Quota mode storage server {#quota-mode-storage-server}
+
+Quota mode bounds each workspace's allocated bytes and inodes with an XFS project quota on the NFS server, set by the `oac-workspace-quota` command that Core calls over a restricted SSH forced command. The [Workspace filesystem protocol](../workspace-provider.md#quota-mode) owns the protocol and enforcement semantics. Prepare the storage server as its administrator:
+
+1. Put the export on a local XFS filesystem mounted with enforcing project quotas (`prjquota`, not `pqnoenforce`). The export root must be a subdirectory of that mount, for example mount `/srv/xfs` and export `/srv/xfs/oac-workspaces`; the command keeps its journal in `/srv/xfs/.oac-quota`, outside the export. Prepare the namespace root and marker as above.
+2. Install `xfsprogs` and Python 3.9 or newer. Install `storage/oac-workspace-quota` from the matching distribution as `/usr/local/sbin/oac-workspace-quota`, owned by root with mode `0755`.
+3. Write `/etc/oac/workspace-quota.json`, owned by root and not writable by group or others: `{"export_root": "/srv/xfs/oac-workspaces", "mount_point": "/srv/xfs"}`.
+4. Reserve a project ID range that no other project on this filesystem uses, then initialize the journal once: `oac-workspace-quota --config /etc/oac/workspace-quota.json init --projid-start 100000 --projid-end 199999`. It refuses to run over an existing journal; never initialize restored storage.
+5. Generate a dedicated key pair, for example `ssh-keygen -t ed25519 -N '' -f oac-workspace-quota`. Authorize its public key for one account with a working shell, such as `oac-quota`, in that account's `authorized_keys`: `restrict,from="<Core address>",command="sudo -n /usr/local/sbin/oac-workspace-quota --config /etc/oac/workspace-quota.json serve" ssh-ed25519 AAAA...`, with the sudoers entry `oac-quota ALL=(root) NOPASSWD: /usr/local/sbin/oac-workspace-quota --config /etc/oac/workspace-quota.json serve`. Alternatively authorize the key for root with the same options and the command without `sudo -n` under `PermitRootLogin forced-commands-only`. Keep `PermitUserEnvironment no`.
+6. Read the server's public host key from `/etc/ssh/` on the server itself, not from an unauthenticated network scan.
+
+Select the quota mode configuration with the private key as its write-only credential. Delete the local private key file after a successful selection; Core keeps it encrypted with `secrets/core/credential.key`:
+
+```json
+{
+  "id": "33333333-3333-4333-8333-333333333333",
+  "adapter": "nfs",
+  "parameters": {
+    "root": "/srv/oac-workspaces",
+    "namespace_id": "22222222-2222-4222-8222-222222222222",
+    "uid": 65532,
+    "quota": {
+      "endpoint": "storage.internal:22",
+      "user": "oac-quota",
+      "host_key": "ssh-ed25519 AAAA..."
+    }
+  },
+  "credential": {
+    "ssh_private_key": "-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----\n"
+  },
+  "tenant_capacity_mib": 65536
+}
+```
+
+Selection calls the command's read-only check through the pinned host key. Then update the deployment with the per-workspace capacity in `resources.environment_disk_mib`. Until that update, an installation that switched from a configuration without quotas refuses new workspaces; existing workspaces continue with their own configuration.
+
+The credential belongs to the immutable configuration. To rotate it, authorize a new key, select a new configuration ID with it, and keep the old key authorized until no workspace bound to the old configuration is still being created.
+
+Supported recovery for quota mode is a block-level copy of the XFS filesystem; see [Back up](./operations.md#back-up).
diff --git a/docs/maintainers.md b/docs/maintainers.md
index 8ee15c1d4..74a1a22ef 100644
--- a/docs/maintainers.md
+++ b/docs/maintainers.md
@@ -2,7 +2,7 @@
 title: "Build and release OpenAgentCore"
 ---
 
-This guide is for maintainers who build and publish OpenAgentCore. To install Core and Web, use the [installation guide](./getting-started/install.md). The rules the installer code follows are in [Deployment](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/README.md) and [Node installer](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md); required checks are in [CONTRIBUTING](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#required-checks).
+This guide is for maintainers who build and publish OpenAgentCore. To install Core and Web, follow [Install Core and Web](./getting-started/install.md). The rules the installer code follows are in [Deployment](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/README.md) and [Node installer](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md); required checks are in [CONTRIBUTING](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#required-checks).
 
 ## Build a distribution
 
@@ -37,24 +37,26 @@ make build-core-distribution
 | `CORE_DISTRIBUTION_MICROSANDBOX_ARCHIVE` | Cached microsandbox release archive. Default: `~/.oac/cache/microsandbox-v0.7.8-linux-x86_64.tar.gz`, downloaded when missing |
 | `CORE_DISTRIBUTION_DATABASE_IMAGE` | PostgreSQL 16 image; the default is the linux/amd64 manifest of the index in `deploy/compose/database-image.txt` |
 
-The build reuses the Core, Web, Runtime, SDK and helper builders. The manifest records the commit, its commit time (`source_time`, which orders releases for upgrades) and source tree, image config and OCI manifest digests, the Runtime OCI manifest digest, the microsandbox runtime and firmware hashes, and the size and SHA-256 of every Runtime and node artifact; native installers carry only their SHA-256 in the [catalog](#native-installers). Output is the control archive and its `.sha256`, the optional offline archive, and the versioned Runtime, node and native installer assets. Nothing is published. Rebuilding into a directory that already holds this commit's distribution is refused.
+The build reuses the Core, Web, Runtime, SDK and helper builders. The manifest records the commit and its source tree, image config and OCI manifest digests, the Runtime OCI manifest digest, the microsandbox runtime and firmware hashes, and the size and SHA-256 of every Runtime and node artifact; native installers carry only their SHA-256 in the [catalog](#native-installers). Output is the control archive and its `.sha256`, the optional offline archive, and the versioned Runtime, node and native installer assets. Nothing is published. Rebuilding into a directory that already holds this commit's distribution is refused.
 
 The ingress image carries only `oac` and four node metadata files: `manifest.json`, `SHA256SUMS`, `node-install.pyz` and `runtime/seccomp.json`. The build prepares their manifest from the same Runtime and artifact identities as the distribution, then verifies initialization with networking disabled. The node manifest omits control-plane image identities so it can be packaged before the ingress image itself exists.
 
 The control archive carries no Runtime image or node execution artifacts; the offline archive carries them. The [download contract](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md#download-contract) describes how nodes obtain them.
 
-A distribution carries the docs listed in `BUNDLED_DOCS` in `scripts/core-distribution-manifest.py`. Links between bundled docs stay relative; every other relative link is rewritten to the same file on GitHub at the bundle's commit. The build fails when a link or anchor does not resolve, and `make check-distribution` runs the same check on every tracked Markdown file outside `example/`. Update the list when you add or move a doc that the installer or its output refers to.
+A distribution carries the docs listed in `BUNDLED_DOCS` in `scripts/core-distribution-manifest.py`. Links between bundled docs stay relative; every other relative link is rewritten to the same file on GitHub at the bundle's commit. The build fails when a link or anchor does not resolve, and `make check-docs` runs the same check on every tracked Markdown file outside `example/`. Update the list when you add or move a doc that the installer or its output refers to.
 
 ### Native installers
 
-Self-hosted machines install `oac-daemon` from per-platform native installers: Linux amd64, macOS arm64 and Windows amd64. Each is built on its own OS by the `native-check` workflow (`scripts/build-native-installer.mjs`, whose `pins` object fixes the Node.js and Harness versions) and verified on every selected native check. Manual packaging runs and release checks upload `oac-native-installer-<OS>-<ARCH>.tar.gz` for seven days; ordinary PR and main checks do not upload successful packages. For a local distribution, download the three artifacts from a `native-check` run on that exact commit (a manual run or the release run; pull-request runs build the merge commit and do not match), then assemble the catalog from that checkout:
+Self-hosted machines install `oac-daemon` from per-platform native installers: Linux amd64, macOS arm64 and Windows amd64. Each is built on its own OS by the `native-check` workflow (`scripts/build-native-installer.mjs`, whose `pins` object fixes the Node.js and Harness versions) and verified on every selected native check. Manual packaging runs and release checks upload the platform's archives as `oac-native-installer-<OS>-<ARCH>` for seven days; ordinary PR and main checks do not upload successful packages. For a local distribution, download the three artifacts from a `native-check` run on that exact commit (a manual run or the release run; pull-request runs build the merge commit and do not match), then assemble the catalog from that checkout, with all archives of the three artifacts in one input directory:
 
 ```sh
 node scripts/build-native-catalog.mjs INPUT_DIR OUTPUT_DIR
 export OAC_NATIVE_INSTALLER_BUILD_DIR=OUTPUT_DIR
 ```
 
-The catalog records the commit, the Runtime protocol version, each archive's SHA-256 and, with a release base, its versioned URL. The control archive and Core image carry only `native-installers/catalog.json`; the archives become separate `oac-native-<commit>-<platform>.tar.gz` release assets, and the offline archive holds one copy of each outside the Core image. Without a catalog, Sessions report the install command as unavailable, and the release workflow refuses to publish.
+Each platform has a small base archive `<os>-<arch>.tar.gz` (`oac-daemon` and `bundle.json`, which lists every component with the SHA-256 of each file) and one archive per component, `<os>-<arch>-node` and `<os>-<arch>-<harness>` (MiniMax Code is not built for Windows). `build-native-installer.mjs` writes them. Core serves these artifacts by name and knows nothing of their content; `oac-daemon install` downloads the components it needs.
+
+The catalog records the commit, the Runtime protocol version, each artifact's SHA-256 and, with a release base, its versioned URL. The control archive and Core image carry only `native-installers/catalog.json`; the archives become separate `oac-native-<commit>-<artifact>.tar.gz` release assets, and the offline archive holds a copy of every Linux amd64 archive outside the Core image, which its `install.py` copies into the installation for Core to serve. Core redirects the other platforms to their release assets; a catalog without a release base has no such URL, so its offline archive holds every archive. Without a catalog, Sessions report the install command as unavailable, and the release workflow refuses to publish.
 
 ### Runtime images and helpers
 
@@ -72,7 +74,7 @@ docker build --platform linux/amd64 -t oac-runtime:codex "${OAC_DEV_HOME:-$HOME/
 
 The script checks the package version, builds `oac-daemon` for Linux amd64 and prepares a context with only the daemon, the unmodified native executable, its resources, the shared login-profile build step and `services/core/deploy/codex/Dockerfile`.
 
-**Claude Code Runtime image.** Node 20 or newer and pnpm are required.
+**Claude Code Runtime image.** Node 22.21 or newer and pnpm are required.
 
 ```sh
 make build-claude-sdk-runtime
@@ -94,7 +96,7 @@ docker build --platform linux/amd64 -t oac-runtime:mcode "${OAC_DEV_HOME:-$HOME/
 
 `scripts/prepare-release-runtimes.sh` runs the companion build from the pins.
 
-The distribution combines the three Harness images into one Runtime image (`deploy/distribution/Runtime.Dockerfile`): the MiniMax Code image, which carries the daemon, with the Codex executable and resources and the Claude SDK bundle copied in. It verifies that each image carries the daemon built from the same commit.
+The distribution combines the three Harness images into one Runtime image (`deploy/distribution/Runtime.Dockerfile`): the MiniMax Code image, which carries the daemon, with the Codex executable and resources and the Claude Code bundle copied in. It verifies that each image carries the daemon built from the same commit.
 
 **E2B helper.**
 
@@ -130,9 +132,12 @@ git tag -a v1.2.3 FULL_REVIEWED_COMMIT_SHA -m "OpenAgentCore v1.2.3"
 git push origin v1.2.3
 ```
 
-Tags use `vMAJOR.MINOR.PATCH`, optionally with a prerelease suffix such as `-rc.1` and build metadata such as `+build.1`. A prerelease suffix creates a GitHub prerelease. Pushing the tag is the release decision. Automated checks establish build and test results, not real-model qualification: assess live execution evidence before you push the tag. Model credentials and private certificate authorities never enter CI or release inputs, including acceptance images that contain them.
+```mermaid
+flowchart LR
+  tag[Push tag] --> checks[Full gate and native packaging] --> build[Build distribution and manifest] --> publish[Push images and publish the Release]
+```
 
-The release notes list every protocol version change (the node wire protocol, the microsandbox helper or the Core–Runtime protocol) with the actions it requires of operators. Core must never require a secret or file that only a newer initialization creates: an upgrade runs the new Core's `check-config` before the new `init`. After the Release is published, set `deploy/compose/smoke-pins.json` to its tag and the SHA-256 of its `compose.yaml`, so the Compose smoke upgrades from the latest published release.
+Tags use `vMAJOR.MINOR.PATCH`, optionally with a prerelease suffix such as `-rc.1` and build metadata such as `+build.1`. A prerelease suffix creates a GitHub prerelease. Pushing the tag is the release decision. Automated checks establish build and test results, not real-model qualification: assess live execution evidence before you push the tag. Model credentials and private certificate authorities never enter CI or release inputs, including acceptance images that contain them.
 
 The workflow runs `check` on the tagged commit, including the full local gate, official-client and image acceptance, and the native matrix with its packaging artifacts enabled. After checks succeed, one `build` job on `blacksmith-4vcpu-ubuntu-2204` prepares the pinned Runtime inputs, reuses the native installers, builds the distribution and publishes directly from its local files. This combined job has `contents: write` and `packages: write`; checkout does not persist credentials. It retains the assets as an uncompressed Actions artifact only when publication fails, for recovery, or when a manual build does not publish.
 
@@ -172,11 +177,11 @@ The planner compares the PR event's tested merge commit with its verified first
 
 | Group | Checks and consumers |
 | --- | --- |
-| `hygiene` | Names, repository links, bundled documentation integrity, and CI planner/gate tests; runs for every change |
+| `hygiene` | Repository links, bundled documentation integrity, and CI planner/gate tests; runs for every change |
 | `distribution` | Harness catalog and installer schema, install/apply/recovery/cleanup tests, Compose parsing and initialization fixtures, release/download and bundle contracts, Go console tests and build; needs Docker Compose for template parsing, no pnpm install or browser |
-| `compose` | Real startup from empty volumes using images built from the checkout, sign-in and API access, file upload and node installer download, then URL reconfiguration and container recreation with preserved credentials and data, and an in-place upgrade from the pinned published release; needs Docker, Go and network access, no model credentials |
+| `compose` | Real startup from empty volumes using images built from the checkout, sign-in and API access, file upload and node installer download, then URL reconfiguration and container recreation with preserved credentials and data; needs Docker, Go and network access, no model credentials |
 | `backend` | Parallel parts, each with a dedicated PostgreSQL guard: `runtime` (sqlc freshness, Runtime/shared Go tests, Linux microsandbox helper, daemon build), `core` (standalone Core build, Core service and client tests) and three `integration` shards of the serial Core integration test package |
-| `harness` | Claude SDK tests and packaging, MiniMax companion scripts |
+| `harness` | Claude Code adapter tests and packaging, MiniMax companion scripts |
 | `example` | Optional application typecheck, tests, build and isolated browser acceptance |
 | `web` | TypeScript, Web/client tests and Web build |
 | `website` | Website build and output checks for website, published documentation and dependency changes |
@@ -187,21 +192,39 @@ The planner compares the PR event's tested merge commit with its verified first
 
 `.github/actionlint.yaml` selects hygiene and lint. Known workflow changes select their consumers: the CI review and actionlint workflows run hygiene and lint; native workflow changes add native checks; API acceptance workflow changes add API checks with container acceptance enabled; website workflow changes add website checks. The shared Node action selects every job that uses it plus lint. A new or unclassified workflow/action selects the full gate until its consumers are declared in the planner. Planner tests and CI measurement scripts run hygiene; changing the planner itself runs the full gate.
 
-Compose template and Compose test changes select both `distribution` fixtures and the `compose` smoke job; Core, Web, shared Go packages and the image Dockerfiles also select the smoke job. Run `python3 scripts/compose-smoke.py` locally with Docker available to repeat it. The script uses a unique project, an automatically assigned loopback port and artifacts under `~/.oac/tests/`; it removes its containers and volumes on exit. CI also performs cleanup after a failed or interrupted smoke step. Diagnostics show container status without printing HTTP response bodies or sign-in keys. Core, Web and the ingress image are built from the checkout, with node metadata for the checkout's commit; Web serves a placeholder page instead of the console build, and the initialization container runs with networking disabled. The upgrade phase starts a new installation from the published `compose.yaml` of the release pinned by tag and SHA-256 in `deploy/compose/smoke-pins.json`, creates a Project, a Project key and a file, then runs the installer's preflight with the checkout's images (`core check-config`, then `init`) and `up --wait`. It checks that the installation ID, Core key, Project, Project key and file survive, that Core and the node payload report the checkout's commit and that the schema is at the latest migration. The smoke matrix runs on native Linux amd64 and arm64 runners; the native matrix builds and tests the shared Core installer on Linux, macOS and Windows.
+Compose template and Compose test changes select both `distribution` fixtures and the `compose` smoke job; Core, Web, shared Go packages and the image Dockerfiles also select the smoke job. Run `python3 scripts/compose-smoke.py` locally with Docker available to repeat it. The script uses a unique project, an automatically assigned loopback port and artifacts under `~/.oac/tests/`; it removes its containers and volumes on exit. CI also performs cleanup after a failed or interrupted smoke step. Diagnostics show container status without printing HTTP response bodies or sign-in keys. Core, Web and the ingress image are built from the checkout, with node metadata for the checkout's commit; Web serves a placeholder page instead of the console build, and the initialization container runs with networking disabled. The smoke matrix runs on native Linux amd64 and arm64 runners; the native matrix builds and tests the shared Core installer on Linux, macOS and Windows.
 
-Go module and workspace inputs select backend, API (including the container), native and distribution checks. Each Node module owns its manifest and lockfile. Website dependencies select website checks; Web dependencies select Web and browser checks; example dependencies select example checks; shared TypeScript client dependencies select Web, browser and example checks; Claude adapter dependencies select Harness, native and distribution checks. Shared package-manager configuration selects all Node consumers. The root TypeScript configuration selects Web and example checks; the adapter TypeScript configuration selects Harness and native checks. Each selected set includes hygiene. Mixed changes accumulate their consumers, and every job reads the same plan instead of maintaining its own path list. For example, a notification-only PR skips database, browser and native jobs, while a notification plus Core change adds backend and API checks.
+`scripts/ci_plan.py` selects groups from the changed paths. Each selected set includes `hygiene`, mixed changes accumulate their consumers, and every job reads the same plan instead of keeping its own path list. A notification-only PR skips database, browser and native jobs; a notification plus Core change adds backend and API checks.
 
-Published documentation and assets under `docs/` and `contracts/`, plus `docs.json`, select hygiene and website. Other ordinary Markdown, including documentation inside source directories, selects hygiene only. Generated catalog files and configuration reference sections retain their distribution freshness checks. Core `.go`, `.sql`, helper scripts and configuration inputs select backend/API checks; Web source, styles and assets select Web checks. Embedded native assets and declared test fixture directories select their consumers regardless of suffix, including Markdown prompts and extensionless data. Installer changes add distribution checks. Web changes add Web checks and all browser shards; Core/DB changes add backend and official-client acceptance. Shared contracts, SDKs, Runtime inputs and dependencies propagate to their consumers according to the planner. Generated catalog and protocol inputs include the installer, client and UI consumers. Do not duplicate path lists in reusable workflows or put a `paths` filter on the required workflow.
+| Changed input | Groups selected |
+| --- | --- |
+| Published documentation and assets under `docs/` and `contracts/`, and `docs.json` | `hygiene`, `website` |
+| Other Markdown, including documentation inside source directories | `hygiene` |
+| Core `.go`, `.sql`, helper scripts and configuration inputs | `backend`, `api` |
+| Web source, styles and assets | `web`, `web-acceptance` (all browser shards) |
+| Installer | `distribution` |
+| Embedded native assets and declared test fixture directories, whatever the suffix | Their consumers |
+| Shared contracts, SDKs, Runtime inputs and dependencies; generated catalog and protocol inputs | Their consumers, including the installer, client and UI |
+| Go module and workspace inputs | `backend`, `api` (including the container), `native`, `distribution` |
+| Website dependencies | `website` |
+| Web dependencies | `web`, `web-acceptance` |
+| Example dependencies | `example` |
+| Shared TypeScript client dependencies | `web`, `web-acceptance`, `example` |
+| Claude adapter dependencies | `harness`, `native`, `distribution` |
+| Shared package-manager configuration | Every Node consumer |
+| Root TypeScript configuration | `web`, `example` |
+| Adapter TypeScript configuration | `harness`, `native` |
+| Core/DB changes | `backend`, official-client acceptance in `api` |
+
+Do not duplicate path lists in reusable workflows or put a `paths` filter on the required workflow. Generated catalog files and configuration reference sections keep their distribution freshness checks.
 
 The final `check` runs even when planning or a dependency fails. It requires a successful, valid plan, every selected job to be successful, and every unselected job to be skipped. Failure, cancellation, a missing job, an unexpected skip or an unexpected execution fails the gate. API/native reusable workflows are direct dependencies of this gate. A newer run on the same PR cancels its predecessor. Release checks run at their requested immutable ref; native packaging executes once inside those checks, and the distribution build waits for them.
 
 Use **Actions → core-check → Run workflow** for a manual full check. For a transient failure, use GitHub's **Re-run failed jobs** so successful jobs remain completed. PR updates cancel the superseded run through Actions concurrency. Build and dependency caches speed execution; they do not stand in for successful tests. Native release installers are passed between jobs using Actions artifacts, within the same release workflow.
 
-The `CI review and Feishu notification` workflow runs after a PR merges into main. A matrix runs **Code review** and **Docs review** in independent LLM contexts with `fail-fast: false`. Both read the merged commit and PR diff. Code review checks implementation, repository rules and existing CI results; it does not start another test run. Docs review checks changed behavior against documentation even when no docs changed. When docs change, it also checks contradictions, duplicated facts, topic ownership under CONTRIBUTING, and English/Chinese agreement. Findings include file and line references, supporting evidence and a minimal correction. Reviews read the repository without editing it.
-
-Each review returns a structured result (`ok`, `issues` or `incomplete`) and Chinese sections, retained as an Actions artifact for seven days. **Combined Feishu notification** waits for both jobs and sends one Card 2.0 message containing both results through the existing `FEISHU_WEBHOOK_URL`; `FEISHU_WEBHOOK_SECRET` optionally signs it. The card uses fixed sections for PR details, behavior changes, code and repository rules, CI results, and documentation review, separated by dividers. Its header shows green for no findings, red for findings, and yellow for an incomplete review without findings. Only this notification job receives the webhook secrets. Failed, missing or invalid reports appear as incomplete, alongside any available result from the other review. The notification job runs even when a review fails. Delivery requires Feishu's `code=0` response; a failed or ambiguous request is not automatically retried, avoiding duplicate messages. Each review has a 25-minute execution timeout. Review and delivery failures do not block merges, and closing an unmerged PR does not trigger this workflow. The workflow checks out only the merged commit with notification credentials.
+The `CI review and Feishu notification` workflow runs once after a PR merges into main. It checks out the merged commit, reads that PR's existing checks and logs, and sends one Feishu card through `FEISHU_WEBHOOK_URL` that summarizes the change, its fit with the repository rules and the actual CI status. It does not trigger another test run, and a failed review or delivery never fails the job or blocks merges. Closing an unmerged PR does not invoke the review. The workflow uses `pull_request_target` only for the merged event and never checks out an unmerged PR head with notification credentials.
 
-Browser jobs own separate fixtures and servers; increasing workers against the shared mutable fixture is unsafe. Failed browser jobs retain reports/traces for seven days. Native failure phase summaries are retained for seven days and detailed output stays in the Actions logs; credentials and temporary installation trees are not uploaded. Successful native archives are uploaded only for explicit manual packaging or releases, without recompressing the compressed archive. Release distribution artifacts retain their existing recovery policy; failed publication can reuse the original build as described above.
+Browser jobs own separate fixtures and servers; increasing workers against the shared mutable fixture is unsafe. Failed browser jobs retain reports/traces for seven days. Native failure phase summaries are retained for seven days and detailed output stays in the Actions logs; credentials and temporary installation trees are not uploaded. Native archives are built and uploaded only for explicit manual packaging or releases, without recompressing the compressed archive. Release distribution artifacts retain their existing recovery policy; failed publication can reuse the original build as described above.
 
 The local Node composite action installs the pinned pnpm and caches its package store by lockfile, OS, architecture, Node version and pnpm version. It caches downloaded packages, not `node_modules`; installs remain frozen. Go partitions retain the existing module/compiler caches described under [publication](#publish-a-version). Cache hits seed work and never replace tests. The three native platforms run independently; parallel execution reduces elapsed time without reducing total machine time.
 
diff --git a/docs/runtime-bootstrap.md b/docs/runtime-bootstrap.md
index 5a788ddf5..a264c12c0 100644
--- a/docs/runtime-bootstrap.md
+++ b/docs/runtime-bootstrap.md
@@ -2,7 +2,39 @@
 title: "Runtime bootstrap"
 ---
 
-A Sandbox Provider starts a managed Runtime by handing it one bootstrap file. This document owns that Provider-to-Runtime startup input. The type and validator live in [`internal/runtimebootstrap`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/runtimebootstrap/bootstrap.go); Go providers build it with `sandbox.Bootstrap.RuntimeConnection()` in [`runtime_bootstrap.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/sandbox/runtime_bootstrap.go), and SDK helpers forward the serialized object unchanged. A provider never reads or writes the Runtime's private authentication store.
+The Runtime bootstrap protocol connects a Sandbox Provider to the managed Runtime it starts. The Provider hands the Runtime one bootstrap file, which is the Runtime's only authentication input for that launch.
+
+| Property | Value |
+| --- | --- |
+| Caller | The Sandbox Provider. Go Providers build the input with `sandbox.Bootstrap.RuntimeConnection()` in [`runtime_bootstrap.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/sandbox/runtime_bootstrap.go); SDK helpers forward the serialized object unchanged. |
+| Implementations | The Runtime, and the Providers listed under [Reference implementations](#reference-implementations) |
+| Code | [`internal/runtimebootstrap`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/runtimebootstrap/bootstrap.go): the type and validator |
+| Transport | A JSON file whose absolute path is passed to `oac-daemon connect --bootstrap-file` |
+| Version rule | The exact `version` ([Launch input](#launch-input)) |
+
+## Responsibilities and readiness
+
+| Party | Owns | Never does |
+| --- | --- | --- |
+| Sandbox Provider | The account, mounts and workspace; delivering the file; the Runtime's resource and Environment binding settings; starting the daemon as the unprivileged Runtime account | Reads or writes the Runtime's private authentication store |
+| Runtime | Validating the input, authentication and the connection | Accepts a second authentication source for the same launch |
+
+A successful launch proves only the handoff: an authenticated connection, prepared capabilities and execution readiness are separate observations under the [Core–Runtime protocol](./runtime-protocol.md), and the [Sandbox Provider protocol](./sandbox-provider.md#four-distinct-readiness-facts) lists what each one proves.
+
+Self-hosted executors and operator-provisioned devices get their daemon identity in other ways; the [machine connection API](../contracts/agents-api/machine-api.md#credentials) lists every credential source. All of them enter the same Runtime execution loop.
+
+## Startup order
+
+```mermaid
+sequenceDiagram
+    participant P as Sandbox Provider
+    participant R as Runtime daemon
+    participant C as Core
+    Note over P: Write the bootstrap file
+    P->>R: start oac-daemon connect --bootstrap-file PATH
+    Note over R: Validate the file, read the credential into memory
+    R->>C: Connect over the Core-Runtime protocol
+```
 
 ## Launch input
 
@@ -20,19 +52,26 @@ oac-daemon connect --bootstrap-file /home/runtime/runtime-bootstrap.json
 | `harness` | The immutable Session Harness identifier; only this Harness is probed and registered by a managed Runtime |
 | `credential` | Nonempty daemon credential Core issued, without whitespace or NUL |
 
-The decoder rejects unknown, duplicate, missing and case-aliased fields, other versions and documents larger than `runtimebootstrap.MaxBytes` (16 KiB). Errors never include submitted values. A missing or malformed file fails before the daemon connects.
+The decoder rejects unknown, duplicate, missing and case-aliased fields, other versions and documents larger than `runtimebootstrap.MaxBytes`. Errors never include submitted values. A missing or malformed file fails before the daemon connects.
 
 The file is the only authentication input for this launch: the daemon refuses to combine it with self-hosted enrollment options, and reads the credential into memory without saving it to a stored profile. Credentials never go in command arguments, environment variables or receipts. The provider keeps the file for process restarts and removes it only during explicit cleanup of the resources it owns.
 
-## Responsibilities and readiness
+## Timeouts and limits
 
-The provider creates the account, mounts and workspace, delivers this file, sets the Runtime's resource and Environment binding settings, and starts the daemon as the unprivileged Runtime account. Docker writes the file into the Runtime's owned home volume; microsandbox and E2B deliver it before launching the same command.
+| Value | Applies to | On breach |
+| --- | --- | --- |
+| 16 KiB (`runtimebootstrap.MaxBytes`) | The bootstrap document | The decoder rejects it, and the daemon fails before it connects. |
 
-Core derives `harness` from the Session that owns the allocation. A combined image can contain several Harnesses, but its managed Runtime discovers only this selection; an unknown, missing or unavailable selection fails without probing another Harness. The bootstrap version is 2. Upgrade Core, its provider helpers and newly launched Runtime images together; retained allocations keep their existing bootstrap and Runtime. Self-hosted installations continue to discover their installed Harness set.
+Core derives `harness` from the Session that owns the allocation. A combined image can contain several Harnesses, but its managed Runtime discovers only this selection; an unknown, missing or unavailable selection fails without probing another Harness. The bootstrap version is 2. Deploy matching Core, provider helpers and Runtime images; the installation does not support an upgrade from another release. Self-hosted installations continue to discover their installed Harness set.
 
 The Runtime validates the input and owns authentication and connection. A successful launch proves only the handoff: an authenticated connection, prepared capabilities and execution readiness are separate observations under the [Core–Runtime protocol](./runtime-protocol.md), and the [Sandbox Provider guide](./sandbox-provider.md#four-distinct-readiness-facts) lists what each one proves.
 
-Self-hosted executors and operator-provisioned devices get their daemon identity in other ways; the [machine connection API](../contracts/agents-api/machine-api.md#credentials) lists every credential source. All of them enter the same Runtime execution loop.
+## Reference implementations
+
+| Provider | Delivery |
+| --- | --- |
+| Docker | Writes the file into the Runtime's owned home volume. |
+| microsandbox, E2B | Deliver the file before launching the same command. |
 
 ## Hosted suspension control
 
diff --git a/docs/runtime-protocol.md b/docs/runtime-protocol.md
index e015989c3..491a65403 100644
--- a/docs/runtime-protocol.md
+++ b/docs/runtime-protocol.md
@@ -2,9 +2,15 @@
 title: "Core\u2013Runtime protocol"
 ---
 
-This protocol connects Core to a Runtime daemon after the daemon has its machine credential. It defines the meaning and order of the messages on the daemon connection. The wire types, limits and validators live once in [`internal/agentdaemon/proto`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/internal/agentdaemon/proto); Core's [gateway](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/runtimegateway) and the reference Runtime's [dispatcher](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/apps/daemon/internal/dispatch) both use them, so there is no second payload schema to keep in sync. The HTTP routes that issue credentials and open the connection are in the [machine connection API](../contracts/agents-api/machine-api.md).
+The Core–Runtime protocol connects Core to a Runtime daemon and defines the meaning and order of the messages on the daemon connection. Hosted and self-hosted Runtimes use the same protocol.
 
-Hosted and self-hosted Runtimes use the same protocol. A Harness joins through the [Harness adapter contract](../contracts/agents-api/harness-onboarding.md), which owns the Executor and Turn lifecycle obligations behind the Runtime registry.
+| Property | Value |
+| --- | --- |
+| Caller | Core's [gateway](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/runtimegateway) |
+| Implementations | The reference Runtime's [dispatcher](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/apps/daemon/internal/dispatch). A Harness joins through the [Harness protocol](../contracts/agents-api/harness-onboarding.md), which owns the Executor and Turn lifecycle obligations behind the Runtime registry. |
+| Code | [`internal/agentdaemon/proto`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/internal/agentdaemon/proto): wire types, limits and validators, defined once and used by both sides, so there is no second payload schema to keep in sync |
+| Transport | JSON [envelopes](#envelope-and-identity) over a WebSocket at `/api/v1/agent-daemon/ws`. The HTTP routes that issue credentials and open the connection are in the [Machine connection API](../contracts/agents-api/machine-api.md). |
+| Version rule | Exact match of `proto.Version` ([Versioning](#versioning)) |
 
 Connection frames are limited to 4 MiB by `proto.MaxFrameBytes`. Core journals a transport-valid observation without truncating its payload. Ordinary journal batches hold up to 64 observations and 1 MiB; a larger observation is stored alone. Each Turn remains limited to 65,536 observations and 32 MiB, with one reserved terminal outcome beyond those limits. Journal failures fail the Turn and retain committed Items. The `execution journal failed` log records Project, Session and Turn IDs, trace context, stage, event kind, byte count, journal position and a bounded failure category or SQLSTATE; it never records event payloads or raw error text.
 
@@ -12,71 +18,59 @@ Command output is text: `command_output.delta`, `tool_call.result` string values
 
 ## Ownership and connection
 
-Core owns durable Session, Turn, input and Environment records, scheduling and reconciliation. Runtime owns native Executors, active Turns, transfer state and cleanup until settlement. A Sandbox Provider owns placement and the surrounding compute. Releasing an execution admission or closing an Executor never deletes, suspends or reclaims a sandbox. The daemon is not an isolation boundary; see [Runtime and outer isolation](./concepts.md#runtime-and-outer-isolation).
+| Party | Owns | Never does |
+| --- | --- | --- |
+| Core | Durable Session, Turn, input and Environment records, scheduling and reconciliation | Replays input, initialization, transfers or unresolved mutations after a reconnection |
+| Runtime | Native Executors, active Turns, transfer state and cleanup until settlement | Deletes, suspends or reclaims a sandbox when it releases an execution admission or closes an Executor; the daemon is not an isolation boundary ([Runtime and outer isolation](./concepts.md#runtime-and-outer-isolation)) |
+| Sandbox Provider | Placement and the surrounding compute | Owns Executors or Turns |
 
 A Runtime connects in this order:
 
-1. Obtain a daemon credential and device ID. The [machine connection API](../contracts/agents-api/machine-api.md#credentials) lists the credential kinds; Project API keys and the Core key are never Runtime credentials.
-2. Call `POST /api/v1/agent-daemon/bootstrap` with the credential as a Bearer header and the device ID. Use the connection URL it returns.
-3. Dial the WebSocket at `/api/v1/agent-daemon/ws` with `device_id` and `version` query parameters and the Bearer header. Never put a credential in a URL, a payload log or a trace.
-4. Send a heartbeat at once, then at the interval bootstrap returned. Each heartbeat declares `supported_agent_kinds`, their availability and their [capabilities](#capability-declarations). Before the first heartbeat, capabilities are unknown; a kind missing from a heartbeat is not advertised. Neither permits inference.
-5. Exchange ordered JSON [envelopes](#envelope-and-identity). Heartbeats establish liveness only, never execution progress or a receipt for an earlier message.
-
 The wire version is [`proto.Version`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/version.go), independent of the Runtime build version that heartbeats report. Core accepts only an exact match, including the patch component. A mismatch returns HTTP 426 `incompatible_version` before any dispatch; the daemon treats it as permanent and stops reconnecting. Breaking changes still require matching peers. Additive transport features may use an explicit, versioned negotiation defined here without changing the base wire version.
 
-Each physical connection has fresh routing, admission handles and transfer state. A newer connection for the same device replaces the previous one: Core fences the owner lease and evicts the old Run routes, and the new connection inherits none of them. A valid credential and connection are never authority to choose another Session or Environment binding.
+- The [Machine connection API](../contracts/agents-api/machine-api.md#credentials) lists the credential kinds. Project API keys and the Core key are never Runtime credentials.
+- Both requests carry the credential as a Bearer header. A credential never appears in a URL, a payload log or a trace.
+- The first heartbeat is sent at once, then at the interval that bootstrap returned. Each heartbeat declares `supported_agent_kinds`, their availability and their [capabilities](#capability-declarations). Before the first heartbeat, capabilities are unknown; a kind missing from a heartbeat is not advertised. Neither permits inference.
+- Heartbeats establish liveness only, never execution progress or a receipt for an earlier message.
+
+Each physical connection has fresh routing, admission handles and transfer state. A newer connection for the same device replaces the previous one: Core evicts the old Run routes, and the new connection inherits none of them. A valid credential and connection are never authority to choose another Session or Environment binding.
+
+## Versioning
+
+The wire version is [`proto.Version`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/version.go), independent of the Runtime build version that heartbeats report. Core accepts only an exact match, including the patch component. A mismatch returns HTTP 426 `incompatible_version` before any dispatch; the daemon treats it as permanent and stops reconnecting. Deploy matching peers together; a change to a payload or its semantics changes `proto.Version`.
 
 ## Capability declarations
 
-`AgentKindCapabilities` in [`inbound.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) describes one composed Runtime and Harness, independently of `available` and of Core's engine profile. Every field is a `CapabilitySupport`: supported or unsupported. The zero value is unspecified and invalid, even for an unavailable Harness. Registration validates the complete declaration before changing the registry; there is no implicit basic descriptor.
+`AgentKindCapabilities` in [`inbound.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) describes one composed Runtime and Harness, independently of `available`. It starts from the Harness's declared capabilities, which state the most it can do, and discovery only narrows them to what the installation verified. Every field is a `CapabilitySupport`: supported or unsupported. The zero value is unspecified and invalid, even for an unavailable Harness. Registration validates the complete declaration before changing the registry; there is no implicit basic descriptor.
 
 On the wire each field is a JSON boolean, and every field is present, including `false`. Encoding an incomplete declaration fails. Decoding rejects omitted, null, invalid and unknown fields, and a missing capability object. An invalid heartbeat clears the connection's admission snapshot and closes its transport; that establishes no native completion or cancellation result.
 
 Each admitted Executor and Turn keeps the declaration it was admitted with. A later heartbeat cannot add operations to an existing owner. Optional operations check this snapshot before any native call; the presence of a Go interface never grants support. A declared operation that returns `agent.ErrUnsupportedOperation` is a contract violation, distinct from unavailability, a failed native call or an uncertain write. Uncertain operations keep their receipts and ownership and are never replayed automatically. Workspace support includes the common Runtime workspace implementation, so a native adapter's unsupported workspace method does not disable that composition.
 
-A new field requires an explicit decision in every production declaration. Contract tests enumerate every field for registration, wire round trips and the persisted boolean projection; the shared test fixture lists fields individually and supplies no defaults for future ones. [Harness onboarding](../contracts/agents-api/harness-onboarding.md) owns the adapter side of each declaration.
+A new field requires an explicit decision in every production declaration. Contract tests enumerate every field for registration, wire round trips and the persisted boolean projection; the shared test fixture lists fields individually and supplies no defaults for future ones. The [Harness protocol](../contracts/agents-api/harness-onboarding.md#register-the-adapter) owns the adapter side of each declaration.
 
-A declaration describes what the Runtime can do. Core admits a public feature only when the Harness's engine profile also qualifies it, and checks the declaration of the selected device during device selection and again at the final check before it claims a Turn:
+A declaration describes what the Runtime can do. Core admits a public feature only when the Harness's declaration also admits it, and checks the declaration of the selected device during device selection and again at the final check before it claims a Turn:
 
 | Capability | Core requires it when |
 | --- | --- |
-| `streaming`, `steering`, `durable_turns`, `durable_input_receipts`, `preparation`, `execution_controls`, `tool_observations` | Always, for every execution on that Harness (with `available` true) |
+| `streaming`, `durable_turns`, `durable_input_receipts`, `preparation`, `execution_controls`, `tool_observations` | Always, for every execution on that Harness (with `available` true) |
 | `environment_none` | The Environment type is `none` |
 | `local_environment`, `workspace_read_preparation`, `workspace_output_export` | The Environment type is `openai_hosted` or `self_hosted` |
 | `workspace_read_preparation` | An idle Files directory read needs a read-only preparation |
 | `native_session_recovery` | A Session with a started Turn has no recorded native Session ID |
-| `retained_native_history` | The Environment uses an external workspace binding; owned workspace storage does not require this capability |
-| `web_search_control`, `text_verbosity` | The Harness's engine profile declares that control |
-| `structured_output` and `message_items` | The Agent requests `json_schema` output |
+| `retained_native_history` | The Environment uses an external workspace binding; a Provider's own disk does not require this capability |
+| `structured_output` and `message_items` | The Agent requests `json_schema` output. A Runtime that declares `message_items` tags text deltas with the native item ID and reports message start, completion, phase and the completion text in `output_message` frames |
 | `subagent_observations` | `multi_agent.enabled` is true |
 | `subagent_control` | `multi_agent.enabled` is false |
 | `tool_search` | The Agent enables tool search or defers function loading |
-| `programmatic_tool_calling_disable` | The Agent explicitly disables programmatic tool calling |
 | `function_tools` | The Agent declares function tools |
 | `message_images`, `function_result_images` | A message, or a function result, carries an image |
-| `mcp_http_tools`, `mcp_http_required`, `mcp_http_bearer_auth` | The Agent declares HTTP MCP servers; one is `required`; a Vault credential is selected for one |
+| `mcp_http_tools`, `mcp_http_required`, `mcp_http_bearer_auth` | The Agent declares MCP servers (HTTP or stdio); one is `required`; a Vault credential is selected for one |
 
 Core has no admission rule for `usage` and `resume`.
 
 `retained_native_history` means the composed Runtime and Harness can reopen the same native Session from its private retained state after confirmed native shutdown. It does not promise process memory, background processes or external connection recovery. The selected filesystem must separately provide retained storage. Core uses the previous device's persisted declaration to determine whether compute can be released without terminating the Session, and validates the replacement Runtime before admitting execution. Missing or invalid native history fails explicitly; it never authorizes a new native root or replay of prior input.
 
-The `execution_prepare` configuration carries the opt-ins Core sets for each Run:
-
-| Field | Set by Core |
-| --- | --- |
-| `agent_options` | Always `model` and `system_prompt` from the Agent; `model_provider` when the Session froze one; `harness_config` when the Agent sets `x_agents_core.harness_config`. Core sends no other key; the Runtime rejects any other key with `unsupported_configuration` before preparation |
-| `execution_controls` | Always: web search `disabled`, the resolved text verbosity (default `medium`), an explicit programmatic-tool-calling disable and any `json_schema` output format. Native option names belong to the adapter |
-| `observe_messages` | When the Runtime declares `message_items`. Text deltas then carry the native item ID, and `output_message` frames report message start, completion, phase and the completion text |
-| `observe_subagent_identities`, `disable_subagents` | From the Agent's `multi_agent.enabled` |
-| `disable_execution_environment` | For an Environment of type `none` |
-| `local_environment` | For `openai_hosted` and `self_hosted`, with the exact Environment binding. The request carries no working directory; the Runtime checks `workspace_directory` against its binding |
-| `require_existing_native_session` | When a native Session must be recovered |
-| `durable_receipt` on `prompt_steer` | For every active input Core delivers |
-
-An execution configuration requires exactly one of `local_environment` and `disable_execution_environment`; `execution_prepare` rejects neither or both with `unsupported_configuration`.
-
-Requests without an opt-in keep the frames and fields they had without it. A `tool_call` frame carries the engine-neutral `observation` whenever the adapter maps the native tool.
-
 ## Envelope and identity
 
 Every data frame is one JSON [`Envelope`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/envelope.go): `type`, a type-dependent `id`, a typed `payload` and an optional W3C `trace`. The trace is diagnostic correlation only; missing or invalid trace data creates a local trace and never changes ownership. Never use a trace ID as a request ID.
@@ -102,41 +96,131 @@ The linked source files define the required fields, validators, limits and finit
 | --- | --- | --- |
 | `runtime_prepare` | `runtime_prepare_result` | [Initialization and capability transfer](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/runtime_prepare.go) |
 | `execution_prepare`, `execution_start`, `execution_release` | `preparation_status` | [Execution admission](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/preparation.go) |
-| `prompt_cancel` | `delta`, `thinking`, `output_message`, `tool_call`, `usage`, `error`, `done`, `heartbeat`, `interaction_decision_ack` | [Requests](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/outbound.go), [events and capabilities](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) |
+| `prompt_cancel` | `delta`, `reasoning`, `output_message`, `tool_call`, `usage`, `error`, `done`, `heartbeat`, `interaction_decision_ack` | [Requests](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/outbound.go), [events and capabilities](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) |
 | `prompt_steer` | `prompt_steer_ack` | [Active input receipts](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/steering.go) |
-| `function_result` | `function_call`, `interaction_decision_ack` | [Function calls](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/functions.go) |
+| `function_result` | `function_call`, `function_call_withdrawn`, `interaction_decision_ack` | [Function calls](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/functions.go) |
 | `workspace_read`, `workspace_write`, `workspace_export` | Matching `*_result` | [Read](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/workspace_read.go), [write](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/workspace_write.go), [export](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/workspace_export.go) |
 | `environment_quiesce`, `environment_resume` | `environment_quiesced`, `environment_resumed` | [Suspension fencing](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/suspend.go) |
 
 Initial, prepared and active input use the same [ordered MessageInput](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/message_input.go). Adapters keep message and content order and reject unsupported content explicitly; a text-only transport rejects image content rather than dropping it. The [message input contract](../contracts/agents-api/message-content.md) owns the public image profile, whitespace rules and each Harness's native conversion.
 
+A `function_call` carries `native_id` and `turn_id` when a Subagent made the call, with the meaning they have in `subagent_turn`; both are empty for a call of the Run itself. The adapter sends the child's `subagent_identity` and `subagent_turn` before the call, and Core answers with `function_result` under the same `call_id`.
+
+A `function_call_withdrawn` carries the `call_id`, `native_id` and `turn_id` of a `function_call` and tells that the native Harness will never apply a result for it, for example because a Codex Subagent Turn ended and native dropped its request. Core stops requiring an answer for the call and rejects a later result for it. The adapter acknowledges a `function_result` already in flight with `not_pending`, and Core then waits for the withdrawal or the Turn's end instead of failing the Turn or resending the result.
+
+A `reasoning` frame reports one native reasoning item of the Run by its native `id`. A frame with status `in_progress` carries the next text fragment in `delta` for native part `index`, which counts from 0 and is the current part or the next one; the frame with status `completed` ends the item and carries no text. An adapter reports no reasoning without text, and sends `reasoning` frames, or `reasoning` Subagent Item snapshots, only when `execution_controls` sets a reasoning summary. [OpenAI compatibility](../contracts/agents-api/index.md#differences-from-openai) describes the text.
+
 Usage frames and the final usage snapshot each carry the cumulative measurement of the current execution and replace the previous snapshot; never add them. An absent measurement is unknown, not zero.
 
 ## Preparation and execution order
 
-Environment initialization uses `runtime_prepare` on every connection, managed or user-owned; the [Environment contract](../contracts/agents-api/environments.md#runtime-capability-preparation) owns what is prepared and when. For a file or archive, send `begin`, wait for `ready`, send ordered chunks and await each matching `received` offset, then send `commit` and await `completed`. Initialization and finalization have typed headers without file data. Every `begin` requires `budget_ms`, an integer from 1 through 1800000 carrying the remaining Core-owned initialization budget; chunks and commits omit it. The Runtime enforces that relative budget from receipt of `begin`, and Core waits no longer than its original operation deadline. The complete `begin`–`commit` staging phase has a separate two-minute limit; applying a committed operation and waiting for `completed` use the remaining initialization budget, not the staging limit. Expiry before application rejects the transfer; expiry during application reports `unknown` after local mutations stop and never authorizes replay. Validate the expected outcome, offset, size and finite error code with the shared validator. One transfer is allowed per connection. A chunk receipt confirms staged bytes, not installation; a completed commit confirms that operation, not that a later Turn ran.
+Environment initialization uses `runtime_prepare` on every connection, managed or user-owned; the [Environment contract](../contracts/agents-api/environments.md#runtime-capability-preparation) owns what is prepared and when. A file or archive moves in one transfer, shown below.
+
+```mermaid
+sequenceDiagram
+    participant C as Core
+    participant R as Runtime
+    C->>R: runtime_prepare begin (budget_ms)
+    R-->>C: runtime_prepare_result ready
+    loop each chunk
+        C->>R: runtime_prepare chunk (offset)
+        R-->>C: runtime_prepare_result received (offset)
+    end
+    C->>R: runtime_prepare commit
+    R-->>C: runtime_prepare_result completed
+```
+
+Initialization and finalization have typed headers without file data. Every `begin` carries `budget_ms`, the remaining Core-owned initialization budget; chunks and commits omit it. The Runtime enforces that relative budget from receipt of `begin`, and Core waits no longer than its original operation deadline. The `begin`–`commit` staging phase has its own limit; applying a committed operation and waiting for `completed` use the remaining initialization budget, not the staging limit. Expiry before application rejects the transfer; expiry during application reports `unknown` after local mutations stop and never authorizes replay. Validate the expected outcome, offset, size and finite error code with the shared validator. One transfer is allowed per connection. A chunk receipt confirms staged bytes, not installation; a completed commit confirms that operation, not that a later Turn ran.
+
+An execution Turn runs as follows. Core subscribes to preparation status before it sends `execution_prepare` and to the Run before it sends `execution_start`, because output can race the status.
+
+```mermaid
+sequenceDiagram
+    participant C as Core
+    participant R as Runtime
+    participant H as Harness adapter
+    Note over C: Subscribe to preparation status
+    C->>R: execution_prepare (Session configuration, no Run input)
+    alt new Executor
+        R-->>C: preparation_status preparing
+        R->>H: ExecutorFactory
+        R-->>C: preparation_status ready (Executor ID, handle, revision, expiry)
+    else reused healthy Executor
+        R-->>C: preparation_status ready
+    end
+    alt abandon before start
+        C->>R: execution_release
+        R-->>C: preparation_status released
+    else start
+        Note over C: Subscribe to the Run
+        C->>R: execution_start (Executor ID, handle, Run ID, input)
+        R-->>C: preparation_status starting
+        R->>H: StartTurn
+        R-->>C: preparation_status started
+        loop until a native terminal outcome
+            R-->>C: delta, tool_call, usage, error
+        end
+        alt Run ends
+            R-->>C: done
+        else cancel during the Run
+            C->>R: prompt_cancel
+            R-->>C: interaction_decision_ack
+        end
+    end
+```
+
+- `preparing` means the Runtime owns preparation. `ready` supplies the Executor ID, admission handle, revision and expiry. Neither submits user input.
+- A valid `execution_start` transfers the reservation once. `started` confirms the transfer to the Turn, not its completion.
+- Consume Run events until a native terminal outcome or loss of observation. An execution error is followed by `done`, which closes the stream; the preceding errors remain part of its outcome.
+- To abandon before start, send `execution_release`. After ownership passes to a Run, use `prompt_cancel`; releasing the old handle cannot cancel its successor.
+
+A preparation reserves a per-Turn admission, not a new Executor. It carries an explicit Session identity and immutable configuration without model input or a Run ID. A fresh request returns a connection-local handle and the owning Executor ID; a reused healthy Executor returns `ready` without native preparation. Per-handle revisions order status observations: ignore older or repeated revisions and never apply a status to another handle. An admission moves through the states below. A `rejected` control operation carries an `operation` and error code and does not replace the handle's current revision. Releasing an admission abandons only that admission; it does not close the Session's idle Executor or cancel a later Turn.
+
+```mermaid
+stateDiagram-v2
+    direction LR
+    [*] --> preparing: execution_prepare
+    [*] --> ready: reused Executor
+    preparing --> ready
+    ready --> starting: execution_start
+    starting --> started
+    starting --> failed
+    preparing --> released: execution_release
+    ready --> released: execution_release
+    preparing --> expired
+    ready --> expired
+    preparing --> failed
+    ready --> failed
+```
+
+Preparation and start run outside the receive loop and router lock. An admission expires at a fixed deadline that retries do not extend; expiry does not remove the Runtime's obligation to settle cleanup. The Runtime bounds active preparation and execution separately from idle retained resources and counts closing or uncertain resources until their cleanup succeeds. A definite `execution_prepare` rejection with `preparation_capacity` leaves the queued Turn unclaimed for the Worker to retry, including when cleanup holds the capacity; any other error or uncertain delivery authorizes no replay. The Runtime retains a bounded number of admission records, and an old handle never consumes a replacement's admission. These records are connection-local, not durable input replay.
 
-An execution Turn runs in five steps:
+Idle expiry of an Executor is a Runtime resource policy, separate from Core's active-Turn concurrency. On shutdown the Runtime closes active and idle Executors, keeps any target whose close failed and allows a later serialized retry. An ordinary disconnection closes the failed transport and keeps the exact router until shutdown succeeds; a wait timeout or failed cleanup never authorizes reconnection, and process shutdown keeps waiting rather than discarding owned native resources. For Runtime initialization, shutdown joins the synchronous apply operation and its receipt delivery before releasing the connection; an `unknown` result remains unknown and blocks further preparation on that Router, but does not prevent reconnection after local mutations have stopped. Core retains the failed initialization and never replays it. Workspace operations keep their binding and settlement rules across Turn boundaries and Executor closure.
 
-1. Subscribe to preparation status, then send `execution_prepare` with the immutable Session configuration and no Run input.
-2. `preparing` means the Runtime owns preparation. `ready` supplies the Executor ID, admission handle, revision and expiry. Neither submits user input.
-3. Subscribe to the Run, then send `execution_start` with that Executor ID, handle, Run ID and ordered input. A valid start transfers the reservation once. `started` confirms the transfer to the Turn, not its completion; output can race the status, so it must already have a subscriber.
-4. Consume Run events until a native terminal outcome or loss of observation. An execution error is followed by `done`, which closes the stream; the preceding errors remain part of its outcome.
-5. To abandon before start, send `execution_release`. After ownership passes to a Run, use `prompt_cancel`; releasing the old handle cannot cancel its successor.
+Suspension closes admission and drains admitted work and receipts while retaining settled idle Executors before acknowledging `environment_quiesced`. Active, preparing, invalid or otherwise unsettled owners prevent suspension. Idle expiry is stopped and its callbacks fenced throughout suspension; exact authenticated `environment_resume` restores a fresh idle interval on the same owners. Only this planned reconnect preserves the Router and native owners across sockets; ordinary disconnect, shutdown and cancellation of the connection lifecycle still require confirmed cleanup. A drain failure keeps admission closed until shutdown. Preparation after resume retains the same native identity and immutable-configuration checks, including credential conflicts; it never silently replaces a conflicting resident Executor. The Sandbox Provider remains responsible for the filesystem flush and compute-stop guarantees of its checkpoint implementation; Runtime quiescence alone proves neither those guarantees nor restoration of native RAM or external network connections.
 
-A preparation reserves a per-Turn admission, not a new Executor. It carries an explicit Session identity and immutable configuration without model input or a Run ID. A fresh request returns a connection-local handle and the owning Executor ID; a reused healthy Executor returns `ready` without native preparation. Per-handle revisions order status observations: ignore older or repeated revisions and never apply a status to another handle. Typical transitions are `preparing → ready → starting → started`, or termination by `released`, `expired` or `failed`. A `rejected` control operation carries an `operation` and error code and does not replace the handle's current revision. Releasing an admission abandons only that admission; it does not close the Session's idle Executor or cancel a later Turn.
+### Execution configuration
 
-Preparation and start run outside the receive loop and router lock. An admission expires five minutes after it is granted, and retries do not extend that deadline; expiry does not remove the Runtime's obligation to settle cleanup. The Runtime bounds active preparation and execution separately from idle retained resources and counts closing or uncertain resources until their cleanup succeeds. A definite `execution_prepare` rejection with `preparation_capacity` leaves the queued Turn unclaimed for the Worker to retry, including when cleanup holds the capacity; any other error or uncertain delivery authorizes no replay. The Runtime retains at most 64 admission records, and an old handle never consumes a replacement's admission. These records are connection-local, not durable input replay.
+The `execution_prepare` configuration carries the opt-ins Core sets for each Run:
 
-Idle expiry of an Executor is a Runtime resource policy, separate from Core's active-Turn concurrency. On shutdown the Runtime closes active and idle Executors, keeps any target whose close failed and allows a later serialized retry. An ordinary disconnection closes the failed transport and keeps the exact router until shutdown succeeds; a wait timeout or failed cleanup never authorizes reconnection, and process shutdown keeps waiting rather than discarding owned native resources. For Runtime initialization, shutdown joins the synchronous apply operation and its receipt delivery before releasing the connection; an `unknown` result remains unknown and blocks further preparation on that Router, but does not prevent reconnection after local mutations have stopped. Core retains the failed initialization and never replays it. Workspace operations keep their binding and settlement rules across Turn boundaries and Executor closure.
+| Field | Set by Core |
+| --- | --- |
+| `agent_options` | Always `model` and `system_prompt` from the Agent; `model_provider` when the Session froze one; `harness_config` when the Agent sets `x_agents_core.harness_config`. Core sends no other key; the Runtime rejects any other key with `unsupported_configuration` before preparation |
+| `execution_controls` | Always: the resolved text verbosity (default `medium`) plus each option the Agent sets, whether web search (mode, `context_size`, `allowed_domains`, `location`), programmatic tool calling, reasoning effort and summary, a non-`auto` service tier or a `json_schema` output format. Core validates every value against the Harness declaration before dispatch; native option names belong to the adapter |
+| `observe_subagent_identities`, `disable_subagents` | From the Agent's `multi_agent.enabled` |
+| `disable_execution_environment` | For an Environment of type `none` |
+| `local_environment` | For `openai_hosted` and `self_hosted`, with the exact Environment binding. The request carries no working directory; the Runtime checks `workspace_directory` against its binding |
+| `require_existing_native_session` | When a native Session must be recovered |
 
-Suspension closes admission and drains admitted work and receipts while retaining settled idle Executors before acknowledging `environment_quiesced`. Active, preparing, invalid or otherwise unsettled owners prevent suspension. Idle expiry is stopped and its callbacks fenced throughout suspension; exact authenticated `environment_resume` restores a fresh idle interval on the same owners. Only this planned reconnect preserves the Router and native owners across sockets; ordinary disconnect, shutdown and cancellation of the connection lifecycle still require confirmed cleanup. A drain failure keeps admission closed until shutdown. Preparation after resume retains the same native identity and immutable-configuration checks, including credential conflicts; it never silently replaces a conflicting resident Executor. The Sandbox Provider remains responsible for the filesystem flush and compute-stop guarantees of its checkpoint implementation; Runtime quiescence alone proves neither those guarantees nor restoration of native RAM or external network connections.
+An execution configuration requires exactly one of `local_environment` and `disable_execution_environment`; `execution_prepare` rejects neither or both with `unsupported_configuration`.
+
+Requests without an opt-in keep the frames and fields they had without it. A `tool_call` frame carries the engine-neutral `observation` whenever the adapter maps the native tool.
 
 ## Execution event flow control
 
-This optional extension keeps the base wire protocol at `0.16.0`. A supporting Runtime offers exactly one `X-Oac-Execution-Flow: credit-v1` header in the authenticated WebSocket upgrade. Core selects it by returning that exact header in the 101 response; both endpoints freeze the selection for that physical connection. An absent offer or selection explicitly uses the base protocol with no event-credit messages or waits. Unknown, empty or repeated offers are rejected with HTTP 400; an invalid response selection is a permanent handshake failure. Reconnection negotiates afresh. Only a new Runtime connected to a selecting Core gains flow control. Old Runtime connections retain the existing 256-frame subscription bound and overflow behavior; updating Core alone does not repair their producer behavior.
+This optional extension keeps the base wire protocol at `0.21.0`. A supporting Runtime offers exactly one `X-Oac-Execution-Flow: credit-v1` header in the authenticated WebSocket upgrade. Core selects it by returning that exact header in the 101 response; both endpoints freeze the selection for that physical connection. An absent offer or selection explicitly uses the base protocol with no event-credit messages or waits. Unknown, empty or repeated offers are rejected with HTTP 400; an invalid response selection is a permanent handshake failure. Reconnection negotiates afresh. Only a connection that selects the extension gains flow control. Connections without the selection retain the 256-frame subscription bound and overflow behavior.
 
-Upgrade Core first, then select a new immutable Runtime template. Existing allocations retain their old Runtime and continue connecting under the base protocol; new allocations use the new template. A new Runtime also runs the base protocol against an old Core, permitting Core rollback without terminating Sessions solely for this extension. Template changes do not rewrite retained sandboxes, files or native history. This is the explicit upgrade contract for this extension, not acceptance of arbitrary base versions.
+Event-flow negotiation is available only between peers with the same base wire version (`0.21.0`). Deploy matching Core and Runtime builds. A missing flow-control offer changes only this optional transport extension; it never permits a connection from an older base protocol.
 
 When event credit is selected, each `execution_start` opens one connection-local Run window: at most 256 unconsumed execution frames and 4 MiB + 64 bytes of accounted storage (so a maximum-size wire frame still fits). A repeated start for the same active Run does not reset credit. The Runtime transport admits at most 1024 active windows per connection; a terminal `done` or `execution_events_stop` releases the window. The shared [event-flow definition](../internal/agentdaemon/proto/event_flow.go) declares the covered frame types and byte accounting, including normalized JSON wire encoding and envelope metadata. Every covered frame, including `error`, `done`, function calls and input receipts, consumes credit before entering the shared socket writer. A blocked producer pauses only its Run; heartbeats, preparation status and cancellation/function-result application receipts remain independent.
 
@@ -146,7 +230,7 @@ On leaving delivery, Core sends `execution_events_stop` with the Run ID to relea
 
 ## Active input receipts
 
-Core delivers active input as `prompt_steer` with `durable_receipt: true`, one input at a time per Run, and waits for its receipt before sending the next:
+Core delivers active input as `prompt_steer`, one input at a time per Run, and waits for its receipt before sending the next.
 
 | Phase | Timer |
 | --- | --- |
@@ -156,7 +240,27 @@ Core delivers active input as `prompt_steer` with `durable_receipt: true`, one i
 | Native acceptance | `accepted` arrives under the Turn lifetime, with no automatic redelivery |
 | Done | The Runtime sends `done` after native Turn settlement and after the receipt send of any in-flight input; native writing remains time-bounded, while receipt delivery follows event flow control |
 
-Neither `written` nor a send failure advances Core's input cursor. Once cancellation is sent, its receipt owns the terminal outcome even if an input becomes unknown first; Core records `cancel_unconfirmed` when no cancellation confirmation arrives within 15 seconds. A cancellation receipt carries the stopped Turn's confirmed continuity snapshot when no `done` is emitted.
+```mermaid
+sequenceDiagram
+    participant C as Core
+    participant R as Runtime
+    participant H as Harness adapter
+    C->>R: prompt_steer
+    Note over C,R: written wait limit, from delivery
+    R->>H: SteerWithReceipt
+    Note over R,H: native write limit
+    H-->>R: write complete
+    Note over R,C: receipt send limit
+    R-->>C: prompt_steer_ack written
+    H-->>R: native application receipt
+    Note over R,C: receipt send limit
+    R-->>C: prompt_steer_ack accepted
+    R-->>C: done after Turn settlement
+```
+
+`accepted` arrives under the Turn lifetime, with no automatic redelivery. The Runtime sends `done` after native Turn settlement and after the receipt send of any in-flight input; the native write and receipt send limits bound that input. The limits are in [Timeouts and limits](#timeouts-and-limits).
+
+Neither `written` nor a send failure advances Core's input cursor. Once cancellation is sent, its receipt owns the terminal outcome even if an input becomes unknown first; Core records `cancel_unconfirmed` when no cancellation confirmation arrives before its limit expires. A cancellation receipt carries the stopped Turn's confirmed continuity snapshot when no `done` is emitted.
 
 ## What each acknowledgement proves
 
@@ -204,19 +308,43 @@ Core stores accepted values in the Turn outcome as `engine_error_code` and `engi
 
 A workspace read that needs no running Turn uses the read-only preparation profile: `execution_prepare` with `workspace_read_only`, which requires the `workspace_read_preparation` capability. It accepts only the bound Environment and resource identity; execution options, model and MCP credentials, native Session continuation and model or tool input are excluded, and the owner rejects `execution_start`. The Runtime serves it from its bound local workspace without starting a Harness process. The profile publishes `released` after the Runtime drops the preparation's ownership; a stale status snapshot never publishes success. A release request, HTTP disconnect or remote socket closure alone does not confirm the release.
 
-`workspace_read` targets an existing preparation handle, or the Run it was transferred to, on the same authenticated device connection, with the exact frozen Environment identity; callers cannot supply sockets, credentials or workspace roots. `operation: directory` lists one workspace-relative directory (an empty path selects the root) with mutually exclusive byte and entry limits. A result carries at most 1024 single-component UTF-8 names of at most 255 bytes each, the entry kind, regular-file sizes and explicit truncation, and is returned only after directory access and handle cleanup settle. There is no snapshot, recursion or pagination at this layer. Byte and directory reads share target checks, correlation, capacity and retained operation waits.
+`workspace_read` targets an existing preparation handle, or the Run it was transferred to, on the same authenticated device connection, with the exact frozen Environment identity; callers cannot supply sockets, credentials or workspace roots. `operation: directory` lists one workspace-relative directory (an empty path selects the root) with mutually exclusive byte and entry limits. A result carries a bounded number of single-component UTF-8 names, the entry kind, regular-file sizes and explicit truncation, and is returned only after directory access and handle cleanup settle. There is no snapshot, recursion or pagination at this layer. Byte and directory reads share target checks, correlation, capacity and retained operation waits.
 
-Request payloads are bounded at 8 KiB and correlation IDs at 128 bytes before admission; oversized IDs are not echoed, and oversized trace metadata is omitted from replies. Raw read results are bounded at 1 MiB within the 4 MiB transport frame. These are private transport limits, not public Files parameters. A successful read requires complete bytes or explicit truncation and an acknowledged native close. A safe native rejection carries no bytes; an interrupted or ambiguous read stays unknown and stops further reads on that owner. A dispatched read keeps its bounded waiter across observer cancellation and resource transfer or release, and resource closure stops new admission. The gateway bounds subscriptions and never retries or replays a read on reconnect; a duplicate pending operation ID cannot start another read.
+Request payloads and correlation IDs are bounded before admission; oversized IDs are not echoed, and oversized trace metadata is omitted from replies. Raw read results are bounded within the transport frame. These are private transport limits, not public Files parameters. A successful read requires complete bytes or explicit truncation and an acknowledged native close. A safe native rejection carries no bytes; an interrupted or ambiguous read stays unknown and stops further reads on that owner. A dispatched read keeps its bounded waiter across observer cancellation and resource transfer or release, and resource closure stops new admission. The gateway bounds subscriptions and never retries or replays a read on reconnect; a duplicate pending operation ID cannot start another read.
 
 Core runs an idle directory read on the Worker's Session scheduling reservation and targets the exact Run during active execution. It keeps the reservation through the bounded read and release, returns data only after a confirmed close (an incomplete read or uncertain cleanup returns unavailable without data), releases the reservation before delivering the result, and revokes the scoped read credential on completion or failure. The Runtime keeps uncertain cleanup ownership and capacity. The [Environment Files contract](../contracts/agents-api/environment-files.md) owns public authorization, paths and pagination.
 
-`workspace_write` transfers a complete bounded body in acknowledged 64 KiB frames before the native writer runs, verifies the declared digest and runs no model. The private transfer bound is 50 MiB, separate from the public 5 MiB decoded inline bound that the API checks before any Runtime work. The Runtime excludes execution while it receives or applies a write; a malformed, incomplete or expired transfer never reaches the installer. An exact commit or rejection receipt releases the mutation owner. A missing or ambiguous receipt keeps the uncertainty: observer cancellation and local process exit cannot prove that nothing changed. Before public admission Core durably reserves the write under the Session lock and blocks successor mutations across restarts until exact settlement; the request is never replayed. Every platform uses the daemon's Go implementation for bounded reads, directory listing, file creation and output export, with no external helper or staging directory.
+`workspace_write` transfers a complete bounded body in acknowledged frames before the native writer runs, verifies the declared digest and runs no model. The private transfer bound is separate from the public decoded inline bound that the API checks before any Runtime work. The Runtime excludes execution while it receives or applies a write; a malformed, incomplete or expired transfer never reaches the installer. An exact commit or rejection receipt releases the mutation owner. A missing or ambiguous receipt keeps the uncertainty: observer cancellation and local process exit cannot prove that nothing changed. Before public admission Core durably reserves the write under the Session lock and blocks successor mutations across restarts until exact settlement; the request is never replayed. Every platform uses the daemon's Go implementation for bounded reads, directory listing, file creation and output export, with no external helper or staging directory.
 
 `workspace_export` pulls one bounded archive stream from an authorized preparation. The daemon coalesces short exporter writes into 64 KiB chunks, except for the final partial chunk; only a clean source EOF permits completion. The gateway requests at most one next chunk while the consumer stores the current chunk, retaining only the current data and one bounded receipt. Consumer failure, cancellation or disconnect stops the transfer; a complete archive still requires the exporter's completion receipt before publication. A shared ten-minute budget bounds Core capture, including preparation and storage, and bounds gateway and daemon export; an earlier parent cancellation or deadline still wins. After an export is authorized, its preparation idle-expiry timer pauses while the export owns it, so the idle preparation limit cannot truncate the transfer. A preparation whose expiry has already started cannot begin export. Export settlement resumes the original idle deadline without renewing the handle. A subsequent read-only release accepts an identity-validated `expired` receipt with no Run or error as confirmed cleanup, retaining any export failure; explicit release and daemon shutdown still cancel active export. The archive size limit applies to the whole transfer.
 
 ## MCP connection authority
 
-Every public `MCPHTTPServer` in an `execution_prepare` configuration carries an explicit `connection_origin`; a missing or unknown value rejects rather than selecting a default, and Core freezes the public default before dispatch. The Runtime validates the origin with the common validator before selecting a factory and resolves public and installed MCP into transient effective bindings. The [Environment contract](../contracts/agents-api/environments.md#public-mcp-connection-origin) owns the supported combinations, native limits and failure ownership.
+Every public `MCPHTTPServer` in an `execution_prepare` configuration carries an explicit `connection_origin`; a missing or unknown value rejects rather than selecting a default, and Core freezes the public default before dispatch. `MCPHTTPServer.headers` carries non-secret literal headers; credentials travel only in `bearer_token`. `MCPHTTPServer.stdio` (`command`, `args`, `cwd`, `env_vars`) declares a process of the Environment instead of a URL: it requires origin `environment` and carries no headers or bearer, and `env_vars` names variables the process inherits, never their values. The Runtime validates the origin with the common validator before selecting a factory and resolves public and installed MCP into transient effective bindings. The [Environment contract](../contracts/agents-api/environments.md#public-mcp-connection-origin) owns the supported combinations, native limits and failure ownership.
+
+## Timeouts and limits
+
+Every number in this protocol is stated here. The Harness side of the Turn lifetime is in the [Harness protocol](../contracts/agents-api/harness-onboarding.md#timeouts-and-limits).
+
+| Value | Applies to | On expiry or breach |
+| --- | --- | --- |
+| 5 minutes | An execution admission, from the moment it is granted; retries do not extend it | The admission becomes `expired`. The Runtime still owes cleanup settlement. |
+| 64 records | Admission records a Runtime retains per connection | `execution_prepare` is rejected with `preparation_capacity`, and Core leaves the queued Turn unclaimed for the Worker to retry. |
+| 64 frames | The bounded output channel of a Turn | A single consumer, started before native Start, drains it. |
+| 10 seconds | The Runtime's settlement wait around a Turn | A timeout is not proof of quiescence; the resources stay owned until cleanup is confirmed. |
+| 1 to 1,800,000 ms | `budget_ms` of a `runtime_prepare` `begin`: the remaining Core-owned initialization budget | Expiry before application rejects the transfer; expiry during application reports `unknown` and is never replayed. |
+| 2 minutes | The `begin`–`commit` staging phase of one `runtime_prepare` transfer | The transfer is rejected. |
+| 64 KiB | One chunk of a `runtime_prepare` transfer or a `workspace_write` body | A larger chunk fails validation. |
+| 50 MiB | One `runtime_prepare` transfer or `workspace_write` body (private bound) | The transfer is rejected before it reaches the installer. |
+| 5 MiB | The decoded inline body of a public write, checked by the API before any Runtime work | The API rejects the request. |
+| 4 MiB | One inbound transport frame | The frame is refused. |
+| 8 KiB, 128 bytes | A `workspace_read` request payload, and a correlation ID, checked before admission | The request is rejected; an oversized ID is not echoed and oversized trace metadata is omitted from replies. |
+| 1 MiB | The raw result of a `workspace_read`, within the transport frame | The result is explicitly truncated. |
+| 1024 names, 255 bytes each | One directory result | The result is explicitly truncated. |
+| 10 seconds | The adapter's native write of an active input; the timer stops when the write completes | The Runtime acknowledges `outcome_unknown` and never redelivers the input automatically. |
+| 30 seconds | Core's wait for `written`, from delivery | The input outcome is unknown. |
+| 5 seconds | Each receipt send, which is shutdown-aware | The send fails; a send failure does not advance Core's input cursor. |
+| 15 seconds | Core's wait for a cancellation confirmation | Core records `cancel_unconfirmed`. |
 
 ## Contract verification
 
@@ -226,4 +354,4 @@ Each [wire scenario](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/inter
 
 The suite covers incompatible versions, preparation failure, cancellation settlement, connection loss without invented terminal events, reconnection without replay, stale or duplicate handles and receipts, cleanup failures, bounded transfer validation and resource ownership after a timeout. Detailed fault injection stays next to the gateway and dispatcher code it tests.
 
-Another Runtime replays the same scenarios against a scripted Core, then runs native acceptance for every capability it declares. A controlled-adapter test establishes the transport contract, not native Harness behavior, operating-system support, provider authentication or sandbox isolation. Change the shared types, this document and the contract checks together. Harness adapters also run the shared text assertions described in [Harness onboarding](../contracts/agents-api/harness-onboarding.md).
+Another Runtime replays the same scenarios against a scripted Core, then runs native acceptance for every capability it declares. A controlled-adapter test establishes the transport contract, not native Harness behavior, operating-system support, provider authentication or sandbox isolation. Change the shared types, this document and the contract checks together. Harness adapters also run the shared text assertions described in [Harness protocol](../contracts/agents-api/harness-onboarding.md#qualify-the-adapter).
diff --git a/docs/sandbox-provider.md b/docs/sandbox-provider.md
index 55759963e..5b74a33d6 100644
--- a/docs/sandbox-provider.md
+++ b/docs/sandbox-provider.md
@@ -1,28 +1,43 @@
 ---
-title: "Add a Sandbox Provider"
+title: "Sandbox Provider protocol"
 ---
 
-A **Sandbox Provider** supplies the outer compute that a Runtime daemon runs in for a Core-managed Environment, and the bounded bootstrap that starts that daemon. This guide is the path for adding one and the reference for how Core drives it. The interface is [`SandboxProvider`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/sandbox/sandbox_provider.go).
+The Sandbox Provider protocol connects Core to the adapter that supplies compute for Core-managed (`openai_hosted`) Environments and runs the bounded bootstrap that starts the Runtime daemon in it. This page is for adapter authors: it says what a Provider implements and what it may rely on Core to do. Docker, microsandbox and E2B implement it.
+
+| | |
+| --- | --- |
+| Caller | Core's runtime manager and execution Worker |
+| Implementations | Docker and microsandbox (node adapters) and E2B (direct adapter); see [Reference adapters](#reference-adapters) |
+| Code | [`SandboxProvider`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/sandbox/sandbox_provider.go) in `sandbox_provider.go`, with the setup-time `ConfigurationAdapter` |
+| Transport | A direct adapter is called in process. A node adapter runs on a sandbox node and receives the same calls over the [sandbox node protocol](../contracts/agents-api/node-generation-protocol.md#provider-requests) |
+| Version rule | The in-process interface has no wire version. The sandbox node protocol and each helper protocol require an exact version match |
 
 | Term | Meaning |
 | --- | --- |
-| Environment | Durable execution place owned by Core; see [Environments](../contracts/agents-api/environments.md) |
+| Environment | Durable execution place owned by Core; see [Environments and Templates](../contracts/agents-api/environments.md) |
 | Allocation | One Core-owned compute lease for an Environment, identified by `Reference` |
-| Runtime | The daemon inside the Environment; it prepares capabilities and executes Turns |
 | Deployment | The single deployment-wide provider selection; see [Sandbox deployment](../contracts/agents-api/sandbox-deployment.md) |
 
-Core owns durable Environment, allocation, placement and cleanup state; the Provider owns compute and bootstrap only. The Runtime prepares capabilities and runs Turns over the [Core–Runtime protocol](./runtime-protocol.md), and the provider hands it its identity through the [Runtime bootstrap](./runtime-bootstrap.md) file. A provider never runs Environment initialization, Skills, Plugins, MCP setup, initial files, execution or Files; those use the Runtime. Isolation belongs to the provider's infrastructure, not the daemon; see [Runtime and outer isolation](./concepts.md#runtime-and-outer-isolation). Use the vendor's maintained SDK behind a thin adapter.
-
-## Steps
+## Implement a Provider
 
 1. **Read the contract.** Implement every method, support the required operations and declare a decision for each of the others in [Implement the interface](#implement-the-interface).
 2. **Write the adapter package** under `services/core/internal/sandbox/<kind>`: native SDK calls, ownership checks, identity translation, private configuration and, for a node adapter, its node-local construction. Assert `var _ sandbox.SandboxProvider = (*YourAdapter)(nil)`. An out-of-process helper lives in `services/core/tools/<kind>-provider`.
 3. **Register the kind** once, following [Register the provider kind](#register-the-provider-kind). Registration is explicit construction, not an init-time plugin registry.
 4. **Label owned resources** with the provider ownership labels in the [Runtime names](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#openagentcore-runtime-names) table, and never accept older label names as a fallback.
-5. **Run the contract suite** with `make check-sandbox-provider-contract`; see [Validate the integration](#validate-the-integration).
+5. **Run the contract suite** with `make check-sandbox-provider-contract`; see [Conformance](#conformance).
 6. **Run native acceptance** against real compute, then `make check`.
 7. **Document the adapter** next to it, like the [reference adapters](#reference-adapters).
 
+## Roles
+
+| Party | Owns | Never does |
+| --- | --- | --- |
+| Core | Durable Environment, allocation, placement and cleanup state; lifecycle serialization; every decision to create, suspend, restore or release | Calls an operation the Provider declared unsupported, or releases an allocation on an offline node, a timeout or an empty read |
+| Sandbox Provider | Compute for an allocation, the bounded Runtime bootstrap, native identity and ownership checks, and the receipts Core needs to observe and clean up | Runs Environment initialization, Skills, Plugins, MCP setup, initial files, execution or Files, or locates a resource by a bare native ID, name or path |
+| Runtime | Capability preparation and Turn execution, over the [Core–Runtime protocol](./runtime-protocol.md) after the Provider hands it its identity through the [Runtime bootstrap](./runtime-bootstrap.md) file | Allocates or destroys compute |
+
+Isolation belongs to the provider's infrastructure, not the daemon; see [Runtime and outer isolation](./concepts.md#runtime-and-outer-isolation). Use the vendor's maintained SDK behind a thin adapter.
+
 ## Implement the interface
 
 `sandbox_provider.go` holds the Core–Sandbox Provider protocol: the `SandboxProvider` interface for allocation, suspension and observation, its request and result types, and the setup-time `ConfigurationAdapter` with its typed errors. Value types that Core also uses beyond this boundary, such as `DeploymentSpec` and `CallFence`, live in their own files of the same package. Every method is required at compile time, and `ProviderOperations()` declares which ones the Provider supports. Five operations are always supported:
@@ -37,6 +52,8 @@ Core owns durable Environment, allocation, placement and cleanup state; the Prov
 
 A backend without a native renewable lease, such as Docker, still keeps Core's hosted expiry and cleanup requirements. Every adapter implements `RunCommand` and its tests exercise it, but Core's orchestration does not call it; only the node transport forwards it. Confidential command input travels in `Command.Stdin`, never in arguments or logs, and the result keeps byte order, bounded output and the actual exit status.
 
+`Bootstrap.Workspace` and `ResumeRequest.Workspace` carry an external workspace binding exactly when the Provider's `DeploymentPolicy.Workspace` is declared; the Provider obligations for it are in [Attachment](./workspace-provider.md#attachment).
+
 ### Explicit operation contracts
 
 Every provider returns a complete `ProviderOperations()` declaration with one entry for each `SandboxProvider` method except `ProviderOperations` itself. The interface's method set is the operation inventory, and `sandbox.ValidateOperations` checks the declaration against it. The groups in the table below are lists in the protocol file, and a test keeps them equal to that method set, so a new method must join one of them.
@@ -46,16 +63,19 @@ Every provider returns a complete `ProviderOperations()` declaration with one en
 | `Create`, `GetInfo`, `Renew`, `Kill`, `RunCommand` | Supported | Allocation lifecycle and bounded commands |
 | `Observe` | Explicit decision | Ownership-checked read-only observation of one allocation |
 | `Initial`, `NewCompute`, `GetCompute`, `RenewCompute`, `Suspend`, `Resume`, `ResumeCompute`, `KillCompute`, `DeleteRetained`, `RunCommandCompute` | The same decision for all ten suspension methods in `nodes` or `direct` mode | Exact compute incarnations, capture and restore, retained-source resume and cleanup |
+| `RestorePreparation`, `SavePreparation` | The same decision for both | Reuse of a finished Environment preparation |
 
 `Initial` and `NewCompute` construct compute references without allocating, `ResumeCompute` thaws only the same resident instance after an aborted pause, and `RunCommandCompute` runs a bounded command in one exact compute incarnation. Core uses `RunCommandCompute` to wake a parked daemon after a restore ([`runtime_compute_wake.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/execution/runtime_compute_wake.go)).
 
+`SavePreparation(reference, key)` stores what preparation wrote under `/environment` (workspace, packages and initialization, never Runtime state) in the allocation's initial compute after a complete preparation, and `RestorePreparation(reference, key)` puts a stored one back and returns `false` when it holds no valid entry. The `key` is opaque: Core derives it from the Project and everything that reaches preparation, never from the Environment, Session, Harness or Agent, and the Provider never interprets it. The Provider owns storage, scoping to its Runtime image, expiry and eviction. An entry is valid for 24 hours after its save, and a restore must not use an expired one. Core calls `RestorePreparation` after the Runtime connects and, on a hit, sends only the `finalize` operation before completing initialization. On a miss it prepares in full and calls `SavePreparation`; a save error is logged and never fails the Session. A Provider that declares neither always prepares in full. The microsandbox adapter keeps one archive per key in a private directory under the Runtime home.
+
 Each declaration entry is `state: supported` with no reason, or `state: unsupported` with an authored reason code. Missing, zero, unknown or unsafe entries fail validation. Adding a method to `SandboxProvider` requires an explicit decision and implementation in every adapter; never supply a base type or generate blanket unsupported implementations.
 
 An unsupported method returns `providercontract.UnsupportedError` before any native I/O. The error names the exact operation and a safe code, never a native message, resource identity, endpoint or credential. An empty result, a nil error, `Unavailable` or an unknown mutation outcome never stands in for unsupported, and the five required methods can never return it.
 
 Each adapter owns one `Operations()` function, shared by its instance and its registration. `providers.ValidateBinding` checks both against the interface and each other, and Runtime admission and node generation loading also reject incomplete providers. Callers check the declaration with `providercontract.Require` before they call an operation, never a type assertion.
 
-`Observe` reads one allocation and never renews, starts, prepares or stops compute; see the [observation contract](../contracts/agents-api/runtime-observability.md).
+`Observe` reads one allocation and never renews, starts, prepares or stops compute; see [Runtime observability](../contracts/agents-api/runtime-observability.md).
 
 Contract tests call every method declared unsupported with no native client configured, require its matching error and zero result, and reject incomplete or contradictory declarations. Supported behavior still needs native and lifecycle tests.
 
@@ -87,7 +107,7 @@ Every call receives a bounded context. Expiry or cancellation ends the caller's
 | `Kill` | Owned compute and retained storage removed; repeated confirmed absence succeeds | An error keeps ownership and cleanup intent; an ownership mismatch never deletes foreign resources | Retry cleanup of the same `Reference` after outstanding creation or mutation is fenced; never release the owner early |
 | `RunCommand`, `RunCommandCompute` | Collected output and actual exit code; a nonzero exit is a settled command failure | Missing native completion is `ErrCommandUnconfirmed`; partial output is not success | Never replay. Keep the owner and reclaim before reuse when completion cannot be proved |
 
-`ErrInvalid`, `ErrOwnership`, `ErrExists`, `ErrNotFound`, `ErrComputeUnconfirmed` and `ErrCommandUnconfirmed` keep their defined meanings. An unclassified native or transport error is unknown, never permission to retry a mutation. Core never reads provider diagnostics as lifecycle truth or exposes native error text or credentials; the node transport maps errors to fixed codes, and direct SDK details stay private.
+`ErrInvalid`, `ErrOwnership`, `ErrExists`, `ErrNotFound`, `ErrComputeUnconfirmed`, `ErrCommandUnconfirmed` and, for `Resume` only, `ErrCheckpointUnusable` keep their defined meanings. An unclassified native or transport error is unknown, never permission to retry a mutation. Core never reads provider diagnostics as lifecycle truth or exposes native error text or credentials; the node transport maps errors to fixed codes, and direct SDK details stay private.
 
 Suspension support adds `Compute` generation, name and ID and `RetainedState`; persist operation IDs and the provider's retained-state provenance unchanged. `ReconcileOnly` on suspend or resume observes the previous attempt and never starts another capture or restore. `ResumeCompute` only thaws the retained source and never cold-starts a stopped one. Cleanup targets the exact compute incarnation and retained state, not whatever instance now has the same name. `GetCompute` returns `ErrNotFound` only when the owning node has verified that the exact incarnation no longer exists; an instance with the same name and another native ID is `ErrOwnership`, and an unreachable node or backend is an unknown result. A `ComputeState.Status` of `stopped` or `crashed` means the adapter verified that the exact incarnation’s process no longer exists; its record or disks can remain until `KillCompute` removes them. `paused`, `running` without a Runtime connection, and unknown states do not establish termination. Read [`runtime_compute.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/execution/runtime_compute.go) and its failure tests before declaring suspension support.
 
@@ -104,18 +124,18 @@ Hosted and self-hosted Environments use the same Runtime preparation; a provider
 
 ## Register the provider kind
 
-`sandbox/providers/registry.go` is the only registration table. Each entry binds the adapter's specification and resource validators, its `sandbox.ConfigurationAdapter`, the deployment mode (`nodes` or `direct`), its `sandbox.DeploymentPolicy` (disk limits, the Runtime input and the default size setup proposes), the operation declaration and a node-local (`BuildLocal`) or direct (`BuildDirect`) constructor. `providers.Build` and `providers.BuildDirect` construct adapters without allocating compute. There is no init-time registration or plugin loading.
+`sandbox/providers/registry.go` is the only registration table. Each entry binds the adapter's specification and resource validators, its `sandbox.ConfigurationAdapter`, the deployment mode (`nodes` or `direct`), its `sandbox.DeploymentPolicy` (disk limits, the optional external workspace requirement and the default size setup proposes), the operation declaration and a node-local (`BuildLocal`) or direct (`BuildDirect`) constructor. `providers.Build` and `providers.BuildDirect` construct adapters without allocating compute. There is no init-time registration or plugin loading.
 
 A new provider takes these steps:
 
 1. Implement the operation contracts in the adapter package, with native contract tests.
 2. Add its specification and resource validators.
 3. Implement `sandbox.ConfigurationAdapter` over a typed native configuration. `DecodeInput` strictly parses the separate public `configuration` and write-only `credential` objects of a request. `Encode` produces whitelisted public selectors, read-only observations and separate secret bytes, and never passes request JSON through. `Decode` restores stored selectors, and keeps access to owned resources, without remote admission or new template validation. `Normalize` copies its input before changing it. `ResolveChange`, `Equal` and `WithCredential` own inheritance, identity and credential composition. `CredentialAccessEqual` compares normalized credentials and every connection selector that determines resource access, excluding templates, capacity and discovery metadata; it validates both configurations and returns an error for invalid inputs. The caller separately preserves explicit credential-submission intent. `Requirements` declares whether a credential and a public Core origin are required, and which setup operations are supported: `Discovery` for `DiscoverConfiguration`, `SelectionDiscovery` for `DiscoverSelection` and `CredentialVerification` for `VerifyCredential`. `DiscoverConfiguration` validates the query and returns a safe catalog, never a mutation or an admission decision, while Core keeps authorization, input limits and deadlines. `DiscoverSelection` resolves a candidate's omitted native values before commit, and `VerifyCredential` verifies a credential's access to owned resources without mutation. Both receive the candidate's `sandbox.DirectConfig` and build any native client for that call only. A node provider accepts only an empty public object, rejects credentials and returns Unsupported for every setup operation and for credential replacement.
-4. For a node adapter, export from its package the `BuildLocal` constructor, the typed `native` object it decodes and the native files it adds to the shared node artifacts. Node-local settings, such as host paths, live only in that object; resources and the Runtime release are read from the node configuration's `specification`.
+4. For a node adapter, export from its package the `BuildLocal` constructor, the typed `native` object it decodes and the native files it adds to the shared node artifacts. Node-local settings, such as host paths, live only in that object; resources are read from the node configuration's `specification`, and the Runtime image comes from the same object.
 5. Register its constructor, policies, configuration adapter and operation declaration in `providers/registry.go`. Its key is the provider kind, which also labels the Provider's observations, and suspension support reads this entry. The generated projections combine each registered mode and deployment policy with the shared field bounds in `sandbox/deployment_contract.go`: the installer reads them from `deploy/node/node_spec.py`, and the TypeScript client and Web from `packages/agents-client/src/deployment-contract.ts`, so Web reads these declarations instead of comparing provider kinds. Regenerate both with `go run ./services/core/cmd/specification-contract -write`.
 6. Supply the distribution artifacts for the adapter and its helper, and offer the provider to operators through the registered configuration contract.
+7. Web's setup step, deployment summary and client projection name each provider. Add the new provider to `apps/web` until the protocol declares configuration fields.
 
-**Known design gap:** Web still names providers in the setup wizard's backend choice, the Docker confirmation and E2B's configuration fields wherever Web shows or parses them (the setup step with its service presets, the deployment summary and the client's deployment projection), because the protocol declares no configuration fields yet. Exposing another provider through that surface currently requires a shared Web edit. This coupling does not meet [Complexity stays in the adapter](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#complexity-stays-in-the-adapter); new integrations must express their configuration through the protocol and keep vendor-specific behavior in the adapter. Never add a Session or Turn scheduling path, a vendor column or API field, or a vendor switch in the store.
 
 A node configuration, `sandbox.NodeConfig`, holds `provider`, `generation`, `installation_id`, `core_url`, `specification` and the adapter's opaque `native` object. `providers.Build` validates `provider`, `generation`, `installation_id` and `specification`, and passes the configuration with ephemeral `sandbox.LocalOptions` to `BuildLocal`, which decodes `native` strictly. The caller explicitly selects standalone registration or single-provider execution with `Standalone`, or generation-owned execution with a canonical absolute node state directory in `GenerationStateDirectory`. Missing or mixed contexts are rejected. The adapter owns generation-specific native preparation and readiness checks. Microsandbox binds helper leases to the installation, generation and specification digest, then checks the pinned image after platform, capacity and artifact readiness.
 
@@ -125,13 +145,14 @@ A node configuration, `sandbox.NodeConfig`, holds `provider`, `generation`, `ins
 
 - A `nodes` registration has only `BuildLocal`, and a `direct` registration only `BuildDirect`; missing, mixed or unknown modes are rejected.
 - The specification and resource validators, the configuration adapter and a complete operation declaration are mandatory, so an incomplete registration cannot publish a partial projection. A declared default size must pass the adapter's resource validator.
-- The Runtime input policy either accepts the pinned Runtime or gives the adapter's fixed reason for rejecting it, never both.
 - Suspension is admitted in both `nodes` and `direct` modes when the complete lifecycle is declared supported. A registration carries no suspension values: Core applies its one [suspension policy](#suspension) to every supported Provider.
 
 The configuration adapter must be non-nil, including its concrete value. Every `ConfigurationRequirements` field needs an explicit valid decision: `Credential` and `PublicOrigin` are `Required` or `NotRequired`, and `Discovery`, `SelectionDiscovery` and `CredentialVerification` use the shared supported or unsupported declaration with a safe reason. A new requirement field needs an explicit validation update and never inherits an existing decision. Requiring a credential does not promise the `VerifyCredential` operation. These checks establish complete registration, not correct native SDK behavior; constructor and adapter contract tests still apply.
 
 ### Configuration storage and construction
 
+`Selection.ComputeProfiles` contains optional administrator-approved resource variants. The registry admits them only for direct-mode registrations, copies the default Runtime/workspace receipt, composes the default credential, and requires identical credential access selectors. Each variant follows the same declared `SelectionDiscovery` rule as the default: providers declaring discovery validate the native immutable selection; providers without discovery use their normalized selection. Node-mode providers explicitly reject nonempty variants. The common store materializes each approved variant as an immutable generation and persists only name-to-generation references in the active deployment. Public selection, freezing and collection are defined by [compute profiles](../contracts/agents-api/sandbox-deployment.md#compute-profiles).
+
 Preview and persistence use `providers.Normalize` and `providers.Describe`. `providers.DiscoverSelection` resolves omitted native values before commit, and the complete specification is validated again at persistence. `providers.ResolveChange` owns configuration inheritance, and comparisons use normalized selectors, so preview, retry and commit share the same defaults. The store owns transactions, credential encryption, generation fencing, resource ownership and generic object storage: only the adapter interprets `provider_config` and `provider_metadata`, and `provider_credential` holds ciphertext bound to the installation and generation. Retained generations keep their original public configuration and metadata and compose the current credential through the adapter, so a credential replacement never rewrites a retained selector. Database constraints check object structure, not the registration list.
 
 A direct adapter with a credential always verifies the committed ownership anchor and the candidate selection. It additionally verifies all retained generations and allocation references when a credential is explicitly submitted or `CredentialAccessEqual` reports changed access; otherwise template and resource updates retain the original resource routing without a full scan. The common `sandbox.CallFence` excludes native calls and waits for helper completion, including calls whose callers timed out; execution invokes the prepared verification and fencing callbacks without branching on a vendor.
@@ -146,25 +167,59 @@ Each node adapter's registration owns its typed `NodeArtifacts` declaration, the
 
 The launcher supplies `sandbox.ProcessPaths` from the [derived process environment](./configuration.md). Core reads these paths once and passes them to direct construction and setup operations. They are fixed distribution properties, not deployment settings or user-selectable helper paths. Each adapter resolves its own relative helper and state locations; E2B uses `e2b/oac-e2b-provider` and `e2b/`. Missing or nonabsolute roots fail before helper execution. Provider construction and discovery never read process environment variables.
 
-## Managed lifecycle
+## What Core guarantees to a Provider
 
-This is what Core does around every provider. Adapters implement none of it, but they rely on it.
+An adapter implements none of this, but it relies on it. The code-level mechanics are in [Core implementation constraints](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/IMPLEMENTATION.md#hosted-sandboxes).
 
-### Deployment publication
+- Core commits the allocation, its daemon credential digest and the Session binding before it calls `Create`. Only a fresh allocation receipt permits `Create`; retries and a Core restart observe the same `Reference` and never replay `Create` or rotate the credential.
+- Each node has one serial lifecycle worker, so calls for one node never run concurrently; E2B allocations share one worker. A stuck Provider on one node never stalls another.
+- Core never infers bootstrap completion from an engine or provider name; the adapter qualifies it through `Info.BootstrapComplete`.
+- Core calls `Kill` only after it has revoked the device's authority, settled pending input and requested cancellation. Temporary provider outages, unknown `Create` results and stopped compute never prove a permanent failure.
+- Core releases an allocation only after confirmed cleanup of its compute and volumes and proof that the original `Create` settled. Until then it keeps cleanup ownership, also after an absence observation, and bounded scans continue to catch late resources without another `Create`. This applies after public Session deletion too.
+- Core never releases an allocation on an offline node, a timeout or an empty read, and takes no lifecycle action on a node that is not [online](../contracts/agents-api/node-generation-protocol.md#connection). Retained ownership needs exact provider evidence: a socket path, a missing instance or an empty listing never proves cleanup or authorizes a replacement.
+- Placement is automatic and callers cannot choose a node. An active allocation keeps its original node, even while it is offline. After confirmed release, eligible retained Sessions can reserve compatible capacity again, including on another node. Source teardown must be confirmed before active capacity is released, and unknown operations keep their reservations. The [deployment contract](../contracts/agents-api/sandbox-deployment.md#generation-ownership-and-rollout) owns waiting, ordering and generation selection.
+- Between Turns, Core observes that connected compute is still its Session's running allocation. The check changes nothing. Running compute never expires, and an unreachable, stopped or missing instance without [confirmation](#confirmed-compute-loss) never authorizes discarding retained workspace or history or selecting replacement compute.
+- Core suspends the idle allocations of every Provider that declares checkpoint support, under one [suspension policy](../contracts/agents-api/sandbox-deployment.md#suspension-policy).
+- Disabling the provider stops new hosted admission and bootstrap but never blocks cancellation, function results or input retry outcomes of existing Sessions.
 
-At startup Core claims the stable installation identity and a new owner epoch before it selects a provider. The runtime manager keeps generation-aware provider facades. Initial setup and replacement prepare and validate candidates before any database write, and a rejected candidate leaves the active configuration and workers unchanged. A backend replacement uses the deployment mutation gate: it pauses manager admission, drains old calls and loops, then repeats the resource and generation guards in the commit transaction, where the new selection, its generation and the retirement of old nodes and unused enrollment tokens commit together. After commit, Core publishes the prevalidated configuration and the shared observation and bootstrap cache under the manager mutex, with no further external work or fallible step, so a request cancelled after commit cannot discard it. An interrupted drain stays a barrier for retries. Provider I/O and draining never hold a database transaction or the manager's map mutex.
+```mermaid
+stateDiagram-v2
+    [*] --> creating: allocation committed before Create
+    creating --> running: matching running compute with completed bootstrap
+    creating --> cleanup_pending: cleanup requested
+    running --> cleanup_pending: cleanup requested
+    cleanup_pending --> released: cleanup confirmed and Create settled
+    released --> [*]
+```
 
-A locally unavailable provider dependency keeps hosted admission closed while the existing scan waits for repair; administrator recovery stays available, also after a restart. Database and ownership errors stay failures. An unconfigured deployment refuses hosted admission with 503 `execution_unavailable` and creates no Session state. Core derives the Runtime bootstrap and daemon WebSocket addresses from the installation public URL, never from request headers, and reads the current selection from the database, never from a startup file.
+An allocation moves to `cleanup_pending` when its Session is deleted or archived, its Environment fails or expires, or an administrator resets the deployment. `released` requires `CreateSettled`; see [Identity and resource ownership](#identity-and-resource-ownership).
 
-Node readiness binds to the exact generation, the current connection and the owner epoch. A durable serving pin is promoted only for readiness of the then-current target, under deployment serialization, so a late report for a superseded target never acquires a pin.
+## Checkpoint lifecycle
 
-### Allocation lifecycle
+A Provider that declares the checkpoint operations (`Initial`, `NewCompute`, `GetCompute`, `RenewCompute`, `Suspend`, `Resume`, `ResumeCompute`, `KillCompute`, `DeleteRetained`, `RunCommandCompute`) lets Core suspend an idle allocation to retained state. Direct Providers resume it through their owning adapter; transferable checkpoints can restore on the same or another compatible node. Core records the allocation's `compute_phase`; it is `disabled` for a Provider that does not declare checkpoint support, and the other phases move as follows. Deletion, archive, reset and retention expiry release the allocation from any phase after the cleanup described in [What Core guarantees to a Provider](#what-core-guarantees-to-a-provider).
 
 Core includes the owning Session’s immutable Harness in `Bootstrap.Harness`; every provider projects it into the [Runtime bootstrap](./runtime-bootstrap.md) without choosing an implementation.
 
 The allocation, its dedicated daemon credential digest and the exact Session binding commit atomically before `Create`, under the execution lease and the Session lock. Only a fresh allocation receipt permits `Create`; retries and a Core restart observe the same reference without replaying it or rotating the credential. An allocation is private compute ownership, separate from public Environment connection and native readiness; adapters qualify bootstrap completion, and Core never infers it from an engine or provider name.
 
-With a configured provider, the Worker scans committed pending hosted Environments that have no allocation, which covers idle Session creation and recovery after an interruption between commit and bootstrap; an existing allocation never re-enters that path. The scan is bounded and serialized by the lifecycle owner and needs no caller action. An initial reservation without a Turn leaves its Session idle, and a daemon connection is never treated as native readiness. The same scan publishes authenticated connection observations with durable generations, after verifying the exact Session and device binding and a settled bootstrap.
+```mermaid
+stateDiagram-v2
+    [*] --> disabled: allocation created
+    disabled --> running: checkpoint Provider, compute running and bootstrapped
+    running --> quiescing: idle
+    quiescing --> suspending: daemon quiesced
+    quiescing --> running: daemon rejected quiesce
+    quiescing --> waking: new work or lost acknowledgement
+    suspending --> suspended: Suspend reports ResourcesReleased and SuspendSettled
+    suspending --> waking: capture cancelled or source still running
+    suspended --> restoring: new work or file access
+    restoring --> waking: Resume reports running
+    waking --> running: daemon resumed
+    running --> [*]: confirmed compute loss releases the allocation
+    suspended --> [*]: cold replacement after retention
+```
+
+The suspend and wake flows call the Provider in this order. Core persists each phase before the effect it describes.
 
 Between Turns, Core checks that connected, observed compute is still its Session's running allocation; the check changes nothing and never revives a cleanup request. Running compute never expires: explicit lifecycle cleanup, retained-state retention and [confirmed compute loss](#confirmed-compute-loss) govern reclamation. An unreachable container, or a stopped or missing one without that confirmation, never authorizes discarding retained workspace or history or selecting replacement compute. Disabling the provider stops new hosted admission and bootstrap but never blocks cancellation, function results or input retry outcomes of existing Sessions.
 
@@ -208,7 +263,35 @@ The Worker lease, the Session lock and the per-node gates own suspension for eve
 
 ### Coordinated protocol upgrade
 
-Upgrade Core and nodes together with node wire version 8, the E2B helper with private wire version 4 and its rebuilt template containing hosted suspension control, and the microsandbox helper with private wire version 5. All Providers deliver Runtime bootstrap version 2. Each boundary validates its own contract; version numbers are not interchangeable across boundaries. Before activation, use the previous compatible release to complete normal cleanup of incompatible unreleased allocations. The startup fence preserves their stored receipts and Session history and makes no Provider calls to migrate them.
+Upgrade Core and nodes together with node wire version 9, the E2B helper with private wire version 4 and its rebuilt template containing hosted suspension control, and the microsandbox helper with private wire version 7. All Providers deliver Runtime bootstrap version 2. Each boundary validates its own contract; version numbers are not interchangeable across boundaries. Before activation, use the previous compatible release to complete normal cleanup of incompatible unreleased allocations. The startup fence preserves their stored receipts and Session history and makes no Provider calls to migrate them.
+
+```mermaid
+sequenceDiagram
+    participant C as Core
+    participant R as Runtime
+    participant P as Provider
+    Note over C: idle, phase running
+    C->>C: persist quiescing
+    C->>R: environment_quiesce
+    R-->>C: environment_quiesced
+    C->>C: persist suspending
+    C->>P: Suspend(OperationID, Source)
+    P-->>C: RetainedState, ResourcesReleased, SuspendSettled
+    C->>C: persist suspended
+    Note over C: new work or live file access
+    C->>C: persist restoring, reserve destination
+    C->>P: NewCompute, then Resume(RetainedState, Target)
+    P-->>C: running Compute
+    C->>C: persist waking
+    C->>P: RunCommandCompute wakes a parked daemon
+    C->>R: environment_resume
+    R-->>C: environment_resumed
+    C->>P: DeleteRetained
+    C->>C: persist running
+```
+
+Capacity pressure can suspend an already idle node allocation earlier, after the inactivity grace in [Timeouts and limits](#timeouts-and-limits), when compatible waiting demand exists. A node with no free active slot but a free retained slot also keeps one active slot free: after the free-slot inactivity in [Timeouts and limits](#timeouts-and-limits), Core can suspend an idle allocation without waiting demand, so the next Session does not wait for a suspension. It does not while a Session placed on the node still waits for its sandbox or its initialization, because the node runs that Session's create and preparation only after the suspension. It never interrupts an active Turn or releases capacity before the ordinary quiesce, capture and source-stop proofs complete. If suspension cannot make capacity usable, the waiting request keeps its original deadline. When retained slots are full, pressure can [release an idle checkpoint](#cold-replacement-after-checkpoint-retention), and it suspends an allocation only if that allocation's checkpoint could then be released.
+
 
 ### Checkpoint transfer
 
@@ -216,9 +299,11 @@ A checkpoint-capable generation reports `CheckpointCompatibility`: opaque `Artif
 
 For transferable checkpoints, `Suspend` may report `ResourcesReleased` and `SuspendSettled` only after publishing a verified full archive durably, stopping the exact source compute and settling source-local capture and cleanup obligations. Core persists the bound retained state before marking it suspended; native absence alone is insufficient. `Suspend.ReconcileOnly` may finish archive publication and source cleanup for an already verified snapshot of the same operation, but cannot capture another snapshot or stop a source that has resumed running. If a previously published archive is missing or damaged, `Suspend.ReconcileOnly` may return its exact durable ownership receipt with `Status: unknown` and `ResourcesReleased: false` for cleanup; that receipt proves neither current archive usability nor source absence. `Resume` still verifies the archive before execution. After the source-settlement barrier, source-node unavailability does not prevent restoration. Deletion and ordinary expiry can transfer an idle suspended allocation's cleanup route to an online node in the same artifact domain; deletion does not require execution-class compatibility. The cleanup destination must already serve the same immutable generation and have retained capacity. Without such a node, cleanup stays pending and ownership is not released; operators must restore an eligible node or its capacity. An unknown running or restoring writer never moves merely because its node is unreachable.
 
-Recovery uses `Resume.ReconcileOnly` for the persisted target and operation. `RestoreAttemptClosed` is an exact operation ID, not a generic absence flag: the adapter may return it only after durably closing an attempt that never entered native execution and fencing every late request for that ID. An adapter may also close a durably admitted attempt when it can prove that its current invocation failed before dispatching native restoration. The microsandbox adapter does this only when the fresh request's wire deadline expires before native dispatch; archive corruption, qualification errors and opaque SDK failures do not authorize an automatic retry. Core then persists a new operation ID before attempting execution. Once native restoration has been dispatched, an unknown outcome retains the same target, ownership and original retention deadline; a missing native listing, helper death or timeout does not authorize replay. Such a restore can remain unavailable until explicit deletion or ordinary retention expiry, and pending inputs can reach their public deadline while waiting. User deletion still requires exact native settlement before resources and ownership can be released. An in-place adapter may retain a nonempty native ID: the closure must equal the requested ID, logical generation, name and retained provenance. The closure proves that this restore attempt was never dispatched, not that its underlying paused source is absent.
+Recovery uses `Resume.ReconcileOnly` for the persisted target and operation. `RestoreAttemptClosed` is an exact operation ID, not a generic absence flag: the adapter may return it only after durably closing an attempt that never entered native execution and fencing every late request for that ID. An adapter may also close a durably admitted attempt when it can prove that its current invocation failed before dispatching native restoration. The microsandbox adapter does this for the fresh request that created the admission, on any failure before it dispatches native restoration. An expired wire deadline or an unclassified failure closes the attempt, and Core then persists a new operation ID. A snapshot that is missing, fails identity or integrity verification, or fails the adapter's qualification for this generation, such as a resource, workspace or runtime image mismatch, is also closed and reported as `ErrCheckpointUnusable`. That outcome is durable: `Resume.ReconcileOnly` for the same operation reports it again, and late requests for the operation ID stay fenced. A Provider never returns it once native restoration was dispatched. On `ErrCheckpointUnusable` Core never restores that snapshot again and [ends its retention at once](#cold-replacement-after-checkpoint-retention). Once native restoration has been dispatched, an unknown outcome retains the same target, ownership and original retention deadline; a missing native listing, helper death or timeout does not authorize replay. Such a restore can remain unavailable until explicit deletion or ordinary retention expiry, and pending inputs can reach their public deadline while waiting. User deletion still requires exact native settlement before resources and ownership can be released.
+
+An in-place adapter may retain a nonempty native ID: the closure must equal the requested ID, logical generation, name and retained provenance. The closure proves that this restore attempt was never dispatched, not that its underlying paused source is absent.
 
-The microsandbox adapter requires an explicit private `checkpoint_root`, outside every guest-accessible filesystem. Its directory is mode `0700`; a private namespace marker identifies the actual archive store. The default installation creates a node-local private store. Cross-node restoration requires operators to mount the same private store on each participating node; mount paths may differ. Runtime state directories and workspace bindings are never used to infer this root. The adapter verifies the archive, external filesystem identity and native execution class again before restoration. Restored RAM and file descriptors do not promise continuity of external TCP connections or replay safety for application side effects.
+The microsandbox adapter requires an explicit private `checkpoint_root`, outside every guest-accessible filesystem. Its directory is mode `0700`; a private namespace marker identifies the actual checkpoint store. The default installation creates a node-local private store. Cross-node restoration requires operators to mount the same private store on each participating node; mount paths may differ. Each retained checkpoint is an uncompressed native snapshot of the guest's memory and root-disk layers, so a shared store carries that volume for every suspension and cross-node restore. Runtime state directories and workspace bindings are never used to infer this root. The adapter verifies the checkpoint, external filesystem identity and native execution class again before restoration. Restored RAM and file descriptors do not promise continuity of external TCP connections or replay safety for application side effects.
 
 ### Cold replacement after checkpoint retention
 
@@ -226,31 +311,41 @@ Retained-state retention bounds compute resources, not the lifetime of an eligib
 
 Core confirms the original creation is settled and all owned compute and retained states are cleaned up before releasing allocation and placement ownership. The old device's authority is revoked before replacement admission. Until Create, Kill or DeleteRetained has a confirmed outcome, it keeps ownership and admits no replacement writer. A recoverable Session and Environment remain disconnected with the same filesystem object and initialization result. Archive, reset and deletion take precedence and cannot be undone by a wake request.
 
-Capacity pressure never shortens checkpoint retention. Until its configured deadline, a suspended allocation keeps its snapshot and retained slot; unavailable capacity or an incompatible node does not authorize cold replacement. Pending requests retain their original input deadline. After retention expires, the ordinary expiry cleanup must confirm resource deletion before another allocation can reserve that slot; files and qualified native history remain retained.
+An unusable checkpoint, reported as `ErrCheckpointUnusable` by a restoring allocation's `Resume`, ends retention at once, exactly as if its deadline had passed. Core deletes the target and snapshot through the ordinary expiry cleanup, and a qualified Session continues as below, while an unqualified one ends as at ordinary expiry.
+
+Capacity pressure ends retention early only for the node's oldest idle suspended allocation that meets these conditions, and only when waiting placement demand is blocked by the node's full retained slots. Core then treats the allocation as expired, one release per blocked demand, and every other suspended allocation keeps its snapshot and retained slot until its configured deadline. A checkpoint whose restore lacks capacity or a compatible node is not cold-replaced for that reason. Pending requests retain their original input deadline. The ordinary expiry cleanup must confirm resource deletion before another allocation can reserve the slot; files and qualified native history remain retained.
 
-New input or live Environment file access reserves a new allocation on a compatible node and bootstraps a fresh Runtime device. Preparation reuses the same filesystem and completed initialization rather than replaying initialization. Execution resumes the same native Session from retained history after validating the replacement Runtime's declaration. Missing or invalid native history fails explicitly; Core never substitutes a new native Session or replays completed input. History and published Artifact reads do not reserve compute. This path does not preserve VM memory, background processes or open connections, and it does not qualify an undeclared Runtime, Harness or filesystem combination.
+Core confirms the original creation is settled and all owned compute and snapshots are cleaned up before releasing allocation and placement ownership. The old device's authority is revoked before replacement admission. Until Create, Kill or DeleteRetained has a confirmed outcome, it keeps ownership and admits no replacement writer. A recoverable Session and Environment remain disconnected with the same filesystem object and initialization result. Archive, reset and deletion take precedence and cannot be undone by a wake request.
+
+New input or live Environment file access reserves a new allocation on a compatible node and bootstraps a fresh Runtime device. Preparation reuses the same filesystem and completed initialization rather than replaying initialization. Execution resumes the same native Session from retained history after validating the replacement Runtime's declaration. Missing or invalid native history fails explicitly; Core never substitutes a new native Session or replays completed input. History and published Artifact reads do not reserve compute. This path does not preserve VM memory, background processes or open connections, and it does not qualify an undeclared Runtime, Harness or filesystem combination. It also provides no node-level drain, failover from an unreachable writer, concurrent writers, multi-active Core, autoscaling or snapshot replication.
 
 ### Confirmed compute loss
 
 Running compute has no retention deadline, so a host crash or reboot would otherwise leave its allocation owned indefinitely. After the owning node is online again, `GetCompute` returning `ErrNotFound` or a verified `stopped` or `crashed` status for the exact persisted incarnation releases a checkpoint-capable allocation in compute phase `running` only when all of these hold: the original creation is settled, the incarnation has a native ID, no capture, restore or rollback intent is recorded, no authenticated Runtime connection exists for the allocation's device, and the Session meets the conditions for [cold replacement](#cold-replacement-after-checkpoint-retention). Core then calls `KillCompute` for that exact incarnation. Only its confirmed result permits one Session-locked commit that rechecks the compute revision and those conditions, revokes the device and releases the allocation and placement. The Session, Environment, pending input, native Session identity and filesystem remain, and new input or live file access continues as in cold replacement.
 
-Every other observation keeps ownership and its diagnostic: a `paused`, `running` or unknown native status, an identity mismatch, a timeout or transport error, an unknown creation, a recorded restore, a live Runtime connection, owned workspace storage, incomplete initialization, a terminal Session or a missing `retained_native_history` declaration. A failed `KillCompute` changes nothing, and a concurrent archive, deletion or compute transition prevails. Core never acts while the node is offline, because it has no authority to stop compute without the node. Continuation retains the filesystem and uses the recorded native Session ID; a Harness resume error fails execution rather than creating another native Session. Core does not replay interrupted or completed input. The [coverage ledger](../contracts/agents-api/index.md) records the qualified continuation cases, including crashes immediately after completion acknowledgement. Completeness of arbitrary crash-damaged native history remains unqualified; identity checks do not detect a truncated but parseable history tail.
+Every other observation keeps ownership and its diagnostic: a `paused`, `running` or unknown native status, an identity mismatch, a timeout or transport error, an unknown creation, a recorded restore, a live Runtime connection, owned workspace storage, incomplete initialization, a terminal Session or a missing `retained_native_history` declaration. A failed `KillCompute` changes nothing, and a concurrent archive, deletion or compute transition prevails. Core never acts while the node is offline, because it has no authority to stop compute without the node. Continuation retains the filesystem and uses the recorded native Session ID; a Harness resume error fails execution rather than creating another native Session. Core does not replay interrupted or completed input. [OpenAI compatibility](../contracts/agents-api/index.md) records the qualified continuation cases, including crashes immediately after completion acknowledgement. Completeness of arbitrary crash-damaged native history remains unqualified; identity checks do not detect a truncated but parseable history tail.
 
-### Reset and archive
+## Timeouts and limits
 
-A [reset](../contracts/agents-api/sandbox-deployment.md#reset) is durable execution state that the runtime manager advances outside its counted work. Start, escalation, cancellation, setup, update and finalization serialize through the mutation gate. Idleness is rechecked with the Session lock and then the deployment lock, never in the reverse order during finalization. Work is keyset-paged and bound to the reset's request time and generation, with the absolute deadline and validated audit provenance persisted.
+| Value | Applies to | On expiry or excess |
+| --- | --- | --- |
+| Bounded context | Every Provider call | Ends the caller's wait and proves no rollback, stop, cleanup or absence. The adapter never detaches untracked mutations or replays a timed-out command |
+| Idle timeout and snapshot retention | Checkpoint-capable allocations, set by the [suspension policy](../contracts/agents-api/sandbox-deployment.md#suspension-policy) | At the idle timeout Core begins [suspension](#suspension). When retention ends Core cleans up the snapshot and, for a qualified Session, replaces the compute through [cold replacement](#cold-replacement-after-checkpoint-retention) |
+| 15 s | Inactivity of an idle node allocation before capacity-pressure suspension | Core can suspend it ahead of the idle timeout when compatible waiting demand exists |
+| 2 min | Inactivity of an idle allocation on a node with no free active slot and a free retained slot | Core can suspend it ahead of the idle timeout without waiting demand, so the next Session finds a free slot |
+| 50 MiB plus 32 bytes (`MaxCommandInputBytes`) | `Command.Stdin` | The command is invalid |
 
-One snapshot and timestamp partition the held resources. Offline ownership comes from the allocation's or active placement's node, with the same 45-second connection and owner-epoch predicate as online presence, independently of provider readiness; no cleanup failure, offline state or empty read authorizes a synthetic release. At zero held resources, Core drains outside database transactions, rechecks under the deployment lock and clears the deployment in one transaction, then publishes a generation-bearing empty provider without fallible work. If the final write or drain fails, it restores the committed provider with a bounded owner context before releasing the mutation gate; if that recovery fails, admission stays fenced and the owner stops.
+The online window and the other node timers are in the [sandbox node protocol](../contracts/agents-api/node-generation-protocol.md#timeouts-and-limits).
 
 An administrator [Session archive](../contracts/agents-api/admin-api.md#session-archive) keeps its Project scope and hosted eligibility checks in a Session-first transaction, together with Environment expiry, cancellation, Runtime authority revocation and audit; a reset's background archive reconstructs the actual Project scope from trusted records and keeps the requester's provenance. The ordinary provider lifecycle releases compute and retained states. Archive cancellation keeps a healthy receipt path until the terminal commit: only the archive that first revokes a device records its exact `archive_cancel_turn_id` (ordinary revocation clears it, and repeated cleanup keeps it), and the existing authenticated delivery may drain that cancellation for at most 20 seconds from the Turn's original `cancel_requested_at`. Core tracks the delivery through `done`, the cancellation acknowledgement and the terminal commit, independently of subscription removal, and grants no new connection, input, file or MCP authority or lease renewal. No transaction or lifecycle gate waits for the receipt, and a lost peer, expiry or restart falls back to ordinary failure and cleanup, never a fabricated cancelled outcome.
 
-## Validate the integration
+## Conformance
 
 E2B template and endpoint validators in the installer and Go adapter consume the shared [selector fixtures](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/sandbox/e2b/testdata/configuration-selectors.json). Extend these cases with any validation change so both entry points accept the same selectors.
 
 Run `make check-sandbox-provider-contract` while developing. It runs the shared [`contracttest`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/sandbox/contracttest) suite through real adapter boundaries with controlled native failures, plus the adapter and node transport tests; `make check` includes the same packages. Call the public failure runner with native-side fixtures instead of a fake `SandboxProvider`, and keep tests for foreign ownership, unknown mutation results, cancellation, no automatic replay, failed cleanup and reference-bound settlement.
 
-Node tests separately cover disconnect and reconnect fencing and cleanup after a lost Create response. Helper protocols and the [sandbox node protocol](../contracts/agents-api/node-generation-protocol.md) require an exact version match; direct in-process interfaces have no separate wire version.
+Node tests separately cover disconnect and reconnect fencing and cleanup after a lost Create response. Helper protocols and the [sandbox node protocol](../contracts/agents-api/node-generation-protocol.md) require an exact version match.
 
 Native acceptance proves what fixtures cannot: creation, lease behavior, owned partial cleanup, declared isolation and limits, and snapshots where supported. The opt-in Docker lifecycle and recovery tests use `AGENTS_RUNTIME_DOCKER_TEST_IMAGE`; the SDK helpers use `make check-e2b-provider` and `make check-microsandbox-provider`. Mocked compute proves neither reclamation nor isolation.
 
@@ -259,7 +354,7 @@ Native acceptance proves what fixtures cannot: creation, lease behavior, owned p
 | Kind | Adapter | Helper and adapter rules | Operator guide |
 | --- | --- | --- | --- |
 | Docker (node) | [`sandbox/docker`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/sandbox/docker) | Node proxy in [`sandbox/node`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/sandbox/node) | [Docker adapter](#docker-adapter) |
-| microsandbox (node) | [`sandbox/microsandbox`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/sandbox/microsandbox) | [`tools/microsandbox-provider`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/tools/microsandbox-provider/README.md) | [Nodes](./getting-started/nodes.md) |
+| microsandbox (node) | [`sandbox/microsandbox`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/sandbox/microsandbox) | [`tools/microsandbox-provider`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/tools/microsandbox-provider/README.md) | [Add and manage nodes](./getting-started/nodes.md) |
 | E2B (direct) | [`sandbox/e2b`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/sandbox/e2b) | [`tools/e2b-provider`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/tools/e2b-provider/README.md) | [Sandbox deployment](../contracts/agents-api/sandbox-deployment.md#e2b-configuration); application-managed templates in [`deploy/e2b`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/e2b/README.md) |
 
 ## Docker adapter
@@ -279,11 +374,3 @@ The node uses the explicit Unix socket in its [provider configuration](./configu
 ### Seccomp profile
 
 [`seccomp.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/codex/seccomp.json) is the Moby default profile at [revision 65adc7e](https://github.com/moby/profiles/blob/65adc7e022c97f55e45c054ff012988027733b87/seccomp/default.json) (Apache-2.0, see [seccomp.LICENSE](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/codex/seccomp.LICENSE); upstream file SHA-256 `785b2429264afba4d594320337cb17f144f3c7d51585f9805eef72e28f4f9334`) with one appended rule that allows `clone`, `unshare`, `setns`, `mount`, `umount2` and `pivot_root`. The distribution ships this file to every Docker node as `runtime/seccomp.json`.
-
-## Independent workspace attachment
-
-`Bootstrap.Workspace` and `ResumeRequest.Workspace` optionally carry a [workspace filesystem binding](workspace-provider.md). Absence selects the Provider's owned Environment disk; presence selects the exact external object and never permits a fallback to an owned disk. Providers validate the tenant and Environment against the binding and its configuration receipt before resolving it. `LocalOptions.Workspace` injects the filesystem resolver; Sandbox Providers never interpret filesystem adapter parameters or native receipts.
-
-`DeploymentPolicy.Workspace` declares supported attachment requirements; absence means external storage is unsupported. The derived immutable `DeploymentSpec.Workspace` receipt selects the generation mode and capabilities; its [deployment workflow](../contracts/agents-api/sandbox-deployment.md#resources) never copies filesystem configuration into the generation. Microsandbox requires `host_directory` and `user_xattr`; Docker and E2B reject external attachments. `ValidateWorkspacePolicy` uses the filesystem protocol's combination validator: an external filesystem without an enforced quota rejects a positive `EnvironmentDiskMiB`, while zero requests no quota. Root disk capacity is still required. Without an external declaration, the existing owned disk bounds apply.
-
-Microsandbox resolves each Create and Resume binding, including observation of an interrupted restore, and passes only the local directory and immutable ObjectID to its private helper. The helper binds the whole `/environment`; its retained contents and private native history follow the [workspace filesystem scope](workspace-provider.md#lifetime-and-filesystem-scope) and [Runtime resource directories](configuration.md#runtime-resource-directories). Private HOME, credentials and the compute root are not a durable history store. Explicit mode, object and path labels qualify native resources; mount shape alone never selects a mode. Checkpoint restore verifies the snapshot's object, remaps `/environment` through SDK `Volumes`, requires strict external mount policy and rejects every restore warning. Partial restore errors retain the exact target identity for cleanup and never establish readiness. Unknown outcomes remain observations of the original operation. Native Bind checkpoint and guest-local flock continuity do not establish fencing against an unknown writer.
diff --git a/docs/web/console-api-usage.md b/docs/web/console-api-usage.md
index 57f0f41bb..97a29c595 100644
--- a/docs/web/console-api-usage.md
+++ b/docs/web/console-api-usage.md
@@ -2,13 +2,13 @@
 title: "Console API usage"
 ---
 
-This page lists the Core routes each console page reads and writes, and how the console bounds its reads. The [administrator API contract](../../contracts/agents-api/admin-api.md) defines the routes, response shapes, pagination and audit records; [API namespaces and credentials](../api/index.md) defines the terms used here.
+This page lists the Core routes each console page calls and how the console bounds its reads. It is for developers of the console; operators read [Web console](./index.md). The [Core administration API](../../contracts/agents-api/admin-api.md) defines the routes, response shapes, pagination and audit records; [API namespaces and credentials](../api/index.md) defines the terms used here.
 
 ## Interfaces
 
 | Interface | Paths | Authentication | Console use |
 | --- | --- | --- | --- |
-| Console server | `/console/auth`, `/console/auth/{login,logout}`, `/console/config`, `/node-install/manifest.json` | The Core key at sign-in, then the console session cookie; `/node-install/manifest.json` needs no sign-in | Sign-in and sign-out; the node installer and node artifacts for Add node; the distribution's Runtime release for Docker and microsandbox setup and for the Runtime row in Settings → Sandbox and scheduling. See [console server](./console-server.md) |
+| Console server | `/console/auth`, `/console/auth/{login,logout}`, `/console/config` | The Core key at sign-in, then the console session cookie | Sign-in and sign-out; the node installer and node artifacts for Add node. See [Console server](./console-server.md) |
 | Administrator API | `/core/v1/**` outside `/core/v1/sandbox` | The Core key, added by the console server | Projects, keys, resource reads and deletion, diagnostics, executor credentials and installation commands, provenance, summaries, Core metrics, the installation, default models |
 | Sandbox administration | `/core/v1/sandbox/**` | The Core key, added by the console server | Sandbox configuration, Nodes, the fleet and capacity summary on Overview, Runtime observations of every project on Sandbox metrics |
 | Agents API | `/v1/**` | Project API key | Not used. The console shows developers how to call it (see [Provenance and monitoring](#provenance-and-monitoring)) |
@@ -54,14 +54,14 @@ Resource-specific rules:
 
 ## Executor credentials and host connection
 
-The **Executor credentials** section of a Session page appears only when the Session's environment is `self_hosted`, for that Session's `project_id` and `environment.id`. The [executor credential contract](../../contracts/agents-api/environment-executor-credentials.md) defines the routes, their 404 and 409 responses and the credential file.
+The **Executor credentials** section of a Session page appears only when the Session's environment is `self_hosted`, for that Session's `project_id` and `environment.id`. [Executor credentials](../../contracts/agents-api/environment-executor-credentials.md) defines the routes, their 404 and 409 responses and the credential file.
 
 | Operation | Route | Console use |
 | --- | --- | --- |
 | List credentials | `GET /core/v1/projects/{project_id}/environments/{environment_id}/executor-credentials` | Read every 5 seconds while visible. The table shows each credential's short `key_id` with its copy button, creation time (`created_at`, which rotation does not change) and status (Active, or Revoked with its time), active first; the credential itself is never listed. The same read's `connection` observation drives the host connection panel: never connected, connected, disconnected, bound credential revoked, and unknown stay distinct, and only a fresh connected read marks the host connected |
 | Issue or rotate | `POST …/executor-credentials` with `{"key_id", "rotate"}` | Issue keeps the generated key ID before submission. Rotation confirms that the old credential stops working; rotating a revoked credential restores it with a new secret. The private JSON is shown once for download or copy, never stored in browser storage or the query cache, and forgotten on Done |
 | Revoke | `DELETE …/executor-credentials/{key_id}` | **Revoke**, confirmed (the executor disconnects and does not retry; its daemon stays parked until the operator stops it), then the list is read again and shows the credential as Revoked |
-| Installation commands | `GET /core/v1/projects/{project_id}/environments/{environment_id}/installation` | **Connect a host**: Core's short-lived Linux/macOS and PowerShell commands, shown as Core returned them with a platform selector and a link to the [native installation guide](../getting-started/self-hosted.md). The commands install the daemon and its Harnesses, start it and check its connection; their authorization expires after 30 minutes, and the console reads them again every 20 minutes. Without an available, unexpired answer the section says the command is unavailable. Archived projects do not read it |
+| Installation commands | `GET /core/v1/projects/{project_id}/environments/{environment_id}/installation` | **Connect a host**: Core's short-lived Linux/macOS and PowerShell commands, shown as Core returned them with a platform selector and a link to [Run self-hosted Sessions](../getting-started/self-hosted.md). The commands install the daemon and its Harnesses, start it and check its connection; their authorization expires after 30 minutes, and the console reads them again every 20 minutes. Without an available, unexpired answer the section says the command is unavailable. Archived projects do not read it |
 
 In an archived project the section hides **Issue credential** and **Rotate** behind a note and keeps the list and **Revoke**, which Core still allows.
 
@@ -73,7 +73,7 @@ In an archived project the section hides **Issue credential** and **Rotate** beh
 | Write operations | `GET /core/v1/projects/{project_id}/write-operations` | A project's write history, newest first, filtered by key and resource type, 50 per page |
 | Summary | `GET /core/v1/summary` | Overview (per project), the Agents list (`group_by=agent`), a project's page (per project and `group_by=key`), Agent metrics (to skip idle projects, and usage by creating key since the start of the range), the Projects list (last activity) |
 | Installation | `GET /core/v1/installation` | Settings → Service and deployment installation facts (`public_url`, `api_base_url`, `installation_id`, `source_commit`) and read-only Startup settings (`configuration.settings`; a sensitive setting shows only whether it is `configured`); `api_base_url` in the call samples; `public_url` as the download origin and `--source-url` of the node install and uninstall commands (and the install command's `--core-url`). A sensitive setting with a value, or an unknown member, fails the read |
-| Core metrics | `GET /core/v1/metrics?range=` | Core metrics page. A Core without the route (404) is shown as not reporting. The [Core metrics contract](../../contracts/agents-api/core-metrics.md) defines every measurement |
+| Core metrics | `GET /core/v1/metrics?range=` | Core metrics page. A Core without the route (404) is shown as not reporting. [Core metrics](../../contracts/agents-api/core-metrics.md) defines every measurement |
 
 `local_only`, or no `public_url`, stops Add node from issuing a command and Clean up the host from giving one. Overview, Nodes and Settings then show a visible warning, with Review the public address leading to Settings → Service and deployment. Nodes disables Add node with a visible reason, and Getting started leaves its sandbox step to do.
 
@@ -97,24 +97,24 @@ The list carries each Harness's configuration, so the console does not read `GET
 
 ## Workspace storage
 
-**Settings → Workspace storage** uses `GET`, `PUT /core/v1/workspace-storage` to read and select configurations and update tenant capacity. The adapter validates parameters and write-only credentials; Web defines no provider-specific fields. The form never returns credentials or automatically retries uncertain writes. The [administration API](../../contracts/agents-api/admin-api.md#workspace-storage) owns these semantics.
+**Settings → Workspace storage** uses `GET`, `PUT /core/v1/workspace-storage` to read and select configurations and update tenant capacity. The adapter validates parameters and write-only credentials; Web defines no provider-specific fields. The form never returns credentials or automatically retries uncertain writes. The [Core administration API](../../contracts/agents-api/admin-api.md#workspace-storage) owns these semantics.
 
 ## Sandbox administration
 
 | Operation | Route | Console use |
 | --- | --- | --- |
-| Deployment | `GET`, `POST`, `PUT /core/v1/sandbox/deployment` | Read the provider, the read-only `core_url` (`OAC_PUBLIC_URL`, shown in the setup review and never sent), reset state, installation ID and specification; a 409 `sandbox_configuration_error` (E2B with a loopback `public_url`) shows the shared client's fixed safe address-configuration message in the setup wizard, with Managed in Settings leading to Settings → Service and deployment, and leaves nothing to confirm; initialize the deployment with `resources` and the Docker or microsandbox `runtime` release, or with the E2B account and no `resources` (Core adopts the template build's CPU and memory); change its settings with the expected generation. E2B's `metadata.template_build` (status, CPU, memory, disk) shows in Settings → Sandbox and scheduling and Sandbox metrics, and sizes each sandbox when `specification.resources` is missing; microsandbox's `suspension` (idle and retention seconds) shows in Settings → Sandbox and scheduling |
+| Deployment | `GET`, `POST`, `PUT /core/v1/sandbox/deployment` | Read the provider, the read-only `core_url` (`OAC_PUBLIC_URL`, shown in the setup review and never sent), reset state, installation ID and specification; a 409 `sandbox_configuration_error` (E2B with a loopback `public_url`) shows the shared client's fixed safe address-configuration message in the setup wizard, with Managed in Settings leading to Settings → Service and deployment, and leaves nothing to confirm; initialize the deployment with Docker or microsandbox `resources`, or with the E2B account and no `resources` (Core adopts the template build's CPU and memory); change its settings with the expected generation. E2B's `metadata.template_build` (status, CPU, memory, disk) shows in Settings → Sandbox and scheduling and Sandbox metrics, and sizes each sandbox when `specification.resources` is missing; microsandbox's `suspension` (idle and retention seconds) shows in Settings → Sandbox and scheduling |
 | E2B discovery | `POST /core/v1/sandbox/providers/e2b/discovery` | The setup wizard lists the templates the entered E2B key can see, then the selected template's ready builds. The key travels only in these request bodies and the deployment write |
 | Reset | `POST`, `DELETE /core/v1/sandbox/deployment/reset` | Explicitly clear hosted resources, or cancel the remaining clear at the observed generation; show Core's remaining and offline projection |
-| Nodes | `GET /core/v1/sandbox/nodes` | Nodes page; fleet on Overview; each hosted Runtime's node on Sandbox metrics. An online node's `diagnostic` (a [readiness code](../getting-started/nodes.md#readiness-codes); any other value reads as `provider_unavailable`) marks it degraded and names the reason and fix in the help tip beside its status on the Nodes list and on the node's page. A node whose `core_url` (the address it enrolled with) differs from the deployment's `core_url` is named on the Nodes page as bound to an old address, to be removed and added again, and its status there and on its page reads Old address instead of its health. **Add node** follows only the node whose `enrollment_id` equals its command's |
-| Node detail | `GET /core/v1/sandbox/nodes/{node_id}?range=1h\|6h\|24h` | A node's page on Nodes: the host's CPU busy share, memory and free disk from its last heartbeat, and CPU and memory history over 1 hour, 6 hours or 24 hours, refreshed every 30 s while visible. **Edit node** reads `host.effective_cpu_cores` and `host.total_memory_bytes` to show the host beside each sandbox's size and at most how many of those fit |
+| Nodes | `GET /core/v1/sandbox/nodes` | Nodes page; fleet on Overview; each hosted Runtime's node on Sandbox metrics. An online node whose `provider_ready` is false is degraded; the help tip beside its status on the Nodes list and on the node's page says *Sandbox provider unavailable*, and the target preparation reason (`rollout.diagnostic`, a [readiness code](../getting-started/nodes.md#readiness-codes)) shows in its target status. A node whose `core_url` (the address it enrolled with) differs from the deployment's `core_url` is named on the Nodes page as bound to an old address, to be removed and added again, and its status there and on its page reads Old address instead of its health. **Edit node** reads the node's `recommended_capacity` from this list. **Add node** follows only the node whose `enrollment_id` equals its command's |
+| Node detail | `GET /core/v1/sandbox/nodes/{node_id}?range=1h\|6h\|24h` | A node's page on Nodes: the host's CPU busy share, memory and free disk from its last heartbeat, and CPU and memory history over 1 hour, 6 hours or 24 hours, refreshed every 30 s while visible. |
 | Allocations | `GET /core/v1/sandbox/nodes/{node_id}/allocations` | Nodes page; Sandbox metrics. A node's page shows from `compute_phase_changed_at` how long each allocation has been in its compute phase; a null time shows a dash. It does not infer snapshot expiry from the phase timestamp or the deployment's `suspension.retention_seconds` |
-| Enrollment | `POST /core/v1/sandbox/enrollment-tokens` | **Add node**: the administrator sets the node's sandbox limits (`max_active`; `max_retained` only for microsandbox, equal to `max_active` for Docker) before Core issues a single-use token inside a command that verifies the installer checksum, with the command's `enrollment_id`, which the node it registers reports. The command runs the installer with sudo (a system service) and passes the token on standard input; root runs it directly. No ordinary-user installation or removal entry is exposed, and the log hint always names the system service. The command downloads the installer from the installation's `public_url`. No token is requested until the installation is read, when it cannot be read, when it is `local_only` (or its `public_url` is not a valid HTTP or HTTPS origin), or when `/console/config` lists `node_artifacts` without the deployment's provider. The dialog reads both again on opening and when the window regains focus |
+| Enrollment | `POST /core/v1/sandbox/enrollment-tokens` | **Add node**: the administrator keeps the recommended limits (the request body is empty and Core derives them when the node registers) or sets both (`max_active`; `max_retained` only for microsandbox, equal to `max_active` for Docker) before Core issues a single-use token inside a command that verifies the installer checksum, with the command's `enrollment_id`, which the node it registers reports. The command runs the installer with sudo (a system service) and passes the token on standard input; root runs it directly. No ordinary-user installation or removal entry is exposed, and the log hint always names the system service. The command downloads the installer from the installation's `public_url`. No token is requested until the installation is read, when it cannot be read, when it is `local_only` (or its `public_url` is not a valid HTTP or HTTPS origin), or when `/console/config` lists `node_artifacts` without the deployment's provider. The dialog reads both again on opening and when the window regains focus |
 | Update node | `PATCH /core/v1/sandbox/nodes/{node_id}` | **Edit node**: the name and sandbox limits together (the retained limit only for microsandbox; under Docker, Core sets it to the active limit) |
 | Remove node | `DELETE /core/v1/sandbox/nodes/{node_id}` | Confirmed node removal; the row goes only after Core acknowledges the deletion, and a Clean up the host dialog then gives the host's uninstall command (requiring root or sudo; for a node enrolled with another address than the deployment's, also with `--force`, which skips the installer's confirmation with Core) |
 | Runtime observations | `GET /core/v1/sandbox/runtime-observations` | Sandbox metrics: hosted Runtimes of every project, each labelled with its project; an E2B sandbox's dialog adds its `observation.disk` as used / limit (null elsewhere) |
 
-An E2B deployment has no nodes; its API key is write-only. Overview and Sandbox metrics count its running and starting sandboxes from the deployment's `resources.allocations` and `resources.pending`, while the hosted Runtime rows come from Runtime observations. The two sources refresh independently, so the console does not infer retention or cleanup from their difference. The Runtime release sent for Docker and microsandbox comes from the console's own `GET /node-install/manifest.json`; without it the administrator enters the release under advanced settings. Settings → Sandbox and scheduling reads the manifest only for a deployment with a saved `specification.runtime` and shows the Runtime row only when the two releases differ; Use this installation's Runtime sends the manifest's release through the same `PUT`.
+An E2B deployment has no nodes; its API key is write-only. Overview and Sandbox metrics count its running and starting sandboxes from the deployment's `resources.allocations` and `resources.pending`, while the hosted Runtime rows come from Runtime observations. The two sources refresh independently, so the console does not infer retention or cleanup from their difference.
 
 ## Writes
 
diff --git a/docs/web/console-server.md b/docs/web/console-server.md
index 36ad38461..50f096fa5 100644
--- a/docs/web/console-server.md
+++ b/docs/web/console-server.md
@@ -2,9 +2,11 @@
 title: "Console server"
 ---
 
-The console server (`services/web`, the `oac-web` process) serves the built console, signs the administrator in with the Core key and forwards the signed-in browser's `/core/v1` requests to Core with that key. The browser never holds the Core key or any API key. Applications, nodes and self-hosted executors reach Core through the console, which forwards `/v1`, `/api/v1` and `/docs` unchanged.
+The console server (`oac-web`) serves Web, signs the administrator in with the Core key and forwards the browser's `/core/v1` requests to Core. This reference is for operators who run Web without the installer or review its security boundary.
 
-[Configuration](../configuration.md#appendix-web-environment-without-the-installer) owns its process settings and defaults.
+It is the `services/web` process. The browser never holds the Core key or any API key. Applications, nodes and self-hosted executors reach Core through the console, which forwards `/v1`, `/api/v1` and `/docs` unchanged.
+
+[Configuration reference](../configuration.md#appendix-web-environment-without-the-installer) owns its process settings and defaults.
 
 ## Request boundary
 
@@ -25,7 +27,7 @@ flowchart LR
   core <--> database
 ```
 
-The deployment's reverse proxy sends every path to the console. The console forwards `/v1`, `/api/v1` and `/docs` to Core and serves everything else itself; the [installation options](../getting-started/install-options.md#https-and-the-reverse-proxy) gives the proxy requirements. The console handles each path as follows:
+The deployment's reverse proxy sends every path to the console. The console forwards `/v1`, `/api/v1` and `/docs` to Core and serves everything else itself; [Configure the public address](../getting-started/public-address.md#https-and-the-reverse-proxy) gives the proxy requirements. The console handles each path as follows:
 
 | Path | Sign-in | Handling |
 | --- | --- | --- |
@@ -56,13 +58,13 @@ On the way to Core, the console:
 
 - removes the browser's `Authorization`, `Proxy-Authorization`, `Cookie`, `Origin` and `Referer` headers;
 - sends `Authorization: Bearer <Core key>`;
-- sets `X-Core-Console-Actor: console`, replacing any value the browser sent. Core records it as a display-only audit label ([administrator API](../../contracts/agents-api/admin-api.md));
+- sets `X-Core-Console-Actor: console`, replacing any value the browser sent. Core records it as a display-only audit label ([Core administration API](../../contracts/agents-api/admin-api.md));
 - ignores ambient HTTP proxy settings, so the Core key reaches only the configured Core;
 - streams responses without buffering.
 
 On the way back, it removes `Set-Cookie`, `WWW-Authenticate`, `Location`, `Refresh` and every `Access-Control-*` header. A redirect from Core, or a failed connection to Core, becomes 502 `core_unreachable`.
 
-The console server never retries a request. Browser code calls `/core/v1` through the typed clients in [`packages/agents-client`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/packages/agents-client/README.md); [console API usage](./console-api-usage.md) lists what each page reads and writes.
+The console server never retries a request. Browser code calls `/core/v1` through the typed clients in [`packages/agents-client`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/packages/agents-client/README.md); [Console API usage](./console-api-usage.md) lists what each page reads and writes.
 
 ## Sign-in
 
@@ -90,15 +92,15 @@ Sign-in errors: 400 for a malformed body, 401 `Invalid Core key`, 405 for a meth
 | --- | --- |
 | `node_installer` | Whether the console serves a node installation payload |
 | `node_installer_sha256` | SHA-256 of that payload's `node-install.pyz`; Add node commands verify it before running the installer |
-| `node_artifacts` | The providers (`docker`, `microsandbox`) whose node artifacts the payload holds, locally or as a pinned release download. Read on every request, so artifacts added by rerunning the installer appear without a restart |
+| `node_artifacts` | The providers (`docker`, `microsandbox`) whose node artifacts the payload holds, locally or as a release download. Read on every request, so artifacts added by rerunning the installer appear without a restart |
 
 ## Node installation payload
 
-With `OAC_WEB_NODE_PAYLOAD_DIR` set, the console serves the matched distribution's node payload at `/node-install/` without sign-in: `node-install.pyz`, `manifest.json`, `SHA256SUMS`, `runtime/seccomp.json`, and the node artifacts the manifest declares under `artifacts/`. An artifact missing locally redirects (307) to its pinned release download. Node install and uninstall commands download from `<public_url>/node-install/`, so the reverse proxy must send that path to the console. Nodes verify every checksum themselves.
+With `OAC_WEB_NODE_PAYLOAD_DIR` set, the console serves the matched distribution's node payload at `/node-install/` without sign-in: `node-install.pyz`, `manifest.json`, `SHA256SUMS`, `runtime/seccomp.json`, and the node artifacts the manifest declares under `artifacts/`. An artifact missing locally redirects (307) to its release download. Node install and uninstall commands download from `<public_url>/node-install/`, so the reverse proxy must send that path to the console. Nodes verify every checksum themselves.
 
 ## Public address
 
-The console does not configure a domain or obtain certificates. The operator's reverse proxy or hosting platform terminates HTTPS and routes to the console, and `OAC_PUBLIC_URL` records the origin that browsers, applications, nodes and executors use. The console accepts only its host, so DNS rebinding cannot reach it.
+The operator's reverse proxy or hosting platform terminates HTTPS and routes to the console ([Configure the public address](../getting-started/public-address.md)), and `OAC_PUBLIC_URL` records the origin that browsers, applications, nodes and executors use. The console accepts only its host, so DNS rebinding cannot reach it.
 
 ## Verification
 
@@ -106,8 +108,8 @@ After installing or changing the console, check:
 
 1. `GET /healthz` on the console and on Core. Each proves only that the process answers.
 2. Sign in, then read `GET /core/v1/projects` in the browser. This proves the browser-to-console and console-to-Core path and the console's Core key.
-3. A Project API key works on `/v1` and fails on `/core/v1`. The Core key fails on `/v1`, and `/v1` sent to the console answers 404.
+3. A Project API key works on `/v1` and fails on `/core/v1`. The Core key fails on `/v1`.
 4. A cross-origin write to the console is rejected, and a forged `X-Core-Console-Actor` header does not change the audit label.
 5. Neither sign-in nor the sandbox deployment read (`GET /core/v1/sandbox/deployment`) proves that a model or a sandbox is ready. Runtime observations and history report execution separately.
 
-A sign-in failure belongs to the console. A 401 from Core on a signed-in request means the console's Core key does not match Core's digest, or the console reaches the wrong Core. The [troubleshooting table](../getting-started/operations.md#troubleshooting) covers the common symptoms.
+A sign-in failure belongs to the console. A 401 from Core on a signed-in request means the console's Core key does not match Core's digest, or the console reaches the wrong Core. [Troubleshooting](../getting-started/troubleshooting.md#web-and-api-access) covers the common symptoms.
diff --git a/docs/web/index.md b/docs/web/index.md
index 17fe9daca..df57f68d5 100644
--- a/docs/web/index.md
+++ b/docs/web/index.md
@@ -1,22 +1,24 @@
 ---
-title: "OpenAgentCore Web"
+title: "Web console"
 ---
 
-Web is the administrator console of one OpenAgentCore deployment. Administrators use it to watch health, capacity, usage and failures, inspect each Project's resources and execution history, and manage Projects, keys, nodes and deployment settings. Applications do not use Web; they call Core's Agents API (`/v1`) with their own Project API keys.
+Web is the administrator console of an OpenAgentCore installation: operators sign in with the Core key to watch health and usage, inspect what applications created, and manage Projects, keys, nodes and settings. Applications call `/v1` with Project API keys and never use Web.
 
 ![OpenAgentCore Web overview](../assets/console-overview-en.webp)
 
 ## Sign in
 
-[Sign in](../getting-started/install.md#sign-in-to-web) with the deployment's [Core key](../getting-started/operations.md#core-key); the console has no user accounts. The browser keeps only a session cookie, and the [console server](./console-server.md) sends the Core key to Core on its behalf; [sign-in](./console-server.md#sign-in) describes how long a session lasts.
+[Sign in](../getting-started/install.md#sign-in-to-web) with the deployment's [Core key](../getting-started/operations.md#core-key); the console has no user accounts. The browser keeps only a session cookie, and the [Console server](./console-server.md) sends the Core key to Core on its behalf; [sign-in](./console-server.md#sign-in) describes how long a session lasts.
 
 Signing in opens the Overview. While any step is still to do, its **Getting started** checklist leads through four steps in any order: sandboxes ready, a default model provider, a Project with an active key, and a first Session. An optional tour of the console opens from it.
 
+![The Getting started checklist on the Overview](../assets/console-getting-started-en.webp)
+
 ## Console pages
 
 | Group | Page | Purpose |
 | --- | --- | --- |
-| Monitor | Overview | Service status, running Sessions, sandbox slots and work needing attention; 24-hour Session activity; Core and its nodes as a topology, each opening its page; Needs attention: failed Sessions and Sessions waiting for their caller, active in the last 24 hours, each with its one-line reason; usage by Project |
+| Monitor | Overview | Service status, running Sessions, **Sandbox capacity** and work needing attention; 24-hour Session activity; Core and its nodes as a topology, each opening its page; Needs attention: failed Sessions and Sessions waiting for their caller, active in the last 24 hours, each with its one-line reason; usage by Project |
 | Monitor | Core metrics | Whether Core can run Turns: execution slots, the Turn queue and its p95 wait, interrupted Turns, connected daemons, database latency, CPU and resident memory against their limits, background jobs; Go heap, goroutines and the database pool under **Diagnostics** |
 | Monitor | Agent metrics | Requests, errors, duration, tokens, models, tools, Agents and API keys over 1 h, 6 h, 24 h or 7 d |
 | Monitor | Sandbox metrics | Hosted Runtimes across Projects over time, active against total, each with its status (active, suspended, changing state, waiting for allocation or stopped) and its CPU and memory observations; an E2B deployment adds the sandboxes Core holds in E2B's cloud |
@@ -33,25 +35,38 @@ Missing data is shown as missing (—), never as zero. [Console API usage](./con
 
 | Task | Where |
 | --- | --- |
-| Give the installation an HTTPS address | Set `OAC_PUBLIC_URL` and point a reverse proxy at Web; see [Make Core reachable](../getting-started/install.md#configure-the-domain-and-https) |
 | Choose the sandbox backend (microsandbox, E2B or Docker), the sandbox size and Runtime, or reset the backend | **Settings → Sandbox and scheduling**; see [change the sandbox configuration](../getting-started/nodes.md#change-the-sandbox-configuration) |
-| Add, resize or remove execution nodes | **Nodes**: **Add node**, **Edit node** and removal; see the [nodes guide](../getting-started/nodes.md) |
+| Add, resize or remove execution nodes | **Nodes**: **Add node**, **Edit node** and removal; see [Add and manage nodes](../getting-started/nodes.md) |
 | Set the default model of a Harness | **Settings → Models and credentials**; see [default models](../configuration.md#default-models) |
 | Create a Project and issue its API keys | **Projects and keys**; see [Projects and API keys](../getting-started/operations.md#projects-and-api-keys) |
-| Issue, rotate or revoke a self-hosted executor's credential, or copy its install command | The Session's page in the **Session log**; see [self-hosted executors](../getting-started/self-hosted.md) |
+| Issue, rotate or revoke a self-hosted executor's credential, or copy its install command | The Session's page in the **Session log**; see [Run self-hosted Sessions](../getting-started/self-hosted.md) |
 | Delete a resource, for example a leaked Credential | The resource's row in its list, or its page; Files are deleted from the Files list. The public deletion rules apply |
 
-Installation creates no Project or key. Opening the console neither allocates compute nor calls a model, and an installation may have zero nodes. Web never starts a Session or sends input. Archiving a hosted Session requests cancellation and reclamation; [administrator authority](../concepts.md#what-administrators-can-and-cannot-do) state what administrators can and cannot do.
+Web observes and administers the installation. It never starts a Session or sends input; agents run only when applications call `/v1`. Archiving a hosted Session requests cancellation and sandbox reclamation. [Concepts](../concepts.md#what-administrators-can-and-cannot-do) defines what administrators can do.
+
+A new Project key is shown once, together with the calls that use it:
+
+![The key issued for a Project, with its calls](../assets/console-issue-key-en.webp)
+
+Each Harness's default model is set in **Settings → Models and credentials**:
+
+![Setting the default model configuration of a Harness](../assets/console-default-model-en.webp)
 
 The deployment's sandbox backend serves hosted Sessions. An application's `self_hosted` Runtime, including one in its own E2B account, is a separate path that the sandbox configuration does not change.
 
 A loopback public address (`local_only`) keeps nodes and remote applications from reaching Core. The console stays reachable at its own address and [warns about it](./console-api-usage.md#provenance-and-monitoring).
 
+## Diagnose a failure
+
+The **Session log** shows a failed Turn with its classified reason and next step; [Session diagnostics](../../contracts/agents-api/session-diagnostics.md) defines the categories. The **Request log** shows the HTTP side, such as a rejected request with status 401.
+
+![A failed Turn in the Session log](../assets/console-session-log-en.webp)
+
+![A 401 in the Request log](../assets/console-request-log-en.webp)
+
 ## More
 
 - [Console server](./console-server.md): request boundary, sign-in, settings and verification.
 - [Console API usage](./console-api-usage.md): the Core routes each page uses.
 - [Web package](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/web/README.md): developing the console.
-- [Administrator API](../../contracts/agents-api/admin-api.md): the `/core/v1` routes behind the console.
-
-OpenAgentCore Web is available under the [MIT License](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/LICENSE).
+- [Core administration API](../../contracts/agents-api/admin-api.md): the `/core/v1` routes behind the console.
diff --git a/docs/workspace-provider.md b/docs/workspace-provider.md
index 37d287c13..2cb4b95ba 100644
--- a/docs/workspace-provider.md
+++ b/docs/workspace-provider.md
@@ -1,8 +1,38 @@
 ---
-title: Workspace filesystem providers
+title: Workspace filesystem protocol
 ---
 
-The independent workspace filesystem boundary is defined in [`workspacefs.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/workspacefs/workspacefs.go). This document specifies the required integration contract; it does not establish that every Sandbox Provider or placement implements it. Filesystem adapters own storage objects and native attachment resolution. [Sandbox Providers](sandbox-provider.md) own compute. Core selects and validates their combination before allocating either resource.
+The workspace filesystem protocol connects Core and sandbox nodes to the adapter that owns durable Environment storage. Core creates, observes and deletes storage objects; a node resolves an object to a host directory that its [Sandbox Provider protocol](sandbox-provider.md) attaches to compute. It is for authors of filesystem adapters and Sandbox Providers.
+
+| | |
+| --- | --- |
+| Caller | Core (`Control`) and the sandbox node (`Resolver`) |
+| Implementations | The kernel NFS adapter (`nfs`), registered in `services/core/internal/workspacefs/providers` |
+| Code | [`workspacefs.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/workspacefs/workspacefs.go) |
+| Transport | In-process Go interfaces; a `Binding` crosses the [Sandbox node protocol](../contracts/agents-api/node-generation-protocol.md#provider-requests) in `Create` bootstrap and `Resume` requests |
+
+Core selects and validates the combination of a Sandbox Provider and a filesystem adapter before it allocates either resource.
+
+| Sandbox Provider | External workspace storage |
+| --- | --- |
+| microsandbox | Required (`host_directory`, `user_xattr`) |
+| Docker, E2B | Not supported; the Provider's own Environment disk |
+
+## Implement an adapter
+
+1. Define `Parameters` and the optional credential, and implement `Normalize` ([Identity and configuration](#identity-and-configuration)).
+2. Implement `Declaration`, `Check`, `Create`, `Observe` and `Delete` in `Control`, and `Resolve` in `Resolver` ([Operations and outcomes](#operations-and-outcomes)).
+3. Declare the attachment kind, user xattr support and quota enforcement ([Capability validation](#capability-validation)).
+4. Keep one writer per object and delete only on Core's authorization ([Lifetime and filesystem scope](#lifetime-and-filesystem-scope)).
+
+## Roles
+
+| Party | Owns |
+| --- | --- |
+| Core | Identities, the persisted `Reference`, configuration and credential, admitted capacity, the lifecycle order and every deletion decision |
+| Filesystem adapter | Native storage objects, their receipts, native ownership checks and path resolution |
+| Sandbox Provider | Compute, and attaching the resolved directory to it |
+
 
 ## Identity and configuration
 
@@ -31,7 +61,18 @@ Every control adapter implements `Declaration`, `Check`, `Create`, `Observe` and
 | `Delete(ctx, reference)` | Converge on terminal deletion of the verified owned object after Core has authorized deletion and confirmed compute stop. |
 | `Resolve(ctx, binding)` | Validate native ownership and resolve the attachment for local compute. |
 
-Errors support `errors.Is`: `ErrInvalid` for invalid input, `ErrOwnership` for a reference or configuration mismatch, `ErrUnavailable` for unavailable storage, `ErrUnconfirmed` for an unknown mutation outcome, `ErrNotFound` for a missing object and `ErrUnsupported` for an unsupported combination. Adapters preserve these outcomes when wrapping errors. A missing observation does not prove an earlier mutation settled. A timeout or canceled context ends the caller's wait; it does not prove native stop or rollback. Core retains ownership on unknown outcomes. It may retry `Create` or `Delete` with the same persisted immutable reference and configuration, including after `ErrUnconfirmed`; it must never substitute a new object identity to retry an uncertain operation.
+Errors support `errors.Is`. Adapters preserve these outcomes when wrapping errors.
+
+| Error | Condition |
+| --- | --- |
+| `ErrInvalid` | Invalid input |
+| `ErrOwnership` | A reference or configuration mismatch |
+| `ErrUnavailable` | Storage is unavailable |
+| `ErrUnconfirmed` | The mutation outcome is unknown |
+| `ErrNotFound` | The object is missing |
+| `ErrUnsupported` | The combination is unsupported |
+
+A missing observation does not prove an earlier mutation settled. A timeout or canceled context ends the caller's wait; it does not prove native stop or rollback. Core retains ownership on unknown outcomes. It may retry `Create` or `Delete` with the same persisted immutable reference and configuration, including after `ErrUnconfirmed`; it must never substitute a new object identity to retry an uncertain operation.
 
 Same-reference retry and concurrent convergence are mandatory adapter guarantees. `Create` preserves any existing object data and returns the attachment for that owned object; it never reinitializes a live object. Repeated and concurrent `Delete` calls converge on the same terminal deletion. Once terminal deletion is recorded, concurrent, delayed or retried `Create` calls must not resurrect the object, and `Resolve` must not expose it. Retained deletion metadata and further cleanup of settled in-flight operations are permitted. These guarantees apply to storage lifecycle operations; they do not establish mutation settlement at timeout or distributed compute fencing.
 
@@ -53,11 +94,19 @@ The object contains the whole `/environment` tree, including the workspace, stag
 
 Workspace storage is retained with its Session until explicit Session deletion. Archival, expiration, reset and compute checkpoint deletion do not authorize workspace deletion. Core calls `Delete` only after explicit Session deletion and confirmed compute stop; unresolved compute or storage mutations retain ownership. Failed creation does not authorize deleting storage while its Session is retained. Eligible nonterminal Sessions can survive checkpoint retention expiry and later attach the same object to fresh compute under the [cold replacement lifecycle](sandbox-provider.md#cold-replacement-after-checkpoint-retention). This does not revive archived, reset or deleted execution.
 
+## Attachment
+
+`Bootstrap.Workspace` and `ResumeRequest.Workspace` optionally carry a [workspace filesystem binding](#identity-and-configuration). A Provider whose policy declares workspace storage requires the binding and returns `ErrInvalid` without it; a Provider without that declaration keeps its own Environment disk and rejects a binding. Presence selects the exact external object and never permits a fallback to another disk. Providers validate the tenant and Environment against the binding and its configuration receipt before resolving it. `LocalOptions.Workspace` injects the filesystem resolver; Sandbox Providers never interpret filesystem adapter parameters or native receipts.
+
+`DeploymentPolicy.Workspace` present means the Provider runs every Environment on external storage with the declared attachment requirements; absent means the Provider's own disk and no external storage. The derived immutable `DeploymentSpec.Workspace` receipt records the selected capabilities and is always present for such a Provider; a deployment with no storage selected returns `ErrWorkspaceRequired`, which Core reports as `workspace_storage_required`. The [deployment workflow](../contracts/agents-api/sandbox-deployment.md#resources) never copies filesystem configuration into the generation. Microsandbox requires `host_directory` and `user_xattr`; Docker and E2B reject external attachments. Validation uses the filesystem protocol's combination validator: `EnvironmentDiskMiB` is only a capacity quota request, valid when the storage declares `capacity_quota`, and its default is zero, which requests no quota. Root disk capacity is still required.
+
+Microsandbox resolves each Create and Resume binding, including observation of an interrupted restore, and passes only the local directory and immutable ObjectID to its private helper. The helper binds the whole `/environment`; its retained contents and private native history follow the [workspace filesystem scope](#lifetime-and-filesystem-scope) and [Runtime resource directories](configuration.md#runtime-resource-directories). Private HOME, credentials and the compute root are not a durable history store. Object and path labels qualify native resources. Checkpoint restore verifies the snapshot's object, remaps `/environment` through SDK `Volumes`, requires strict external mount policy and rejects every restore warning. Partial restore errors retain the exact target identity for cleanup and never establish readiness. Unknown outcomes remain observations of the original operation. Native Bind checkpoint and guest-local flock continuity do not establish fencing against an unknown writer.
+
 ## Kernel NFS adapter
 
 The `nfs` adapter uses an operator-premounted Linux kernel NFS filesystem. The supported setup is NFSv4.2 on trusted AUTH_SYS clients with `root_squash`, using the same export and absolute mount path on Core and nodes. The adapter neither mounts exports nor manages NFS credentials or service accounts. Other operating systems return `ErrUnsupported`. [Configuration](./configuration.md#independent-workspace-storage) owns installation steps and selection.
 
-Parameters contain `root`, `namespace_id`, `uid` and, in quota mode, `quota`. `root` is a clean absolute mount path; `namespace_id` is a canonical nonzero UUID; `uid` is the nonzero effective host UID required on both Core and nodes. The initial deployment uses 65532. The operator prepares the mounted root with mode `0700`, owned by this UID, and a regular `.oac-storage-root` file with mode `0600`, owned by the same UID, containing exactly the namespace UUID followed by one newline. Do this on the export's server-side storage as its administrator; root-squashed clients cannot assume privileged ownership changes. The root marker is an assertion of the selected export's identity, not a credential or distributed lock.
+Parameters contain `root`, `namespace_id`, `uid` and, in quota mode, `quota`. `root` is a clean absolute mount path; `namespace_id` is a canonical nonzero UUID; `uid` is the nonzero effective host UID required on both Core and nodes. A Compose installation uses 65532, the UID of Core's container. The operator prepares the mounted root with mode `0700`, owned by this UID, and a regular `.oac-storage-root` file with mode `0600`, owned by the same UID, containing exactly the namespace UUID followed by one newline. Do this on the export's server-side storage as its administrator; root-squashed clients cannot assume privileged ownership changes. The root marker is an assertion of the selected export's identity, not a credential or distributed lock.
 
 Construction validates and canonicalizes JSON without filesystem I/O. `Check` verifies the opened root is kernel NFS, the effective UID and private ownership/modes match, the namespace marker matches, and real file-descriptor `user.*` xattr set/get/remove operations succeed. Every filesystem operation, including opening the root and checking availability, runs within one process-wide budget of 32 in-flight operations. A timed-out caller receives `ErrUnconfirmed`; its slot remains occupied until the kernel call returns. An exhausted budget returns `ErrUnavailable`. Directory-descriptor-relative operations stay anchored to the opened root. An unavailable mount or a local directory at the configured path fails validation; no local fallback is created.
 
@@ -67,7 +116,7 @@ Without `quota`, the adapter enforces no per-Environment byte or inode quota and
 
 ### Quota mode
 
-Quota mode bounds each object with an XFS project quota enforced by the NFS server's own filesystem. `quota` contains exactly `endpoint` (`host:port` of the storage server's SSH service), `user` (the restricted account) and `host_key` (the server's pinned OpenSSH public host key in authorized-key form; a comment is dropped). The credential is `{"ssh_private_key": "..."}`, one unencrypted OpenSSH private key whose public key the server authorizes only for the `oac-workspace-quota` forced command. [Configuration](configuration.md#quota-mode-storage-server) owns server preparation.
+Quota mode bounds each object with an XFS project quota enforced by the NFS server's own filesystem. `quota` contains exactly `endpoint` (`host:port` of the storage server's SSH service), `user` (the restricted account) and `host_key` (the server's pinned OpenSSH public host key in authorized-key form; a comment is dropped). The credential is `{"ssh_private_key": "..."}`, one unencrypted OpenSSH private key whose public key the server authorizes only for the `oac-workspace-quota` forced command. [Set up workspace storage](getting-started/workspace-storage.md#quota-mode-storage-server) owns server preparation.
 
 For a positive capacity, `Create` calls the command after claiming the identity and creating the object's empty `staging/` and `trash/`, and before creating a stage or returning an existing `live` object, so every retry re-verifies the bound. The request carries the complete reference, configuration ID, namespace ID, capacity and an inode limit of 256 per MiB; it can name no path, project ID, user or command. The client verifies the pinned host key, keeps the key in memory and runs one bounded session per call. A failure before the request is sent is `ErrUnavailable`; a missing or malformed answer afterwards is `ErrUnconfirmed`, and the same reference converges on retry. `Check` also calls the command, proving reachability, the host key, the namespace marker, the journal and enforcement before selection.
 
@@ -77,6 +126,19 @@ The bound is authoritative when `Create` succeeds; `Resolve` does not re-attest
 
 Each object owns `objects/<ObjectID>/identity`, `staging/`, `live/`, `trash/` and, after deletion begins, `deleted-marker`. The permanent identity binds the tenant, Environment and object UUIDs. Create prepares and syncs a private unique staging envelope before atomically publishing its nonempty directory as `live`; replay cannot overwrite existing live data. Delete first records a durable object-local terminal marker, retires live data to unique object-local trash and removes data before its ownership markers. Concurrent deleters converge. Minimal identity and deletion metadata remain intentionally; deletion does not mean every metadata file disappears. Create and Resolve refuse the retired identity. A late in-flight Create can leave empty controlled metadata requiring a repeated Delete after its syscall settles; it cannot authorize a new writer or reuse the object identity. Cleanup examines only that object's staging and trash, without a namespace-wide sweep or background service.
 
+```mermaid
+stateDiagram-v2
+    [*] --> staging: Create
+    staging --> live: publish
+    live --> deleted: Delete (marker written)
+    deleted --> [*]: data removed from trash
+    note right of deleted: Create and Resolve refuse the retired identity
+```
+
 NFS storage does not supply compute fencing or automatic distributed failover. Guest `flock` is not a cross-VM writer lock. The single-writer and explicit-deletion requirements above remain mandatory. Confirmed release can permit a fresh VM on another compatible node to attach the same object, but an offline node or an unknown Create, Kill or snapshot-cleanup result never proves that the old writer stopped. Native history and database behavior require qualification of the selected Runtime, Harness and filesystem combination; file persistence alone is not a guarantee of native Session recovery, cross-node memory restore or arbitrary crash durability.
 
-Core requires the selected Harness profile to support `retained_native_history` when the selected deployment generation uses external workspace storage. Creation validates that generation while holding the deployment lock, before committing the Session or compute reservation. Existing Sessions use their immutable workspace binding for Runtime admission and the final execution check. Owned workspace storage does not require this capability.
+Core requires the selected Harness profile to support `retained_native_history` when the selected deployment generation uses external workspace storage, which is every microsandbox generation. Creation validates that generation while holding the deployment lock, before committing the Session or compute reservation. Existing Sessions use their immutable workspace binding for Runtime admission and the final execution check. A Provider with its own disk does not require this capability.
+
+## Conformance
+
+The shared validators and the combination check are covered by `services/core/internal/workspacefs/workspacefs_test.go`, and the kernel NFS adapter by the tests in `services/core/internal/workspacefs/nfs`. `make check-core-packages` runs them.
diff --git a/docs/zh/api/index.md b/docs/zh/api/index.md
index 13980ce1e..00f729dc3 100644
--- a/docs/zh/api/index.md
+++ b/docs/zh/api/index.md
@@ -1,10 +1,10 @@
 ---
 title: "API 命名空间和凭据"
 source: docs/api/index.md
-source_hash: 8d2ad771264cdae08856ea185cd9e1be9ee54f436e38de3fbd9d792c28248f42
+source_hash: d6d1482165c94d0d832593a7ea1ae8c24d20189a1b6bd6a945f4c49944785ca2
 ---
 
-Core 提供三个命名空间。每个命名空间都有一种调用方及其独立凭据，凭据只能在其所属命名空间中使用。
+Core 提供三个 API 命名空间，每个面向一类调用方并使用独立凭据：应用使用 `/v1`，管理员使用 `/core/v1`，机器使用 `/api/v1`。凭据只能在其所属命名空间中使用。
 
 | 命名空间 | 调用方 | 凭据 | 内容 | 所有者 |
 | --- | --- | --- | --- | --- |
@@ -14,14 +14,8 @@ Core 提供三个命名空间。每个命名空间都有一种调用方及其独
 
 在其他命名空间中使用凭据会返回 401：在 `/core/v1` 或 `/api/v1` 上使用项目 API 密钥，或者在 `/v1` 或 `/api/v1` 上使用 Core 密钥。有关项目和密钥的行为，请参阅 [项目自有资产](../concepts.md#projects-own-assets)。
 
-**路由。** Web 把 `/v1`、`/api/v1` 和 `/docs` 原样转发到 Core（[控制台服务器](../web/console-server.md)）。已登录的浏览器通过 Web 访问 `/core/v1`，由 Web 附上 Core 密钥。操作员脚本在 Core 主机上从 Core 的网络命名空间内调用 `/core/v1`（[编写 Core API 脚本](../getting-started/operations.md#script-the-core-api)）。
+**路由。** Web [把 API 路径转发到 Core](../web/console-server.md#request-boundary)。已登录的浏览器通过 Web 访问 `/core/v1`，由 Web 附上 Core 密钥。操作员脚本在 Core 主机上从 Core 的网络命名空间内调用 `/core/v1`（[编写 Core API 脚本](../getting-started/operations.md#script-the-core-api)）。
 
-**API 参考。** Core 在 `/docs` 提供三个命名空间的只读 Swagger UI，文档位于 `/docs/openapi.yaml`、`/docs/core.openapi.yaml` 和 `/docs/runtime.openapi.yaml`。不需要凭据，页面也不发送 API 请求。在控制台源地址打开，例如 `http://localhost:8080/docs`。浏览器从 `unpkg.com` 加载 Swagger UI。
+## API 参考 {#api-reference}
 
-## 机器连接 API {#machine-connection-api}
-
-节点、Runtime 守护进程和自托管安装程序使用各自的凭据调用 `/api/v1`。[机器连接 API](../../../contracts/agents-api/zh/machine-api.md) 列出了每个路由、调用方和凭据。
-
-运维脚本通过经 Core 密钥认证的 `GET` 和 `PUT /core/v1/workspace-storage` 配置独立文件系统存储；参见[工作区存储](../../../contracts/agents-api/zh/admin-api.md#workspace-storage)。
-
-Web 和运维脚本通过 Core 密钥认证的 `PATCH /core/v1/sandbox/deployment` 更新沙箱空闲策略；参见[沙箱部署](../../../contracts/agents-api/zh/sandbox-deployment.md)。
+Core 在 `/docs` 提供三个命名空间的只读 Swagger UI，文档位于 `/docs/openapi.yaml`、`/docs/core.openapi.yaml` 和 `/docs/runtime.openapi.yaml`。不需要凭据，页面也不发送 API 请求。在控制台源地址打开，例如 `http://localhost:8080/docs`。浏览器从 `unpkg.com` 加载 Swagger UI。
diff --git a/docs/zh/api/public-agent-api.md b/docs/zh/api/public-agent-api.md
index 35cefc5ca..f22e63781 100644
--- a/docs/zh/api/public-agent-api.md
+++ b/docs/zh/api/public-agent-api.md
@@ -1,12 +1,10 @@
 ---
 title: "Agents API 指南"
 source: docs/api/public-agent-api.md
-source_hash: de6019074f5fd4e6a4c6eabd23be5cbe02c2e617d3d84be2ba2f91591106eb10
+source_hash: 847dce3a8a99582c558c2c33f6de52bd34a56c1d94bb199332522b628ae1b14d
 ---
 
-Core 在 `/v1` 提供 [OpenAI Agents API](https://platform.openai.com/docs/api-reference)。可以使用官方 OpenAI SDK 或普通 HTTP。本指南针对每项常见操作同时展示这两种方式，并说明 Core 与 OpenAI 存在差异的地方。
-
-初次使用此 API？请先运行[快速入门](../getting-started/quickstart.md)。
+Core 在 `/v1` 提供 OpenAI Agents API。本指南用官方 OpenAI SDK 和普通 HTTP 两种方式演示每项常见任务，并说明 Core 与 OpenAI 的差异。如果尚未启动过 Session，请先阅读[运行第一个 Session](../getting-started/quickstart.md)。
 
 ## 准备开始 {#before-you-start}
 
@@ -32,13 +30,13 @@ client = OpenAI()  # reads OPENAI_BASE_URL and OPENAI_API_KEY
 **HTTP。** 每个请求都需要 Bearer 密钥。`/agents` 和 `/vaults` 下的路由还需要 `OpenAI-Beta: agents=v1`；`/files` 和 `/skills` 则不需要。SDK 会同时设置这两者。下面的 HTTP 示例使用以下 shell 辅助函数：
 
 ```sh
-oac() {  # oac PATH [curl options]: call /agents or /vaults with the required headers
+agents() {  # agents PATH [curl options]: call /agents or /vaults with the required headers
   curl -sS "$OPENAI_BASE_URL$1" \
     -H "Authorization: Bearer $OPENAI_API_KEY" \
     -H "OpenAI-Beta: agents=v1" \
     -H "Content-Type: application/json" "${@:2}"
 }
-oac /agents
+agents /agents
 ```
 
 在共享主机上，`-H @<(printf 'Authorization: Bearer %s\n' "$OPENAI_API_KEY")` 可以避免密钥出现在进程列表中。
@@ -56,9 +54,9 @@ oac /agents
 | [Skills](#skills) | `/skills` | 带版本的能力捆绑包 |
 | [Environment 模板](#environment-templates) | `/agents/environments/templates` | 可复用的工作区设置 |
 | [Vaults](#vaults) | `/vaults` | MCP 服务器的只写凭据 |
-| Subagents | `/agents/sessions/{id}/subagents` | 只读的子任务；请参阅 [subagents](../../../contracts/agents-api/zh/subagents.md) |
+| Subagents | `/agents/sessions/{id}/subagents` | 只读的子任务；请参阅 [子 Agent](../../../contracts/agents-api/zh/subagents.md) |
 
-Core 保留固定版本 SDK 的全部路由，完整列表见 [upstream-routes.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/upstream-routes.json)。配置扩展位于 [`x_agents_core`](#core-extensions-x-agents-core)。使用 Project key 的[输入回执扩展](../../../contracts/agents-api/zh/sessions-events.md#input-receipts)可准确识别批次受理产生的用户 Item，不改变官方 events 响应。
+Core 保留固定版本 SDK 的全部路由，完整列表见 [upstream-routes.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/upstream-routes.json)。配置扩展位于 [`x_agents_core`](#core-extensions)。使用 Project key 的[输入回执扩展](../../../contracts/agents-api/zh/sessions-events.md#input-receipts)可准确识别批次受理产生的用户 Item，不改变官方 events 响应。
 
 ## 常见任务 {#common-tasks}
 
@@ -69,7 +67,7 @@ Core 保留固定版本 SDK 的全部路由，完整列表见 [upstream-routes.j
 | 停止当前 Turn，或在响应丢失后恢复 | [取消](#cancel)、[幂等性](#idempotency) |
 | 从 Agent 调用你自己的代码 | [函数工具](#function-tools) |
 | 为 Agent 提供 Skills、软件包、文件和设置命令 | [Skills](#skills)、[Environment 模板](#environment-templates) |
-| 连接需要凭据的 MCP 服务器 | [Vaults](#vaults) 和 [execution tools](../../../contracts/agents-api/zh/execution-tools.md) |
+| 连接需要凭据的 MCP 服务器 | [Vaults](#vaults) 和 [执行工具](../../../contracts/agents-api/zh/execution-tools.md) |
 | 在自己的计算机上使用 Skill 或 Plugin 目录 | [本地能力目录](../getting-started/self-hosted.md#local-capability-directories) |
 | 将文件放入工作区，或下载 Agent 生成的内容 | [Files](#files) |
 | 读取对话和工具结果 | [Turns 和 Items](#turns-and-items) |
@@ -93,15 +91,19 @@ Core 保留固定版本 SDK 的全部路由，完整列表见 [upstream-routes.j
 
 SDK 会自动为你分页：
 
-```python
+::: code-group
+
+```python [Python]
 for session in client.beta.agents.sessions.list(limit=100):
     print(session.id, session.status)
 ```
 
-```sh
-oac "/agents/sessions?limit=100&after=$LAST_ID"
+```sh [curl]
+agents "/agents/sessions?limit=100&after=$LAST_ID"
 ```
 
+:::
+
 有两个列表存在差异：`GET /files` 一次最多返回 10,000 个文件；工作区文件使用不透明的 `page` 令牌（请参阅[工作区文件](#workspace-files)）。
 
 ### 幂等性 {#idempotency}
@@ -138,17 +140,17 @@ client.beta.agents.sessions.create(environment=..., extra_headers={"Idempotency-
 
 每个响应都包含 `X-Request-Id`；报告问题时请包含该值。
 
-### Core 扩展：`x_agents_core` {#core-extensions-x-agents-core}
+### Core 扩展：`x_agents_core` {#core-extensions}
 
 Core 可以运行多种 Harness，并允许接入你自己的模型访问方式。这些设置是对 OpenAI 数据结构仅有的扩展，位于 `x_agents_core` 内：
 
 | 字段 | 所在位置 | 值 |
 | --- | --- | --- |
 | `harness` | Agent，或 Session 的内联 `agent` | `codex`、`claude_sdk` 或 `mcode` |
-| `model_provider` | Agent，或 Session 创建请求（顶层） | `protocol`、`base_url`、`api_key`；对于 `mcode`，还包括 `context_window` 和 `max_output_tokens`。协议必须是该 Harness 的原生协议之一 |
-| `harness_config` | Agent、内联 `agent`，或 Session 创建请求（顶层，优先） | Harness 的原生模型参数，例如 Codex 的 `model_reasoning_effort` |
+| `model_provider` | Agent，或 Session 创建请求（顶层） | `protocol`、`base_url`、`api_key`，以及可选的 `context_window` 和 `max_output_tokens`。协议必须是该 Harness 的原生协议之一 |
+| `harness_config` | Agent、内联 `agent`，或 Session 创建请求（顶层，优先） | Harness 的原生模型参数，例如 Claude Code 的 `thinking` |
 | `environment` | `openai_hosted` 或 `self_hosted` Session 创建请求（顶层） | 可移植的准备配置：`environment_template_id`、`files`、`env`、`packages`、`setup_commands`、`skills`、`plugins`、`capability_directories`。同一字段不能也出现在 `environment` 中；请参阅 [Environments](../../../contracts/agents-api/zh/environments.md#preparation-order) |
-| `installation` | 只读，适用于 `self_hosted` Session | 在你的计算机上运行的短期安装命令；请参阅 [self-hosted execution](../getting-started/self-hosted.md) |
+| `installation` | 只读，适用于 `self_hosted` Session | 在你的计算机上运行的短期安装命令；请参阅 [运行自托管 Session](../getting-started/self-hosted.md) |
 
 任何其他成员都会导致 400 错误。`api_key` 为只写字段；读取时会返回 `api_key_configured`。`harness_config` 会替换整个对象；传入 `{}` 可将其清除。使用 SDK 时，请通过 `extra_body` 传入这些字段。
 
@@ -157,16 +159,18 @@ Core 可以运行多种 Harness，并允许接入你自己的模型访问方式
 Harness 是运行 Session 的 Agent 程序：Codex（`codex`）、Claude Code（`claude_sdk`）或 MiniMax Code（`mcode`）。请在 Agent 或内联 `agent` 上设置 `x_agents_core.harness`；如果未设置，则使用安装的默认 Harness（[`OAC_DEFAULT_HARNESS`](../configuration.md#settings)，除非操作员另行更改，否则为 Codex）。
 
 - **模型。** `model` 是提供商给出的准确模型 ID。`openai_hosted` 或 `none` Session 上的内联 Agent 可以省略此字段，以使用其 Harness 的默认模型配置。保存的 Agent 始终必须指定模型。
-- **提供商。** Harness 会使用其原生协议之一直接调用你的提供商；系统不会进行转换，不匹配时会在创建 Session 阶段拒绝请求。[Model execution](../../../contracts/agents-api/zh/model-execution.md#saved-defaults-and-precedence) 列出了每个 Harness 的协议，以及各类 Environment 上 Session 使用的提供商。Session 会在创建时冻结其提供商。
+- **提供商。** Harness 会使用其原生协议之一直接调用你的提供商；系统不会进行转换，不匹配时会在创建 Session 阶段拒绝请求。[模型执行](../../../contracts/agents-api/zh/model-execution.md#saved-defaults-and-precedence) 列出了每个 Harness 的协议，以及各类 Environment 上 Session 使用的提供商。Session 会在创建时冻结其提供商。
 - **原生参数。** `harness_config` 承载 Harness 自身的模型设置；请参阅[原生模型参数](../../../contracts/agents-api/zh/model-execution.md#native-model-parameters)。
 
-并非每种 Harness、部署位置和操作组合都受支持；[Harness capabilities](../../../contracts/agents-api/zh/harness-capabilities.md) 列出了受支持的组合。
+并非每种 Harness、部署位置和操作组合都受支持；[Harness 能力](../../../contracts/agents-api/zh/harness-capabilities.md)列出了受支持的组合，以及图像输入、用量报告和公共函数等限制。
 
 ## Agents {#agents}
 
 Agent 是保存的配置。Session 启动时会复制该配置，因此编辑 Agent 只会影响新的 Session。
 
-```python
+::: code-group
+
+```python [Python]
 agent = client.beta.agents.create(
     model="your-model-id",
     name="Reviewer",
@@ -175,8 +179,8 @@ agent = client.beta.agents.create(
 )
 ```
 
-```sh
-oac "/agents" -d '{
+```sh [curl]
+agents "/agents" -d '{
   "model": "your-model-id",
   "name": "Reviewer",
   "instructions": "Review code changes and report problems.",
@@ -184,6 +188,8 @@ oac "/agents" -d '{
 }'
 ```
 
+:::
+
 ```json
 {"id": "00000000-0000-4000-8000-000000000001", "object": "agent", "model": "your-model-id", "name": "Reviewer",
  "instructions": "...", "tools": [], "metadata": {}, "created_at": 1790000000,
@@ -202,7 +208,7 @@ oac "/agents" -d '{
 
 - **更新**只会更改你发送的字段。`metadata` 会替换所有键值对；`null` 会清除 `name` 或 `instructions`。
 - **删除**不会影响现有 Session。
-- **工具**包括函数、MCP 服务器、`tool_search`（Claude）以及设置了 `mode: "disabled"` 的 `web_search`。支持情况取决于 Harness 和 Environment；请参阅 [execution tools](../../../contracts/agents-api/zh/execution-tools.md)。
+- **工具**包括函数、MCP 服务器、`tool_search`（Claude）以及 `web_search`。支持情况取决于 Harness 和 Environment；请参阅 [执行工具](../../../contracts/agents-api/zh/execution-tools.md)。
 
 ## Sessions {#sessions}
 
@@ -210,7 +216,9 @@ Session 是一次使用固定配置并拥有独立 Environment 的对话。
 
 ### 创建 Session {#create-a-session}
 
-```python
+::: code-group
+
+```python [Python]
 session = client.beta.agents.sessions.create(
     environment={"type": "openai_hosted"},
     agent_id=agent.id,
@@ -219,8 +227,8 @@ session = client.beta.agents.sessions.create(
 )
 ```
 
-```sh
-oac "/agents/sessions" -H "Idempotency-Key: $(uuidgen)" -d '{
+```sh [curl]
+agents "/agents/sessions" -H "Idempotency-Key: $(uuidgen)" -d '{
   "environment": {"type": "openai_hosted"},
   "agent_id": "00000000-0000-4000-8000-000000000001",
   "input": "Review the files in /workspace and summarize the risks.",
@@ -228,6 +236,8 @@ oac "/agents/sessions" -H "Idempotency-Key: $(uuidgen)" -d '{
 }'
 ```
 
+:::
+
 返回 201 和 Session：
 
 ```json
@@ -250,10 +260,10 @@ oac "/agents/sessions" -H "Idempotency-Key: $(uuidgen)" -d '{
 | `environment.type` | 运行位置 | 备注 |
 | --- | --- | --- |
 | `openai_hosted` | Core 在某个节点或 E2B 上创建的沙箱；容量由管理员提供 | 可选 `network`、`packages`、`files`、`skills`、`plugins`、`env`、`capability_directories`、`setup_commands`，也可指定模板 |
-| `self_hosted` | 你自己的 Linux、macOS 或 Windows 计算机 | 要求提供绝对路径 `workspace_directory`。Skills、软件包、文件或模板应放在 `x_agents_core.environment` 中。响应会在 `x_agents_core.installation` 中携带安装命令；请参阅 [self-hosted execution](../getting-started/self-hosted.md)。Session 会自带自己的 `model_provider` |
+| `self_hosted` | 你自己的 Linux、macOS 或 Windows 计算机 | 要求提供绝对路径 `workspace_directory`。Skills、软件包、文件或模板应放在 `x_agents_core.environment` 中。响应会在 `x_agents_core.installation` 中携带安装命令；请参阅 [运行自托管 Session](../getting-started/self-hosted.md)。Session 会自带自己的 `model_provider` |
 | `none` | 由操作员注册的设备连接，无工作区 | `input` 为必填。模型来自安装的默认配置；如果未配置默认模型，则来自设备 |
 
-新建的 `openai_hosted` Session 在 Core 准备沙箱期间会读取到 `idle`；Environment 准备就绪后，其首个 Turn 才会启动。[Environment contract](../../../contracts/agents-api/zh/environments.md) 负责部署位置、过期和准备过程。
+新建的 `openai_hosted` Session 在 Core 准备沙箱期间会读取到 `idle`；Environment 准备就绪后，其首个 Turn 才会启动。[Environment 与模板](../../../contracts/agents-api/zh/environments.md)负责部署位置、过期和准备过程。
 
 ### Session 状态 {#session-status}
 
@@ -281,7 +291,9 @@ client.beta.agents.sessions.delete(session.id)
 
 ### 发送消息 {#send-a-message}
 
-```python
+::: code-group
+
+```python [Python]
 client.beta.agents.sessions.events.create(
     session.id,
     events=[{
@@ -292,34 +304,42 @@ client.beta.agents.sessions.events.create(
 )
 ```
 
-```sh
-oac "/agents/sessions/$SESSION_ID/events" -H "Idempotency-Key: $KEY" -d '{
+```sh [curl]
+agents "/agents/sessions/$SESSION_ID/events" -H "Idempotency-Key: $KEY" -d '{
   "events": [{"type": "agent.session.input.message",
               "input": [{"role": "user", "content": [{"type": "input_text", "text": "Now fix the first risk."}]}]}]
 }'
 ```
 
+:::
+
 - **处于空闲状态时，**消息会启动一个新 Turn。**Turn 运行时，**消息会加入该 Turn（进行引导），而不会启动并行任务。
-- **内容**使用 `input_text`，也可以使用 `input_image` 并以内联 PNG 或 JPEG 数据 URI 提供。Codex 和 Claude Code 接受图像；MiniMax Code 会拒绝图像。整个请求限制为 1 MiB。
+- **内容**使用 `input_text`，也可以使用带 `image_url` 的 `input_image`，由 Harness 决定接受哪些引用。整个请求限制为 1 MiB。
 - 完整规则请参阅[消息内容](../../../contracts/agents-api/zh/message-content.md)。
 
 ### 取消 {#cancel}
 
-```python
+::: code-group
+
+```python [Python]
 client.beta.agents.sessions.events.create(session.id, events=[{"type": "agent.session.input.cancel"}])
 ```
 
-```sh
-oac "/agents/sessions/$SESSION_ID/events" -d '{"events": [{"type": "agent.session.input.cancel"}]}'
+```sh [curl]
+agents "/agents/sessions/$SESSION_ID/events" -d '{"events": [{"type": "agent.session.input.cancel"}]}'
 ```
 
+:::
+
 Turn 到达 `cancelled` 状态时才会被取消，而不是请求返回时立即取消。在空闲状态下发送取消时，如果没有待处理输入，则不会执行任何操作；如果 Environment 输入预留仍处于待处理状态，则返回 409。重启同一 installation 时，自托管计算机上的工作区和历史记录会保留；请参阅[操作 installation](../getting-started/self-hosted.md#operate-the-installation)。
 
 ## 流式传输事件 {#stream-events}
 
 `GET /agents/sessions/{id}/events` 是服务器发送事件流。它**仅提供实时数据**：断连期间发送的事件不会重放。请在发送输入前打开该流，并通过 [Turns 和 Items](#turns-and-items) 补齐缺失内容。
 
-```python
+::: code-group
+
+```python [Python]
 with client.beta.agents.sessions.events.stream(session.id) as stream:
     for event in stream:
         if event.type == "agent.session.turn.output_text.delta":
@@ -328,10 +348,12 @@ with client.beta.agents.sessions.events.stream(session.id) as stream:
             break
 ```
 
-```sh
-oac "/agents/sessions/$SESSION_ID/events" -N
+```sh [curl]
+agents "/agents/sessions/$SESSION_ID/events" -N
 ```
 
+:::
+
 ```text
 event: agent.session.turn.output_text.delta
 data: {"type": "agent.session.turn.output_text.delta", "item_id": "item_...", "delta": "Hello", ...}
@@ -357,7 +379,9 @@ data: {"type": "agent.session.turn.output_text.delta", "item_id": "item_...", "d
 
 Turn 是由输入启动的一项工作。Items 是其中记录的内容：消息、推理、工具调用及其结果。两者都是持久化的；你可以读取它们来检查结果或在断连后恢复。
 
-```python
+::: code-group
+
+```python [Python]
 turns = client.beta.agents.sessions.turns.list(session.id, order="desc")
 latest = turns.data[0]
 print(latest.status, latest.usage)
@@ -365,18 +389,20 @@ for item in client.beta.agents.sessions.items.list(session.id, order="asc"):
     print(item.type)
 ```
 
-```sh
-oac "/agents/sessions/$SESSION_ID/turns?order=desc&limit=1"
-oac "/agents/sessions/$SESSION_ID/items?order=asc"
+```sh [curl]
+agents "/agents/sessions/$SESSION_ID/turns?order=desc&limit=1"
+agents "/agents/sessions/$SESSION_ID/items?order=asc"
 ```
 
+:::
+
 | Turn `status` | 含义 |
 | --- | --- |
 | `queued`、`in_progress` | 尚未完成 |
 | `waiting` | 正在等待函数结果 |
 | `completed`、`failed`、`cancelled` | 已完成 |
 
-- **用量**（`input_tokens`、`output_tokens`、`total_tokens`、……）未知时为 null，绝不会为零。Turn 运行期间，Session 的用量会保持为 null；Claude Code 和 MiniMax Code 不报告用量（[用量规则](../../../contracts/agents-api/zh/sessions-events.md#usage)）。
+- **用量**（`input_tokens`、`output_tokens`、`total_tokens`、……）未知时为 null，绝不会为零。Turn 运行期间，Session 的用量会保持为 null（[用量规则](../../../contracts/agents-api/zh/sessions-events.md#usage)）。
 - Turn 列表只包含顶层 Turn。要读取 `/subagents` 下的子任务，请使用该路径。
 
 ## 函数工具 {#function-tools}
@@ -411,13 +437,13 @@ with client.beta.agents.sessions.stream(
 如果不使用该辅助函数，请从 `session.required_actions` 读取调用，然后发送：
 
 ```sh
-oac "/agents/sessions/$SESSION_ID/events" -d '{
+agents "/agents/sessions/$SESSION_ID/events" -d '{
   "events": [{"type": "agent.session.input.tool_result",
               "turn_id": "turn_...", "call_id": "call_...", "success": true, "output": "Sunny in Paris"}]
 }'
 ```
 
-重新发送相同结果是安全的。为同一次调用发送不同结果，或在取消后发送结果，都会失败并返回 409。MiniMax Code 不支持公共函数。
+重新发送相同结果是安全的。为同一次调用发送不同结果，或在取消后发送结果，都会失败并返回 409。
 
 ## Files {#files}
 
@@ -431,32 +457,40 @@ oac "/agents/sessions/$SESSION_ID/events" -d '{
 
 ### 源文件 {#source-files}
 
-```python
+::: code-group
+
+```python [Python]
 f = client.files.create(file=open("data.csv", "rb"), purpose="user_data")
 ```
 
-```sh
+```sh [curl]
 curl "$OPENAI_BASE_URL/files" -H "Authorization: Bearer $OPENAI_API_KEY" \
   -F purpose=user_data -F file=@data.csv
 ```
 
+:::
+
 仅接受 `purpose=user_data`，最大为 512 MiB。不需要 Beta 请求头。其内容无法再次下载；请在工作区文件或模板中使用其 ID。
 
 ### 工作区文件 {#workspace-files}
 
 将文件复制到 Session 的 Environment 工作区（`session.environment.id`）：
 
-```python
+::: code-group
+
+```python [Python]
 env_id = session.environment.id
 client.beta.agents.environments.files.create(env_id, type="file_id", file_id=f.id, path="/workspace/data.csv")
 client.beta.agents.environments.files.create(env_id, type="inline", data="aGVsbG8K", path="/workspace/hello.txt")
 page = client.beta.agents.environments.files.list(env_id, path="/workspace")
 ```
 
-```sh
-oac "/agents/environments/$ENV_ID/files" -d '{"type": "file_id", "file_id": "file-...", "path": "/workspace/data.csv"}'
+```sh [curl]
+agents "/agents/environments/$ENV_ID/files" -d '{"type": "file_id", "file_id": "file-...", "path": "/workspace/data.csv"}'
 ```
 
+:::
+
 - `inline` 数据使用 base64，解码后最大为 5 MiB；`file_id` 最大为 50 MiB。
 - 系统会创建父目录。已有文件绝不会被覆盖（400）。
 - 列表显示单个目录中的普通文件，不会递归列出内容。列表使用 `page` 令牌分页，并返回 `next`。
@@ -465,37 +499,45 @@ oac "/agents/environments/$ENV_ID/files" -d '{"type": "file_id", "file_id": "fil
 
 Turn 完成时，Core 会捕获工作区 `outputs/` 目录下的普通文件。即使 Environment 消失，Artifacts 仍可读取。
 
-```python
+::: code-group
+
+```python [Python]
 for a in client.beta.agents.sessions.artifacts.list(session.id):
     data = client.beta.agents.sessions.artifacts.content(a.id, session_id=session.id)
     data.write_to_file(a.path.rsplit("/", 1)[-1])
 ```
 
-```sh
-oac "/agents/sessions/$SESSION_ID/artifacts"
-oac "/agents/sessions/$SESSION_ID/artifacts/$ARTIFACT_ID/content" -o report.md
+```sh [curl]
+agents "/agents/sessions/$SESSION_ID/artifacts"
+agents "/agents/sessions/$SESSION_ID/artifacts/$ARTIFACT_ID/content" -o report.md
 ```
 
+:::
+
 每个 Artifact 都有 `path`、`size_bytes`、`turn_id` 和 `environment_id`。删除 Artifact 不会删除工作区文件。
 
 ## Skills {#skills}
 
 Skill 是 Agent 可使用的、包含指令和文件的带版本捆绑包。可以上传目录或 ZIP；每次上传都会创建一个版本。
 
-```sh
-curl "$OPENAI_BASE_URL/skills" -H "Authorization: Bearer $OPENAI_API_KEY" -F files=@my-skill.zip
-```
+::: code-group
 
-```python
+```python [Python]
 skill = client.skills.create(files=[("my-skill/SKILL.md", open("my-skill/SKILL.md", "rb"))])
 client.skills.versions.create(skill.id, files=[...], default=True)
 ```
 
+```sh [curl]
+curl "$OPENAI_BASE_URL/skills" -H "Authorization: Bearer $OPENAI_API_KEY" -F files=@my-skill.zip
+```
+
+:::
+
 - 不需要 Beta 请求头。每个 Environment 最多可选择 50 个 Skills；每个归档压缩后最大为 5 MiB，展开后最大为 20 MiB。
 - SDK 3.13.0 会上传内容中丢弃唯一的 ZIP 文件；上传 ZIP 时请使用 HTTP。
 - 可通过 Session 的 `environment.skills` 或[模板](#environment-templates)为其附加 Skills。
 
-详细信息请参阅 [Files and Skills](../../../contracts/agents-api/zh/source-files.md)。Session 会在准备期间一次性安装其 Skills、Plugins 和软件包；之后编辑源文件不会影响正在运行的 Session。准备错误会在任何工作开始前导致 Session 失败：请修复原因，而不是在新 Session 中重试。
+详细信息请参阅 [文件与 Skill](../../../contracts/agents-api/zh/source-files.md)。Session 会在准备期间一次性安装其 Skills、Plugins 和软件包；之后编辑源文件不会影响正在运行的 Session。准备错误会在任何工作开始前导致 Session 失败：请修复原因，而不是在新 Session 中重试。
 
 ## Environment 模板 {#environment-templates}
 
@@ -531,17 +573,17 @@ client.beta.agents.vaults.credentials.create(
 session = client.beta.agents.sessions.create(environment={"type": "none"}, input="...", vault_ids=[vault.id], agent_id=agent.id)
 ```
 
-HTTP 路径为 `/vaults`，需要 Beta 请求头。Session 从其 `vault_ids` 中选择凭据，也可以通过 `credential_id` 指定具体凭据；无论采用哪种方式，MCP 服务器的 URL 都必须与所选凭据的 `mcp_server_url` 完全匹配。[Vaults contract](../../../contracts/agents-api/zh/vaults.md) 负责选择、错误、OAuth 刷新和删除。MCP 工具的 `connection_origin` 决定由 Core 端还是工作区连接服务器，而且每个 Harness 支持的取值集合不同；请参阅 [MCP connection origin](../../../contracts/agents-api/zh/environments.md#public-mcp-connection-origin)。
+HTTP 路径为 `/vaults`，需要 Beta 请求头。Session 从其 `vault_ids` 中选择凭据，也可以通过 `credential_id` 指定具体凭据；无论采用哪种方式，MCP 服务器的 URL 都必须与所选凭据的 `mcp_server_url` 完全匹配。[Vault 与 Credential](../../../contracts/agents-api/zh/vaults.md)负责选择、错误、OAuth 刷新和删除。MCP 工具的 `connection_origin` 决定由 Core 端还是工作区连接服务器，而且每个 Harness 支持的取值集合不同；请参阅 [MCP connection origin](../../../contracts/agents-api/zh/environments.md#public-mcp-connection-origin)。
 
 ## 诊断故障 {#diagnose-a-failure}
 
 1. 读取 Session 的 `status` 和 `error`，以及最新 Turn 的 `error`。失败的 Turn 只会报告通用的 `internal_error`。
 2. 检查 Environment 是否已连接，以及其 harness 是否可用。
 3. 在 [Harness capabilities](../../../contracts/agents-api/zh/harness-capabilities.md) 中检查 harness、模型和工具的组合。
-4. 读取 Session 的 [Project 诊断扩展](../../../contracts/agents-api/zh/session-diagnostics.md#project-diagnostics-extension) 获取安全故障分类，再请管理员查看[故障排除](../getting-started/operations.md#troubleshooting)，了解服务日志、凭据和节点就绪状态。
+4. 读取 Session 的 [Project 诊断扩展](../../../contracts/agents-api/zh/session-diagnostics.md#project-diagnostics-extension) 获取安全故障分类，再请管理员查看[故障排除](../getting-started/troubleshooting.md)，了解服务日志、凭据和节点就绪状态。
 
-401 通常表示使用了其他命名空间中的密钥；请参阅 [API 命名空间与凭据](index.md)。
+401 通常表示使用了其他命名空间中的密钥；请参阅 [API 命名空间和凭据](index.md)。
 
 ## 与 OpenAI 的差异 {#differences-from-openai}
 
-Core 在某些行为上与 OpenAI 服务不同，例如 Session 创建的幂等性和特定 Harness 的工具支持。[覆盖情况清单](../../../contracts/agents-api/zh/index.md#differences-from-openai) 列出了所有差异及各资源的状态；[公共 OpenAPI](../../../contracts/agents-api/openapi.yaml) 包含准确的模式定义。
+Core 在某些行为上与 OpenAI 服务不同，例如 Session 创建的幂等性和特定 Harness 的工具支持。[OpenAI 兼容性](../../../contracts/agents-api/zh/index.md#differences-from-openai) 列出了所有差异及各资源的状态；[公共 OpenAPI](../../../contracts/agents-api/openapi.yaml) 包含准确的模式定义。
diff --git a/docs/zh/architecture.md b/docs/zh/architecture.md
index 7417c58bc..214beac84 100644
--- a/docs/zh/architecture.md
+++ b/docs/zh/architecture.md
@@ -1,49 +1,37 @@
 ---
 title: "架构"
 source: docs/architecture.md
-source_hash: ed19d090bf0b65d33895ff59ee2f134916b03df74536ffb9b2659a3d3cb952c9
+source_hash: 957a59269543af671ccac136b00d54e78da276958c9c765ac43151174c6fd918
 ---
 
 OpenAgentCore 是 Agent 运行平台，通过可替换的协议实现统一组织 Harness、模型、工具、Session 和执行环境。它将编排、计算资源和原生执行分开。Core 负责 API 和持久状态。沙箱提供商管理计算资源。独立工作区文件系统 adapter 通过单独的协议管理 Environment 持久存储。Runtime daemon 准备 Environment 并运行选定的 Harness；Harness 的原生 SDK 或协议负责模型与工具循环。
 
-推荐的自部署方案是 microsandbox 配合独立持久化工作区存储，当前由 kernel NFS adapter 提供。E2B 是托管计算的另一选择。两者使用相同的 Core 编排和能力检查。Docker 仍是可用的提供商。计算和文件系统 adapter 声明其支持的组合；部署选择不会引入独立的 Agent 执行流程。具体契约和支持能力见 [沙箱提供商](./sandbox-provider.md) 和[工作区文件系统提供商](./workspace-provider.md)。
+推荐的自部署方案是 microsandbox 配合 kernel NFS 工作区存储。E2B 提供托管计算。Docker 运行在没有检查点或外部存储的节点上。它们使用相同的 Core 编排和能力检查。计算和文件系统 adapter 声明其支持的组合；部署选择不会引入独立的 Agent 执行流程。[沙箱提供商协议](./sandbox-provider.md)和[工作区文件系统协议](./workspace-provider.md)定义其契约和支持的能力。
 
 ```mermaid
 flowchart TB
-    App["Application / official SDK"] <-->|"Agents API /v1: HTTP and SSE"| Core
-    Web["Web administrator console"] <-->|"Core API /core/v1"| Core
-    Core["Core: authorization, configuration snapshots,<br/>orchestration and durable state"]
-    Core --- DB[("PostgreSQL")]
-    Core -->|"Sandbox Provider protocol"| SP["Sandbox Provider:<br/>microsandbox / E2B / Docker"]
-    Core -->|"Workspace filesystem protocol"| FS["Workspace filesystem adapter: NFS"]
-    SP -->|"Resolve external attachment"| FS
-    FS -->|"Own durable storage"| Store[("Independent Environment storage")]
-    SP -.->|"Provision compute and bootstrap Runtime"| R
-    User["User-machine installer"] -.->|"Start Runtime"| R
-    Core <-->|"Core–Runtime protocol:<br/>preparation, execution, events and receipts"| R
-    subgraph Env["Environment: managed sandbox or user-owned machine"]
-        R["Runtime daemon"] --> P["Workspace and capability preparation"]
-        P -->|"Harness protocol"| A["Harness adapter"]
-        A <-->|"Native SDK or protocol"| H["Native Harness: model and tool loop"]
-        H <--> F["Workspace, tools and artifacts"]
-    end
-    F <-->|"Mount when the combination supports external storage"| Store
-    H <-->|"Model API"| Model["Model provider"]
-    H <-->|"MCP"| MCP["Local or remote MCP servers"]
+    App["Application"] -->|"Application–Core"| Core
+    Web["Web"] -->|"Web–Core"| Core
+    Core[("Core + PostgreSQL")]
+    Core -->|"Core–Sandbox Provider"| SP["Sandbox Provider"]
+    Core -->|"Workspace filesystem"| FS["Workspace storage"]
+    SP -->|"Provider–Runtime"| Env
+    Core <-->|"Core–Runtime"| Env["Environment:<br/>Runtime + Harness"]
+    Env -->|"Harness–Model provider"| Model["Model provider"]
 ```
 
-虚线表示资源供应与安装。实线表示组件交互，包括进程内接口。daemon 主动向 Core 发起经过认证的 WebSocket 连接。[API 索引](api/index.md) 说明应用、运维和机器命名空间；[协议边界](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#protocols-at-every-boundary) 列出各协议的代码和所属文档。
+Runtime daemon 主动向 Core 发起经过认证的 WebSocket 连接。[API 命名空间和凭据](api/index.md) 说明应用、运维和机器命名空间；[协议边界](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#protocols-at-every-boundary) 列出各协议的代码和所属文档。
 
 ## 组件职责 {#component-responsibilities}
 
 | 组件 | 职责 | 参考 |
 | --- | --- | --- |
 | Core | 认证调用方，解析并冻结配置，调度 Turn，处理取消和待处理交互，将资源与执行事实持久化到 PostgreSQL | [Core 服务](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/README.md) |
-| 沙箱提供商 | 创建、观察、续期和回收计算资源；提供 Runtime 启动输入 | [沙箱提供商](sandbox-provider.md)、[Runtime 引导](runtime-bootstrap.md) |
-| Workspace filesystem adapter | 创建、观察和删除 Environment 持久存储；验证并解析计算资源所需的挂载 | [工作区文件系统提供商](workspace-provider.md) |
+| 沙箱提供商 | 创建、观察、续期和回收计算资源；提供 Runtime 启动输入 | [沙箱提供商协议](sandbox-provider.md)、[Runtime 引导](runtime-bootstrap.md) |
+| Workspace filesystem adapter | 创建、观察和删除 Environment 持久存储；验证并解析计算资源所需的挂载 | [工作区文件系统协议](workspace-provider.md) |
 | Sandbox node | 运行 Docker 或 microsandbox 主机，协调分配给它的 generation 与 allocation | [Sandbox node 协议](../../contracts/agents-api/zh/node-generation-protocol.md) |
 | Runtime | 准备工作区和能力，管理 Session Executor，执行 Turn 并报告事件与回执 | [Core–Runtime 协议](runtime-protocol.md) |
-| Harness adapter | 验证原生配置，调用上游 SDK 或协议，转换事件并确认原生清理完成 | [Harness 接入](../../contracts/agents-api/zh/harness-onboarding.md) |
+| Harness adapter | 验证原生配置，调用上游 SDK 或协议，转换事件并确认原生清理完成 | [Harness 协议](../../contracts/agents-api/zh/harness-onboarding.md) |
 | 模型提供商 | 提供 Harness 选定的模型协议 | [模型执行](../../contracts/agents-api/zh/model-execution.md) |
 | Web | 让管理员通过服务端 Core API 连接配置与观察安装实例 | [控制台服务端](web/console-server.md) |
 
@@ -53,9 +41,34 @@ Harness 负责原生 Agent loop 和上下文管理。应用负责业务工作流
 
 ## Session 的完整流程 {#a-session-end-to-end}
 
-应用通过 Agents API 创建 Session。Core 解析其配置与执行位置。托管 Session 通过选定的沙箱提供商获取计算资源；自托管 Session 等待用户运行安装命令。`environment: none` 的 Session 使用已连接的执行设备，不提供工作区。[应用指南](api/public-agent-api.md#create-a-session) 说明这些选项。
+应用通过 Agents API 创建 Session，Core 解析其配置与执行位置。托管 Session 通过选定的沙箱提供商获取计算资源。自托管 Session 等待用户运行安装命令，由该命令代替步骤 2 和 3 启动 Runtime。`environment: none` 的 Session 使用已连接的执行设备，不提供工作区。[应用指南](api/public-agent-api.md#create-a-session) 说明这些选项。
 
-daemon 连接后，Core 检查可用 Harness 和请求的能力。Runtime 准备工作区 Environment 及其能力快照，然后准备或复用 Session Executor。每个 Turn 通过原生 Harness 运行。Core 持久化输出、工具交互和回执，供应用读取和接收事件。完成或取消使 Turn 结算；健康的 Executor 可以在同一 Environment 中执行下一个 Turn。
+```mermaid
+%%{init: {"sequence": {"actorMargin": 16, "width": 100}}}%%
+sequenceDiagram
+    autonumber
+    participant App as Application
+    participant Core
+    participant P as Sandbox Provider
+    participant R as Runtime
+    participant H as Harness
+    App->>Core: Create Session
+    Core->>P: Create(Bootstrap)
+    P->>R: Start Runtime
+    R->>Core: Connect, heartbeat
+    Core->>R: runtime_prepare
+    R-->>Core: prepare result
+    App->>Core: Send input
+    Core->>R: execution_prepare
+    R-->>Core: status ready
+    Core->>R: execution_start
+    R->>H: Run the Turn
+    H-->>R: Native events
+    R-->>Core: delta, tool_call, done
+    Core-->>App: Stream events
+```
+
+daemon 连接后，Core 检查可用 Harness 和请求的能力。Runtime 准备工作区 Environment 及其能力快照，然后准备或复用 Session Executor。Core 持久化输出、工具交互和回执，供应用读取和接收事件。完成或取消使 Turn 结算；健康的 Executor 可以在同一 Environment 中执行下一个 Turn。
 
 对于支持检查点的计算资源，Core 自动挂起空闲工作，并在确认快照捕获及源计算停止后释放活跃计算容量。新工作在符合条件的兼容节点上恢复保留的内存；独立工作区存储始终属于同一 Environment 标识。[检查点生命周期](./sandbox-provider.md#suspension)负责空闲准入、唤醒与保留规则，[检查点转移](./sandbox-provider.md#checkpoint-transfer)定义共享存储和兼容性要求。仅凭节点失联不能授权替代写入者。
 
diff --git a/docs/zh/concepts.md b/docs/zh/concepts.md
index fa0717184..457ec541b 100644
--- a/docs/zh/concepts.md
+++ b/docs/zh/concepts.md
@@ -1,16 +1,16 @@
 ---
 title: "概念"
 source: docs/concepts.md
-source_hash: 2d65b520ffc8ccce8836d6196fb9daa217a438e4f79ae2aee70d4cb77da4c606
+source_hash: 378b3621d64bbe1d70057c048c5bac457361dea628a30c5e60704d69d17277ca
 ---
 
-项目是 OpenAgentCore 的执行租户。应用使用其 API 密钥；运维人员使用独立的 Core 密钥管理安装实例。[API 索引](api/index.md) 将每类调用方映射到对应命名空间和凭据。
+项目是 OpenAgentCore 的执行租户。应用使用其 API 密钥；运维人员使用独立的 Core 密钥管理安装实例。[API 命名空间和凭据](api/index.md)将每类调用方映射到对应命名空间和凭据。
 
 ## 项目拥有资产 {#projects-own-assets}
 
 项目拥有自己的 Agent、Session、Environment、Skill、File 和 Vault。其命名 API 密钥共用相同的主体、权限和资源。Core 不提供产品用户、角色、成员关系或只读密钥。名称是标签；稳定 ID 标识项目和密钥。
 
-项目和密钥存储在 PostgreSQL 中。Core 仅在签发时返回一次密钥明文。轮换密钥时，在同一项目中签发新密钥，再撤销旧密钥。撤销保留资产、写入来源和已接受的工作。归档项目会撤销所有密钥并禁止签发新密钥；管理员仍可检查和删除其资源。[管理契约](../../contracts/agents-api/zh/admin-api.md#projects-and-keys) 定义这些操作。
+项目和密钥存储在 PostgreSQL 中。Core 仅在签发时返回一次密钥明文；轮换步骤见[项目和 API 密钥](getting-started/operations.md#projects-and-api-keys)。撤销保留资产、写入来源和已接受的工作。归档项目会撤销所有密钥并禁止签发新密钥；管理员仍可检查和删除其资源。[管理契约](../../contracts/agents-api/zh/admin-api.md#projects-and-keys) 定义这些操作。
 
 [Core 密钥](getting-started/operations.md#core-key) 是独立的部署凭据。管理员需要使用应用 API 时，应签发项目 API 密钥并使用该项目的权限。产品用户、工作区和业务权限属于应用。
 
@@ -22,7 +22,7 @@ source_hash: 2d65b520ffc8ccce8836d6196fb9daa217a438e4f79ae2aee70d4cb77da4c606
 
 管理员管理项目和密钥、沙箱部署、节点、执行器凭据及部署默认模型。他们可以检查资源、执行历史、运行计数与用量，并按删除规则删除资源。归档托管 Session 会请求取消和沙箱回收；参见 [Session 归档](../../contracts/agents-api/zh/admin-api.md#session-archive)。
 
-创建或编辑应用资产、启动 Session 和提交输入都需要项目 API 密钥。Core 密钥不提供应用身份，不能读取已保存的秘密。[管理 API](../../contracts/agents-api/zh/admin-api.md) 定义其操作；[控制台服务端](web/console-server.md) 负责 Web 登录与凭据处理。
+创建或编辑应用资产、启动 Session 和提交输入都需要项目 API 密钥。Core 密钥不提供应用身份，不能读取已保存的秘密。[Core 管理 API](../../contracts/agents-api/zh/admin-api.md) 定义其操作；[控制台服务器](web/console-server.md) 负责 Web 登录与凭据处理。
 
 ## Runtime 与外层隔离 {#runtime-and-outer-isolation}
 
diff --git a/docs/zh/configuration.md b/docs/zh/configuration.md
index bc269449b..c9ab6ea5c 100644
--- a/docs/zh/configuration.md
+++ b/docs/zh/configuration.md
@@ -1,10 +1,10 @@
 ---
 title: "配置参考"
 source: docs/configuration.md
-source_hash: e62a7ce6fb3c56f6522cb3444c8c5391a872ae12895122aca4cbf299e96f2c15
+source_hash: f59a53edb908b1a7e884e598fbb6eb85d40941110e0de60014c14de3b929aaf9
 ---
 
-Core 安装的每项设置都恰好只有一个归属位置，分属以下三类：
+Core 安装的每项设置、其归属位置以及修改方式。安装程序写入初始值；之后请使用本参考。每项设置都恰好只有一个归属位置，分属以下三类：
 
 | 类别 | 示例 | 归属位置 | 修改方式 | 生效方式 |
 | --- | --- | --- | --- | --- |
@@ -16,30 +16,12 @@ Core 安装的每项设置都恰好只有一个归属位置，分属以下三类
 
 ## 进程设置 {#process-settings}
 
-[安装选项](getting-started/install-options.md)中的安装标志只会一次性写入 `.env`。要更改设置，请编辑 `.env` 并应用：
+[安装选项](getting-started/install-options.md#flags)中的安装标志只会一次性写入 `.env`。要更改设置，请编辑 `.env` 并应用：
 
 ```sh
 ~/.oac/core/oac apply
 ```
 
-### oac apply 的工作方式 {#how-oac-apply-works}
-
-1. 它运行 `init` 服务，确认数据卷属于已安装的版本；如果首次启动中途停止，就完成初始化。
-2. 它用你改过的 `.env` 运行 `oac-core check-config`。值无效时不改动任何服务。
-3. 它用主机上已有的镜像运行 `docker compose up -d --wait`。Compose 只重新创建配置有变化的服务，并移除该版本不再定义的容器。若有服务未变为健康，消息会指出该服务和打印其日志的命令。
-
-用 `docker compose ps` 检查服务。重启会中断哪些操作，见[停止和重启](getting-started/operations.md#stop-and-restart)。
-
-### 更改公共 URL {#changing-the-public-url}
-
-`OAC_PUBLIC_URL` 是应用、节点、沙箱和自托管执行器使用的唯一源地址。Core 从中派生守护进程 WebSocket URL、自托管 `remote_url` 和每个沙箱的连接地址。它是 http 或 https 源地址，也就是浏览器和节点使用的地址。安装通过 `OAC_WEB_PORT` 以 HTTP 提供 Web；前面有反向代理或托管平台时，由它们终止 HTTPS。
-
-要更改它，先把反向代理指向新地址，然后编辑 `OAC_PUBLIC_URL` 并运行 `oac apply`。之后：
-
-- 使用旧地址的节点不会再获得新沙箱：请在 Web 中移除这些节点，然后重新添加。
-- 只有在旧地址仍可访问此 Core 时，现有沙箱和执行器才会继续工作。
-- 自托管执行器必须使用新的 `remote_url` 重启，并且其安装程序会拒绝为旧地址进行的安装：请创建新的自托管 Session，然后重新连接其主机。
-
 ### 设置 {#settings}
 
 模型提供商不属于进程设置；请参阅[默认模型](#default-models)。
@@ -48,8 +30,8 @@ Core 安装的每项设置都恰好只有一个归属位置，分属以下三类
 
 | Variable | Default | Meaning |
 | --- | --- | --- |
-| `OAC_PUBLIC_URL` | 必填；`compose.yaml` 设为 `http://localhost:` 加 `OAC_WEB_PORT` | 应用、节点、沙箱和自托管执行器使用的源地址。参阅[更改公共 URL](#changing-the-public-url) |
-| `OAC_HOST` | `127.0.0.1` | `compose.yaml` 发布的 Web 绑定地址。安装器设置为 `0.0.0.0` |
+| `OAC_PUBLIC_URL` | 必填；`compose.yaml` 设为 `http://localhost:` 加 `OAC_WEB_PORT` | 应用、节点、沙箱和自托管执行器使用的源地址。参阅[更改公共 URL](getting-started/public-address.md#changing-the-public-url) |
+| `OAC_HOST` | `127.0.0.1` | `compose.yaml` 发布的 Web 绑定地址。安装程序设置为 `0.0.0.0` |
 | `OAC_WEB_PORT` | `8080` | Host port of Web |
 | `OAC_LOG_LEVEL` | `info` | `debug`, `info`, `warn` or `error` |
 | `OAC_LOG_FORMAT` | `auto` | `auto`, `text` or `json` |
@@ -66,33 +48,13 @@ Core 安装的每项设置都恰好只有一个归属位置，分属以下三类
 
 未设置或为空的值使用默认值。编辑 `.env`，然后运行 `oac apply`。Core 在启动时一次性读取所有进程设置及设置指向的文件，并在 `GET /core/v1/installation` 报告加载的结果。`oac-core check-config` 会在不启动 Core 的情况下加载并校验同样的设置和文件。`OAC_PROVIDER_ROOT` 下的原生安装程序目录清单不属于设置，Core 只在启动时检查它。错误信息只指明变量名，绝不包含其值。敏感设置只报告是否已配置。
 
-### Runtime 历史文件 {#runtime-history-file}
-
-`OAC_HISTORY_SETTINGS_FILE` 指向一个 JSON 文件，用于调整[保留的历史记录](../../contracts/agents-api/zh/runtime-observability.md#retained-history-and-optional-export)，并可添加 OTLP 导出。没有此文件时，Core 按下表默认值把历史记录保存在数据库中。在 Compose 安装中，把该文件放在数据卷的 `secrets/core/` 目录中，属主为 UID 65532，权限为 `0600`，并设置 `OAC_HISTORY_SETTINGS_FILE=/run/oac/<file name>`：Core 以只读方式把该目录挂载到 `/run/oac`。headers 中可以包含导出凭据，它们绝不会出现在 `oac` 输出或安装报告中。未知字段会被拒绝。
-
-| 字段 | 默认值 | 含义 |
-| --- | --- | --- |
-| `sample_interval_seconds` | `30` | 定期采样间隔，范围为 5 到 300 |
-| `queue_capacity` | `256` | 每个导出器排队的记录数，最大 4096 |
-| `timeout_seconds` | `2` | 导出和历史查询超时，最大 30 |
-| `endpoint` | 未设置 | 绝对 OTLP/HTTP 指标 URL，例如 `https://collector.example/v1/metrics`。未设置时 Core 不导出，其他导出字段也必须未设置 |
-| `transport` | 未设置 | `otlp_http`；设置 `endpoint` 时必填 |
-| `insecure` | `false` | `http` 端点必须设为 `true`，`https` 端点不允许设为 `true` |
-| `headers` | 无 | 发往端点的请求标头。`Host`、`Content-Length`、`Content-Type` 和 `Content-Encoding` 为保留标头 |
-
-### Runtime 资源目录 {#runtime-resource-directories}
-
-Runtime 在发现 Harness 适配器之前解析资源目录。`<RuntimeHome>` 是由 `OAC_RUNTIME_HOME` 选择的 Runtime 主目录。`OAC_RUNTIME_STATE_DIRECTORY` 仅在未设置时采用默认值；显式空值、相对路径或非规范路径会被拒绝。目录设置没有其他文件或环境变量回退来源。
-
-| Runtime 进程设置 | 默认值 | 打包的 Linux 镜像 |
-| --- | --- | --- |
-| `OAC_RUNTIME_INITIALIZATION_DIRECTORY` | `<RuntimeHome>/initialization` | `/environment/initialization` |
-| `OAC_RUNTIME_PACKAGE_DIRECTORY` | `<RuntimeHome>/packages` | `/environment/packages` |
-| `OAC_RUNTIME_STATE_DIRECTORY` | `<RuntimeHome>` | `/environment/runtime-state` |
+### oac apply 的工作方式 {#how-oac-apply-works}
 
-状态目录包含保留的原生 Harness 历史和能力安装完成记录，与声明的工作区目录分开。选择独立状态目录不会将 Runtime 设备凭据或连接身份移出 Runtime 主目录中的实例私有路径；不得随原生历史复制这些数据。[Harness 接入指南](../../contracts/agents-api/zh/harness-onboarding.md#register-the-adapter)定义适配器边界，[Environment 准备](../../contracts/agents-api/zh/environments.md)负责初始化和包的行为。
+1. 它运行 `init` 服务，确认数据卷属于已安装的版本；如果首次启动中途停止，就完成初始化。
+2. 它用你改过的 `.env` 运行 `oac-core check-config`。值无效时不改动任何服务。
+3. 它用主机上已有的镜像运行 `docker compose up -d --wait`。Compose 只重新创建配置有变化的服务，并移除该版本不再定义的容器。若有服务未变为健康，消息会指出该服务和打印其日志的命令。
 
-将状态放在独立文件系统上，可以在替换计算资源时保留这些文件。原生续接仍要求 Harness 已通过资格验证、所有权匹配，并确认前一个写入者已停止。这不保留进程内存或计算资源根磁盘上的任意文件。
+用 `docker compose ps` 检查服务。重启会中断哪些操作，见[停止和重启](getting-started/operations.md#stop-and-restart)。
 
 ## 运行时设置：Web {#runtime-settings-web}
 
@@ -101,10 +63,10 @@ Runtime 在发现 Harness 适配器之前解析资源目录。`<RuntimeHome>` 
 | 设置 | Web 中的位置 | Core API | 注意事项 |
 | --- | --- | --- | --- |
 | 沙箱提供商：Docker、microsandbox 或 E2B | **设置** → **沙箱与调度**：设置向导，最后点击 **保存配置** | `/core/v1/sandbox/deployment` | 每个安装只能使用一个沙箱提供商，在首次登录后选择。要改用其他提供商，必须先执行 **重置部署**；请参阅[更改沙箱配置](getting-started/nodes.md#change-the-sandbox-configuration) |
-| 沙箱大小、Runtime 发行版、E2B 密钥和模板构建 | **设置** → **沙箱与调度** → **修改资源** | `/core/v1/sandbox/deployment` | Web 会推荐 [提供商声明的默认大小](sandbox-provider.md#register-the-provider-kind)。现有沙箱会保留其大小和发行版。E2B 密钥仅可写入，并且已加密 |
-| 节点及其容量 | **节点**：**添加节点**、**编辑节点** 和移除 | `/core/v1/sandbox/enrollment-tokens`、`/core/v1/sandbox/nodes` | 请参阅[节点容量](#node-capacity)和[节点指南](getting-started/nodes.md) |
+| 沙箱大小、E2B 密钥和模板构建 | **设置** → **沙箱与调度** → **修改资源** | `/core/v1/sandbox/deployment` | Web 会推荐 [提供商声明的默认大小](sandbox-provider.md#register-the-provider-kind)。现有沙箱会保留其大小。E2B 密钥仅可写入，并且已加密 |
+| 节点及其容量 | **节点**：**添加节点**、**编辑节点** 和移除 | `/core/v1/sandbox/enrollment-tokens`、`/core/v1/sandbox/nodes` | 请参阅[节点容量](#node-capacity)和[添加和管理节点](getting-started/nodes.md) |
 | 空闲挂起 | **设置** → **沙箱与调度** → **自动挂起** → **空闲多久后挂起（秒）** → **保存** | `PATCH /core/v1/sandbox/deployment` | 整个部署统一生效；参阅[挂起策略](../../contracts/agents-api/zh/sandbox-deployment.md#suspension-policy) |
-| 独立工作区存储和租户容量 | **设置 → 工作区存储** | `/core/v1/workspace-storage` | 参阅[独立工作区存储](#independent-workspace-storage)；现有工作区保留自身配置 |
+| 独立工作区存储和租户容量 | **设置 → 工作区存储** | `/core/v1/workspace-storage` | 参阅[设置工作区存储](getting-started/workspace-storage.md)；现有工作区保留自身配置 |
 | 项目和 API 密钥 | **项目与密钥**：**创建项目**、**改名**、**签发密钥**、**撤销**、**归档** | `/core/v1/projects` | 密钥只显示一次；Core 存储其摘要 |
 | 每个 Harness 的默认模型 | **设置** → **模型与凭据**：**设置** | `/core/v1/harnesses/{harness}/model-configuration` | 请参阅[默认模型](#default-models) |
 | 自托管 Session 的执行器凭据 | **Session 日志**，然后进入 **Session** 页面：**执行器凭据** | `/core/v1/projects/{project_id}/environments/{environment_id}/executor-credentials` | 请参阅[自托管执行器](getting-started/self-hosted.md) |
@@ -115,88 +77,17 @@ Runtime 在发现 Harness 适配器之前解析资源目录。`<RuntimeHome>` 
 
 在 `.env` 中设置 `OAC_SANDBOX_MAX_ACTIVE` 和 `OAC_SANDBOX_MAX_RETAINED`，然后运行 `oac apply`。Core 将这些限制用于启用暂停能力的直接 Provider。每个尚未释放的分配都占用保留容量。降低上限不会终止已有沙箱；新分配会等待使用量低于两项上限。这些设置独立于 `OAC_EXECUTION_CONCURRENCY` 和已注册节点的容量。
 
-### 独立工作区存储 {#independent-workspace-storage}
-
-首个支持的独立文件系统组合是 microsandbox 与[内核 NFS 适配器](./workspace-provider.md#kernel-nfs-adapter)。新安装应先准备存储和服务账户，再向 Core 暴露挂载、选择存储、配置 microsandbox，最后注册节点。启动服务前，在 Linux Core 主机和所有参与节点上将同一个 NFSv4.2 导出挂载到相同的绝对路径，例如 `/srv/oac-workspaces`。运维人员负责导出、挂载可用性和服务启动顺序。使用带有 `root_squash` 的受信任客户端 AUTH_SYS 导出；不要启用 `no_root_squash` 或放宽权限来使检查通过。按照适配器的[所有权要求](./workspace-provider.md#kernel-nfs-adapter)准备命名空间和服务身份。
-
-Core 的 Compose 服务已使用 UID 65532 运行。添加节点前，创建同 UID 的 `oac-node`，主目录为 `/var/lib/oac-node`，使用 nologin shell 和非零主组。附加组只能包含其主组、`docker` 和 `kvm`；已有主目录必须属于该账户。安装器会接管此账户。如果没有预创建账户，安装器分配的系统 UID 不一定与 Core 一致。注册前应通过主机管理流程解决已有 UID 或账户冲突；修改运行中账户的 UID 不属于存储配置步骤。
-
-对于 Compose 部署，通过部署平台的 Compose 自定义能力，在现有 `core` 服务的 `volumes` 中添加可读写绑定挂载，保留现有服务卷和用户。主机源目录必须已经是 NFS 挂载；`create_host_path: false` 只防止创建不存在的源目录，并不能证明 NFS 已挂载。先挂载再创建容器；主机卸载或重新挂载后，应重新创建容器，使其挂载命名空间使用预期挂载。
-
-```yaml
-services:
-  core:
-    volumes:
-      - type: bind
-        source: /srv/oac-workspaces
-        target: /srv/oac-workspaces
-        read_only: false
-        bind:
-          create_host_path: false
-```
+### 节点容量 {#node-capacity}
 
-在 **设置 → 工作区存储 → 选择新配置** 中选择存储，或按[管理 API](../../contracts/agents-api/zh/admin-api.md#workspace-storage)说明，使用 Core 密钥调用 `PUT /core/v1/workspace-storage`。首次设置时，分别为不可变配置 `id` 和命名空间标记生成规范 UUID，然后使用实际值提交以下结构。恢复时保留已有标识。选择操作会在 Core 中运行适配器的可用性、所有权和 xattr 检查；它不证明每个节点均能解析该挂载：
-
-```json
-{
-  "id": "11111111-1111-4111-8111-111111111111",
-  "adapter": "nfs",
-  "parameters": {
-    "root": "/srv/oac-workspaces",
-    "namespace_id": "22222222-2222-4222-8222-222222222222",
-    "uid": 65532
-  },
-  "tenant_capacity_mib": 0
-}
-```
+节点容量是 **同时运行的沙箱**（`max_active`），并且仅对 microsandbox 还有 **保留的沙箱**（`max_retained`），其中 `max_retained >= max_active >= 1`。**添加节点** 默认采用推荐值，即节点注册时 Core [按主机推导](../../contracts/agents-api/zh/sandbox-deployment.md#recommended-capacity)的值；也可以自行填写两个数字。Docker 从不暂停沙箱，因此 Web 不会询问此项，并且 Core 会使 `max_retained` 保持等于 `max_active`。之后可在 **节点** 使用 **编辑节点** 修改这些值，它会显示推荐值并可一键填入。预留和尚未确认的清理操作都会占用容量；retained slot 已满时可以[提前结束空闲检查点的保留期](./sandbox-provider.md#cold-replacement-after-checkpoint-retention)；调低限制不会停止任何正在运行的沙箱。节点自身的文件无法更改其容量、大小或 Runtime。
 
-此配置不实施单个工作区配额，因此 `tenant_capacity_mib` 必须为 `0`。如需有上限的工作区，应准备[配额模式存储服务器](#quota-mode-storage-server)，并改为选择带[租户容量](#tenant-capacity)的配额模式配置。
-
-随后通过[沙箱部署 API](../../contracts/agents-api/zh/sandbox-deployment.md#routes)创建或更新 microsandbox 部署，并保留所需计算资源、Runtime 和提供商配置。`resources.environment_disk_mib` 是每个新工作区的容量：非配额模式下为 `0`，正数会被拒绝；配额模式下至少为 1024 MiB，`0` 会在工作区准入时被拒绝。部署变更时，既有工作区保持其获准时的容量。部署的工作区要求和每个 Session 的挂载凭据均从已选数据库配置派生；不要向部署添加文件系统字段，也不要在节点文件中添加第二份存储配置。
-
-存储表单接受 adapter 标识、JSON 对象形式的参数和可选的只写凭据 JSON 对象。Core 验证这些由 adapter 定义的值；Web 不定义提供商专属存储字段。**修改租户容量** 保留已选的不可变配置。选择另一份配置需要新的 ID，不会迁移现有工作区。
-
-选择文件系统和部署后，通过 **节点 → 添加节点** 注册已准备的主机。计算资源已连接且就绪并不足以证明外部文件系统具备资格；准入应用流量前，通过每个参与节点验证实际 Session 创建和访问。将独立命名空间纳入[停止写入后的备份恢复流程](./getting-started/operations.md#back-up)。
-
-#### 配额模式存储服务器 {#quota-mode-storage-server}
-
-配额模式通过 NFS 服务器上的 XFS project quota 为每个工作区的已分配字节和 inode 设定上限，由 Core 经受限 SSH 强制命令调用的 `oac-workspace-quota` 命令设置。协议和强制执行语义由[配额模式](./workspace-provider.md#quota-mode)负责。以存储服务器管理员身份完成以下准备：
-
-1. 将导出放在启用强制 project quota（`prjquota`，而非 `pqnoenforce`）挂载的本地 XFS 文件系统上。导出根目录必须是该挂载点的子目录，例如挂载 `/srv/xfs`、导出 `/srv/xfs/oac-workspaces`；该命令将日志库保存在导出之外的 `/srv/xfs/.oac-quota`。按上文准备命名空间根目录和标记。
-2. 安装 `xfsprogs` 和 Python 3.9 或更高版本。从匹配的发行包将 `storage/oac-workspace-quota` 安装为 `/usr/local/sbin/oac-workspace-quota`，所有者为 root，权限 `0755`。
-3. 写入 `/etc/oac/workspace-quota.json`，所有者为 root，组和其他用户不可写：`{"export_root": "/srv/xfs/oac-workspaces", "mount_point": "/srv/xfs"}`。
-4. 预留该文件系统上其他 project 均未使用的 project ID 范围，然后仅初始化一次日志库：`oac-workspace-quota --config /etc/oac/workspace-quota.json init --projid-start 100000 --projid-end 199999`。它拒绝在已有日志库上运行；绝不要初始化恢复后的存储。
-5. 生成专用密钥对，例如 `ssh-keygen -t ed25519 -N '' -f oac-workspace-quota`。在一个具有可用 shell 的账户（如 `oac-quota`）的 `authorized_keys` 中授权其公钥：`restrict,from="<Core address>",command="sudo -n /usr/local/sbin/oac-workspace-quota --config /etc/oac/workspace-quota.json serve" ssh-ed25519 AAAA...`，并添加 sudoers 条目 `oac-quota ALL=(root) NOPASSWD: /usr/local/sbin/oac-workspace-quota --config /etc/oac/workspace-quota.json serve`。也可以在 `PermitRootLogin forced-commands-only` 下为 root 使用相同选项授权该密钥，命令中不带 `sudo -n`。保持 `PermitUserEnvironment no`。
-6. 在服务器本机的 `/etc/ssh/` 中读取其公共主机密钥，不要通过未经认证的网络扫描获取。
-
-选择配额模式配置时，将私钥作为只写凭据提交。选择成功后删除本地私钥文件；Core 使用 `secrets/core/credential.key` 加密保存它：
-
-```json
-{
-  "id": "33333333-3333-4333-8333-333333333333",
-  "adapter": "nfs",
-  "parameters": {
-    "root": "/srv/oac-workspaces",
-    "namespace_id": "22222222-2222-4222-8222-222222222222",
-    "uid": 65532,
-    "quota": {
-      "endpoint": "storage.internal:22",
-      "user": "oac-quota",
-      "host_key": "ssh-ed25519 AAAA..."
-    }
-  },
-  "credential": {
-    "ssh_private_key": "-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----\n"
-  },
-  "tenant_capacity_mib": 65536
-}
-```
+`OAC_EXECUTION_CONCURRENCY` 与此无关：它限制 Core 中并发执行的工作量。
 
-选择操作会通过固定的主机密钥调用该命令的只读检查。随后在 `resources.environment_disk_mib` 中设置每个工作区的容量并更新部署。在此更新之前，从非配额配置切换过来的安装会拒绝新工作区；既有工作区继续使用其自身配置。凭据属于不可变配置。如需轮换，先授权新密钥，使用新密钥选择新的配置 ID，并在仍有绑定旧配置的工作区处于创建过程中时保留旧密钥的授权。
+### 默认模型 {#default-models}
 
-配额模式支持的恢复方式是对 XFS 文件系统进行块级复制；参见[备份](./getting-started/operations.md#back-up)。
+在 **设置** → **模型与凭据** 中设置默认值，或使用 `PUT /core/v1/harnesses/{harness}/model-configuration`。Core 使用 `secrets/core/credential.key` 加密提供商密钥，并且绝不返回这些密钥。[模型执行](../../contracts/agents-api/zh/model-execution.md#deployment-defaults) 定义了请求字段和替换规则，[优先级](../../contracts/agents-api/zh/model-execution.md#saved-defaults-and-precedence)说明了哪些 Session 使用默认值。
 
-#### 租户容量 {#tenant-capacity}
+### 租户容量 {#tenant-capacity}
 
 `tenant_capacity_mib` 是安装唯一的租户容量策略，只能与选择一起通过 `PUT /core/v1/workspace-storage` 写入，并保存在 Core 数据库中。正值要求配额模式配置，配额模式配置也要求正值。它限制单个租户所有尚未确认删除的工作区的获准容量之和，并跨配置变更生效；计数规则由[能力验证](./workspace-provider.md#capability-validation)负责。调低该值只拒绝新工作区；删除 Session 后，其存储被移除时即释放容量。
 
@@ -206,16 +97,6 @@ Session 创建可以在异步工作区准入之前成功。容量耗尽时，Cor
 
 该策略限制每个租户可承诺的容量，而不限制文件系统。应按租户数乘以策略值，并为无上限工作区、标识、删除标记、日志库和 XFS 元数据预留余量来规划 XFS 文件系统大小；或者明知超额分配并监测可用空间。每个节点的 `checkpoint_root` 应放在独立存储上。容量上限不提供 I/O 公平性。
 
-### 节点容量 {#node-capacity}
-
-生成 **添加节点** 命令时，Core 会批准节点容量：**同时运行的沙箱**（`max_active`，默认值为 2），并且仅对 microsandbox 还会批准 **保留的沙箱**（`max_retained`，默认值为 8），其中 `max_retained >= max_active >= 1`。Docker 从不暂停沙箱，因此 Web 不会询问此项，并且 Core 会使 `max_retained` 保持等于 `max_active`。之后可在 **节点** 使用 **编辑节点** 修改这些值。预留和尚未确认的清理操作都会占用容量；调低限制不会停止任何正在运行的沙箱。节点自身的文件无法更改其容量、大小或 Runtime。
-
-`OAC_EXECUTION_CONCURRENCY` 与此无关：它限制 Core 中并发执行的工作量。
-
-### 默认模型 {#default-models}
-
-在 **设置** → **模型与凭据** 中设置默认值，或使用 `PUT /core/v1/harnesses/{harness}/model-configuration`。Core 使用 `secrets/core/credential.key` 加密提供商密钥，并且绝不返回这些密钥。[模型执行](../../contracts/agents-api/zh/model-execution.md#deployment-defaults) 定义了请求字段和替换规则，[优先级](../../contracts/agents-api/zh/model-execution.md#saved-defaults-and-precedence)说明了哪些 Session 使用默认值。
-
 ## Compose 安装 {#compose-installations}
 
 发行版中的[独立 Compose 文件](getting-started/install-options.md#docker-compose-and-hosting-platforms)从平台环境读取进程设置。把 [`OAC_PUBLIC_URL`](#settings) 设成准确的公共源地址，不要带尾部斜杠，并在添加节点或执行器之前重新创建 Core 和 Web。平台终止 TLS，并把流量转到 `web:8080`。
@@ -237,12 +118,12 @@ Session 创建可以在异步工作区准入之前成功。容量耗尽时，Cor
 
 ## Docker 节点配置 {#docker-node-configuration}
 
-节点安装程序会将 Docker 的主机设置写入节点配置文件的 `native` 对象，只有 Docker 适配器读取它。部署资源、Runtime 发行版本和容量仍存储在 [Core 的数据库](#runtime-settings-web)中。
+节点安装程序会将 Docker 的主机设置写入节点配置文件的 `native` 对象，只有 Docker 适配器读取它。部署资源和容量仍存储在 [Core 的数据库](#runtime-settings-web)中。
 
 | 字段 | 安装程序设置的值 | 含义 |
 | --- | --- | --- |
 | `host` | `unix:///var/run/docker.sock` | 显式 Docker Engine 套接字 |
-| `image` | 加载后 Runtime 镜像的本地 ID | 发行版本的 `image_id` 或 `image_manifest_digest`。主机的镜像存储决定由哪个 digest 指代已加载的镜像，因此该值属于节点本地；适配器只接受这两个值 |
+| `image` | 加载后 Runtime 镜像的本地 ID | 本安装的 Runtime 镜像。主机的镜像存储决定其本地 ID 是清单中的 `image_id` 还是 `image_manifest_digest`，因此该值属于节点本地 |
 | `network` | `oac-node-<installation-id>` | Runtime 容器网络 |
 | `seccomp_file` | `<node-root>/runtime/seccomp.json` | 所匹配发行版的 seccomp 配置文件 |
 | `nested_sandbox` | `true` | 启用 Docker 适配器的 init 进程和 proc-mask 配置 |
@@ -256,13 +137,17 @@ Session 创建可以在异步工作区准入之前成功。容量耗尽时，Cor
 | 路径 | 内容 | 修改者 |
 | --- | --- | --- |
 | `.env` | 进程设置和固定的 Compose 项目名 | 用户修改后运行 `oac apply` |
-| `compose.yaml` | 已校验的发行版服务定义 | 安装程序，在安装或[升级](getting-started/operations.md#upgrade)时 |
-| `compose.override.yaml` | 可选的本地 Compose 条目。源码包安装中它是 JSON，还保存四个服务镜像和 Web 的 `/node-payload` 绑定 | 用户。`install.py` 只替换自己的条目，并要求 JSON 格式 |
+| `compose.yaml` | 已校验的发行版服务定义 | 安装程序，在安装时 |
+| `compose.override.yaml` | 可选的本地 Compose 条目。源码包安装中它是 JSON，还保存 Web 的 `/node-payload` 绑定和 Core 的原生安装程序绑定 | 用户。`install.py` 只替换自己的条目，并要求 JSON 格式 |
 | `oac`（Windows 为 `oac.exe`） | 原生管理命令 | 安装程序 |
 
 同级 `<install-dir>.lock` 目录用于同步操作并一直保留；`<install-dir>.staging` 保存尚未就位的安装文件。两者都不保存服务数据。Unix 上安装程序以 `0700` 创建私有目录，以 `0600` 创建配置文件。
 
-Compose 项目名为 `oac-<10 hex digits>`，服务包括 `init`、`database`、`core` 和 `web`。Core 启动时执行数据库迁移。Web 提供控制台并把 `/v1`、`/api/v1` 转发到 Core，是唯一发布端口（`OAC_WEB_PORT`）的服务。没有服务持有 Docker 套接字。
+Compose 项目名为 `oac-<10 hex digits>`，服务包括 `init`、`database`、`core` 和 `web`。Core 启动时执行数据库迁移。Web 提供控制台，是唯一发布端口（`OAC_WEB_PORT`）的服务；它转发的内容见[请求边界](./web/console-server.md#request-boundary)。没有服务持有 Docker 套接字，Web 和 Core 也没有 KVM 访问权限。
+
+## 独立工作区存储 {#independent-workspace-storage}
+
+microsandbox 要求使用独立工作区存储，唯一支持的组合是与[内核 NFS 适配器](./workspace-provider.md#kernel-nfs-adapter)。在 **设置 → 工作区存储** 中选择它（`/core/v1/workspace-storage`，参阅 [Core 管理 API](../../contracts/agents-api/zh/admin-api.md#workspace-storage)）；该选择及其租户容量适用于新工作区，现有工作区保留自身配置。[设置工作区存储](getting-started/workspace-storage.md)涵盖 NFS 导出、Compose 挂载、选择负载和配额模式存储服务器。
 
 ## 附录：没有安装程序时的 Core 环境 {#appendix-core-environment-without-the-installer}
 
@@ -298,3 +183,31 @@ Compose 为 Web 设置这些变量。仅在不使用 Compose 运行控制台时
 | `OAC_WEB_NODE_PAYLOAD_DIR` | 未设置 | 所匹配发行版的节点载荷（即安装程序的 `node-payload/`）的绝对路径。未设置时，不提供 `/node-install/*`，且 **添加节点** 不可用 |
 
 未设置或为空的变量使用其默认值。无效值会阻止控制台启动，并显示一条指明变量名的消息。控制台还会读取三个日志[进程设置](#settings)，并拒绝 Core 拒绝的值。对于不在同一台计算机上的任何浏览器，请使用 HTTPS。
+
+## 附录：Runtime 历史文件 {#runtime-history-file}
+
+`OAC_HISTORY_SETTINGS_FILE` 指向一个 JSON 文件，用于调整[保留的历史记录](../../contracts/agents-api/zh/runtime-observability.md#retained-history-and-optional-export)，并可添加 OTLP 导出。没有此文件时，Core 按下表默认值把历史记录保存在数据库中。在 Compose 安装中，把该文件放在数据卷的 `secrets/core/` 目录中，属主为 UID 65532，权限为 `0600`，并设置 `OAC_HISTORY_SETTINGS_FILE=/run/oac/<file name>`：Core 以只读方式把该目录挂载到 `/run/oac`。headers 中可以包含导出凭据，它们绝不会出现在 `oac` 输出或安装报告中。未知字段会被拒绝。
+
+| 字段 | 默认值 | 含义 |
+| --- | --- | --- |
+| `sample_interval_seconds` | `30` | 定期采样间隔，范围为 5 到 300 |
+| `queue_capacity` | `256` | 每个导出器排队的记录数，最大 4096 |
+| `timeout_seconds` | `2` | 导出和历史查询超时，最大 30 |
+| `endpoint` | 未设置 | 绝对 OTLP/HTTP 指标 URL，例如 `https://collector.example/v1/metrics`。未设置时 Core 不导出，其他导出字段也必须未设置 |
+| `transport` | 未设置 | `otlp_http`；设置 `endpoint` 时必填 |
+| `insecure` | `false` | `http` 端点必须设为 `true`，`https` 端点不允许设为 `true` |
+| `headers` | 无 | 发往端点的请求标头。`Host`、`Content-Length`、`Content-Type` 和 `Content-Encoding` 为保留标头 |
+
+## 附录：Runtime 资源目录 {#runtime-resource-directories}
+
+Runtime 在发现 Harness 适配器之前解析资源目录。`<RuntimeHome>` 是由 `OAC_RUNTIME_HOME` 选择的 Runtime 主目录。`OAC_RUNTIME_STATE_DIRECTORY` 仅在未设置时采用默认值；显式空值、相对路径或非规范路径会被拒绝。目录设置没有其他文件或环境变量回退来源。
+
+| Runtime 进程设置 | 默认值 | 打包的 Linux 镜像 |
+| --- | --- | --- |
+| `OAC_RUNTIME_INITIALIZATION_DIRECTORY` | `<RuntimeHome>/initialization` | `/environment/initialization` |
+| `OAC_RUNTIME_PACKAGE_DIRECTORY` | `<RuntimeHome>/packages` | `/environment/packages` |
+| `OAC_RUNTIME_STATE_DIRECTORY` | `<RuntimeHome>` | `/environment/runtime-state` |
+
+状态目录包含保留的原生 Harness 历史和能力安装完成记录，与声明的工作区目录分开。选择独立状态目录不会将 Runtime 设备凭据或连接身份移出 Runtime 主目录中的实例私有路径；不得随原生历史复制这些数据。[Harness 接入指南](../../contracts/agents-api/zh/harness-onboarding.md#register-the-adapter)定义适配器边界，[Environment 准备](../../contracts/agents-api/zh/environments.md)负责初始化和包的行为。
+
+将状态放在独立文件系统上，可以在替换计算资源时保留这些文件。原生续接仍要求 Harness 已通过资格验证、所有权匹配，并确认前一个写入者已停止。这不保留进程内存或计算资源根磁盘上的任意文件。
diff --git a/docs/zh/development.md b/docs/zh/development.md
index 44ce3dab1..102c1183b 100644
--- a/docs/zh/development.md
+++ b/docs/zh/development.md
@@ -1,10 +1,10 @@
 ---
 title: "开发 OpenAgentCore"
 source: docs/development.md
-source_hash: 3516f7088aadb05c19a61187a3c66fcf39503c24635b38509349d05eecf06623
+source_hash: f0e015b4f13aeafa5ec486c42a5d4210f6dd9a9ce40b34112cdef1ed3aad28ba
 ---
 
-准备工作副本，构建组件并验证修改。如需使用已安装的实例，从[入门指南](getting-started/index.md)开始。修改代码前阅读[贡献者规则](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md)。
+准备工作副本，构建组件并验证修改。如需使用已安装的实例，从[概览](getting-started/index.md)开始。修改代码前阅读[贡献者规则](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md)。
 
 组件职责和执行流程参见[架构](architecture.md)。
 
@@ -13,7 +13,7 @@ source_hash: 3516f7088aadb05c19a61187a3c66fcf39503c24635b38509349d05eecf06623
 使用独立 worktree，让实验与验证不影响其他工作副本。从 `main` 已更新的现有克隆执行：
 
 ```sh
-git worktree add ../openagentcore-change -b codex/my-change main
+git worktree add ../openagentcore-change -b fix-session-timeout main
 cd ../openagentcore-change
 ```
 
@@ -40,7 +40,7 @@ export OAC_TEST_OFFICIAL_SDK_PYTHON="$PWD/.venv/bin/python"
 
 ### Node 依赖边界 {#node-dependency-boundaries}
 
-每个 pnpm 模块在 `package.json` 旁拥有自己的 `pnpm-lock.yaml`。Website 和 Claude SDK adapter 是独立 pnpm 项目，各自拥有工作区边界。Web/example/client 工作区使用 `sharedWorkspaceLockfile: false`：链接已声明的工作区依赖，但不共享依赖解析或虚拟存储。根脚本仅编排模块命令，不安装工具依赖。构建与测试工具应在导入或执行它们的模块中声明。MiniMax companion 使用自己的 npm manifest 和 `package-lock.json`，位于 pnpm 工作区之外。
+每个 pnpm 模块在 `package.json` 旁拥有自己的 `pnpm-lock.yaml`。Website 和 Claude Code adapter 是独立 pnpm 项目，各自拥有工作区边界。Web/example/client 工作区使用 `sharedWorkspaceLockfile: false`：链接已声明的工作区依赖，但不共享依赖解析或虚拟存储。根脚本仅编排模块命令，不安装工具依赖。构建与测试工具应在导入或执行它们的模块中声明。MiniMax companion 没有依赖，位于 pnpm 工作区之外。
 
 使用 `pnpm --dir website install --frozen-lockfile` 安装一个模块，或使用 `pnpm --filter @oac/web... install --frozen-lockfile` 连同工作区依赖一起安装。通过同一 package filter 添加或更新依赖，并提交该模块的 manifest 与 lockfile。`make node-deps` 安装所有 pnpm 模块，用于完整本地验证。Web 和示例通过明确的 `workspace:*` 依赖共享 `packages/agents-client`；它们的检查也安装该 client。组件 Make target 使用过滤后的安装与检查。CI 缓存仅使用该作业的依赖锁；[CI 选择策略](maintainers.md#continuous-integration) 负责决定修改选择哪些检查。
 
@@ -50,7 +50,7 @@ export OAC_TEST_OFFICIAL_SDK_PYTHON="$PWD/.venv/bin/python"
 
 ## 不发布版本，直接安装工作副本 {#install-a-checkout-without-publishing-a-release}
 
-使用此路径体验已提交工作副本中的完整 Core、Web 和受管沙箱节点。它复用正式发版的分发构建器、Compose 服务、初始化和节点安装器。构建时需要联网获取固定的上游依赖；生成的离线包不依赖 OpenAgentCore 发版或镜像仓库。在 Linux amd64 上按[分发构建前提](maintainers.md#build-a-distribution)构建和安装。需要 Docker Engine 26+ 和 Compose 2.26+。源码必须已提交，包括本地修改。
+使用此路径体验已提交工作副本中的完整 Core、Web 和受管沙箱节点。它复用正式发版的分发构建器、Compose 服务、初始化和节点安装程序。构建时需要联网获取固定的上游依赖；生成的离线包不依赖 OpenAgentCore 发版或镜像仓库。在 Linux amd64 上按[分发构建前提](maintainers.md#build-a-distribution)构建和安装。需要 Docker Engine 26+ 和 Compose 2.26+。源码必须已提交，包括本地修改。
 
 在仓库根目录一次性准备固定 Runtime 输入，然后构建和安装。如果 `~/.oac/build/release-inputs/inputs.json` 已存在，跳过第一条命令并复用它：
 
@@ -72,23 +72,11 @@ python3 "$bundle/install.py" \
   --public-url http://YOUR_CORE_HOST:8080
 ```
 
-将 `YOUR_CORE_HOST` 替换为浏览器与沙箱节点都能访问的地址。需要时使用反向代理后的 HTTPS 地址；入口配置见[安装选项](getting-started/install-options.md)。新安装会输出用于登录的 Core 密钥；重新运行时输出显示该密钥的命令。它创建标准 Compose 安装，以及包含该构建公共节点制品的只读 `node-payload` 目录。磁盘需同时容纳解压后的构建包和安装副本。Core、Web 均不会获得 Docker socket。
+将 `YOUR_CORE_HOST` 替换为浏览器与沙箱节点都能访问的地址。[安装选项](getting-started/install-options.md#offline-hosts)说明 `install.py` 的选项、重新运行和恢复。构建还会生成 `oac-<commit>-linux-amd64-offline.tar.gz`，用于在另一台 Linux amd64 Docker 主机上安装。
 
-构建还会生成 `oac-<commit>-linux-amd64-offline.tar.gz`。可将其复制到另一台 Linux amd64 Docker 主机，解压后执行其中的 `install.py`；目标主机只需要 Python 3.9+ 和 Docker，无需源码、Go、Node 或 pnpm。安装完成前保留解压目录；安装后的服务和节点下载不再依赖它的原始位置。
+在 Web 中配置模型提供商，创建沙箱部署，再使用[添加和管理节点](getting-started/nodes.md)中显示的命令添加节点。节点前提仍然适用，包括 microsandbox 所需的 KVM。命令直接从本次安装下载匹配的执行制品。此路径构建全部三个受管 Harness；除非提供[原生安装程序目录](maintainers.md#native-installers)，否则可选的自托管原生安装程序不可用，不会生成占位目录。
 
-在 Web 中配置模型提供商，创建沙箱部署，再使用[节点](getting-started/nodes.md)中显示的命令添加节点。节点前提仍然适用，包括 microsandbox 所需的 KVM。命令直接从本次安装下载匹配的执行制品。此路径构建全部三个受管 Harness；除非提供[原生安装器目录](maintainers.md#native-installers)，否则可选的自托管原生安装器不可用，不会生成占位目录。
-
-启动失败或安装已停止时，使用保存的配置，而不是重新安装：
-
-```sh
-cd "$HOME/.oac/local"
-docker compose logs --tail 100
-# Retry without downloading release images or replacing saved configuration.
-docker compose up -d --wait --pull never
-./oac core-key --show
-```
-
-对安装目录重新运行同一源码包的 `install.py`，会以已保存的设置继续该安装；只有新目录才需要 `--public-url`。其他提交的源码包会拒绝已有安装，除非传入 `--upgrade`，此时会[原地升级](getting-started/operations.md#upgrade)该安装。新安装若在启动服务之前失败，安装目录会保持运行前的状态；修复原因后重新运行同一命令即可。配置、密钥和停止服务参见[运维命令](getting-started/operations.md)。
+配置、密钥和停止服务参见[运维命令](getting-started/operations.md)。
 
 ## 构建与运行组件 {#build-and-run-components}
 
@@ -109,20 +97,20 @@ Core 构建产物和输出目录设置见[独立 Core 构建](maintainers.md#sta
 
 | 位置 | 职责 | 后续阅读 |
 | --- | --- | --- |
-| `services/core/internal/api` | 公开、管理员与机器 HTTP 边界 | [API 索引](api/index.md) |
+| `services/core/internal/api` | 公开、管理员与机器 HTTP 边界 | [API 命名空间和凭据](api/index.md) |
 | `services/core/internal/persistence`、`services/core/internal/db` 和 `services/core/migrations` | Core 的 PostgreSQL adapter、事务、查询和迁移 | [服务指南](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/README.md#database) |
 | `services/core/tests/integration` | 共同驱动 HTTP 边界、执行 Worker 和 PostgreSQL adapter 的测试 | [服务指南](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/README.md#tests) |
 | `services/core/internal/execution` | 持久化 Turn 分发与调度 | [Runtime 协议](runtime-protocol.md) |
-| `services/core/internal/engine` | 对 Harness 操作与执行位置进行纯资格验证 | [Harness 接入](../../contracts/agents-api/zh/harness-onboarding.md) |
+| `internal/harnessconfig` | 每个 Harness 一份声明，由 Core 准入和 Runtime 共同读取 | [Harness 协议](../../contracts/agents-api/zh/harness-onboarding.md) |
 | `internal/agentdaemon/proto` | Core–Runtime wire 类型与验证器 | [Runtime 协议](runtime-protocol.md) |
 | `internal/runtimebootstrap` | 提供商到 Runtime 的启动输入 | [Runtime 引导](runtime-bootstrap.md) |
 | `apps/daemon/internal/dispatch` | Runtime 准备、Executor 复用、Turn 和清理所有权 | [Harness 生命周期](../../contracts/agents-api/zh/harness-onboarding.md#required-adapter-interfaces) |
 | `apps/daemon/internal/agent` | 原生 Harness adapter | [原生参考](../../contracts/agents-api/zh/harness-onboarding.md#native-references) |
-| `services/core/internal/sandbox` | 提供商接口与托管计算资源生命周期 | [提供商接入](sandbox-provider.md) |
+| `services/core/internal/sandbox` | 提供商接口与托管计算资源生命周期 | [沙箱提供商协议](sandbox-provider.md) |
 | `services/web` | 控制台登录与服务端管理代理 | [控制台服务端](web/console-server.md) |
 | `apps/web` 和 `packages/agents-client` | 控制台 UI 与类型化 client | [Web 指南](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/web/README.md) |
-| `deploy` 和 `scripts` | 发行、安装和验证工具 | [维护者指南](maintainers.md) |
-| `contracts/agents-api` | 固定 schema、语义契约和覆盖台账 | [覆盖台账](../../contracts/agents-api/zh/index.md) |
+| `deploy` 和 `scripts` | 发行、安装和验证工具 | [构建并发布 OpenAgentCore](maintainers.md) |
+| `contracts/agents-api` | 固定 schema、语义契约和兼容性记录 | [OpenAI 兼容性](../../contracts/agents-api/zh/index.md) |
 
 ## 选择扩展边界 {#choose-an-extension-boundary}
 
@@ -139,12 +127,12 @@ Core 构建产物和输出目录设置见[独立 Core 构建](maintainers.md#sta
 | 公共 schema、Core 扩展或内部处理函数注解 | `make openapi`、`make check-openapi`；检查生成类型和三个命名空间的 schema |
 | 共享 Runtime 协议 | `make check-runtime-contract` |
 | 提供商集成 | `make check-sandbox-provider-contract` 和提供商的原生检查 |
-| Claude SDK bridge 与产物 | `make check-claude-sdk` |
+| Claude Code adapter 与产物 | `make check-claude-sdk` |
 | Web UI 与 client | `make check-web` |
-| 发行或安装器 | `make check-distribution` |
-| 文档 | `make check-names`；`make check-distribution` 验证 Markdown 链接与打包文档 |
+| 发行或安装程序 | `make check-distribution` |
+| 文档 | `make check-docs`（Markdown 链接与锚点），以及用于中文镜像的 `pnpm --dir website check-translations` |
 
-Fixture 浏览器验收使用 loopback 端口 18092 和 4174。并行验证时通过 `AGENTS_FIXTURE_PORT` 和 `AGENTS_WEB_PORT` 选择空闲端口。验证 worker 之间使用独立数据库、端口和容器。编译、fixture 成功和真实模型/提供商验收分别证明不同事实；应明确报告跳过或不可用的检查。验证后遵循[独立盲审工作流](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#review)。
+Fixture 浏览器验收使用 loopback 端口 18092 和 4174。并行验证时通过 `AGENTS_FIXTURE_PORT` 和 `AGENTS_WEB_PORT` 选择空闲端口。验证 worker 之间使用独立数据库、端口和容器。编译、fixture 成功和真实模型/提供商验收分别证明不同事实；应明确报告跳过或不可用的检查。验证后遵循[审查流程](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#review)。
 
 ## 修改文档 {#change-documentation}
 
diff --git a/docs/zh/examples.md b/docs/zh/examples.md
index 601436927..80b9fe13f 100644
--- a/docs/zh/examples.md
+++ b/docs/zh/examples.md
@@ -1,14 +1,10 @@
 ---
 title: "示例"
 source: docs/examples.md
-source_hash: 60a228b1b499d11f5f6f122a5e298962fcc9ced9777688f69f5078a2f5df4c9c
+source_hash: 9678dd4dd68c8b78151a441360adb3384542708ad981eb451d98732c4a4a7c58
 ---
 
-基于 [Agents API](api/public-agent-api.md)构建的完整应用。每个示例都使用项目 API 密钥连接真实的 Core 安装。
-
-| 示例 | 展示内容 |
-| --- | --- |
-| [Parsar Agent 工作台](#parsar-agent-workbench) | 产品 UI：模型、Skills、MCP、可复用 Agent，以及在任意 Runtime 上运行的 Session |
+基于 [Agents API 指南](api/public-agent-api.md)构建的完整应用，每个都使用项目 API 密钥连接真实的 Core 安装。
 
 ## Parsar Agent 工作台 {#parsar-agent-workbench}
 
@@ -25,15 +21,13 @@ source_hash: 60a228b1b499d11f5f6f122a5e298962fcc9ced9777688f69f5078a2f5df4c9c
 | 功能 | 使用的 API | 指南 | 代码 |
 | --- | --- | --- | --- |
 | 服务端密钥和请求头 | Bearer 密钥、`OpenAI-Beta`、路由允许列表 | [开始前](api/public-agent-api.md#before-you-start) | [`server.mjs`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/server.mjs) |
-| 带 Harness 和模型的 Agent | `x_agents_core.harness`、`model_provider` | [Core 扩展](api/public-agent-api.md#core-extensions-x-agents-core) | [`server/sessions.mjs`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/server/sessions.mjs) |
+| 带 Harness 和模型的 Agent | `x_agents_core.harness`、`model_provider` | [Core 扩展](api/public-agent-api.md#core-extensions) | [`server/sessions.mjs`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/server/sessions.mjs) |
 | 三种 Runtime 上的 Session | `openai_hosted`、`none`、带 `workspace_directory` 的 `self_hosted` | [创建 Session](api/public-agent-api.md#create-a-session) | [`server/sessions.mjs`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/server/sessions.mjs) |
 | 可在崩溃后恢复的 Session 创建 | `Idempotency-Key`、响应丢失后的恢复 | [幂等性](api/public-agent-api.md#idempotency) | [`server/sessions.mjs`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/server/sessions.mjs) |
 | 实时回复 | 事件流、文本增量、重连与状态协调 | [流式事件](api/public-agent-api.md#stream-events) | [`src/lib/live-session.ts`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/src/lib/live-session.ts) |
 | 后续输入与取消 | 带幂等键的输入事件 | [发送输入](api/public-agent-api.md#send-input) | [`src/Composer.tsx`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/src/Composer.tsx) |
 | 历史 | 分页读取 Turns 和 Items | [分页](api/public-agent-api.md#pagination) | [`src/lib/api.ts`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/src/lib/api.ts) |
 | Skills 和版本 | `/skills`、默认版本 | [Skills](api/public-agent-api.md#skills) | [`src/Skills.tsx`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/src/Skills.tsx) |
-| 连接自己的机器 | `x_agents_core.installation`、Environment 状态 | [自托管执行](getting-started/self-hosted.md) | [`src/ConnectMachine.tsx`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/src/ConnectMachine.tsx) |
-
-## 添加示例 {#add-an-example}
+| 连接自己的机器 | `x_agents_core.installation`、Environment 状态 | [运行自托管 Session](getting-started/self-hosted.md) | [`src/ConnectMachine.tsx`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/example/parsar/src/ConnectMachine.tsx) |
 
-在 `example/` 下创建目录，用 README 说明运行方式及展示的 API 功能，然后在本索引添加一行。遵循[应用示例边界](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#optional-application-example)。
+要贡献示例，请遵循[应用示例边界](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#optional-application-example)。
diff --git a/docs/zh/getting-started/index.md b/docs/zh/getting-started/index.md
index 5f4647628..00c3b446e 100644
--- a/docs/zh/getting-started/index.md
+++ b/docs/zh/getting-started/index.md
@@ -1,34 +1,27 @@
 ---
 title: "概览"
 source: docs/getting-started/index.md
-source_hash: 50f7acd140432ea6643dce0d3e8186812bf471f5aa844f7a7dde0d4f94bb9b56
+source_hash: d356cbd5268238500410b3152537c2d832e43aeda2310f183b5ab21055bd4618
 ---
 
-OpenAgentCore 在你自己的基础设施上运行 AI Agent，并提供 OpenAI Agents API。[架构概览](../architecture.md)介绍各个组成部分。根据你的角色选择指南。
+OpenAgentCore 在你自己的基础设施上运行 AI Agent，并提供 OpenAI Agents API。运维人员安装它并添加沙箱容量；应用开发者用官方 OpenAI SDK 调用它。[概念](../concepts.md)定义了它的术语，[架构](../architecture.md)展示了它的组成部分。
 
-## 运维人员 {#operators}
+## 运行安装 {#run-an-installation}
 
-运维人员安装 Core 和 Web、添加沙箱容量并签发项目 API 密钥。
+1. [安装 Core 和 Web](install.md)
+2. [配置公开地址](public-address.md)
+3. [选择沙箱提供商](sandbox-backends.md)，然后[设置工作区存储](workspace-storage.md)并[添加和管理节点](nodes.md)
+4. [运维](operations.md)和[故障排查](troubleshooting.md)
 
-| 指南 | 内容 |
-| --- | --- |
-| [安装 Core 和 Web](install.md) | 默认安装流程：从空白主机到第一个项目 API 密钥 |
-| [安装选项](install-options.md) | 安装参数、已有反向代理、离线主机 |
-| [节点](nodes.md) | 添加、修改、移除沙箱节点及排查问题 |
-| [运维](operations.md) | `oac` 命令、Core 密钥、备份、卸载、升级及问题排查 |
-| [配置参考](../configuration.md) | 所有设置、文件和环境变量 |
-| [Web 控制台](../web/index.md) | 控制台展示和管理的内容 |
+所有设置见[配置参考](../configuration.md)。管理员在 [Web 控制台](../web/index.md)中查看和管理安装。
 
-## 应用开发者 {#application-developers}
+## 构建应用 {#build-an-application}
 
-应用开发者使用项目 API 密钥调用 API，也可以在自己的机器上运行 Session。
+1. [运行第一个 Session](quickstart.md)
+2. [Agents API 指南](../api/public-agent-api.md)
+3. 在自己的机器上[运行自托管 Session](self-hosted.md)
+4. [示例](../examples.md)
 
-| 指南 | 内容 |
-| --- | --- |
-| [快速开始](quickstart.md) | 从项目 API 密钥到完成一个 Session |
-| [Agents API 指南](../api/public-agent-api.md) | 常见任务、Harness 与模型选择，以及各资源的 SDK 和 HTTP 示例 |
-| [自托管执行](self-hosted.md) | 在自己的机器上运行 Session |
-| [示例](../examples.md) | 基于 API 构建的完整应用 |
-| [API 索引](../api/index.md) | 三个命名空间及其凭据 |
+[API 命名空间和凭据](../api/index.md)列出三个 API 命名空间及各自使用的凭据。
 
-贡献者从[开发指南](../development.md)和 [CONTRIBUTING.md](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md)开始。
+贡献者请从[开发 OpenAgentCore](../development.md)和 [CONTRIBUTING.md](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md) 开始。
diff --git a/docs/zh/getting-started/install-options.md b/docs/zh/getting-started/install-options.md
index 515fa4855..5caa5b326 100644
--- a/docs/zh/getting-started/install-options.md
+++ b/docs/zh/getting-started/install-options.md
@@ -1,22 +1,48 @@
 ---
 title: "安装选项"
 source: docs/getting-started/install-options.md
-source_hash: a27a6f3c7c819690fa81d5ede14c80b93446ffea33781764272dc9bec58ea942
+source_hash: e3503e97930dc4d36f34411e5588d4b9c7102b15eeb14d3763a797c18081af2e
 ---
 
-[默认安装](install.md)无需任何选项。本页介绍安装选项、Compose 部署和反向代理配置。
+本页是安装程序参数的参考，并说明如何用默认方式以外的方式安装：在已有反向代理之后、在托管平台上使用 Docker Compose，或在无法访问互联网的主机上。[默认安装](./install.md)无需任何选项。
 
-向下载的脚本传递选项：
+## 传入参数 {#pass-flags}
 
-```sh
-./install.sh --public-url https://core.example
+::: code-group
+
+```sh [macOS / Linux]
+curl -fsSL https://openagentcore.dev/install.sh | bash -s -- --public-url https://core.example
+```
+
+```powershell [Windows]
+& ([scriptblock]::Create((irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1))) --public-url https://core.example
 ```
 
-Windows 上 `irm … | iex` 无法传参，默认执行策略也会拦截下载的 `.ps1` 文件，因此以脚本块运行：`& ([scriptblock]::Create((irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1))) --public-url https://core.example`。Unix 单行命令的参数追加在 `bash -s --` 后。`--version TAG` 选择已发布的版本；默认选择最新稳定版，并校验原生命令和 Compose 文件的 SHA-256。
+:::
+
+Windows 上 `irm … | iex` 无法传参，默认执行策略也会拦截下载的 `.ps1` 文件，因此以脚本块运行脚本。除非传入 `--version`，脚本会选择最新稳定版，并校验原生命令和 Compose 文件的 SHA-256。
+
+## 参数 {#flags}
+
+| 参数 | 默认值 | 写入 `.env` 的变量 | 作用 |
+| --- | --- | --- | --- |
+| `--public-url` | 由主机的私网地址推导，或 `http://localhost:<web port>`；参阅[选择公开 URL](./public-address.md#choose-the-public-url) | `OAC_PUBLIC_URL` | 应用、节点和执行器使用的源地址 |
+| `--host` | `0.0.0.0` | `OAC_HOST` | Web 绑定的地址；参阅[监听器与访问](./public-address.md#listeners-and-access) |
+| `--web-port` | `8080` | `OAC_WEB_PORT` | Web 的主机端口；参阅[端口](./public-address.md#ports) |
+| `--install-dir` | `~/.oac/core` | | 绝对安装目录。新安装使用空目录或不存在的目录；[重试](./install.md#install)时使用已有安装目录 |
+| `--version` | `latest` | | 已发布的版本标签 |
+
+映射到 `.env` 的参数只会写入一次。安装完成后，编辑该文件并运行 `oac apply`。对已有安装重新运行安装程序时，这些参数会被忽略，安装程序会指出与已保存设置不同的参数，并以已保存的设置启动。
+
+只要使用不同的安装目录和端口，多个安装就可以共用一台机器。需要更多安装时，请使用不同的 IP 地址或共享反向代理。每个安装都有自己的数据库、Core 密钥和节点。
+
+## 反向代理与 HTTPS {#reverse-proxy-and-https}
+
+请用 `--host 127.0.0.1` 安装，把反向代理指向 Web，并把 `--public-url` 设为它的 HTTPS 源地址。代理要求、Caddy 和 nginx 示例、路由检查，以及 `--host`、`--web-port` 和端口检查，见[配置公开地址](./public-address.md#https-and-the-reverse-proxy)。
 
 ## Docker Compose 与托管平台 {#docker-compose-and-hosting-platforms}
 
-在任一[支持的 Core 主机](install.md#prerequisites)上使用发行版中的 `compose.yaml`。发行流程会固定初始化、Core、Web 和 PostgreSQL 镜像及源码版本。PostgreSQL 16 使用官方镜像，按摘要固定，并与其他镜像一起镜像到 GHCR。它会启动 PostgreSQL、Core 和 Web。Web 把 `/v1` 和 `/api/v1` 转发到 Core。数据保存在 Docker 命名卷中。一次性初始化服务会在该目录中生成随机机密信息并准备节点安装程序；Core 启动时执行数据库迁移。[Compose 配置](../configuration.md#compose-installations)负责管理各项设置和数据目录。
+在任一[支持的 Core 主机](./install.md#prerequisites)上使用发行版中的 `compose.yaml`。发行流程会固定初始化、Core、Web 和 PostgreSQL 镜像及源码版本。PostgreSQL 16 使用官方镜像，按摘要固定，并与其他镜像一起镜像到 GHCR。它会启动 PostgreSQL、Core 和 Web。数据保存在 Docker 命名卷中。一次性初始化服务会在该卷中生成随机机密信息并准备节点安装程序；Core 启动时执行数据库迁移。[Compose 配置](../configuration.md#compose-installations)负责管理各项设置和数据目录。
 
 进行本地试用时，请将发行版的 `compose.yaml` 下载到一个空目录，然后运行：
 
@@ -33,109 +59,56 @@ docker compose exec web oac-web core-key
 
 ### Dokploy {#dokploy}
 
-创建一个 Docker Compose 应用并粘贴 `compose.yaml`。将 `OAC_PUBLIC_URL` 设置为公共 HTTPS 源地址，启用隔离部署，并为 `web` 服务添加域名和端口 `8080`。部署前，为此域名启用 **HTTPS**，并选择 **Let's Encrypt** 等证书提供程序。部署前移除 `web` 服务的 `ports` 块，让 Dokploy 路由到容器端口，而不发布主机端口。将此 Compose 文件打包到 Dokploy 模板目录时，[模板元数据](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/dokploy.toml)会提供生成的域名和环境；导入后仍需启用 HTTPS 及其证书提供程序。
-
-### Coolify {#coolify}
-
-创建一个 **Docker Compose Empty** 服务并粘贴 `compose.yaml`。将 `OAC_PUBLIC_URL` 设置为公共 HTTPS 源地址，并将该域名分配给 `web` 服务的端口 `8080`。将 Coolify 的 `exclude_from_hc: true` 添加到 `init` 的服务定义中，使已完成的初始化不会影响其总体健康状态。移除 `web` 服务的 `ports` 块，再保存并部署；Coolify 路由到容器端口并提供 HTTPS。
-
-在这两个平台上，打开服务器终端并运行 `docker compose ls`，查找已部署的项目名称和 Compose 文件。使用这些完全一致的值以及该部署的 `OAC_PUBLIC_URL`，运行 `docker compose -p <project-name> -f <compose-file> exec web oac-web core-key`，然后在已配置的源地址登录。[Dokploy 域名指南](https://docs.dokploy.com/docs/core/docker-compose/domains)和[Coolify Compose 指南](https://coolify.io/docs/services/configuration/docker-compose)介绍了各自的域和服务控制项。这些都是可导入的部署文件；本仓库不发布托管市场条目。
-
-登录后，使用 [Nodes](nodes.md)选择沙箱提供商并添加节点。Compose 堆栈部署控制平面；执行机器仍需单独部署。
-
-使用相同的文件和环境运行 `docker compose stop` 以停止服务。停止服务后，一并备份数据卷和配置。升级时先备份，再使用相同的项目、环境和数据卷部署新版本的 `compose.yaml`：初始化会升级数据卷，Core 会迁移数据库。[升级](operations.md#upgrade)说明会保留哪些内容，以及为何拒绝较旧的版本。
-
-## 进程设置 {#process-settings}
-
-这些标志只会一次性写入 `.env`。安装完成后，编辑该文件并运行 `oac apply`。对已有安装重新运行安装程序时，这些标志会被忽略，安装程序会指出与已保存设置不同的标志，并以已保存的设置启动。
-
-以下表格是由脚本自动生成的参考信息，因此保留为英文原文：
-| Flag | `.env` variable |
-| --- | --- |
-| `--public-url` | `OAC_PUBLIC_URL` |
-| `--host` | `OAC_HOST` |
-| `--web-port` | `OAC_WEB_PORT` |
-
-## 安装操作 {#installation-actions}
-
-`--install-dir` 选择安装目录。这两个选项都不是进程设置。
+1. 创建一个 Docker Compose 应用并粘贴 `compose.yaml`。
+2. 将 `OAC_PUBLIC_URL` 设置为公共 HTTPS 源地址，并启用隔离部署。
+3. 为 `web` 服务添加域名，端口 `8080`。为该域名启用 **HTTPS**，并选择 **Let's Encrypt** 等证书提供程序。
+4. 移除 `web` 服务的 `ports` 块，让 Dokploy 路由到容器端口，而不发布主机端口。
+5. 部署。
 
-| 选项 | 用途 |
-| --- | --- |
-| `--install-dir DIR` | 绝对安装目录；默认为 `~/.oac/core`。新安装使用空目录或不存在的目录；[重试](install.md#install)或升级时使用已有安装目录 |
-| `--upgrade` | 将 `--install-dir` 中的已有安装升级到安装程序所属的版本；参见[升级](operations.md#upgrade) |
+将此 Compose 文件打包到 Dokploy 模板目录时，[模板元数据](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/dokploy.toml)会提供生成的域名和环境；导入后仍需启用 HTTPS 及其证书提供程序。
 
-只要使用不同的安装目录和端口，多个安装就可以共用一台机器。需要更多安装时，请使用不同的 IP 地址或共享反向代理。每个安装都有自己的数据库、Core 密钥和节点。
-
-## 沙箱提供商 {#sandbox-backend}
-
-安装程序不保存沙箱提供商。登录后，打开 **设置** → **沙箱与调度**，选择 Docker、microsandbox 或 E2B；Web 会把 [提供商声明的默认大小](../sandbox-provider.md#register-the-provider-kind)推荐为 Standard 尺寸。该选择保存在 Core 的数据库中。以后要更改，请[重置部署](nodes.md#change-the-sandbox-configuration)。Docker 沙箱与每个节点共用该节点的内核，其节点服务账户[等效于 root](nodes.md#what-the-installer-sets-up)。E2B 需要一个非回环的公共 HTTPS URL，因为 E2B 沙箱会从 E2B 云端调用 Core。按照 [E2B 指南](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/e2b/README.md)准备模板。
-
-## 监听器与访问 {#listeners-and-access}
-
-默认安装在 `--host 0.0.0.0` 的 `--web-port`（8080）上发布 Web。Core 和 PostgreSQL 保持私有。`--host` 是不含端口、协议或区域的 IPv4 或 IPv6 地址。请在浏览器中使用服务器的具体 IP，而不是通配地址。
-
-`--public-url` 设置 `OAC_PUBLIC_URL`，即应用、节点和执行器使用的源地址。使用反向代理时，把它设为代理提供的 HTTPS 源地址。未传入时，如果 `--host` 为 `0.0.0.0` 且主机默认路由的源地址是私有网络地址，安装程序使用 `http://<address>:<web port>`，否则使用 `http://localhost:<web port>`。可接受的源地址见[修改公开 URL](../configuration.md#changing-the-public-url)。
-
-### 端口 {#ports}
-
-安装程序在下载镜像之前检查 `--web-port`。
-
-- `--host` 是该端口绑定的地址。`0.0.0.0` 在所有 IPv4 接口发布 Web。`127.0.0.1` 只在本机发布 Web。
-- 端口被占用时安装停止，不会改用其他端口。
-
-`OAC_HOST` 或 `OAC_WEB_PORT` 变化时，`oac apply` 会重新创建 Web。
+### Coolify {#coolify}
 
-## HTTPS 与反向代理 {#https-and-the-reverse-proxy}
+1. 创建一个 **Docker Compose Empty** 服务并粘贴 `compose.yaml`。
+2. 将 `OAC_PUBLIC_URL` 设置为公共 HTTPS 源地址，并将该域名分配给 `web` 服务的端口 `8080`。
+3. 将 Coolify 的 `exclude_from_hc: true` 添加到 `init` 的服务定义中，使已完成的初始化不会影响其总体健康状态。
+4. 移除 `web` 服务的 `ports` 块，再保存并部署。Coolify 路由到容器端口并提供 HTTPS。
 
-请用 `--host 127.0.0.1` 安装，并把反向代理指向 Web，默认是 `127.0.0.1:8080`。Web 把 `/v1`、`/api/v1` 和 `/docs` 转到 Core，其余由自己提供。
+在这两个平台上，打开服务器终端并运行 `docker compose ls`，查找已部署的项目名称和 Compose 文件。使用这些完全一致的值以及该部署的 `OAC_PUBLIC_URL`，运行 `docker compose -p <project-name> -f <compose-file> exec web oac-web core-key`，然后在已配置的源地址登录。[Dokploy 域名指南](https://docs.dokploy.com/docs/core/docker-compose/domains)和 [Coolify Compose 指南](https://coolify.io/docs/services/configuration/docker-compose)介绍了各自的域名和服务控制项。
 
-反向代理必须：
+登录后，[选择沙箱提供商](./sandbox-backends.md)，并按[添加和管理节点](./nodes.md)添加节点。Compose 堆栈部署控制平面；执行机器仍需单独部署。
 
-- **保留 Host。** Web 仅接受 `OAC_PUBLIC_URL` 中的主机。
-- **传递 WebSocket 升级请求**，包括 `/api/v1` 上的升级请求。
-- **不对流进行缓冲或设置超时。** `/v1` 会流式传输 Session 事件。
-- **接受大文件上传。** 源文件最大可达 512 MiB；具体限制由 Core 执行。
+使用相同的文件和环境运行 `docker compose stop` 以停止服务。停止服务后，一并备份数据卷和配置。要换到另一个版本，请连同数据卷一起移除该栈（`docker compose down --volumes`），然后部署新版本。
 
-按照默认配置，让网关在回环地址上监听，并在 Core 主机上运行反向代理。
+## 离线主机 {#offline-hosts}
 
-**Caddy** 会自行获取证书，默认传递 Host 并支持 WebSockets：
+安装程序使用当前 shell 的网络设置（包括 `HTTPS_PROXY`）从 GitHub Releases 下载发行文件。Docker 通过其守护进程拉取镜像，守护进程不读取 shell 的代理变量。所有镜像（包括 PostgreSQL）都来自 GHCR（`ghcr.io`），不需要 Docker Hub。如果只能经代理或镜像加速器访问 GHCR，请配置[守护进程代理](https://docs.docker.com/engine/daemon/proxy/)或[镜像加速器](https://docs.docker.com/docker-hub/image-library/mirror/)，然后重新运行安装程序。
 
-```caddyfile
-core.example {
-	reverse_proxy 127.0.0.1:8080
-}
-```
+无法访问这些地址的 Linux amd64 主机可使用发行资产 `oac-<commit>-linux-amd64-offline.tar.gz` 安装，其中包含所有镜像、节点制品和包含全部 Harness 的 Linux amd64 自托管安装程序。macOS 和 Windows 上的自托管机器从 GitHub Releases 下载各自的安装程序。将其复制到该主机并解压，然后用 Python 3.9 或更高版本和 Docker 运行其中的 `install.py`。该主机上不需要检出代码、Go、Node 或 pnpm。安装完成前请保留解压后的安装包；之后已安装的服务和节点下载不再依赖它原来的位置。[开发 OpenAgentCore](../development.md#install-a-checkout-without-publishing-a-release)从检出代码构建的就是同一个归档。
 
-然后在 `~/.oac/core/.env` 中设置 `OAC_PUBLIC_URL=https://core.example`，并运行 `~/.oac/core/oac apply`。检查路由：
+### `install.py` 选项 {#install-py-options}
 
 ```sh
-curl -s -o /dev/null -w '%{http_code}\n' -H 'OpenAI-Beta: agents=v1' https://core.example/v1/agents
+python3 oac-<commit>-linux-amd64/install.py --install-dir "$HOME/.oac/local" --host 0.0.0.0 --public-url http://YOUR_CORE_HOST:8080
 ```
 
-`401` 表示 `/v1` 已到达 Core，Core 正在要求提供密钥。`404` 表示请求已到达 Web：请修复反向代理，否则应用调用和每个节点连接都会失败。
+| 选项 | 默认值 | 作用 |
+| --- | --- | --- |
+| `--install-dir` | `~/.oac/local` | 绝对安装目录 |
+| `--host` | `127.0.0.1` | Web 绑定的地址。与 `oac install` 不同，`install.py` 默认使用回环地址：需要从其他机器访问时传入 `0.0.0.0` |
+| `--web-port` | `8080` | Web 的主机端口 |
+| `--public-url` | | 浏览器和节点使用的源地址。新安装必须提供 |
 
-所有位置都必须保持启用 TLS 验证。使用私有证书颁发机构时，节点主机、自托管机器和 Runtime 镜像必须信任该机构。
+将 `YOUR_CORE_HOST` 替换为浏览器和沙箱节点都能访问的地址，或在反向代理之后使用你的 HTTPS 源地址。新安装会打印 Core 密钥；重新运行则打印显示它的命令。该安装是标准的 Compose 安装，外加一个只读的 `node-payload` 目录，其中保存安装包的公开节点制品。请为解压后的安装包和已安装的副本都预留磁盘空间。
 
-### 使用快速隧道进行本地试用 {#try-it-locally-with-a-quick-tunnel}
+在其安装目录上重新运行同一安装包的 `install.py`，会以已保存的设置继续安装。来自其他提交的安装包会拒绝已有安装。如果新安装在启动服务之前失败，它会保持安装目录原样；修复原因后重新运行同一命令。
 
-[Cloudflare 快速隧道](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/)会为使用外部入口的试用安装提供一个临时公共 HTTPS 地址。它只会转发到一个端口，因此需要在前面放置一个具有相同路由的本地代理：
+启动失败或安装中断时，使用已保存的配置，而不是重新安装：
 
-```caddyfile
-http://:8443 {
-	bind 127.0.0.1
-	reverse_proxy 127.0.0.1:8080
-}
+```sh
+cd "$HOME/.oac/local"
+docker compose logs --tail 100
+# Retry without downloading release images or replacing saved configuration.
+docker compose up -d --wait --pull never
+./oac core-key --show
 ```
-
-1. 启动代理：`caddy run --config Caddyfile`。
-2. 启动隧道：`cloudflared tunnel --url http://127.0.0.1:8443`。它会打印一个地址，例如 `https://random-words.trycloudflare.com`。
-3. 在 `~/.oac/core/.env` 中将该地址设置为 `OAC_PUBLIC_URL`，并运行 `~/.oac/core/oac apply`。
-
-每当 `cloudflared` 重启时，该地址都会改变；随后必须重新添加绑定到旧地址的节点。吞吐量较低，因此节点首次下载 Runtime（约 500 MB）时可能很慢；请参阅[慢速链接](nodes.md#rerun-expiry-and-slow-links)。
-
-## 离线主机 {#offline-hosts}
-
-安装程序使用当前 shell 的网络设置（包括 `HTTPS_PROXY`）从 GitHub Releases 下载发行文件。Docker 通过其守护进程拉取镜像，守护进程不读取 shell 的代理变量。所有镜像（包括 PostgreSQL）都来自 GHCR（`ghcr.io`），不需要 Docker Hub。如果只能经代理或镜像加速器访问 GHCR，请配置[守护进程代理](https://docs.docker.com/engine/daemon/proxy/)或[镜像加速器](https://docs.docker.com/docker-hub/image-library/mirror/)，然后重新运行安装程序。
-
-无法访问这些地址的 Linux amd64 主机可使用发行资产 `oac-<commit>-linux-amd64-offline.tar.gz` 安装，其中包含所有镜像和节点制品。将其复制到该主机并解压，然后用 Python 3.9 或更高版本运行其中的 `install.py`；[源码安装](../development.md#install-a-checkout-without-publishing-a-release)介绍其选项。
diff --git a/docs/zh/getting-started/install.md b/docs/zh/getting-started/install.md
index 88216b03f..ec3f614c2 100644
--- a/docs/zh/getting-started/install.md
+++ b/docs/zh/getting-started/install.md
@@ -1,78 +1,74 @@
 ---
 title: "安装 Core 和 Web"
 source: docs/getting-started/install.md
-source_hash: 5589a96a188bc9d778f5bebf8cab78db7f9fbebffb1656a0b91001ac05f31d95
+source_hash: ec59f9762d21e486cf84108e4dda087c9640095196527bb8059c6833279df8ec
 ---
 
-一条命令即可在 Linux、macOS 或 Windows 上安装 Core、Web 控制台和 PostgreSQL。用 Core 密钥登录 Web，设置默认模型并签发项目 API 密钥。应用使用这些密钥调用 Core。Session 在你添加的节点上的沙箱中运行，也可以在 E2B 上运行。
+本指南带运维人员从一台空主机到可用的安装：在 Docker 下运行的 Core、Web 控制台和 PostgreSQL，一个沙箱提供商，一个默认模型和第一个项目 API 密钥。Web 的 **概览** 通过 **新手引导** 清单跟踪同样的步骤。
 
 1. [检查前置条件](#prerequisites)。
 2. [运行安装程序](#install)。
 3. [登录 Web](#sign-in-to-web)。
-4. [配置公开地址](#configure-the-domain-and-https)。
+4. [添加沙箱容量](#add-sandbox-capacity)。
 5. [设置默认模型](#set-a-default-model)。
 6. [签发项目 API 密钥](#issue-a-project-api-key)。
-7. [添加沙箱容量](#add-sandbox-capacity)。
 
-本页介绍默认流程。完整参数、已有反向代理和离线主机请参阅[安装选项](install-options.md)。
+全部安装程序参数、已有反向代理和离线主机见[安装选项](./install-options.md)。
 
 ## 前置条件 {#prerequisites}
 
-- Linux amd64/arm64 或 macOS Intel/Apple Silicon，需安装 curl；Windows x64 需 PowerShell。
-- Docker Engine 26 或更高版本，以及 Docker Compose 2.26.0 或更高版本。macOS 和 Windows 使用已启动的 Docker Desktop，并选择 Linux 容器。
-- 能运行 `docker` 并向自己的主目录写入文件的账号。在 Linux 上，将该账号加入 `docker` 组后重新登录，或使用 rootless Docker。始终以该账号运行安装程序和 `oac`，不要使用 `sudo`：`sudo` 运行会在 `~/.oac` 中留下属于 root 的文件，导致之后的运行失败。
-- Docker 守护进程能访问容器注册表；守护进程不使用当前 shell 的代理变量。参阅[离线主机](install-options.md#offline-hosts)。
-- Web 的 8080 端口空闲。参阅[端口](install-options.md#ports)。Docker 必须能发布该端口；安装程序不会修改主机策略。
-- 本机以外的访问要求 `OAC_PUBLIC_URL` 就是浏览器、节点和执行器使用的地址。可以先在本机登录。
+| | Linux | macOS | Windows |
+| --- | --- | --- | --- |
+| 主机 | amd64 或 arm64，需安装 curl | Intel 或 Apple Silicon，需安装 curl | x64，需 PowerShell |
+| Docker | Docker Engine，已启动 | Docker Desktop，已启动 | Docker Desktop，运行 Linux 容器 |
+| 账号 | `docker` 组成员，或使用 rootless Docker | 你的用户 | 你的用户 |
 
-沙箱节点运行在 Linux amd64 上。在 macOS 或 Windows 上部署 Core 时，可连接 Linux 节点，或使用 E2B。
+- 所有平台都需要 Docker Engine 26 或更高版本，以及 Docker Compose 2.26.0 或更高版本。Docker Desktop 的版本需足够新，已包含它们。
+- Docker 守护进程能访问容器注册表。它不使用当前 shell 的代理变量，参阅[离线主机](./install-options.md#offline-hosts)。下载发行制品还需要能访问 GitHub。
+- 8080 端口空闲，且 Docker 能发布该端口，参阅[端口](./public-address.md#ports)。安装程序不会修改主机策略。
+
+> [!WARNING]
+> 以该账号运行安装程序和 `oac`，不要使用 `sudo`。`sudo` 运行会在 `~/.oac` 中留下属于 root 的文件，导致之后的运行失败。
 
 ## 安装 {#install}
 
-Linux 和 macOS：
+::: code-group
 
-```sh
+```sh [macOS / Linux]
 curl -fsSL https://openagentcore.dev/install.sh | bash
 ```
 
-该域名入口会下载并运行 GitHub 最新 Release 中的安装脚本，并透传所有参数。下载发行制品仍需能够访问 GitHub。
-
-Windows PowerShell：
-
-```powershell
+```powershell [Windows]
 irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1 | iex
 ```
 
-Windows 上传参的方式见[安装选项](./install-options.md)。
-
-绑定所有 IPv4 地址时，安装器会使用默认路由的私网地址；如果没有可用私网地址，则使用 `http://localhost:8080`。也可以通过 `--public-url` 指定可访问的源地址；如果已有反向代理，就使用它的 HTTPS 地址：
+:::
 
-```sh
-curl -fsSL https://openagentcore.dev/install.sh | bash -s -- --public-url https://core.example
-```
+安装程序检查 Docker 和端口，写入[安装目录](../configuration.md#installation-directory) `~/.oac/core`，其中包含 `.env` 和 `oac` 命令（Windows 为 `oac.exe`），然后启动服务。Web 在 8080 端口提供控制台，并[把 API 请求转发到 Core](./public-address.md#listeners-and-access)。下载和配置检查在创建安装目录之前完成，因此全新安装失败时不会留下任何文件。安装程序会打印控制台地址；仅在全新安装时打印 Core 密钥，重新运行则打印 `oac core-key --show`。
 
-脚本下载该发布版的 Compose 文件，校验 SHA-256，然后：
+控制台地址默认是本机默认路由上的私网 IP；没有时为 `http://localhost:8080`。浏览器必须打开这个确切的地址。要自行指定，例如已有反向代理的 HTTPS 地址，请传入 `--public-url`。Windows 上传参的方式见[传入参数](./install-options.md#pass-flags)。
 
-1. 检查 Docker 使用 Linux 容器、符合版本要求，并确认所选端口空闲；
-2. 准备[安装目录](../configuration.md#installation-directory) `~/.oac/core`，写入 `.env` 和原生 `oac` 命令（Windows 为 `oac.exe`）；
-3. 用 Docker Compose 启动服务。Web 在 8080 端口提供控制台，并把 `/v1`、`/api/v1` 和 `/docs` 转发到 Core。Core 和 PostgreSQL 不发布端口。
+::: code-group
 
-安装器会打印控制台地址；仅在全新安装时打印 Core 密钥，重新运行或升级则打印 `oac core-key --show`。控制台地址由安装器自行选定时，它还会提示浏览器必须打开的确切地址，以及如何用 `OAC_PUBLIC_URL` 修改。登录后，在 Web 中配置执行资源并创建项目。
-
-安装目录就位前，先完成下载和配置检查。之后的失败会保留配置与数据。被拒绝的设置或数据卷会单独报告，按提示修复即可。服务三分钟内未变为健康时，会列出这些服务和查看其日志的 `docker compose logs --tail 50` 命令；修复原因后重新执行同一命令。按 Ctrl-C 会打印 `Interrupted; rerun the installer to continue.`，安装保持可继续的状态。重新执行同一命令，或指定安装目录即可继续：
+```sh [macOS / Linux]
+curl -fsSL https://openagentcore.dev/install.sh | bash -s -- --public-url https://core.example
+```
 
-```bash
-curl -fsSL https://openagentcore.dev/install.sh | bash -s -- --install-dir "$HOME/.oac/core"
+```powershell [Windows]
+& ([scriptblock]::Create((irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1))) --public-url https://core.example
 ```
 
-如果使用了其他目录，请替换路径。重新执行时沿用已保存的 Compose 文件和设置；安装参数只对新目录生效，安装器会指出被忽略的参数。已有镜像和容器直接复用，缺失镜像会重新下载。修改设置请编辑 `.env` 并运行 `oac apply`。要换到更新的发布版本，请按[升级](operations.md#upgrade)操作。
+:::
+
+> [!TIP]
+> 可以放心重新运行。如果安装程序因检查失败、服务三分钟内未变为健康或按 Ctrl-C 而停止，修复提示信息所指的问题后重新执行同一命令。重新运行会保留配置和数据，并复用已有镜像。`--public-url`、`--host` 和 `--web-port` 只对全新安装生效；之后要修改它们，请编辑 `.env` 并运行 `oac apply`。在 Linux 和 macOS 上，启动脚本还会继续未完成的下载。[故障排查](./troubleshooting.md#installation)列出了这些提示信息。
 
-空间或配额不足时，请释放错误信息所指文件系统的空间。加载镜像失败还可能需要释放 Docker 存储空间，该存储可能位于另一个文件系统。
+要换到更新的发布版本，请重新安装：先[卸载](./operations.md#uninstall)现有安装，再运行安装程序。
 
 ## 登录 Web {#sign-in-to-web}
 
 1. 打开安装程序输出的控制台地址，即公开 URL。Web 只接受这个主机名。
-2. 使用 [Core 密钥](operations.md#core-key)登录，这是安装的管理员凭据。Web 没有用户账号。
+2. 使用 [Core 密钥](./operations.md#core-key)登录，这是安装的管理员凭据。Web 没有用户账号。
 
    ```sh
    ~/.oac/core/oac core-key --show
@@ -80,30 +76,32 @@ curl -fsSL https://openagentcore.dev/install.sh | bash -s -- --install-dir "$HOM
 
    Windows 使用 `& "$HOME/.oac/core/oac.exe" core-key --show`。各平台的命令参数相同。
 
-## 配置公开地址 {#configure-the-domain-and-https}
-
-应用、节点和沙箱通过同一个地址访问 Core，即公开 URL。局域网上用 HTTP 即可。对外暴露时，在前面放反向代理，并把公开 URL 设为它提供的 HTTPS 源地址。E2B 客户机从互联网访问 Core，因此需要非回环的公开 URL。
+## 添加沙箱容量 {#add-sandbox-capacity}
 
-1. 把反向代理指向 Web。
-2. 把 `OAC_PUBLIC_URL` 设为反向代理提供的 HTTPS 源地址，然后运行 `oac apply`。见[修改公开 URL](../configuration.md#changing-the-public-url)。
+安装程序不选择沙箱提供商。请[选择沙箱提供商](./sandbox-backends.md)：在自有 Linux 节点上运行 microsandbox，并使用[设置工作区存储](./workspace-storage.md)中的工作区存储，是推荐的自管部署；E2B 不需要节点。应用也可以在自己的机器上运行[自托管 Session](./self-hosted.md)。
 
 ## 设置默认模型 {#set-a-default-model}
 
-没有自带模型提供商的 Core 托管 Session 使用其 Harness 的默认模型。在 **设置 → 模型与凭据** 的 **默认模型配置** 下，找到标记为 **默认** 的 Harness（除非修改了 `OAC_DEFAULT_HARNESS`，否则为 Codex），它显示 **未设置模型提供商**。选择 **设置**，输入模型 ID、协议以及提供商的基础 URL 和 API 密钥。MiniMax Code 还需要上下文窗口和最大输出 token 数。之后该 Harness 显示 **就绪**。参阅[默认模型](../configuration.md#default-models)。
+没有自带模型提供商的 Core 托管 Session 使用其 Harness 的默认模型。参阅[默认模型](../configuration.md#default-models)。
+
+1. 打开 **设置 → 模型与凭据**。在 **默认模型配置** 下，标记为 **默认** 的 Harness 显示 **未设置模型提供商**。除非修改了 `OAC_DEFAULT_HARNESS`，否则为 Codex，参阅[设置](../configuration.md#settings)。
+2. 选择 **设置**，输入模型 ID、协议以及提供商的基础 URL 和 API 密钥。
+3. 保存。该 Harness 显示 **就绪**。
 
 ## 签发项目 API 密钥 {#issue-a-project-api-key}
 
 1. 在 **项目与密钥** 中选择 **创建项目**，然后选择 **签发密钥**。对话框只显示一次密钥：复制并妥善保存。**如何调用** 卡片展示 API 基础 URL 和示例请求。
-2. 将密钥和 API 基础 URL 交给应用开发者，他们可以继续阅读[快速开始](quickstart.md)。
-
-Web 的 **概览** 通过 **新手引导** 清单跟踪这些步骤。
+2. 将密钥和 API 基础 URL 交给应用开发者，他们可以继续阅读[运行第一个 Session](./quickstart.md)。
 
-## 添加沙箱容量 {#add-sandbox-capacity}
+## 从其他机器访问 Core {#configure-the-domain-and-https}
 
-安装程序不选择沙箱提供商。根据你的基础设施选择部署方案：
+在一台机器上试用时，此步骤可选。应用、节点和沙箱通过同一个地址访问 Core，即公开 URL。局域网上用 HTTP 即可；超出局域网时，在前面放反向代理，并把公开 URL 设为它提供的 HTTPS 源地址。反向代理、端口以及之后如何修改地址，见[配置公开地址](./public-address.md)。
 
-- **推荐：microsandbox 配合独立工作区存储。** 先准备 [NFS 文件系统和服务账户](../configuration.md#independent-workspace-storage)，再在 **设置** → **沙箱与调度** 选择 **自有机器** 和 **microsandbox**，通过 **节点** [添加 Linux 节点](./nodes.md)。[节点指南](./nodes.md#before-you-add-a-node)同时说明了跨兼容节点恢复内存所需的私有检查点存储。
-- **托管计算：E2B。** 在同一个沙箱配置流程中选择 E2B 并配置凭据和模板。不需要执行节点；参阅[部署设置](../../../contracts/agents-api/zh/sandbox-deployment.md#initial-setup-and-same-provider-changes)。
-- **其他支持的执行位置。** Docker 节点仍然可用，应用也可以连接[自托管机器](./self-hosted.md)。[提供商对照表](../../../contracts/agents-api/zh/sandbox-deployment.md#what-each-field-means-per-sandbox-provider)区分各方案的文件系统和挂起支持。
+## 后续步骤 {#next-steps}
 
-日常操作、备份和升级见[运维](operations.md)。
+| 下一步 | 位置 |
+| --- | --- |
+| 发起 API 调用 | [运行第一个 Session](./quickstart.md) |
+| 添加 Linux 节点 | [添加和管理节点](./nodes.md) |
+| 备份和卸载 | [运维](./operations.md) |
+| 参数、Compose 和离线主机 | [安装选项](./install-options.md) |
diff --git a/docs/zh/getting-started/nodes.md b/docs/zh/getting-started/nodes.md
index e34723bd9..e59860b63 100644
--- a/docs/zh/getting-started/nodes.md
+++ b/docs/zh/getting-started/nodes.md
@@ -1,34 +1,43 @@
 ---
 title: "添加和管理节点"
 source: docs/getting-started/nodes.md
-source_hash: b6c4b068edb9c7ecd3b59e105ef77ea05d39e9b8a2eae90f0f2bbd30d826e3aa
+source_hash: fef6bd64da44efaa4ab1943901667c68c749790c36974ffb15b1b2845d62a7eb
 ---
 
-节点是一台 Linux 主机，在沙箱提供商为 microsandbox（推荐）或 Docker 时，为 Core 托管 Session 运行沙箱。Core 将新 Session 分配给有空余容量的节点；节点创建沙箱，沙箱回连 Core。E2B 不需要节点。应用为自己的 Session 连接的机器是[自托管执行器](self-hosted.md)，而不是节点。
+节点是一台 Linux 主机，为 Core 托管 Session 运行沙箱。本指南面向在沙箱提供商（参阅[选择沙箱提供商](./sandbox-backends.md)）为 microsandbox 或 Docker 时添加、修改和移除节点的运维人员；E2B 不需要节点。
 
-添加节点的方法是在 Web 生成命令并在主机上执行。[沙箱部署协议](../../../contracts/agents-api/zh/sandbox-deployment.md)定义沙箱设置及其变更规则，[节点协议](../../../contracts/agents-api/zh/node-generation-protocol.md)定义节点如何准备和保留 Runtime 代次。
+Core 将新 Session 分配给有空余容量的节点；节点创建沙箱，沙箱回连 Core。应用为自己的 Session 连接的机器是[自托管执行器](./self-hosted.md)，而不是节点。添加节点的方法是在 Web 生成命令并在主机上执行。[沙箱部署协议](../../../contracts/agents-api/zh/sandbox-deployment.md)定义沙箱设置及其变更规则，[节点协议](../../../contracts/agents-api/zh/node-generation-protocol.md)定义节点如何准备和保留 Runtime 代次。
 
 ## 添加节点前 {#before-you-add-a-node}
 
-- **Core 已有主机及沙箱可访问的公开 URL。** 节点从 Core 控制台下载文件，并通过 `public_url` 连接 Core。设置前，**添加节点** 显示 *添加节点前，请先设置其他机器能访问的公开地址。*参阅[配置公开地址](install.md#configure-the-domain-and-https)。
-- **沙箱配置已保存。** 打开 **设置** → **沙箱与调度**，选择 **自有机器**、沙箱提供商和沙箱规格，最后选择 **保存配置**。要更改沙箱提供商，先选择 **重置部署**。同一安装的所有节点使用同一沙箱提供商。
+- **沙箱配置已保存。** 打开 **设置** → **沙箱与调度**，选择 **自有机器**、沙箱提供商和沙箱规格，最后选择 **保存配置**；参阅[选择沙箱提供商](./sandbox-backends.md)。要更改沙箱提供商，先选择 **重置部署**。同一安装的所有节点使用同一沙箱提供商。
+- **Core 已有主机及沙箱可访问的公开 URL。** 节点从 Core 控制台下载文件，并通过 `public_url` 连接 Core。设置前，**添加节点** 显示 *添加节点前，请先设置其他机器能访问的公开地址。*参阅[配置公开地址](./public-address.md)。
 - **控制台能提供节点文件。** 节点从控制台下载 Runtime 和提供商文件；控制台缺少文件时重定向到发行下载地址。节点依据发行清单检查各文件的大小和 SHA-256。因此节点主机需要能访问发行下载地址。缺少文件时，**添加节点** 显示 *这个控制台没有 … 的节点文件。*
+- **主机满足下面的要求。**
+- **使用 microsandbox 时，** 此主机上用于工作区存储的 NFS 挂载已就绪；参阅[设置工作区存储](./workspace-storage.md)。节点随每次 binding 接收所选不可变文件系统配置；不要单独编写节点存储设置。
+- **microsandbox 跨节点检查点恢复，** 参阅[跨节点的检查点恢复](#checkpoint-recovery-across-nodes)。
 
 Core 主机与其他主机一样加入：要在它上面运行沙箱，将它添加为节点。
 
-microsandbox 跨节点检查点恢复要求在每个参与节点的安装命令加入 `--checkpoint-root /absolute/private/shared-store`。安装前将同一个私有 store 挂载到这些路径，并只允许 node 服务账户访问。默认使用节点本地私有 store，只支持在该节点恢复。检查点 store 独立于 workspace 存储，绝不能允许 guest 访问；[检查点转移契约](../sandbox-provider.md#checkpoint-transfer) 定义兼容性和保留要求。
-
-Microsandbox 的检查点执行兼容性包含主机内核和 CPU profile。因此，操作系统或 CPU profile 变化可能使保留的检查点不再兼容，甚至无法在原节点恢复。维护前，应为这些检查点保留具有匹配 execution class 且已就绪同一 generation 的节点；否则，相关请求会按[检查点保留策略](../sandbox-provider.md#checkpoint-transfer)等待。
+### 主机要求 {#host-requirements}
 
-对于使用独立工作区存储的 microsandbox，应在注册前完成此主机上的 [NFS 挂载和服务账户配置](../configuration.md#independent-workspace-storage)。节点随每次 binding 接收所选不可变文件系统配置；不要单独编写节点存储设置。
+- Linux amd64 和 systemd；Python 3.9+、`curl`、`sha256sum` 和 `flock`；root 或 sudo。
+- SELinux 不处于 enforcing 模式。安装程序不支持 enforcing SELinux 主机。
+- Docker：正在运行的 rootful Docker Engine，其 `/var/run/docker.sock` 套接字属于 `docker` 组，权限为 `0660`，并强制执行 CPU 和内存限制（cgroup v2）。
+- microsandbox：`/dev/kvm` 属于 `kvm` 组（硬件或嵌套虚拟化），并具有 microsandbox 链接的库（glibc）。
+- CPU 和内存至少足以运行一个所配置规格的沙箱；安装 Runtime 镜像期间约需 3 GB 空闲磁盘：下载的归档及其解包副本在导入完成前位于 `/var/lib/oac-node`，镜像本身在 Docker 存储或 microsandbox 存储中约占 1.5 GB。安装程序在下载前检查空间，并在导入后删除归档，因此节点最终只保留镜像和不足 0.2 GB 的程序。
+- 可通过公开 URL 访问控制台和 Core；沙箱也能访问 Core。
 
 ## 添加节点 {#add-a-node}
 
 1. 在 Web 打开 **节点**，选择 **添加节点**。
-2. 设置 **同时运行的沙箱**，使用 microsandbox 时还设置 **保留的沙箱**，即节点[容量](../configuration.md#node-capacity)。之后可以通过 **编辑节点** 修改。
+2. 保持 **推荐** 上限，或选择 **自定义** 并设置 **同时运行的沙箱**（使用 microsandbox 时还有 **保留的沙箱**），即节点[容量](../configuration.md#node-capacity)。**编辑节点** 会显示该主机的推荐值，并可通过 **使用推荐值** 填入。
 3. 选择 **生成命令** 并复制命令。命令仅注册一个节点、只能使用一次，且必须在 1 小时内执行；Web 显示倒计时，过期后提供 **生成新命令**。
 4. 在主机上执行。Web 跟踪节点从注册、连接到就绪的过程。
 
+> [!NOTE]
+> 注册令牌一次性使用，1 小时后过期，仅用于注册节点。安装程序只从标准输入接收它，拒绝环境变量中的令牌，因为 `sudo VAR=… python3` 会在 sudo 日志中记录它。启用了 `log_input` 的 sudoers 策略会记录标准输入，从而记录令牌。
+
 命令从你的控制台下载节点安装程序、检查 SHA-256，并使用一次性注册令牌运行它。安装程序下载节点文件并逐一对照发行清单验证、导入 Runtime 镜像、注册节点、启动服务，并等待 Core 报告节点已连接且就绪。程序不安装软件；前置条件缺失时，会在修改任何内容之前停止并输出一行提示。
 
 安装和移除节点需要 root。除非 shell 已是 root，Web 命令会使用 `sudo`。安装程序创建 `oac-node` 服务用户和系统服务；节点以该用户运行，而非 root。普通用户运行安装程序时，会在读取注册令牌或修改主机前失败。
@@ -43,15 +52,6 @@ Microsandbox 的检查点执行兼容性包含主机内核和 CPU profile。因
 
 安装程序逐阶段展示执行过程，Core 确认节点后展示状态与日志命令摘要。`export NO_COLOR=1` 禁用颜色；命令将其作为 `--no-color` 传过 sudo。程序不输出令牌。
 
-### 主机要求 {#host-requirements}
-
-- Linux amd64 和 systemd；Python 3.9+、`curl`、`sha256sum` 和 `flock`；root 或 sudo。
-- SELinux 不处于 enforcing 模式。安装程序不支持 enforcing SELinux 主机。
-- Docker：正在运行的 rootful Docker Engine，其 `/var/run/docker.sock` 套接字属于 `docker` 组，权限为 `0660`，并强制执行 CPU 和内存限制（cgroup v2）。
-- microsandbox：`/dev/kvm` 属于 `kvm` 组（硬件或嵌套虚拟化），并具有 microsandbox 链接的库（glibc）。
-- CPU 和内存至少足以运行一个所配置规格的沙箱；安装 Runtime 镜像期间约需 3 GB 空闲磁盘：下载的归档及其解包副本在导入完成前位于 `/var/lib/oac-node`，镜像本身在 Docker 存储或 microsandbox 存储中约占 1.5 GB。安装程序在下载前检查空间，并在导入后删除归档，因此节点最终只保留镜像和不足 0.2 GB 的程序。
-- 可通过公开 URL 访问控制台和 Core；沙箱也能访问 Core。
-
 ### 通过代理下载 {#download-through-a-proxy}
 
 执行生成的命令前，导出 `http_proxy`、`https_proxy` 和 `no_proxy`。大写的 `HTTP_PROXY`、`HTTPS_PROXY` 和 `NO_PROXY` 也支持；大小写同时设置时，小写优先，即使值为空。使用 HTTP 代理 URL，可包含 URL 编码的凭据，并在 `no_proxy` 中提供逗号分隔的排除主机。HTTPS 下载代理必须支持 CONNECT。
@@ -64,7 +64,7 @@ Microsandbox 的检查点执行兼容性包含主机内核和 CPU profile。因
 
 | 项目 | 详情 |
 | --- | --- |
-| 服务用户 | 系统用户 `oac-node`，主目录 `/var/lib/oac-node`，无登录 shell。已有账号的主目录相同且 shell 为 nologin 时会复用；其他名为 `oac-node` 的账号会被拒绝 |
+| 服务用户 | 系统用户 `oac-node`，UID 为 65532（与 Core 服务相同），主目录 `/var/lib/oac-node`，无登录 shell。已有账号的 UID、主目录都相同且 shell 为 nologin 时会复用；其他名为 `oac-node` 的账号会被拒绝。如果其他账号占用 UID 65532，安装程序会停止且不做任何更改 |
 | 用户组 | 拥有 `/var/run/docker.sock`（Docker）或 `/dev/kvm`（microsandbox）的组：仅 `docker` 或 `kvm` |
 | 服务 | `/etc/systemd/system/oac-node-<installation-id>.service`，root 所属的系统单元，使用 `User=oac-node`，开机启用。Core 无法访问时每 5 秒重启；Core 不再接受节点后永久停止 |
 | 节点状态 | `/var/lib/oac-node/.oac/nodes/<installation-id>/`：身份、配置和节点文件。microsandbox 在 `/var/lib/oac-node/.oac/m/` 保存镜像和沙箱 |
@@ -72,22 +72,22 @@ Microsandbox 的检查点执行兼容性包含主机内核和 CPU profile。因
 | Docker | 一次性导入 Runtime 镜像，以及网络 `oac-node-<installation-id>` |
 | microsandbox 网络策略 | 沙箱仅能访问 Core、主机上的 DNS 和公开地址：无入站连接、不可访问私有网络 |
 
-root 只准备账号、组和服务单元；其他操作（包括 Docker 网络）都以 `oac-node` 在没有终端的独立会话中执行。安装程序不安装 Docker、KVM 或软件包，不启动 Docker，不修改设备权限、sudoers、防火墙或 SELinux 设置，也不修改其他账号。
+root 只准备账号、组和服务单元；其他操作（包括 Docker 网络）都以 `oac-node` 在没有终端的独立会话中执行。安装程序不安装 Docker、KVM 或软件包，不启动 Docker，不修改设备权限、sudoers、防火墙或 SELinux 设置，也不修改其他账号。节点向外连接 Core；Core 不需要通过 SSH 或 Docker TCP 访问主机。
 
-**Docker 模式等同于 root 权限。** 加入 `docker` 组后，`oac-node` 以及任何能控制节点的主体，都可以在主机上执行 root 操作。容器共享主机内核，因此容器逃逸能访问主机。只在沙箱专用主机上添加 Docker 节点。microsandbox 节点只需要 `kvm` 组，每个沙箱运行在独立 microVM 中。
+> [!CAUTION]
+> Docker 模式等同于 root 权限。加入 `docker` 组后，`oac-node` 以及任何能控制节点的主体，都可以在主机上执行 root 操作，并且容器共享主机内核。只在沙箱专用主机上添加 Docker 节点。microsandbox 节点只需要 `kvm` 组，每个沙箱运行在独立 microVM 中。
 
-**microsandbox 拦截私有端点。** 沙箱无法访问位于私有地址的模型提供商或 MCP 服务器。沙箱的 DNS 查询发往主机 `/etc/resolv.conf` 中列出的域名服务器，DNS 重绑定保护会丢弃任何包含私有地址的应答；因此，这些域名服务器解析为私有地址的域名在沙箱中完全无法解析，即使它是公开服务，例如云 VPC 解析器后的模型 API。Harness 停止重试后，Turn 随即失败。通过安装程序添加的节点没有更改此行为的设置。请让这些域名服务器返回该服务的公开地址；microsandbox 不读取主机的 `/etc/hosts`，因此只有当 `/etc/resolv.conf` 指向会读取该文件的本地 stub 解析器（例如位于 `127.0.0.53` 的 systemd-resolved）时，在其中添加条目才有效。否则，可以使用不过滤沙箱流量的 Docker 节点，或[手动注册节点](#register-a-node-manually)，在 `network` 策略中为该私有网段添加不带端口的允许规则，因为重绑定保护忽略带端口的规则。
+> [!WARNING]
+> microsandbox 沙箱无法访问私有地址；参见[沙箱无法访问私有端点](./troubleshooting.md#sandboxes-cannot-reach-a-private-endpoint)。
 
 **每台主机只服务一个 Core。** 节点共享 `oac-node` 账号，因此主机只服务一个 Core；第二个 Core 的命令会被拒绝。
 
-**节点程序。** 节点保留添加它的控制台所提供的主机程序；升级 Core 不会替换它。更改节点协议的版本会列出所需操作；参阅[协议变更](operations.md#protocol-changes)。
-
-**令牌。** 令牌仅用于注册节点，一次性使用，1 小时后过期。安装程序只从标准输入接收它，拒绝环境变量中的令牌，因为 `sudo VAR=… python3` 会在 sudo 日志中记录它。启用了 `log_input` 的 sudoers 策略会记录标准输入，从而记录令牌。
+**节点程序。** 节点运行添加它的安装所提供的主机程序和 Runtime。另一个安装的命令在该主机上会被拒绝，直到你[移除节点](#remove-a-node)后重新添加。
 
 ## 重新运行、过期与慢速网络 {#rerun-expiry-and-slow-links}
 
-- 重新执行同一命令是安全的。节点注册后，重新运行使用节点自身凭据，不改变已匹配的内容，也无需令牌。以下情况程序不做任何修改并说明原因：保留的节点身份属于其他 Core 地址或安装；节点注册后沙箱配置发生变化（节点会自行准备，参阅[修改沙箱配置](#change-the-sandbox-configuration)）；或 Core 已升级、提供了更新的节点程序，此时在 **节点** 选择 **移除节点**，在主机上卸载该节点，再通过 **添加节点** 重新添加。
-- 节点注册前失败的运行不会在 Core 留下任何记录。下一条命令即使在配置变更或 Core 升级之后执行，也会替换上次尝试的配置和不再匹配的已下载文件，保留匹配的文件并继续。
+- 重新执行同一命令是安全的。节点注册后，重新运行使用节点自身凭据，不改变已匹配的内容，也无需令牌。以下情况程序不做任何修改并说明原因：保留的节点身份或节点程序属于其他 Core 地址或安装；或节点注册后沙箱配置发生变化（节点会自行准备，参阅[修改沙箱配置](#change-the-sandbox-configuration)），此时在 **节点** 选择 **移除节点**，在主机上卸载该节点，再通过 **添加节点** 重新添加。
+- 节点注册前失败的运行不会在 Core 留下任何记录。下一条命令即使在配置变更之后执行，也会替换上次尝试的配置和不再匹配的已下载文件，保留匹配的文件并继续。
 - 已过期或已在其他主机使用的命令立即失败，显示 `The enrollment command expired or was already used`：生成新命令并在 1 小时内执行。
 - 慢速下载期间命令过期时，注册失败并显示 `The enrollment command expired or was already used`。下载文件保留：在 Web 生成新命令后执行，下载从中断处继续。
 - 每个文件都会显示进度。失败或中断时保留已收到的部分；重新执行时，每个未完成的文件从中断处继续（`Resuming …`），复用已校验的完整文件，其余照常下载。服务器不支持续传时，该文件从头开始。每分钟下载不足 64 KiB 时会停止，请检查网络后重新执行命令。
@@ -104,13 +104,18 @@ root 只准备账号、组和服务单元；其他操作（包括 Docker 网络
 
 沙箱设置适用于整个安装，节点跟随这些设置。
 
-- **规格、Runtime 版本、E2B 密钥或模板构建。** 打开 **设置** → **沙箱与调度** → **修改资源**，修改并保存。已有沙箱保持其配置。每个节点继续服务旧配置，同时准备新配置；**节点** 展示进度：**正在准备目标配置**、**目标配置已就绪**，或带[原因](#readiness-codes)的 **目标配置准备失败**。Core 优先在已准备好新配置的节点上放置新 Session；这些节点没有容量时，会使用仍服务旧配置的节点。E2B 变更立即生效。
-- **安装提供的 Runtime。** 已保存的 Runtime 与安装提供的不同时，**设置** → **沙箱与调度** 会显示 **Runtime** 行，列出两者的源码提交。**使用本安装的 Runtime** 以该 Runtime 打开 **修改资源** 的确认页，**保存配置** 后节点按上面的方式准备。其他修改保留已保存的 Runtime。控制台没有提供 Runtime 清单时，在 **高级设置** 中填写版本。
-- **容量与空闲挂起。** 在 **节点** 中通过 **编辑节点** 修改节点的活跃和保留上限。在 **设置** → **沙箱与调度** 中，通过 **自动挂起** → **空闲多久后挂起（秒）** → **保存** 修改整个部署的[空闲策略](../../../contracts/agents-api/zh/sandbox-deployment.md#suspension-policy)。
+- **规格、E2B 密钥或模板构建。** 打开 **设置** → **沙箱与调度** → **修改资源**，修改并保存。已有沙箱保持其配置。每个节点继续服务旧配置，同时准备新配置；**节点** 展示进度：**正在准备目标配置**、**目标配置已就绪**，或带[原因](#readiness-codes)的 **目标配置准备失败**。Core 优先在已准备好新配置的节点上放置新 Session；这些节点没有容量时，会使用仍服务旧配置的节点。E2B 变更立即生效。
+- **容量与空闲挂起。** 在 **节点** 中通过 **编辑节点** 修改节点的活跃和保留上限，或用 **使用推荐值** 填入推荐值。在 **设置** → **沙箱与调度** 中，通过 **自动挂起** → **空闲多久后挂起（秒）** → **保存** 修改整个部署的[空闲策略](../../../contracts/agents-api/zh/sandbox-deployment.md#suspension-policy)。
 - **沙箱提供商。** 同一页面选择 **重置部署**。自动重置立即归档空闲托管 Session，并让运行中的工作在设定截止时间前完成；强制重置立即取消工作。离线节点必须恢复连接，让 Core 确认清理。重置完成时，Core 已撤销所有节点和未使用命令：配置新的沙箱提供商后重新添加节点。**取消重置** 停止剩余工作；已归档 Session 仍保持归档。
 
 [重置协议](../../../contracts/agents-api/zh/sandbox-deployment.md#generation-ownership-and-rollout)描述重置会归档和保留哪些内容。归档单个托管 Session 时，使用 [Core API](../../../contracts/agents-api/zh/admin-api.md#session-archive)。
 
+## 跨节点的检查点恢复 {#checkpoint-recovery-across-nodes}
+
+microsandbox 跨节点检查点恢复要求在每个参与节点的安装命令加入 `--checkpoint-root /absolute/private/shared-store`。安装前将同一个私有 store 挂载到这些路径，并只允许 node 服务账户访问。默认使用节点本地私有 store，只支持在该节点恢复。检查点 store 独立于 workspace 存储，绝不能允许 guest 访问；[检查点转移契约](../sandbox-provider.md#checkpoint-transfer) 定义兼容性和保留要求。
+
+microsandbox 的检查点执行兼容性包含主机内核和 CPU profile。因此，操作系统或 CPU profile 变化可能使保留的检查点不再兼容，甚至无法在原节点恢复。维护前，应为这些检查点保留具有匹配 execution class 且已就绪同一 generation 的节点；否则，相关请求会按[检查点保留策略](../sandbox-provider.md#checkpoint-transfer)等待。
+
 ## 移除节点 {#remove-a-node}
 
 1. 在 Web 打开 **节点**，在节点页面选择 **移除节点**，或在列表行选择 **移除**，再选择 **确认移除**。节点仍持有沙箱、快照或待清理资源时，Core 拒绝操作；等待完成或归档对应 Session。移除是永久的：主机只能作为新节点重新加入。移除所有节点仍保留沙箱配置。
@@ -120,93 +125,28 @@ root 只准备账号、组和服务单元；其他操作（包括 Docker 网络
 
 程序不删除 Docker 镜像或卷。保留 Runtime 镜像并输出 `sudo docker image rm` 命令。microsandbox 在 Core 确认节点已移除后，还会删除节点位于 `/var/lib/oac-node/.oac/m/` 的存储（约 1.5 GB），随后删除所创建的账号。使用 `--force` 时不询问 Core，因此保留存储，并输出删除命令（`sudo -u oac-node rm -rf <store>`）；microVM 可能仍使用存储，请先检查 `pgrep -u oac-node`，再重新卸载以完成账号移除。输出会列出已删除和已保留的内容。可以重复卸载直到完成。
 
-## 手动注册节点 {#register-a-node-manually}
-
-如果自行管理节点文件和服务，而不执行 Web 命令，请使用手动注册。手动注册的节点只服务注册时的配置：规格或 Runtime 修改后，**节点** 显示 **节点程序不兼容**；它继续服务旧配置，直到移除节点并重新注册主机。
-
-1. 使用与 Core 同一发行版本的 `oac-node`。
-2. 获取注册令牌：使用 **添加节点** 命令中的令牌，或通过 Core 密钥调用 `POST /core/v1/sandbox/enrollment-tokens`。令牌一次性使用，包含批准的节点容量；响应的 `expires_at` 给出过期时间。在主机上存入权限为 `0600` 的文件。
-3. 使用令牌读取节点配置，不会消耗令牌：`GET /api/v1/sandbox-node/configuration`，带 `Authorization: Bearer <token>`。
-4. 写入私有提供商文件。从响应复制 `provider`、`installation_id`、`core_url`、`generation` 和 `specification`，并添加 `native` 对象，写入该提供商的主机设置。适配器从 `specification` 读取沙箱规格、Runtime 镜像和产物哈希：
-   - Docker：[Docker 节点配置](../configuration.md#docker-node-configuration)中的字段，其中 `host` 是显式 Unix 套接字，`image` 是导入的 Runtime 镜像的本地 ID，`seccomp_file` 是绝对路径。
-   - microsandbox：绝对路径 `helper_path`、`runtime_path` 和 `firmware_path`；`network` 策略；私有检查点归档的显式 `checkpoint_root`；以及 `runtime_home` 私有目录。目录缺失时辅助程序以 `0700` 创建。microsandbox 在其中放置 Unix 套接字，因此路径不要超过 48 字节；安装程序对自管节点拒绝更长路径。
-   首次注册 microsandbox 前，以 node 服务账户在相同发行版本的源码 checkout 中初始化空的 `checkpoint_root`：`PYTHONPATH=deploy/node python3 -c 'from node_install import prepare_checkpoint_root; prepare_checkpoint_root("/absolute/private/checkpoints")'`。它复用安装程序的 UUID marker 排他初始化与所有权检查。共享 store 只初始化一次，其他 node 使用已有 marker。不得替换 marker，也不得在恢复后的存储或非空且无所有权证明的目录上重新初始化。
-5. 使用真实绝对路径注册，然后通过主机服务管理器运行节点：
-
-   ```sh
-   oac-node register \
-     --config /var/lib/oac/provider.json \
-     --state-dir /var/lib/oac/node \
-     --core-url https://core.example \
-     --name worker-1 \
-     --enrollment-token-file /var/lib/oac/enrollment-token
-   oac-node run \
-     --config /var/lib/oac/provider.json \
-     --state-dir /var/lib/oac/node
-   ```
-
-节点移除后，Core 拒绝其凭据时，`oac-node run` 以状态 78 退出；配置管理器不要在该情况下重启（systemd：`RestartPreventExitStatus=78`）。
-
-节点向外连接 Core；Core 不需要通过 SSH 或 Docker TCP 访问主机。注册在联系 Core 前先将节点身份写入状态目录，因此响应丢失时可以复用同一身份重试。状态目录放在持久存储上，仅节点账号可访问，每次只由一个进程使用。不要复制到其他目录或主机：节点已有连接打开时，Core 拒绝第二个连接。提供商文件不能修改节点容量或沙箱配置。Core 在注册及每次连接时比较摘要；文件不匹配的节点在恢复批准配置前不接收工作。
-
 ## 节点主机故障时 {#when-a-node-host-fails}
 
 重启节点服务会保留身份并重新发现已有沙箱。Core 不会仅因节点不可达或沙箱缺失就接管活动或未确认的 writer：所有权未结清时，这些资源显示 **节点已断开** 或 **沙箱资源缺失**。主机崩溃或挂起时，应重启主机而不是移除其节点：节点重新连接后，节点确认已不存在的运行中沙箱会按[已确认的计算资源丢失](../sandbox-provider.md#confirmed-compute-loss)规则释放，Session 的下一个 input 在新计算资源上续接；其他缺失的沙箱保持 **沙箱资源缺失**。主机始终未恢复时，其 Session 的计算资源归属保持不变。已结清的保留检查点可以遵循[检查点转移契约](../sandbox-provider.md#checkpoint-transfer)，确认释放后可以按条件进行[冷替换](../sandbox-provider.md#cold-replacement-after-checkpoint-retention)。丢失节点状态目录属于恢复事件：从[备份](operations.md#back-up)恢复，并同时恢复数据库和提供商存储；不要在已有资源上重新注册主机。
 
 ## 问题排查 {#troubleshooting}
 
-### 就绪状态码 {#readiness-codes}
+连接失败和安装程序消息见[故障排查](./troubleshooting.md#nodes)。
 
-节点在线但沙箱提供商未就绪时，**节点** 和 **概览** 显示 **沙箱提供商未就绪**。原因展示位置取决于节点添加方式：
+### 就绪状态码 {#readiness-codes}
 
-- **使用 Web 命令添加的节点**：当前沙箱配置检查失败时，在目标状态显示 **目标配置准备失败**，帮助提示中给出原因（`GET /core/v1/sandbox/nodes` 的 `rollout.diagnostic`）。**沙箱提供商未就绪** 旁的提示仅显示 *沙箱提供商不可用*。
-- **手动注册的节点**：在 **沙箱提供商未就绪** 旁的帮助提示展示原因（`diagnostic`）。
+节点在线但沙箱提供商未就绪时，**节点** 和 **概览** 显示 **沙箱提供商未就绪**。节点在当前沙箱配置检查失败时，在目标状态显示 **目标配置准备失败**，帮助提示中给出原因（`GET /core/v1/sandbox/nodes` 的 `rollout.diagnostic`）。**沙箱提供商未就绪** 旁的提示仅显示 *沙箱提供商不可用*。
 
-每个状态码都是与提供商无关的类别；其背后的本地错误留在节点上。手动注册的节点会把它写入日志。对于使用 Web 命令添加的节点，请在主机上重新运行该命令：安装程序会先检查主机要求，并指出需要修复的问题（[安装程序消息](#installer-messages)）。
+每个状态码都是与提供商无关的类别；其背后的本地错误留在节点上。请在主机上重新运行该命令：安装程序会先检查主机要求，并指出需要修复的问题（[安装程序消息](./troubleshooting.md#installer-messages)）。
 
-节点按如下顺序仅报告首个失败检查：Docker 守护进程或 KVM、Docker 限制支持、主机容量、已安装的 Runtime 文件。因此无法访问 Docker 守护进程时，会隐藏镜像缺失问题。修复后约十秒的下一次心跳会清除或替换状态码。离线节点保留最后状态码，Web 在节点重连前隐藏它。
+节点按如下顺序仅报告首个失败检查：Docker 守护进程或 KVM、Docker 限制支持、主机容量、已安装的 Runtime 文件。因此无法访问 Docker 守护进程时，会隐藏镜像缺失问题。修复后的下一次准备尝试会清除或替换状态码。
 
 | 状态码 | 帮助提示 | 原因 | 解决方法 |
 | --- | --- | --- | --- |
-| `provider_unavailable` | 沙箱提供商不可用 | 提供商的服务不可达或请求失败（例如 Docker 守护进程已停止），或失败没有类别 | 重新运行节点的命令，或阅读手动注册节点的日志 |
-| `host_unsupported` | 主机不满足要求 | 主机缺少提供商所需的能力，例如 Docker 的 CPU 与内存限制（cgroup v2）或对 `/dev/kvm` 的读写权限 | 重新运行节点的命令，或阅读手动注册节点的日志 |
+| `provider_unavailable` | 沙箱提供商不可用 | 提供商的服务不可达或请求失败（例如 Docker 守护进程已停止），或失败没有类别 | 重新运行节点的命令 |
+| `host_unsupported` | 主机不满足要求 | 主机缺少提供商所需的能力，例如 Docker 的 CPU 与内存限制（cgroup v2）或对 `/dev/kvm` 的读写权限 | 重新运行节点的命令 |
 | `capacity_insufficient` | 主机资源不足 | 主机 CPU 或内存不足以运行一个沙箱 | 使用更大主机或修改沙箱规格 |
-| `runtime_image_unavailable` | 缺少 Runtime 镜像 | 提供商中没有固定版本的 Runtime 镜像 | Web 命令添加的节点自动重新下载；其他节点加载匹配发行版镜像 |
-| `artifacts_unavailable` | 沙箱提供商文件缺失 | 固定版本的提供商文件（例如 microsandbox 的 Runtime、固件或辅助程序）缺失或 SHA-256 检查失败 | Web 命令添加的节点自动下载缺失文件；其他节点从匹配发行版恢复 |
-| `runtime_download_failed` | Runtime 下载失败 | 准备新配置时无法下载或验证 Runtime 文件 | 检查节点到控制台和发行下载地址的 HTTPS 访问。节点以递增间隔重试，最长间隔 30 分钟 |
+| `runtime_image_unavailable` | 缺少 Runtime 镜像 | 提供商中没有本安装的 Runtime 镜像 | 重新运行节点的命令以再次下载；否则加载匹配发行版镜像 |
+| `artifacts_unavailable` | 沙箱提供商文件缺失 | 固定版本的提供商文件（例如 microsandbox 的 Runtime、固件或辅助程序）缺失或 SHA-256 检查失败 | 重新运行节点的命令以下载缺失文件；否则从匹配发行版恢复 |
 
 新用户组成员关系仅对新进程生效。重启节点服务：`sudo systemctl restart oac-node-<installation-id>.service`。
-
-### 连接失败 {#connection-failures}
-
-已注册但无法连接 Core 的节点会在[日志](#logs)中说明原因：记录 `sandbox node connection to Core failed; retrying` 并附带 `cause`，无论重试多少次，每种原因只记录一次；连接成功后记录 `sandbox node connected to Core`。节点服务启动时若 Core 不可达，会记录 `cannot confirm approved node capacity:`，后接原因。
-
-| 原因 | 解决方法 |
-| --- | --- |
-| `HTTP 400 on the WebSocket upgrade` | Core 前的反向代理没有在 `/api/v1` 上传递 WebSocket 升级；参见 [HTTPS 与反向代理](install-options.md#https-and-the-reverse-proxy) |
-| 其他状态码，例如 `HTTP 404 on the WebSocket upgrade` 或 `HTTP 502 …` | 反向代理没有将 `/api/v1` 转发到 Core 或没有保留 Host，或者 Core 未运行 |
-| `dial tcp: …`，例如 `connection refused`、`i/o timeout` 或 `no such host` | 主机无法通过公开 URL 访问 Core。检查 DNS 和防火墙；节点服务使用安装程序运行时的[代理](#download-through-a-proxy)，代理变化后请用正确的设置重新执行命令 |
-| `tls: …`，或 `TLS certificate expired or not yet valid` | 主机不信任 Core 的证书，或公开 URL 对不提供 HTTPS 的端口使用了 `https` |
-| `Core did not accept the node: …` | 节点自我介绍后 Core 关闭了连接。Core 升级后，执行该发行版的[协议变更](operations.md#protocol-changes)；否则查看 Core 日志 |
-
-### 安装程序消息 {#installer-messages}
-
-| 消息 | 解决方法 |
-| --- | --- |
-| `The enrollment command expired or was already used` | 在 Web 生成新命令并在 1 小时内执行 |
-| `Core rejected the node configuration read (HTTP …)` | 检查 Core URL 及其前面的反向代理后重试 |
-| `Not enough disk space under …` 或 `The disk is full` | 按提示释放空间后重试，下载会继续 |
-| This host's node program differs from the one this console serves | 节点添加后 Core 已升级。选择 **移除节点**，在主机上卸载，再通过 **添加节点** 重新添加 |
-| Another node installation is running, or this node is preparing a new sandbox configuration | 待 **节点** 不再显示 **正在准备目标配置** 后重试 |
-| 注册前的沙箱提供商检查失败，例如 `This host lacks a capability …` | 修复提示的问题（参阅[就绪状态码](#readiness-codes)）后重试；令牌未被使用 |
-| Core's public URL changed after this command was generated | 在 Web 生成并执行新命令 |
-| This host's node uses `<address>`, but this command uses `<address>` | 节点在旧公开 URL 下添加。在 Web 移除、卸载，然后重新添加 |
-| Docker Engine is not installed, or Docker is not running | 安装 Docker Engine，或运行 `sudo systemctl enable --now docker` 后重试 |
-| Docker on this host does not enforce CPU and memory limits | 使用 cgroup v2 后重试 |
-| KVM is unavailable, or `/dev/kvm` must be group-accessible | 启用虚拟化；发行版的 KVM 包会设置 `root:kvm 0660` |
-| This host has N CPUs and M MiB of memory; each sandbox needs … | 使用更大主机或修改沙箱规格 |
-| SELinux is enforcing on this host | 使用安装程序支持的主机；程序不修改 SELinux 设置 |
-| This host already runs a sudo-mode node for another Core | 先移除并卸载该节点 |
-| Node installation and removal require root | 通过 sudo 或 root shell 执行 Web 命令 |
-| Core still lists this node | 先在 Nodes 页面移除 |
-| Core no longer accepts this node | 节点已移除或重置已撤销它。卸载后使用新命令重新添加主机 |
diff --git a/docs/zh/getting-started/operations.md b/docs/zh/getting-started/operations.md
index 29f49a7c7..99e35ecb2 100644
--- a/docs/zh/getting-started/operations.md
+++ b/docs/zh/getting-started/operations.md
@@ -1,31 +1,30 @@
 ---
 title: "运维"
 source: docs/getting-started/operations.md
-source_hash: 34bed3662a32f4627dd229e9913d4d1910d9fd59fddf0f7cf78ca12c3cd63c17
+source_hash: 3d2771c328b71e1c66c04e6724b0aa0763067b19d8da4b94e29510adcd131335
 ---
 
-安装运维人员负责 Core 主机、存储和可用性。节点主机运行各自的服务；参阅[节点](nodes.md)。设置见[配置参考](../configuration.md)。
+Core 安装运维人员的日常任务：`oac` 命令、服务健康状态、Core 密钥、备份和卸载。节点有[专门的指南](./nodes.md)，[故障排查](./troubleshooting.md)列出了安装程序和访问方面的提示信息。设置见[配置参考](../configuration.md)。
 
 ## oac 命令 {#the-oac-command}
 
-每个安装目录都有自己的原生管理命令：Unix 使用 `oac`，Windows 使用 `oac.exe`。命令需要 Docker 访问权限，不需要 root：
-
-```sh
-docker compose -f ~/.oac/core/compose.yaml ps
-```
+每个安装目录都有自己的 `oac` 命令（Windows 为 `oac.exe`）。以安装 Core 的账号运行它；它需要 Docker 访问权限，不需要 root。示例使用默认安装目录 `~/.oac/core`；Windows 上使用 `& "$HOME/.oac/core/oac.exe"` 调用该命令，后接相同参数。使用自定义目录时，替换路径。
 
 | 命令 | 功能 |
 | --- | --- |
-| `docker compose ps` | 在安装目录中展示服务 |
-| `docker compose start` | 启动服务 |
-| `docker compose stop` | 停止服务。保留数据、节点和沙箱 |
+| `oac install` | 安装，或继续一个在启动前停止的安装；安装脚本会运行它 |
 | `oac apply` | 检查数据卷和 `.env`，然后启动服务，并重新创建配置有变化的服务；参见 [oac apply 的工作方式](../configuration.md#how-oac-apply-works)。校验失败时不改动任何服务。成功时打印 `Services are running with the current settings.` |
 | `oac core-key [--show]` | 指出 Core 密钥在数据卷中的位置；加上 `--show` 时打印密钥本身 |
 | `oac rotate-core-key` | 替换 Core 密钥并重启 Core 和 Web，然后说明如何读取新密钥 |
-| `docker compose down` | 移除容器。数据保留 |
 | `oac uninstall` | 确认后删除安装及其数据；参见[卸载](#uninstall) |
 
-示例使用默认安装目录。Windows 上使用 `& "$HOME/.oac/core/oac.exe"` 调用管理命令，后接相同参数。使用自定义安装目录时，替换各命令中的路径。
+Docker Compose 命令管理服务；针对该安装的 Compose 文件运行它们。`stop` 和 `start` 见[停止与重启](#stop-and-restart)。
+
+| 命令 | 功能 |
+| --- | --- |
+| `docker compose -f ~/.oac/core/compose.yaml ps` | 展示服务 |
+| `docker compose -f ~/.oac/core/compose.yaml logs --tail 200 core` | 展示服务的日志 |
+| `docker compose -f ~/.oac/core/compose.yaml down` | 移除容器。数据保留 |
 
 本地凭据和注册解析完成后，Runtime 的 Harness 发现与已认证的引导 HTTP 请求并发执行。两者都成功后才建立连接并发布能力。失败会取消另一项操作并等待其清理。执行器仍由连接生命周期持有。Runtime 启动变更需要重新构建并验证 Runtime 模板。
 
@@ -52,7 +51,7 @@ app-server 初始化前仍会校验并固定模型目录。阶段计时用于区
 | Environment 连接 | Runtime 传输已连接 |
 | 已完成的 Turn 及结果 | 任务已记录的结果 |
 
-服务健康状态不表示 Harness 或模型可用。执行情况使用 Session、Turn、Items 和 Usage 读取，节点连接、就绪和分配使用 Web 的 **节点** 页面。本地诊断使用安装自身的 Compose 文件：
+只有 Web 是监听器；参阅[配置公开地址](./public-address.md#listeners-and-access)。服务健康状态不表示 Harness 或模型可用。执行情况使用 Session、Turn、Items 和 Usage 读取，节点连接、就绪和分配使用 Web 的 **节点** 页面。本地诊断使用安装自身的 Compose 文件：
 
 ```sh
 docker compose -f "$HOME/.oac/core/compose.yaml" ps --all
@@ -87,7 +86,7 @@ docker compose -f ~/.oac/core/compose.yaml start
 
 停止 Core 不会停止节点或沙箱。节点服务、microVM 和 Docker 容器继续运行；停止不是回收计算资源的方法。Core 重启不会透明地继续被中断的原生工具调用。重连后查询同一 Session；不要创建新 Session 来重放结果不确定的工作。Session 事件流仅提供实时事件；通过读取 Session、Turn 和 Items 恢复。
 
-Web 重启（包括 `oac apply` 引起的重启）会让所有控制台用户退出登录。其他情况下，Web 登录持续 12 小时。
+Web 重启（包括 `oac apply` 引起的重启）会让所有控制台用户退出登录；参阅[登录](../web/console-server.md#sign-in)。
 
 ## Core 密钥 {#core-key}
 
@@ -101,7 +100,7 @@ Web 重启（包括 `oac apply` 引起的重启）会让所有控制台用户退
 
 ### 用脚本调用 Core API {#script-the-core-api}
 
-Core 不发布主机端口。在 Core 主机上，此辅助函数在 Core 的网络命名空间中运行 `curl`，并通过 stdin 传入密钥，使其不进入命令行：
+在 Core 主机上，此辅助函数在 Core 的网络命名空间中运行 `curl`，并通过 stdin 传入密钥，使其不进入命令行：
 
 ```sh
 core() (  # core METHOD PATH [JSON body]
@@ -149,7 +148,7 @@ Core 记录每次公开资源写入所使用的密钥；历史保留策略为 [`
 
 ## 备份 {#back-up}
 
-可恢复的备份必须是一组在停止写入期间取得的一致数据。仅数据库转储或 Core 卷导出不包含独立工作区存储及节点计算状态。恢复数据卷时，同时恢复同一份备份中的安装目录，其中保存着写入该数据的版本；之后可以用更新的版本[升级](#upgrade)恢复后的安装。
+可恢复的备份必须是一组在停止写入期间取得的一致数据。仅数据库转储或 Core 卷导出不包含独立工作区存储及节点计算状态。恢复数据卷时，同时恢复同一份备份中的安装目录，其中保存着写入该数据的版本。
 
 ### 单机备份与恢复 {#single-host-backup}
 
@@ -189,7 +188,7 @@ docker run --rm -v "${project}_data:/data" -v ~/oac-backup:/backup:ro --entrypoi
 - 对于[配额模式](../workspace-provider.md#quota-mode)命名空间，将承载导出的整个 XFS 文件系统作为一份块级副本备份：存储或 LVM 快照，或已冻结或已卸载设备的镜像。只有这样的副本能保持 project ID、配额限制、inode 标识、文件系统 UUID 和 `oac-workspace-quota` 日志库的一致。文件级复制、`tar`、`rsync` 或 `xfsdump` 会丢失这些信息；此时该命令会拒绝恢复后的对象，而不是在无上限状态下提供它们。
 - 各节点状态目录 `/var/lib/oac-node/.oac/nodes/<installation-id>/` 及其提供商存储：Docker 卷或 microsandbox 存储。包含数据库仍然引用的全部计算资源和快照。参见[节点主机故障时](./nodes.md#when-a-node-host-fails)。
 
-- 每个私有 `checkpoint_root` 的全部内容，包括 `.oac-checkpoint-store`、归档、operation journal、lock 文件与 tombstone，并与匹配的 Core 数据库一起保留。它独立于原生 SDK store 和工作区 namespace。保留其身份和私有所有权；[检查点转移契约](../sandbox-provider.md#checkpoint-transfer)定义其生命周期。
+- 每个私有 `checkpoint_root` 的全部内容，包括 `.oac-checkpoint-store`、检查点、operation journal、lock 文件与 tombstone，并与匹配的 Core 数据库一起保留。它独立于原生 SDK store 和工作区 namespace。保留其身份和私有所有权；[检查点转移契约](../sandbox-provider.md#checkpoint-transfer)定义其生命周期。
 
 ### 建立停止写入窗口 {#establish-a-stopped-write-window}
 
@@ -205,7 +204,7 @@ docker run --rm -v "${project}_data:/data" -v ~/oac-backup:/backup:ro --entrypoi
 
 ```sh
 docker compose -f "$HOME/.oac/core/compose.yaml" exec -T database \
-  pg_dump -U agents_api agents_api > oac-backup.sql
+  pg_dump -U oac oac > oac-backup.sql
 ```
 
 逻辑转储仍然需要匹配的 secrets、state、独立文件系统及所需节点资源。Docker Desktop 的 **Volumes** 导出可用于复制已停止的数据卷，但不会协调这些其他部分。
@@ -214,60 +213,16 @@ docker compose -f "$HOME/.oac/core/compose.yaml" exec -T database \
 
 恢复期间保持应用入口及 Core/节点服务关闭。暴露恢复后的文件系统前，必须隔离或关闭每一个旧写入方；旧主机不可达不代表已隔离。演练必须使用隔离的安装和存储副本，不能连接原节点，也不能共享其可写命名空间。
 
-启动 Core 前，恢复相匹配的 secrets 和数据库状态、完整的独立文件系统命名空间，以及任何所需的节点标识和提供商存储。保留数据库中的配置和命名空间 UUID、对象标识及删除标记；不要对恢复后的存储执行首次命名空间初始化。恢复配额模式文件系统时，将其块级副本写入后备设备，并以 `prjquota` 挂载到配置的挂载点；绝不要对其运行 `oac-workspace-quota init`，也不要将副本与原文件系统同时挂载，二者具有相同的文件系统 UUID。重新建立配置中的挂载路径和服务 UID，然后从每个参与服务的上下文验证所挂载文件系统、所有权及 xattr。[独立工作区存储](../configuration.md#independent-workspace-storage)负责定义部署设置。
+启动 Core 前，恢复相匹配的 secrets 和数据库状态、完整的独立文件系统命名空间，以及任何所需的节点标识和提供商存储。保留数据库中的配置和命名空间 UUID、对象标识及删除标记；不要对恢复后的存储执行首次命名空间初始化。恢复配额模式文件系统时，将其块级副本写入后备设备，并以 `prjquota` 挂载到配置的挂载点；绝不要对其运行 `oac-workspace-quota init`，也不要将副本与原文件系统同时挂载，二者具有相同的文件系统 UUID。重新建立配置中的挂载路径和服务 UID，然后从每个参与服务的上下文验证所挂载文件系统、所有权及 xattr。[设置工作区存储](./workspace-storage.md)负责定义部署设置。
 
 已释放计算资源的冷恢复基线仅在新计算资源准入后续接具备资格的原生历史。包含保留检查点的备份还依赖匹配的原生 Runtime、节点标识、提供商存储和外部文件系统标识。文件级恢复可能改变 inode 标识，即使文件字节一致，也可能阻止严格检查点恢复。此流程不承诺可移植内存快照，也不承诺恢复到任意替代节点；应保留未解决的归属，而不是替换为新沙箱。
 
 恢复依赖全部完整后才启动 database、Core 和节点服务；检查期间保持入口受限。在隔离演练中，验证保留 Session 的文件和具备资格时在新计算资源上的原生续接，确认已删除对象无法重新打开，并检查旧写入方均无法访问恢复后的命名空间。在依赖备份进行恢复前记录结果。
 
-## 升级 {#upgrade}
-
-v0.0.10 及更高版本的安装可以原地升级到更新的发布版本，并保留数据库、数据卷、`.env`、密钥、Core 密钥、安装 ID 以及你在 `compose.override.yaml` 中添加的条目。更早的安装无法升级：请将新版本安装到新目录。降级会被拒绝。
-
-1. 阅读目标版本的发布说明，了解[协议变更](#protocol-changes)及其要求的操作。
-2. [备份](#single-host-backup)安装。升级不会备份；升级之后，备份是回到先前版本的唯一途径。
-3. 使用目标版本的安装程序，带上 `--upgrade` 和安装目录运行：
-
-   ```sh
-   curl -fsSL https://openagentcore.dev/install.sh | bash -s -- --upgrade --install-dir "$HOME/.oac/core"
-   ```
-
-   `--version TAG` 选择最新版本以外的发布版本。Windows 上运行 `& ([scriptblock]::Create((irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1))) --upgrade --install-dir "$HOME\.oac\core"`。对于从[源码包](../development.md#install-a-checkout-without-publishing-a-release)安装的实例，运行新源码包的安装程序：`python3 <bundle>/install.py --install-dir <dir> --upgrade`。
-4. 准备好后，[应用该版本的 Runtime](#runtime-after-an-upgrade)。
-
-不带 `--upgrade` 时，其他版本的安装程序不做任何更改，并以 `This installation runs release <old>; this installer is <new>. Back up the installation (Upgrade in the operations guide), then rerun with --upgrade.` 停止（`install.py` 的提示为 `this bundle is`）。无论是否带该参数，已安装版本的安装程序都会继续该安装。安装程序和修改状态的 `oac` 命令共用[安装锁](../configuration.md#installation-directory)；其他命令正在运行时，等待其结束后重试。
-
-### 升级会做什么 {#what-the-upgrade-does}
-
-安装程序下载该版本的 `compose.yaml` 并拉取缺失的镜像。替换任何文件之前，它使用安装的 `.env` 和 Compose 覆盖文件运行新版本的配置检查和初始化。初始化会升级数据卷，或拒绝降级。随后安装程序将新的 `compose.yaml` 和 `oac` 放到位并启动服务，重新创建有变化的服务；Core 启动时迁移数据库。[部署](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/README.md#installation)说明了每个步骤。这次重启对工作的影响与任何一次 [Core 重启](#stop-and-restart)相同；节点和沙箱继续运行并重新连接。
-
-成功时，安装程序打印控制台地址、用 `oac core-key --show` 代替密钥，以及一行 `Upgraded from <old> to <new>. Settings → Sandbox and scheduling offers this release's Runtime; sandboxes keep their current Runtime until you apply it.`
-
-如果某项检查失败，安装程序会打印 `Upgrade stopped; the running services are unchanged` 及 Docker 的输出，先前版本继续提供服务。修复原因后重新运行命令。初始化升级数据卷后，先前版本便无法再在该数据卷上启动：如果后续步骤失败（例如出现 `startup failed; data retained, rerun the installer`），重新运行同一命令，它会安全地重复每个步骤；也可以[回滚](#roll-back)。
-
-### 升级后的 Runtime {#runtime-after-an-upgrade}
-
-升级不会改变沙箱配置：节点继续服务已保存的 Runtime，新 Session 也使用它。要切换到该版本的 Runtime，打开 **设置** → **沙箱与调度**，在 **Runtime** 行选择 **使用本安装的 Runtime**，确认更改后选择 **保存配置**。节点随后准备新代次，现有沙箱保留原代次，直到被释放；参阅[修改沙箱配置](nodes.md#change-the-sandbox-configuration)。E2B 部署没有 **Runtime** 行；除非该版本更改了 Core–Runtime 协议，其模板继续可用。
-
-### 协议变更 {#protocol-changes}
-
-以下三种连接要求两端的协议版本相同：Core 与节点、节点与 microsandbox 辅助程序、Core 与 Runtime。升级不会改动任何节点主机或正在运行的沙箱。更改其中某个协议的版本会在发布说明中注明，并指出需要以下哪些操作：
-
-- 重新安装每个节点：[移除节点](nodes.md#remove-a-node)，清理主机，再通过 **添加节点** 重新添加该主机。Core 拒绝移除仍持有沙箱的节点，所以升级前先归档这些 Session；
-- 升级后立即应用该版本的 Runtime；仍在较早代次上的沙箱将停止工作；
-- [构建新的 E2B 模板](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/e2b/README.md#build-a-template)，并在[沙箱配置](nodes.md#change-the-sandbox-configuration)中选择它；
-- 重新连接[自托管机器](self-hosted.md#reconnect-an-existing-session)。
-
-### 降级 {#downgrades}
-
-初始化会拒绝不比已安装版本更新的版本，并提示 `This installation runs release <installed> (<date>); this release, <own> (<date>), is not newer. Downgrades are not supported: run that release or a newer one, or restore the backup taken before the upgrade.` 安装程序将其报告为已停止的升级，安装继续运行。Core 会拒绝由更新版本迁移过的数据库，并提示 `Agents API database schema version N is newer than this Core supports (M). Downgrades are not supported: run the release that upgraded this database or a newer one, or restore the backup taken before the upgrade.` 要回到较早的版本，请[回滚](#roll-back)。
-
-### 回滚 {#roll-back}
-
-回滚即恢复升级前的备份：停止服务，[恢复](#restore-and-rehearse)数据卷和安装目录，然后启动服务。尽量在应用该版本的 Runtime 之前恢复：节点准备好它之后，恢复的数据库并不知道节点的新代次，因此还需[移除每个节点](nodes.md#remove-a-node)并重新添加。备份之后创建的 Session 和数据会丢失。
-
 ## 卸载 {#uninstall}
 
+先移除节点，参见[移除节点](./nodes.md#remove-a-node)。
+
 ```sh
 ~/.oac/core/oac uninstall
 ```
@@ -278,7 +233,7 @@ Windows 上运行 `& "$HOME/.oac/core/oac.exe" uninstall`。命令会展示 Comp
 
 卸载不停止沙箱：节点沙箱在节点继续运行，E2B 沙箱在 E2B 继续运行并计费。Core 仍运行时，归档它们的 Session，或[重置部署](nodes.md#change-the-sandbox-configuration)并等待完成。
 
-其他主机上的节点继续运行。按常规方式卸载时，先在 Web 移除，见[移除节点](nodes.md#remove-a-node)。安装删除后，它们的 Core 已不存在：在各节点主机用原命令留在 `~/.oac/node-bootstrap/` 的安装程序，执行带 `--force` 的节点卸载命令（见[移除节点](nodes.md#remove-a-node)），并传入 `oac uninstall` 打印的安装 ID。如果没有记下，可以从节点的单元名 `oac-node-<installation-id>.service` 中读取。
+如果 Core 已不存在，按那里的说明在各节点主机上带 `--force` 运行节点卸载命令，使用 `oac uninstall` 打印的安装 ID，或节点单元名 `oac-node-<installation-id>.service` 中的安装 ID。
 
 如果安装目录被手动删除，其容器会继续运行并占用 Web 端口。不依赖任何安装文件即可找到并移除该项目：
 
@@ -289,38 +244,6 @@ docker compose -p <project> down --volumes --remove-orphans
 
 项目是列表中的 `oac-…` 名称。之后如果 `~/.oac/core.lock` 仍然存在（Windows 上还有 `~/.oac/.core.lock.runtime.lock`），将其删除。
 
-## 问题排查 {#troubleshooting}
-
-| 症状 | 原因与解决方法 |
-| --- | --- |
-| `Web port unavailable; choose --web-port` | 其他程序占用该端口。停止它，或另选 `--web-port`。安装程序不会改用其他端口。如果消息点名了 Compose 项目 `oac-…`，说明目录已不存在的早期安装仍在运行：按[卸载](#uninstall)移除它 |
-| `incomplete installation: preserve … and choose another directory` | 保留目录内容，选择另一个 `--install-dir` |
-| `configuration check failed; no service was changed` | `.env` 中有 Core 拒绝的值。消息只包含变量名。修正 `.env` 后再次运行 `oac apply` |
-| `data volume check failed; no service was changed` | 初始化拒绝了数据卷；消息会说明原因，例如数据卷已被更新的版本升级。参见[降级](#downgrades) |
-| `This installation runs release …` | 安装程序或初始化属于另一个版本。要换到更新的版本，请按[升级](#upgrade)操作；降级会被拒绝 |
-| `This account cannot use Docker` | 将该账号加入 `docker` 组后重新登录，或使用 Docker Desktop 或 rootless Docker。不要用 `sudo` 运行安装程序 |
-| `This account cannot access …` | 之前用 `sudo` 运行留下了属于 root 的文件。运行消息给出的 `sudo chown` 命令，再以自己的账号重新运行 |
-| `Docker Compose 2.26 or newer is required` | 安装或更新 Docker Compose 插件 |
-| `Docker could not pull …` | Docker 守护进程无法访问容器注册表。配置其代理或镜像加速器，或使用[离线归档](install-options.md#offline-hosts) |
-| `startup failed; data retained, rerun the installer` | 消息会列出不健康的服务和查看其日志的 `docker compose logs --tail 50` 命令。修复原因，再[继续安装](install.md#install)；不要删除数据。运行 `oac apply` 时，同一消息会提示再次运行 `oac apply` |
-| Web 返回 403 `Forbidden` | 浏览器主机名不是 `OAC_PUBLIC_URL`。打开该源地址；反向代理必须传递原始 Host |
-| Web 显示 Core 不可用（502） | Core 停止或失败：先 `docker compose ps`，再查看 Core 日志 |
-| 创建 Session 返回 400 `model_provider_required` | 缺少模型提供商：为 Harness 设置[默认模型](../configuration.md#default-models)，或显式提供；自托管 Session 始终自带提供商 |
-| **添加节点** 不展示命令 | 参阅[添加节点前](nodes.md#before-you-add-a-node) |
-| 节点未就绪 | 参阅[节点问题排查](nodes.md#troubleshooting) |
-
-## 对外暴露与网络策略 {#exposure-and-network-policy}
-
-| 监听器 | 主机安装 | 反向代理之后 |
-| --- | --- | --- |
-| Web 和 API | Web 在 `OAC_HOST` 上发布 `OAC_WEB_PORT`（8080） | Web 在 `OAC_HOST` 上发布 `OAC_WEB_PORT`。反向代理应使用 `127.0.0.1` |
-| Core | 不发布端口。Web 转发 `/v1`、`/api/v1` 和 `/docs` | 不发布端口。Web 转发 `/v1`、`/api/v1` 和 `/docs` |
-| PostgreSQL | 不发布端口 | 不发布端口 |
-
-Web 使用 Core 密钥让管理员登录，检查每个请求来源，并用保留在服务器上的 Core 密钥将已登录的 `/core/v1` 请求转发到 Core。它把 `/v1` 和 `/api/v1` 原样转发给 Core，使用调用方自己的凭据；Web 仅在 `/node-install/` 提供不含密钥的节点文件，没有 Docker 或 KVM 访问权限。`/api/v1` 机器路由使用独立注册和连接凭据。没有服务持有 Docker 套接字。
-
-沙箱是隔离边界（[Runtime 与外层隔离](../concepts.md#runtime-and-outer-isolation)）。Docker 沙箱共享节点内核，Docker 节点在主机上[等同于 root 权限](nodes.md#what-the-installer-sets-up)；microsandbox 为每个沙箱提供具有显式[网络策略](nodes.md#what-the-installer-sets-up)的 microVM。Core 自身无 Docker 套接字或 KVM 访问权限。
-
 ## 执行延迟 {#execution-latency}
 
 通过 `environment input reserved` 日志将提交输入的 HTTP Trace 与 `reservation_id`、`execution_trace_id` 关联。worker 从持久化预留标识派生执行诊断 Trace，观察连接断开或 owner 重启都不依赖进程内 Trace 映射。这是 HTTP Trace 与执行 Trace 之间的明确关联，不是原 HTTP span 的延续。沿 `environment input selected`、`execution preparation requested`、`environment input admitted` 将预留与 Session、Environment、device、准备请求、Executor、Turn 关联。`preparation_request_id` 标识控制准备请求，与 HTTP `request_id` 不同。创建 Session 时附带输入的情况，通过相同 `session_id` 和 `is_initial=true` 将 `session initial input origin` 与 worker 的预留关联；普通和流式创建都支持，不增加 store 查询。
diff --git a/docs/zh/getting-started/public-address.md b/docs/zh/getting-started/public-address.md
new file mode 100644
index 000000000..d85986ecc
--- /dev/null
+++ b/docs/zh/getting-started/public-address.md
@@ -0,0 +1,128 @@
+---
+title: "配置公开地址"
+source: docs/getting-started/public-address.md
+source_hash: 18cf3655776a7bd22a09023a7764abf17461570371b846ef5ce4d1caa3d13a6f
+---
+
+设置浏览器、节点、沙箱和应用访问 Core 所用的唯一源地址，并在其前面放置带 HTTPS 的反向代理。本指南面向将 Core 暴露到其所在机器之外的运维人员。
+
+## 选择公开 URL {#choose-the-public-url}
+
+`OAC_PUBLIC_URL` 是应用、节点、沙箱和自托管执行器使用的源地址。Web 只接受其中的主机。Core 从中派生守护进程 WebSocket URL、自托管 `remote_url` 和每个沙箱的连接地址。它是不含路径的 http 或 https 源地址。
+
+| 场景 | 公开 URL |
+| --- | --- |
+| 在本机试用 | `http://localhost:8080`，`--host` 不是 `0.0.0.0` 或主机没有私有地址时的默认值 |
+| 本地网络 | `http://<private address>:8080`，`--host` 为 `0.0.0.0` 且默认路由带有私有网络地址时由安装程序选用 |
+| 本地网络之外 | 反向代理提供的 HTTPS 源地址，例如 `https://core.example` |
+| E2B 提供商 | 可从互联网访问且不是回环地址的 HTTPS 源地址，因为 E2B 沙箱会从 E2B 云端调用 Core |
+
+安装时用 `--public-url` 传入该源地址，或按[更改公开 URL](#changing-the-public-url)稍后修改。使用选项安装，参阅[安装选项](./install-options.md#pass-flags)。
+
+## 监听器与访问 {#listeners-and-access}
+
+默认安装在 `--host` `0.0.0.0` 的 `--web-port`（8080）上发布 Web。Core 和 PostgreSQL 不发布端口。`--host` 是不含端口、协议或区域的 IPv4 或 IPv6 地址。请在浏览器中使用服务器的具体 IP，而不是通配地址。
+
+| 服务 | 外部可访问性 |
+| --- | --- |
+| Web | `OAC_HOST` 上的 `OAC_WEB_PORT`。使用反向代理时，用 `--host 127.0.0.1` 安装 |
+| Core | 仅通过 Web。`/v1`、`/api/v1` 和 `/docs` 原样透传；已登录的控制台 `/core/v1` 请求带有 Core 密钥。其余由 Web 自己提供；参阅[请求边界](../web/console-server.md#request-boundary) |
+| PostgreSQL | 否 |
+
+沙箱是隔离边界：参阅 [Runtime 与外层隔离](../concepts.md#runtime-and-outer-isolation)。
+
+### 端口 {#ports}
+
+安装程序在下载镜像之前检查 `--web-port`。
+
+- `--host` 是该端口绑定的地址。`0.0.0.0` 在所有 IPv4 接口发布 Web。`127.0.0.1` 只在本机发布 Web。
+- 端口被占用时安装停止，不会改用其他端口。
+
+`OAC_HOST` 或 `OAC_WEB_PORT` 变化时，`oac apply` 会重新创建 Web。
+
+## 将 Core 置于 HTTPS 之后 {#https-and-the-reverse-proxy}
+
+用 `--host 127.0.0.1` 安装，并把反向代理指向 Web，默认是 `127.0.0.1:8080`。反向代理必须：
+
+- **保留 Host。** Web 仅接受 `OAC_PUBLIC_URL` 中的主机。
+- **在 `/api/v1` 上传递 WebSocket 升级请求。** 节点、沙箱 Runtime（包括 E2B）和自托管执行器通过它连接。
+- **不对流进行缓冲或设置超时。** `/v1` 会流式传输 Session 事件。
+- **接受大文件上传。** 源文件最大可达 512 MiB；具体限制由 Core 执行。
+
+::: code-group
+
+```caddyfile [Caddy]
+core.example {
+	reverse_proxy 127.0.0.1:8080
+}
+```
+
+```nginx [nginx]
+map $http_upgrade $connection_upgrade {
+	default upgrade;
+	''      close;
+}
+
+server {
+	listen 443 ssl;
+	server_name core.example;
+	ssl_certificate     /etc/ssl/core.example/fullchain.pem;
+	ssl_certificate_key /etc/ssl/core.example/privkey.pem;
+
+	client_max_body_size 513m;
+
+	location / {
+		proxy_pass http://127.0.0.1:8080;
+		proxy_http_version 1.1;
+		proxy_set_header Host $http_host;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_buffering off;
+		proxy_read_timeout 1h;
+		proxy_send_timeout 1h;
+	}
+}
+```
+
+:::
+
+Caddy 会自行获取证书，默认传递 Host 和 WebSockets。nginx 的 server 块放在 `http` 上下文中，并需要你提供证书。
+
+然后在 `~/.oac/core/.env` 中设置 `OAC_PUBLIC_URL=https://core.example`，并运行 `~/.oac/core/oac apply`。
+
+### 检查路由 {#verify-the-routing}
+
+```sh
+curl -s -o /dev/null -w '%{http_code}\n' -H 'OpenAI-Beta: agents=v1' https://core.example/v1/agents
+```
+
+`401` 表示 `/v1` 已到达 Core，Core 正在要求提供密钥。`404` 表示请求已到达 Web：请修复反向代理，否则应用调用和每个节点连接都会失败。节点记录 `HTTP 400 on the WebSocket upgrade`，说明其前面的代理没有在 `/api/v1` 上传递升级请求；参阅[故障排查](./troubleshooting.md#nodes)。
+
+所有位置都必须保持启用 TLS 验证。使用私有证书颁发机构时，节点主机、自托管机器和 Runtime 镜像必须信任该机构。
+
+### 使用快速隧道进行本地试用 {#try-it-locally-with-a-quick-tunnel}
+
+[Cloudflare 快速隧道](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/)会为使用外部入口的试用安装提供一个临时公共 HTTPS 地址。它只会转发到一个端口，因此需要在前面放置一个具有相同路由的本地代理：
+
+```caddyfile
+http://:8443 {
+	bind 127.0.0.1
+	reverse_proxy 127.0.0.1:8080
+}
+```
+
+1. 启动代理：`caddy run --config Caddyfile`。
+2. 启动隧道：`cloudflared tunnel --url http://127.0.0.1:8443`。它会打印一个地址，例如 `https://random-words.trycloudflare.com`。
+3. 在 `~/.oac/core/.env` 中将该地址设置为 `OAC_PUBLIC_URL`，并运行 `~/.oac/core/oac apply`。
+
+每当 `cloudflared` 重启时，该地址都会改变；随后必须重新添加绑定到旧地址的节点。吞吐量较低，因此节点首次下载 Runtime（约 500 MB）时可能很慢；请参阅[慢速链接](./nodes.md#rerun-expiry-and-slow-links)。
+
+## 更改公开 URL {#changing-the-public-url}
+
+先把反向代理指向新地址，然后编辑 `~/.oac/core/.env` 中的 `OAC_PUBLIC_URL` 并运行 `oac apply`。之后：
+
+- 使用旧地址的节点不会再获得新沙箱：请在 Web 中移除这些节点，然后重新添加。
+- 只有在旧地址仍可访问此 Core 时，现有沙箱和执行器才会继续工作。
+- 自托管执行器必须使用新的 `remote_url` 重启，并且其安装程序会拒绝为旧地址进行的安装：请创建新的自托管 Session，然后重新连接其主机。
+
+该设置列在[配置参考](../configuration.md#settings)中。
diff --git a/docs/zh/getting-started/quickstart.md b/docs/zh/getting-started/quickstart.md
index b4d499ed2..25e35b55c 100644
--- a/docs/zh/getting-started/quickstart.md
+++ b/docs/zh/getting-started/quickstart.md
@@ -1,13 +1,15 @@
 ---
 title: "运行第一个 Session"
 source: docs/getting-started/quickstart.md
-source_hash: 36731629434acafda8c48640aba3eda4967622525ed1b9dbf49ba40769513bc3
+source_hash: 8795e92d7eb61f7f946e96bcd3966b16e2eb800a8f36ee1b1de524df106c868f
 ---
 
-本教程从项目 API 密钥开始，让 Agent 创建一个文件并汇报结果。你需要：
+使用官方 OpenAI Python SDK 通过 Core 运行 Agent：用项目 API 密钥连接，启动一个会写入文件的 Session，并读取结果。你需要管理员提供的密钥和 API 基础 URL。
 
-- 管理员提供的项目 API 密钥和 API 基础 URL（[签发项目 API 密钥](install.md#issue-a-project-api-key)）；
-- 已就绪的节点或 E2B 沙箱提供商，让 Core 能运行 Agent（[节点](nodes.md)）；
+开始之前，请准备：
+
+- 项目 API 密钥和 API 基础 URL（[签发项目 API 密钥](install.md#issue-a-project-api-key)）；
+- 已就绪的节点或 E2B 沙箱提供商，让 Core 能运行 Agent（[添加和管理节点](nodes.md)）；
 - Python 3.9 或更高版本；
 - 一个模型：安装的默认模型，或你自己的提供商的模型 ID、基础 URL 和 API 密钥。[模型执行](../../../contracts/agents-api/zh/model-execution.md#saved-defaults-and-precedence)说明 Session 使用哪个模型，以及每个 Harness 支持哪些协议。
 
@@ -32,25 +34,29 @@ read -rs OPENAI_API_KEY && export OPENAI_API_KEY   # paste the key; it is not ec
 
 检查访问情况。此操作不运行模型，也不创建沙箱：
 
-```python
+::: code-group
+
+```python [Python]
 from openai import OpenAI
 
 client = OpenAI()  # reads OPENAI_BASE_URL and OPENAI_API_KEY
 print(client.beta.agents.list().data)
 ```
 
-空列表表示连接成功。使用 curl 做同样的检查：
-
-```sh
+```sh [curl]
 curl "$OPENAI_BASE_URL/agents" -H "OpenAI-Beta: agents=v1" \
   -H @<(printf 'Authorization: Bearer %s\n' "$OPENAI_API_KEY")
 ```
 
+:::
+
+空列表（`[]`）表示连接成功。
+
 ## 2. 启动 Session {#_2-start-a-session}
 
 Session 是拥有独立工作区的一次 Agent 对话。使用 `openai_hosted` 时，Core 在节点或 E2B 上创建沙箱，并在其中启动 Harness。
 
-使用安装的默认模型时，跳过下面这一步。如果使用自己的提供商：
+要使用自己的提供商而不是安装的默认模型，请先导出其设置，然后运行第二个标签页的代码：
 
 ```sh
 export MODEL_NAME='your-model-id'
@@ -58,29 +64,40 @@ export MODEL_BASE_URL='https://your-provider.example/v1'
 read -rs MODEL_API_KEY && export MODEL_API_KEY
 ```
 
-```python
-import os
+::: code-group
 
-extra = {"agent": {"x_agents_core": {"harness": "codex"}}}
-if os.environ.get("MODEL_API_KEY"):
-    extra["agent"]["model"] = os.environ["MODEL_NAME"]
-    extra["x_agents_core"] = {"model_provider": {
-        "protocol": "responses",
-        "base_url": os.environ["MODEL_BASE_URL"],
-        "api_key": os.environ["MODEL_API_KEY"],
-    }}
+```python [Default model]
+session = client.beta.agents.sessions.create(
+    environment={"type": "openai_hosted"},
+    input="Create /workspace/hello.txt with a short greeting, then describe it.",
+    extra_body={"agent": {"x_agents_core": {"harness": "codex"}}},
+)
+print(session.id)
+```
+
+```python [Your own provider]
+import os
 
 session = client.beta.agents.sessions.create(
     environment={"type": "openai_hosted"},
     input="Create /workspace/hello.txt with a short greeting, then describe it.",
-    extra_body=extra,
+    extra_body={
+        "agent": {"model": os.environ["MODEL_NAME"], "x_agents_core": {"harness": "codex"}},
+        "x_agents_core": {"model_provider": {
+            "protocol": "responses",
+            "base_url": os.environ["MODEL_BASE_URL"],
+            "api_key": os.environ["MODEL_API_KEY"],
+        }},
+    },
 )
 print(session.id)
 ```
 
+:::
+
 这会发起真实模型请求，可能产生费用。
 
-- `x_agents_core` 包含 Core 对 OpenAI API 的扩展；参阅 [Core 扩展](../api/public-agent-api.md#core-extensions-x-agents-core)。
+- `x_agents_core` 包含 Core 对 OpenAI API 的扩展；参阅 [Core 扩展](../api/public-agent-api.md#core-extensions)。
 - 将整个 `agent` 对象放入 `extra_body`。SDK 3.13.0 使用 `extra_body` 中的同名字段替换请求体字段，而非合并。
 
 ## 3. 等待结果 {#_3-wait-for-the-result}
@@ -104,7 +121,14 @@ else:
     raise TimeoutError(f"Session {session.id} is still running; inspect it before retrying")
 ```
 
-成功意味着一个状态为 `completed` 的 Turn，其 Items 描述新文件。超时不会取消工作，也不能证明执行失败。
+它会输出：
+
+```text
+Turn: 00000000-0000-4000-8000-000000000003 completed
+[…the Turn's Items, including the assistant message that describes /workspace/hello.txt…]
+```
+
+状态为 `completed` 且其 Items 描述了新文件的 Turn，表示 Agent 已运行。超时不会取消工作，也不能证明执行失败。
 
 ## 后续步骤 {#next-steps}
 
@@ -112,5 +136,5 @@ else:
 | --- | --- |
 | 流式输出、发送后续消息、上传文件、添加 Skills 或 MCP、取消 | [Agents API 指南](../api/public-agent-api.md#common-tasks) |
 | 查看各资源的请求和响应示例 | [Agents API 指南](../api/public-agent-api.md) |
-| 在自己的机器上运行 Agent | [自托管执行](self-hosted.md) |
+| 在自己的机器上运行 Agent | [运行自托管 Session](self-hosted.md) |
 | 查看完整应用 | [示例](../examples.md) |
diff --git a/docs/zh/getting-started/sandbox-backends.md b/docs/zh/getting-started/sandbox-backends.md
new file mode 100644
index 000000000..d7310d808
--- /dev/null
+++ b/docs/zh/getting-started/sandbox-backends.md
@@ -0,0 +1,51 @@
+---
+title: "选择沙箱提供商"
+source: docs/getting-started/sandbox-backends.md
+source_hash: 8dd1818c9061d0e29aee5949c189772aba6ffe72a9d984c0ed8d226571754d51
+---
+
+比较 microsandbox、Docker 和 E2B，然后在 Web 中选择一个。本指南面向已完成[安装 Core 和 Web](./install.md)、需要为 Core 托管的 Session 提供计算资源的运维人员。
+
+安装程序不选择提供商。一个安装只使用一个提供商。以后要更改，请先重置部署；参阅[更改沙箱配置](./nodes.md#change-the-sandbox-configuration)。
+
+## 比较各提供商 {#compare-the-backends}
+
+| | microsandbox（推荐） | Docker | E2B |
+| --- | --- | --- | --- |
+| 沙箱运行位置 | Linux 节点上的 microVM | Linux 节点上的容器 | E2B 云端 |
+| 需要添加节点 | 是 | 是 | 否 |
+| 你需要提供 | 带 systemd 和 `/dev/kvm` 的 Linux amd64 主机 | 带 systemd 和 rootful Docker Engine 的 Linux amd64 主机 | E2B API 密钥和模板；Core 的公共 HTTPS URL |
+| 隔离 | 每个沙箱有独立内核 | 容器共享节点内核 | 由 E2B 提供 |
+| 空闲沙箱可挂起和恢复 | 是，通过检查点 | 否 | 否 |
+| 工作区存储 | 必需，使用 NFS | 自有磁盘 | 自有磁盘 |
+| 磁盘限制 | 根磁盘和工作区配额 | 无 | 由模板设置 |
+
+字段级差异见[部署契约](../../../contracts/agents-api/zh/sandbox-deployment.md#what-each-field-means-per-sandbox-provider)。节点的主机要求见[添加和管理节点](./nodes.md#host-requirements)。
+
+Docker 节点在其主机上[等同于 root](./nodes.md#what-the-installer-sets-up)：仅在专用于沙箱的主机上添加。
+
+沙箱节点运行在 Linux amd64 上。Core 运行在 macOS 或 Windows 上时，请连接 Linux 节点或使用 E2B。应用也可以在自己的机器上运行[自托管 Session](./self-hosted.md)，无需提供商。
+
+## 在 Web 中选择提供商 {#select-the-backend-in-web}
+
+1. 打开 **设置 → 沙箱与调度**。设置向导会询问沙箱运行位置：**自有机器**（microsandbox 或 Docker）或 **E2B 云端**。
+2. 选择提供商和沙箱规格。Web 会把[提供商声明的默认大小](../sandbox-provider.md#register-the-provider-kind)推荐为 **标准**。
+3. 选择 **保存配置**。该选择保存在 Core 的数据库中。
+
+选择 **自有机器** 后，继续阅读[添加和管理节点](./nodes.md)。使用 microsandbox 时，请先[设置工作区存储](./workspace-storage.md)。microsandbox 节点间的检查点恢复，参阅[跨节点恢复检查点](./nodes.md#checkpoint-recovery-across-nodes)。
+
+## 使用 E2B {#use-e2b}
+
+E2B 不需要节点，但其沙箱会从 E2B 云端调用 Core，因此 Core 需要一个不是回环地址的公共 HTTPS URL；参阅[配置公开地址](./public-address.md)。
+
+1. 按[构建模板](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/e2b/README.md#build-a-template)，用 Runtime 镜像构建模板。其输出记录了不可变的 `templateID:build_UUID` 值。
+2. 在设置向导中选择 **E2B 云端**，输入 **E2B API 密钥**，并选择模板构建或输入其 `templateID:build_UUID`。密钥必须属于拥有该模板的团队。
+3. 选择 **保存配置**。Core 加密保存该密钥，且不会再返回它。
+
+密钥和模板规则（包括密钥替换）见[初始设置与同提供商变更](../../../contracts/agents-api/zh/sandbox-deployment.md#initial-setup-and-same-provider-changes)。
+
+## 后续步骤 {#next-steps}
+
+- microsandbox 或 Docker：[添加和管理节点](./nodes.md)。
+- 使用 NFS 的工作区：[设置工作区存储](./workspace-storage.md)。
+- 模型和密钥：继续阅读[安装 Core 和 Web](./install.md#set-a-default-model)。
diff --git a/docs/zh/getting-started/self-hosted.md b/docs/zh/getting-started/self-hosted.md
index 638b524b9..58c4faa25 100644
--- a/docs/zh/getting-started/self-hosted.md
+++ b/docs/zh/getting-started/self-hosted.md
@@ -1,12 +1,15 @@
 ---
-title: "自托管执行器"
+title: "运行自托管 Session"
 source: docs/getting-started/self-hosted.md
-source_hash: 9fda47d5be8d2977ac66a7db3ae2ce7c1112784a0a6521dc3791cdd0f284899f
+source_hash: de2bf583004e0aabb735d434133780e26f96e9912dd7e11100327b2f83f403c4
 ---
 
-`self_hosted` Session 在应用拥有的机器上运行：工作站、虚拟机或你管理的沙箱。应用通过 `/v1` 创建 Session，并获得安装 `oac-daemon`、启动它并连接 Core 的命令。Web 在 Session 页面展示同一命令；Web 是可选的。Core 不创建、停止或回收这台机器。
+`self_hosted` Session 在应用拥有的机器上运行，例如工作站、虚拟机或容器，而不是 Core 管理的沙箱。本指南面向用 `oac-daemon` 连接此类机器并保持其运行的应用开发者。
 
-**守护进程不是沙箱。** 工具以启动守护进程的账号权限运行，能访问该账号可访问的所有资源。需要隔离时，请使用容器或虚拟机；参阅 [Runtime 与外层隔离](../concepts.md#runtime-and-outer-isolation)。守护进程不限制网络访问，因此要求网络策略的模板会被自托管 Session 拒绝。
+应用通过 `/v1` 创建 Session，并获得安装 `oac-daemon`、启动它并连接 Core 的命令。Web 在 Session 页面展示同一命令；Web 是可选的。Core 不创建、停止或回收这台机器。
+
+> [!WARNING]
+> 守护进程不是沙箱。工具以启动守护进程的账号权限运行，能访问该账号可访问的所有资源。需要隔离时，请使用容器或虚拟机；参阅 [Runtime 与外层隔离](../concepts.md#runtime-and-outer-isolation)。
 
 Session 自带模型提供商；安装默认模型不适用（[原因](../../../contracts/agents-api/zh/model-execution.md#saved-defaults-and-precedence)）。机器获得的执行器凭据仅适用于这一个 Environment。
 
@@ -20,16 +23,23 @@ Session 自带模型提供商；安装默认模型不适用（[原因](../../../
 
 安装程序自带固定版本的 Node.js 和 Harness（列于 [`scripts/build-native-installer.mjs`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/scripts/build-native-installer.mjs)），不修改这些工具的其他安装。在没有匹配安装程序的平台上，命令会失败。
 
-下载约 320 MiB。安装高峰时，Runtime 主目录和安装目录所在磁盘需要约 2 GiB 可用空间（只选一个 Harness：归档 316 MiB、解包后的安装程序 907 MiB、安装后的文件约 560 MiB），三个 Harness 全选约 2.2 GiB；解包副本在命令结束时删除，归档在安装完成时删除。安装完成后占用约 560 MiB（一个 Harness）至约 940 MiB（全部三个）。
+下载量取决于你安装的 Harness。安装程序（9 MiB）和 Node.js（59 MiB）始终需要，再加上 Codex 的 121 MiB、Claude Code 的 99 MiB 或 MiniMax Code 的 23 MiB，因此安装一个 Harness 的 Session 下载 90 到 189 MiB。Runtime 主目录和安装目录所在磁盘需要有空闲空间：
+
+| | 一个 Harness | 全部三个 |
+| --- | --- | --- |
+| 高峰时所需空闲空间 | 约 0.7 GiB | 约 1.1 GiB |
+| 安装后占用，每台机器每个版本一份 | 约 560 MiB | 约 940 MiB |
+
+组件按机器和版本只安装一份，位于 Runtime 主目录的 `components/<version>` 中，这台机器上该版本的所有 Session 共用。它们是只读的，可防止意外改动；所有 Session 都以同一账号运行，因此 `start` 会校验这些组件，并拒绝已被改动的组件。同一发行版的另一个 Session 只需下载 9 MiB 的安装程序，不再安装任何组件，只增加自己的小目录。高峰为安装后占用加上正在解包的归档（Codex 为 121 MiB）；每个归档在其组件安装完成后即删除。
 
 机器需要：
 
-- 通过 HTTP 或 HTTPS 访问 Core，以及访问发布下载主机；如果 Core 已有安装程序的离线副本，则无需后者；
+- 通过 HTTP 或 HTTPS 访问 Core，以及访问发布下载主机；如果 Core 已有本平台安装程序的离线副本，则无需后者（离线安装只带有 Linux amd64 的安装程序）；
 - 用于环境设置和 MiniMax Code 工具的 Bash；Windows 上需要 Git Bash，Claude Code 也要求它；
 - Session 的软件包需要时，安装 Python 和 pip；
 - 环境设置所需的系统软件包。守护进程不运行 apt、sudo 或其他提权命令，请通过主机的常规管理方式安装。
 
-不需要管理员权限或 Docker。Unix 下载命令还使用 `curl`、`tar`、`gzip`、SHA-256 工具和系统文件锁命令（Linux 为 `flock`，macOS 为 `lockf`）。Windows 需要系统自带的 `tar.exe`，命令会在下载前检查。Runtime 主目录必须允许执行文件。如果 Unix 挂载点设为 `noexec`，请先用 `OAC_RUNTIME_HOME` 指定另一个允许执行的绝对目录，再运行命令。
+不需要管理员权限或 Docker。Unix 下载命令还使用 `curl`、`tar`、`gzip` 和 SHA-256 工具。Windows 需要系统自带的 `tar.exe`，命令会在下载前检查。Runtime 主目录必须允许执行文件。如果 Unix 挂载点设为 `noexec`，请先用 `OAC_RUNTIME_HOME` 指定另一个允许执行的绝对目录，再运行命令。
 
 ## 连接机器 {#connect-a-machine}
 
@@ -58,11 +68,13 @@ Session 自带模型提供商；安装默认模型不适用（[原因](../../../
    print(installation["commands"]["posix"])  # use "powershell" on Windows
    ```
 
-2. 在目标机器上，以应运行工具的账号执行命令。命令下载与 Core 匹配的安装程序、验证校验和、询问要安装哪些 Harness 以及安装位置、完成安装、按需创建工作区、启动守护进程并检查连接。
+2. 在目标机器上，以应运行工具的账号执行命令。命令下载与 Core 匹配的安装程序、验证校验和、询问要安装哪些 Harness 以及安装位置、下载 Node.js 和所选 Harness、完成安装、按需创建工作区、启动守护进程并检查连接。
 3. 发送一个 Turn。机器已连接只证明认证成功；第一个 Turn 才会检查 Harness 和模型。
 
 在 Web 中打开 Session，复制 **连接主机** 下的命令。
 
+![Web 中 Session 页面的“连接主机”](../../assets/console-connect-host-zh.webp)
+
 请保密该命令：它包含短期[安装授权](../../../contracts/agents-api/zh/environment-executor-credentials.md#installation-grant)，用于领取机器凭据。命令通过环境变量 `OAC_INSTALL_GRANT` 传递授权，从不放在参数中。在 Linux 和 macOS 上，命令以空格开头，会忽略空格开头命令的 shell 不会把它记入历史。PowerShell 没有这条规则：它的历史文件（`ConsoleHost_history.txt`）会把整条命令连同授权一起保存，直到你清除它，不过授权在 30 分钟后就会失效。过期后重新读取 Session，或从 Web 复制新命令。
 
 安装程序报告三个结果：
@@ -73,7 +85,12 @@ Session 自带模型提供商；安装默认模型不适用（[原因](../../../
 | **Daemon connection** | Core 已确认守护进程的认证连接 |
 | **Model configuration** | 未检查；第一个 Turn 使用 Session 的模型提供商 |
 
-安装程序在下载任何内容之前先检查授权，因此过期的命令不会白下载。归档下载在连接重置后会续传，只在传输停滞（60 秒没有数据）时失败，最多尝试五次；重新执行命令即可从中断处继续。校验通过的归档保存在 Runtime 主目录的 `native-download` 中，直到安装完成，因此失败后重跑无需重新下载；每次运行都会对照 Core 提供的校验和检查它，未通过则丢弃。下载、解压和复制组件前会检查磁盘空间。如果下载或安装被中断，重新执行命令：它清理未完成的临时副本，同时保留已完成的组件、凭据和工作区。`native-download` 中的小型 `download.lock` 文件保留用于并发控制。其他运行不会清理仍在进行的下载或安装。命令过期时，从 Session 复制新命令。
+<details>
+<summary>下载中断时</summary>
+
+安装程序在下载 Harness 之前先检查授权，因此过期的命令只会下载 9 MiB 的安装程序。每个归档的下载在连接重置后会续传，只在传输停滞（60 秒没有数据）时失败，最多尝试五次；重新执行命令即可从中断处继续。未完成的归档保存在 Runtime 主目录的 `native-download/<version>` 中，直到之后的运行将其完成；其他版本的下载会被删除。这台机器上已安装的组件不会再次下载。同一台机器上的安装轮流安装组件：后到的会输出等待提示，10 分钟后失败。如果某个共享组件被修改，`install` 和 `start` 会失败并指出它的目录：停止使用它的安装，删除该目录（文件是只读的：`chmod -R u+w <directory> && rm -rf <directory>`，在 PowerShell 中用 `Remove-Item -Recurse -Force <directory>`），再重新执行安装命令。下载、解压和复制组件前会检查磁盘空间。如果下载或安装被中断，重新执行命令：它清理未完成的临时副本，同时保留已完成的组件、凭据和工作区。命令过期时，从 Session 复制新命令。
+
+</details>
 
 如果 45 秒内未确认连接，安装程序输出守护进程日志路径。守护进程继续重连。修复原因后，以同一安装目录重新执行安装命令；如果命令已过期，从 Web 复制新的。已完成的组件和凭据会保留，已运行的守护进程会复用。不要删除工作区或 Session 来重试。
 
@@ -91,37 +108,6 @@ Session 自带模型提供商；安装默认模型不适用（[原因](../../../
 
 工作区在创建 Session 时固定。使用不同工作区时，创建另一个 Session。
 
-## 本地能力目录 {#local-capability-directories}
-
-自托管 Session 可以在工作区之外提供 `capability_directories`：
-
-```python
-environment = {
-    "type": "self_hosted",
-    "workspace_directory": os.environ["EXECUTOR_WORKSPACE"],
-    "capability_directories": [os.environ["EXECUTOR_CAPABILITIES"]],
-}
-```
-
-路径使用机器自身语法的绝对路径（Unix、Windows 驱动器或 UNC）；由守护进程而非 Core 检查。守护进程连接前，先准备这些目录。它们是守护进程可见的普通路径；指定路径不会挂载它或创建沙箱。
-
-使用 `x_agents_core.environment` 提供与托管 Session 相同的项目所属 Skills、Plugin 归档、文件、软件包、设置命令或模板：
-
-```python
-session = client.beta.agents.sessions.create(
-    agent_id=agent_id,
-    environment=environment,
-    extra_body={"x_agents_core": {
-        "model_provider": model_provider,
-        "environment": {"environment_template_id": template_id},
-    }},
-)
-```
-
-同一扩展也支持 `environment={"type": "openai_hosted"}`。不要在 `environment` 和扩展中重复指定同一个字段。设置过程使用守护进程账号权限。部署的模型密钥不会发送到你的机器。
-
-第一个 Turn 之前，守护进程将这些来源复制成快照。即使来源之后被修改，重连仍复用快照；新的 Session 获取新快照。[准备协议](../../../contracts/agents-api/zh/environments.md#runtime-capability-preparation)列出字段、合并规则、快照行为和失败情况。
-
 ## 管理安装 {#operate-the-installation}
 
 安装的 `bin/oac-daemon` 能定位自己的安装目录。使用它执行：
@@ -140,6 +126,31 @@ session = client.beta.agents.sessions.create(
 
 停止守护进程、取消 Turn 或删除 Session，都不会删除机器的工作区、原生历史或能力快照。安装程序拒绝其他守护进程版本的安装，以及文件已被修改的安装。程序不升级、修复或迁移它们。要在新目录上使用该 Session，请[重新连接](#reconnect-an-existing-session)。
 
+## 轮换或撤销 {#rotate-or-revoke}
+
+在 Web 中，Session 的 **执行器凭据** 列出机器凭据：
+
+| 操作 | 效果 |
+| --- | --- |
+| **轮换** | 凭据获得新密钥；旧密钥立即失效。已撤销凭据的操作为 **恢复** |
+| **撤销** | 凭据立即失效 |
+
+轮换后重新连接时，通过 `oac-daemon stop` 停止守护进程，用新凭据替换已配置的凭据文件路径中的 JSON，然后运行 `oac-daemon start`。不要再次对已有安装运行 `install`；轮换现有凭据，而非签发第二个凭据，后者[无法连接](../../../contracts/agents-api/zh/environment-executor-credentials.md#revoked-or-rotated-credential)。
+
+已归档项目无法签发或轮换凭据，仍可撤销。运维人员可以使用 Core 密钥管理凭据；参阅[凭据协议](../../../contracts/agents-api/zh/environment-executor-credentials.md#core-key-routes)。
+
+## 重新连接已有 Session {#reconnect-an-existing-session}
+
+安装命令只能认领一次 Session 的机器凭据，再次认领会以 `This Session's machine credential is already claimed by another installation` 结束。在另一个目录、另一台机器上运行命令，安装目录丢失，或目录中是其他 Core 版本或其他 Session 的安装（安装程序拒绝修改）时，都会出现这种情况。在原目录中重新运行命令始终可行。
+
+没有原目录时，轮换该 Session 的凭据，并用已解压的发行包安装到新目录：
+
+1. 在 Web 中打开该 Session，在 **执行器凭据** 中选择 **轮换**，保存返回的凭据 JSON。
+2. 下载 `<base>/<platform>.tar.gz`，以及 `node` 和你要安装的每个 Harness（`codex`、`claude` 或 `minimax`）的 `<base>/<platform>-<component>.tar.gz`，并解压到同一个目录。`<base>` 是安装命令中的第一个 URL（以 Core 版本结尾），`<platform>` 是 `linux-amd64`、`darwin-arm64` 或 `windows-amd64`，对应[平台](#platforms)表中的各行。
+3. 按[从已解压的发行包安装](#install-from-an-extracted-distribution)运行安装程序，使用该 Session 的 `remote_url`、Environment ID、工作区和保存的凭据文件。
+
+或者新建 Session 并运行它的命令。
+
 ## 移除机器 {#remove-a-machine}
 
 运行该安装自带的命令：
@@ -154,7 +165,7 @@ session = client.beta.agents.sessions.create(
 & "$HOME\.oac\environments\<environment-id>\bin\oac-daemon.exe" uninstall
 ```
 
-它会停止守护进程，列出将删除的内容并请求确认。它只删除安装目录中属于该安装的条目（`bin`、`daemon`、`components`、`capabilities`、`runtime`、`initialization` 和 `packages`，含凭据文件、原生历史和 Harness），之后若目录中没有其他内容，再删除目录本身。目录中的其他内容会保留，工作区以及安装目录之外的凭据文件或能力目录也会保留；命令会逐一列出保留的路径。`native-download` 目录及其 `download.lock` 不会被触碰。在没有安装的位置运行时，它会说明这一点并以 0 退出。如果某个文件无法删除，命令会指出它，待其被释放后可再次运行。在 Windows 上，最后的删除会在命令退出几秒后完成。
+它会停止守护进程，列出将删除的内容并请求确认。它只删除安装目录中属于该安装的条目（`bin`、`daemon`、`capabilities`、`runtime`、`initialization` 和 `packages`，含凭据文件和原生历史），之后若目录中没有其他内容，再删除目录本身。目录中的其他内容会保留，工作区以及安装目录之外的凭据文件或能力目录也会保留；命令会逐一列出保留的路径。Runtime 主目录中的共享组件随该版本在这台机器上的最后一个安装一并删除；否则命令会说明还有多少其他安装在使用它们。手动删除的安装目录会在这台机器上的下一次安装或卸载时被忘记，无人使用的组件也在那时删除。`native-download` 中未完成的下载不会被触碰；如需回收空间，请删除该目录。在没有安装的位置运行时，它会说明这一点并以 0 退出。如果某个文件无法删除，命令会指出它，待其被释放后可再次运行。在 Windows 上，最后的删除会在命令退出几秒后完成。
 
 随后在 Web 中打开该 Session，在 **执行器凭据** 中选择 **撤销**，或 **删除** 该 Session；在此之前，Core 仍接受这台机器的凭据。
 
@@ -162,32 +173,40 @@ session = client.beta.agents.sessions.create(
 
 Session 被删除，或其凭据被撤销或轮换后，由 `start` 启动的守护进程会在 `connect.log` 中写明原因（见 `oac-daemon logs`）并退出，再次启动会打印同样的原因。要重新连接，参阅[轮换或撤销](#rotate-or-revoke)或[重新连接已有 Session](#reconnect-an-existing-session)；要移除，运行 `uninstall`。
 
-## 轮换或撤销 {#rotate-or-revoke}
-
-在 Web 中，Session 的 **执行器凭据** 列出机器凭据：
+## 参考 {#reference}
 
-| 操作 | 效果 |
-| --- | --- |
-| **轮换** | 凭据获得新密钥；旧密钥立即失效。已撤销凭据的操作为 **恢复** |
-| **撤销** | 凭据立即失效 |
+### 本地能力目录 {#local-capability-directories}
 
-轮换后重新连接时，通过 `oac-daemon stop` 停止守护进程，用新凭据替换已配置的凭据文件路径中的 JSON，然后运行 `oac-daemon start`。不要再次对已有安装运行 `install`；轮换现有凭据，而非签发第二个凭据，后者[无法连接](../../../contracts/agents-api/zh/environment-executor-credentials.md#revoked-or-rotated-credential)。
+自托管 Session 可以在工作区之外提供 `capability_directories`：
 
-已归档项目无法签发或轮换凭据，仍可撤销。运维人员可以使用 Core 密钥管理凭据；参阅[凭据协议](../../../contracts/agents-api/zh/environment-executor-credentials.md#core-key-routes)。
+```python
+environment = {
+    "type": "self_hosted",
+    "workspace_directory": os.environ["EXECUTOR_WORKSPACE"],
+    "capability_directories": [os.environ["EXECUTOR_CAPABILITIES"]],
+}
+```
 
-## 重新连接已有 Session {#reconnect-an-existing-session}
+路径使用机器自身语法的绝对路径（Unix、Windows 驱动器或 UNC）；由守护进程而非 Core 检查。守护进程连接前，先准备这些目录。它们是守护进程可见的普通路径；指定路径不会挂载它或创建沙箱。
 
-安装命令只能认领一次 Session 的机器凭据，再次认领会以 `This Session's machine credential is already claimed by another installation` 结束。在另一个目录、另一台机器上运行命令，安装目录丢失，或目录中是其他 Core 版本或其他 Session 的安装（安装程序拒绝修改）时，都会出现这种情况。在原目录中重新运行命令始终可行。
+使用 `x_agents_core.environment` 提供与托管 Session 相同的项目所属 Skills、Plugin 归档、文件、软件包、设置命令或模板：
 
-没有原目录时，轮换该 Session 的凭据，并用已解压的发行包安装到新目录：
+```python
+session = client.beta.agents.sessions.create(
+    agent_id=agent_id,
+    environment=environment,
+    extra_body={"x_agents_core": {
+        "model_provider": model_provider,
+        "environment": {"environment_template_id": template_id},
+    }},
+)
+```
 
-1. 在 Web 中打开该 Session，在 **执行器凭据** 中选择 **轮换**，保存返回的凭据 JSON。
-2. 下载并解压 `<base>/<platform>.tar.gz`。`<base>` 是安装命令中的第一个 URL（以 Core 版本结尾），`<platform>` 是 `linux-amd64`、`linux-arm64`、`darwin-arm64` 或 `windows-amd64`。
-3. 按[从已解压的发行包安装](#install-from-an-extracted-distribution)运行安装程序，使用该 Session 的 `remote_url`、Environment ID、工作区和保存的凭据文件。
+同一扩展也支持 `environment={"type": "openai_hosted"}`。不要在 `environment` 和扩展中重复指定同一个字段。设置过程使用守护进程账号权限。部署的模型密钥不会发送到你的机器。
 
-或者新建 Session 并运行它的命令。
+第一个 Turn 之前，守护进程将这些来源复制成快照。即使来源之后被修改，重连仍复用快照；新的 Session 获取新快照。[准备协议](../../../contracts/agents-api/zh/environments.md#runtime-capability-preparation)列出字段、合并规则、快照行为和失败情况。
 
-## 从已解压的发行包安装 {#install-from-an-extracted-distribution}
+### 从已解压的发行包安装 {#install-from-an-extracted-distribution}
 
 同一安装程序也接受已解压的发行包和运维人员签发的凭据文件，无需安装命令：
 
@@ -201,4 +220,4 @@ Session 被删除，或其凭据被撤销或轮换后，由 `start` 启动的守
 "$HOME/.oac/my-runtime/bin/oac-daemon" start
 ```
 
-使用 Session 的 `remote_url` 和 Environment ID。发行包即[重新连接已有 Session](#reconnect-an-existing-session) 中的压缩包。在 PowerShell 中，以原生绝对路径运行 `.\oac-daemon.exe`。安装目录必须不存在、为空，或已包含一个安装。此模式要求工作区已存在，且在运行 `start` 前不会启动守护进程。
+使用 Session 的 `remote_url` 和 Environment ID。发行包即[重新连接已有 Session](#reconnect-an-existing-session) 中描述的目录：平台归档中的 `oac-daemon` 和 `bundle.json`，以及 `node` 和每个所选 Harness 的归档中的 `components/`。这台机器上尚未安装的组件会从发行包复制，已安装的则直接使用。两处都缺少的组件会失败，并指出需要解压的归档；此模式从不下载。在 PowerShell 中，以原生绝对路径运行 `.\oac-daemon.exe`。安装目录必须不存在、为空，或已包含一个安装。此模式要求工作区已存在，且在运行 `start` 前不会启动守护进程。
diff --git a/docs/zh/getting-started/troubleshooting.md b/docs/zh/getting-started/troubleshooting.md
new file mode 100644
index 000000000..094fc2d47
--- /dev/null
+++ b/docs/zh/getting-started/troubleshooting.md
@@ -0,0 +1,81 @@
+---
+title: "故障排查"
+source: docs/getting-started/troubleshooting.md
+source_hash: b57b7719fd48f61d1a10077eaca44efc89a58b7d2d68d4a5ce96bf537ba6680e
+---
+
+按症状查找安装、访问、节点和 Session 问题的原因与解决方法。本页面向 Core 安装的运维人员。
+
+对于失败的请求或 Turn，先查看 Web 的 **监控 → 请求日志** 和 **Session 日志**；参阅[请求诊断](./operations.md#request-diagnosis)和[服务健康状态](./operations.md#service-health)。
+
+## 安装 {#installation}
+
+| 症状 | 原因与解决方法 |
+| --- | --- |
+| `Web port unavailable; choose --web-port` | 其他程序占用该端口。停止它，或另选 `--web-port`。安装程序不会改用其他端口。如果消息点名了 Compose 项目 `oac-…`，说明目录已不存在的早期安装仍在运行：按[卸载](./operations.md#uninstall)移除它 |
+| `incomplete installation: preserve … and choose another directory` | 保留目录内容，选择另一个 `--install-dir` |
+| `configuration check failed; no service was changed` | `.env` 中有 Core 拒绝的值。消息只包含变量名。修正 `.env` 后再次运行 `oac apply` |
+| `data volume check failed; no service was changed` | 初始化拒绝了数据卷；消息会说明原因，例如数据卷属于另一个版本（`existing data belongs to release …`）。要使用此版本，请[卸载](./operations.md#uninstall)该安装（这会删除其数据），然后重新安装 |
+| `This installation runs release …` | 安装程序或初始化属于另一个版本。要使用此版本，请[卸载](./operations.md#uninstall)该安装（这会删除其数据），然后重新安装 |
+| `This account cannot use Docker` | 将该账号加入 `docker` 组后重新登录，或使用 Docker Desktop 或 rootless Docker。不要用 `sudo` 运行安装程序 |
+| `This account cannot access …` | 之前用 `sudo` 运行留下了属于 root 的文件。运行消息给出的 `sudo chown` 命令，再以自己的账号重新运行 |
+| `Docker Compose 2.26 or newer is required` | 安装或更新 Docker Compose 插件 |
+| `Docker could not pull …` | Docker 守护进程无法访问容器注册表。配置其代理或镜像加速器，或使用[离线归档](./install-options.md#offline-hosts) |
+| `Interrupted; rerun the installer to continue.` | Ctrl-C 中断了安装程序，安装保持可重新运行的状态。再次执行同一命令即可。在 Linux 和 macOS 上，启动脚本把未完成的 `oac` 下载保存在 `${TMPDIR:-/tmp}/oac-install-<uid>`，重新运行会继续该下载；删除该目录可让下载重新开始 |
+| `startup failed; data retained, rerun the installer` | 消息会列出不健康的服务和查看其日志的 `docker compose logs --tail 50` 命令。修复原因，再[继续安装](./install.md#install)；不要删除数据。运行 `oac apply` 时，同一消息会提示再次运行 `oac apply` |
+
+如果安装程序的某个步骤报告空间或配额不足，请释放错误所指文件系统上的空间。导入镜像失败还可能需要 Docker 存储中的空间，它可能位于另一个文件系统。
+
+## Web 与 API 访问 {#web-and-api-access}
+
+| 症状 | 原因与解决方法 |
+| --- | --- |
+| Web 返回 403 `Forbidden` | 浏览器主机名不是 `OAC_PUBLIC_URL`。打开该源地址；反向代理必须传递原始 Host |
+| Web 显示 Core 不可用（502） | Core 停止或失败：先 `docker compose ps`，再查看 Core 日志 |
+| 创建 Session 返回 400 `model_provider_required` | 缺少模型提供商：为 Harness 设置[默认模型](../configuration.md#default-models)，或显式提供；自托管 Session 始终自带提供商 |
+
+对于已到达 Core 的请求，参阅 Agents API 指南中的[诊断失败](../api/public-agent-api.md#diagnose-a-failure)。执行失败的 Session 有 [Session 诊断](../../../contracts/agents-api/zh/session-diagnostics.md)，其中说明了失败类别。
+
+## 节点 {#nodes}
+
+**添加节点** 不展示命令：参阅[添加节点前](./nodes.md#before-you-add-a-node)。在线但未就绪的节点会报告一个状态码；参阅[就绪状态码](./nodes.md#readiness-codes)。
+
+### 沙箱无法访问私有端点 {#sandboxes-cannot-reach-a-private-endpoint}
+
+microsandbox 沙箱无法访问私有地址上的模型提供商或 MCP 服务器，Harness 停止重试后 Turn 失败。沙箱的 DNS 查询发往主机 `/etc/resolv.conf` 中列出的域名服务器，而 DNS rebind 保护会丢弃任何包含私有地址的应答。因此，这些域名服务器解析为私有地址的名称在沙箱内根本无法解析，即使是云 VPC 解析器之后的公共模型 API 这类公共服务也是如此。
+
+节点没有更改此行为的设置。请让这些域名服务器返回该服务的公共地址。microsandbox 不读取主机的 `/etc/hosts`，因此只有当 `/etc/resolv.conf` 指向提供该条目的本地存根解析器（例如 `127.0.0.53` 上的 systemd-resolved）时，那里的条目才有用。否则，请使用不过滤沙箱流量的 Docker 节点。
+
+### 连接失败 {#connection-failures}
+
+已注册但无法连接 Core 的节点会在[日志](./nodes.md#logs)中说明原因：记录 `sandbox node connection to Core failed; retrying` 并附带 `cause`，无论重试多少次，每种原因只记录一次；连接成功后记录 `sandbox node connected to Core`。节点服务启动时若 Core 不可达，会记录 `cannot confirm approved node capacity:`，后接原因。
+
+| 原因 | 解决方法 |
+| --- | --- |
+| `HTTP 400 on the WebSocket upgrade` | Core 前的反向代理没有在 `/api/v1` 上传递 WebSocket 升级；参阅 [将 Core 置于 HTTPS 之后](./public-address.md#https-and-the-reverse-proxy) |
+| 其他状态码，例如 `HTTP 404 on the WebSocket upgrade` 或 `HTTP 502 …` | 反向代理没有将 `/api/v1` 转发到 Core 或没有保留 Host，或者 Core 未运行 |
+| `dial tcp: …`，例如 `connection refused`、`i/o timeout` 或 `no such host` | 主机无法通过公开 URL 访问 Core。检查 DNS 和防火墙；节点服务使用安装程序运行时的[代理](./nodes.md#download-through-a-proxy)，代理变化后请用正确的设置重新执行命令 |
+| `tls: …`，或 `TLS certificate expired or not yet valid` | 主机不信任 Core 的证书，或公开 URL 对不提供 HTTPS 的端口使用了 `https` |
+| `Core did not accept the node: …` | 节点自我介绍后 Core 关闭了连接。查看 Core 日志 |
+
+### 安装程序消息 {#installer-messages}
+
+| 消息 | 解决方法 |
+| --- | --- |
+| `The enrollment command expired or was already used` | 在 Web 生成新命令并在 1 小时内执行 |
+| `Core rejected the node configuration read (HTTP …)` | 检查 Core URL 及其前面的反向代理后重试 |
+| `Not enough disk space under …` 或 `The disk is full` | 按提示释放空间后重试，下载会继续 |
+| This host's node was added with another Core address, release or provider | 该节点由另一个 Core 地址、版本或提供商添加。选择 **移除节点**，在主机上卸载，再通过 **添加节点** 重新添加 |
+| Another node installation is running, or this node is preparing a new sandbox configuration | 待 **节点** 不再显示 **正在准备目标配置** 后重试 |
+| 注册前的沙箱提供商检查失败，例如 `This host lacks a capability …` | 修复提示的问题（参阅[就绪状态码](./nodes.md#readiness-codes)）后重试；令牌未被使用 |
+| Core's public URL changed after this command was generated | 在 Web 生成并执行新命令 |
+| This host's node uses `<address>`, but this command uses `<address>` | 节点在旧公开 URL 下添加。在 Web 移除、卸载，然后重新添加 |
+| Docker Engine is not installed, or Docker is not running | 安装 Docker Engine，或运行 `sudo systemctl enable --now docker` 后重试 |
+| Docker on this host does not enforce CPU and memory limits | 使用 cgroup v2 后重试 |
+| KVM is unavailable, or `/dev/kvm` must be group-accessible | 启用虚拟化；发行版的 KVM 包会设置 `root:kvm 0660` |
+| This host has N CPUs and M MiB of memory; each sandbox needs … | 使用更大主机或修改沙箱规格 |
+| SELinux is enforcing on this host | 使用安装程序支持的主机；程序不修改 SELinux 设置 |
+| This host already runs a sudo-mode node for another Core | 先移除并卸载该节点 |
+| Node installation and removal require root | 通过 sudo 或 root shell 执行 Web 命令 |
+| Core still lists this node | 先在 **节点** 页面移除 |
+| Core no longer accepts this node | 节点已移除或重置已撤销它。卸载后使用新命令重新添加主机 |
diff --git a/docs/zh/getting-started/workspace-storage.md b/docs/zh/getting-started/workspace-storage.md
new file mode 100644
index 000000000..511b98aa9
--- /dev/null
+++ b/docs/zh/getting-started/workspace-storage.md
@@ -0,0 +1,120 @@
+---
+title: "设置工作区存储"
+source: docs/getting-started/workspace-storage.md
+source_hash: 3e1ff9740cc093133658186a8562250f183963f83c657d5413d64058975f75df
+---
+
+将 Session 工作区保存在沙箱节点之外的 NFS 文件系统上，可选择是否设置每个工作区的配额。microsandbox 的每个 Environment 都运行在此存储上，因此请在配置 microsandbox 后端之前先选择它。
+
+支持的组合是 microsandbox 与[内核 NFS 适配器](../workspace-provider.md#kernel-nfs-adapter)。Docker 和 E2B 使用自有磁盘，不支持独立工作区存储；参阅[选择沙箱提供商](./sandbox-backends.md)。[配置参考](../configuration.md#independent-workspace-storage)列出了该设置所在的位置。
+
+```mermaid
+flowchart LR
+  A[Prepare NFS export] --> C[Mount into Core]
+  C --> D[Select the storage]
+  D --> E[Configure microsandbox]
+  E --> F[Add nodes]
+  F --> G[Validate with a Session]
+```
+
+## 准备 NFS 导出 {#prepare-the-nfs-export}
+
+启动服务前，在 Linux Core 主机和所有参与节点上将同一个 NFSv4.2 导出挂载到相同的绝对路径，例如 `/srv/oac-workspaces`。运维人员负责导出、挂载可用性和服务启动顺序。使用带有 `root_squash` 的受信任客户端 AUTH_SYS 导出。
+
+> [!WARNING]
+> 不要启用 `no_root_squash` 或放宽权限来使检查通过。
+
+按照适配器的[所有权要求](../workspace-provider.md#kernel-nfs-adapter)准备命名空间和服务身份。
+
+## 将导出挂载到 Core {#mount-the-export-into-core}
+
+通过部署平台的 Compose 自定义能力（例如 `compose.override.yaml`），在现有 `core` 服务的 `volumes` 中添加可读写绑定挂载。保留现有服务卷和用户。
+
+```yaml
+services:
+  core:
+    volumes:
+      - type: bind
+        source: /srv/oac-workspaces
+        target: /srv/oac-workspaces
+        read_only: false
+        bind:
+          create_host_path: false
+```
+
+主机源目录必须已经是 NFS 挂载；`create_host_path: false` 只防止创建不存在的源目录，并不能证明 NFS 已挂载。先挂载再创建容器；主机卸载或重新挂载后，应重新创建容器，使其挂载命名空间使用预期挂载。
+
+## 选择存储 {#select-the-storage}
+
+打开 **设置 → 工作区存储** 并选择 **选择新配置**，或按 [Core 管理 API](../../../contracts/agents-api/zh/admin-api.md#workspace-storage)的说明，使用 Core 密钥调用 `PUT /core/v1/workspace-storage`。表单接受 adapter 标识、JSON 对象形式的参数和可选的只写凭据 JSON 对象。Core 验证这些由 adapter 定义的值；Web 不定义提供商专属存储字段。
+
+首次设置时，分别为不可变配置 `id` 和命名空间标记生成规范 UUID，然后使用实际值提交以下结构。恢复时保留已有标识。
+
+```json
+{
+  "id": "11111111-1111-4111-8111-111111111111",
+  "adapter": "nfs",
+  "parameters": {
+    "root": "/srv/oac-workspaces",
+    "namespace_id": "22222222-2222-4222-8222-222222222222",
+    "uid": 65532
+  },
+  "tenant_capacity_mib": 0
+}
+```
+
+选择操作会在 Core 中运行适配器的可用性、所有权和 xattr 检查；它不证明每个节点均能解析该挂载。此配置不实施单个工作区配额，因此 `tenant_capacity_mib` 必须为 `0`。如需有上限的工作区，应准备[配额模式](#quota-mode-storage-server)，并改为选择带[租户容量](../configuration.md#tenant-capacity)的配额模式配置。
+
+**修改租户容量** 保留已选的不可变配置。选择另一份配置需要新的 ID，不会迁移现有工作区。
+
+## 配置 microsandbox 并添加节点 {#configure-microsandbox-and-add-nodes}
+
+通过[沙箱部署 API](../../../contracts/agents-api/zh/sandbox-deployment.md#routes)创建或更新 microsandbox 部署，并保留所需计算资源、Runtime 和提供商配置。`resources.environment_disk_mib` 是每个新工作区的容量配额请求：非配额模式下为 `0`（默认值），正数会被拒绝；配额模式下至少为 1024 MiB，`0` 会在工作区准入时被拒绝。选择存储之前保存的部署会返回 `workspace_storage_required`。部署变更时，既有工作区保持其获准时的容量。
+
+部署的工作区要求和每个 Session 的挂载凭据均从已选数据库配置派生。已选配置是唯一的存储设置。
+
+然后在每台已准备的主机上使用 **节点 → 添加节点**；参阅[添加和管理节点](./nodes.md)。
+
+## 用 Session 验证 {#validate-with-a-session}
+
+计算资源已连接且就绪并不足以证明外部文件系统具备资格。准入应用流量前，创建 Session，并通过每个参与节点读写文件。将独立命名空间纳入[停止写入后的备份恢复流程](./operations.md#back-up)。
+
+## 配额模式存储服务器 {#quota-mode-storage-server}
+
+配额模式通过 NFS 服务器上的 XFS project quota 为每个工作区的已分配字节和 inode 设定上限，由 Core 经受限 SSH 强制命令调用的 `oac-workspace-quota` 命令设置。协议和强制执行语义由[工作区文件系统协议](../workspace-provider.md#quota-mode)负责。以存储服务器管理员身份完成以下准备：
+
+1. 将导出放在启用强制 project quota（`prjquota`，而非 `pqnoenforce`）挂载的本地 XFS 文件系统上。导出根目录必须是该挂载点的子目录，例如挂载 `/srv/xfs`、导出 `/srv/xfs/oac-workspaces`；该命令将日志库保存在导出之外的 `/srv/xfs/.oac-quota`。按上文准备命名空间根目录和标记。
+2. 安装 `xfsprogs` 和 Python 3.9 或更高版本。从匹配的发行包将 `storage/oac-workspace-quota` 安装为 `/usr/local/sbin/oac-workspace-quota`，所有者为 root，权限 `0755`。
+3. 写入 `/etc/oac/workspace-quota.json`，所有者为 root，组和其他用户不可写：`{"export_root": "/srv/xfs/oac-workspaces", "mount_point": "/srv/xfs"}`。
+4. 预留该文件系统上其他 project 均未使用的 project ID 范围，然后仅初始化一次日志库：`oac-workspace-quota --config /etc/oac/workspace-quota.json init --projid-start 100000 --projid-end 199999`。它拒绝在已有日志库上运行；绝不要初始化恢复后的存储。
+5. 生成专用密钥对，例如 `ssh-keygen -t ed25519 -N '' -f oac-workspace-quota`。在一个具有可用 shell 的账户（如 `oac-quota`）的 `authorized_keys` 中授权其公钥：`restrict,from="<Core address>",command="sudo -n /usr/local/sbin/oac-workspace-quota --config /etc/oac/workspace-quota.json serve" ssh-ed25519 AAAA...`，并添加 sudoers 条目 `oac-quota ALL=(root) NOPASSWD: /usr/local/sbin/oac-workspace-quota --config /etc/oac/workspace-quota.json serve`。也可以在 `PermitRootLogin forced-commands-only` 下为 root 使用相同选项授权该密钥，命令中不带 `sudo -n`。保持 `PermitUserEnvironment no`。
+6. 在服务器本机的 `/etc/ssh/` 中读取其公共主机密钥，不要通过未经认证的网络扫描获取。
+
+选择配额模式配置时，将私钥作为只写凭据提交。选择成功后删除本地私钥文件；Core 使用 `secrets/core/credential.key` 加密保存它：
+
+```json
+{
+  "id": "33333333-3333-4333-8333-333333333333",
+  "adapter": "nfs",
+  "parameters": {
+    "root": "/srv/oac-workspaces",
+    "namespace_id": "22222222-2222-4222-8222-222222222222",
+    "uid": 65532,
+    "quota": {
+      "endpoint": "storage.internal:22",
+      "user": "oac-quota",
+      "host_key": "ssh-ed25519 AAAA..."
+    }
+  },
+  "credential": {
+    "ssh_private_key": "-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----\n"
+  },
+  "tenant_capacity_mib": 65536
+}
+```
+
+选择操作会通过固定的主机密钥调用该命令的只读检查。随后在 `resources.environment_disk_mib` 中设置每个工作区的容量并更新部署。在此更新之前，从非配额配置切换过来的安装会拒绝新工作区；既有工作区继续使用其自身配置。
+
+凭据属于不可变配置。如需轮换，先授权新密钥，使用新密钥选择新的配置 ID，并在仍有绑定旧配置的工作区处于创建过程中时保留旧密钥的授权。
+
+配额模式支持的恢复方式是对 XFS 文件系统进行块级复制；参阅[备份](./operations.md#back-up)。
diff --git a/docs/zh/maintainers.md b/docs/zh/maintainers.md
index 7597b1a9d..013a1cc94 100644
--- a/docs/zh/maintainers.md
+++ b/docs/zh/maintainers.md
@@ -1,14 +1,14 @@
 ---
 title: "构建并发布 OpenAgentCore"
 source: docs/maintainers.md
-source_hash: 18bb1549e69536abfe758b043e8621e77899a848efa8613760f7aff728afd63e
+source_hash: f66f608093cc824add3215a9df520082b1679af1852ee213b7a6adfca40221ed
 ---
 
-本指南面向负责构建和发布 OpenAgentCore 的维护者。要安装 Core 和 Web，请使用 [安装指南](getting-started/install.md)。安装器代码遵循的规则见 [部署](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/README.md) 和 [节点安装器](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md)；必需检查见 [CONTRIBUTING](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#required-checks)。
+本指南面向负责构建和发布 OpenAgentCore 的维护者。要安装 Core 和 Web，请按 [安装 Core 和 Web](getting-started/install.md) 操作。安装程序代码遵循的规则见 [部署](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/README.md) 和 [节点安装程序](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md)；必需检查见 [CONTRIBUTING](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#required-checks)。
 
 ## 构建分发包 {#build-a-distribution}
 
-分发包是从同一个提交构建的一组相互匹配的发布资源：控制归档（安装器、`oac` 命令，以及 Core、Web、ingress 和 PostgreSQL 镜像）、作为独立文件的 Runtime 镜像和节点构件，以及原生安装器。
+分发包是从同一个提交构建的一组相互匹配的发布资源：控制归档（安装程序、`oac` 命令，以及 Core、Web、ingress 和 PostgreSQL 镜像）、作为独立文件的 Runtime 镜像和节点构件，以及原生安装程序。
 
 Core、Web 和 ingress 镜像发布为经过校验的 Linux amd64/arm64 多架构索引。arm64 控制归档包含这三个镜像；Node、托管 Runtime 和离线包使用 Linux amd64。发行构建使用 QEMU 执行 ARM 镜像步骤，包括 E2B helper。主机 `oac` 从同一份实现构建为 Linux amd64/arm64、macOS amd64/arm64 和 Windows amd64 二进制；启动脚本只选择、校验并运行它们。所有版本索引校验通过后才更新浮动标签。
 
@@ -33,30 +33,32 @@ make build-core-distribution
 | `CORE_DISTRIBUTION_PLATFORMS` | 默认 `linux/amd64,linux/arm64`；[本地源码安装](development.md#install-a-checkout-without-publishing-a-release)使用 `linux/amd64`，无需 QEMU 或 ARM 控制面镜像 |
 | `CODEX_CLI_DIR`、`MCODE_HARNESS_BUILD_DIR` | `prepare-release-runtimes.sh` 固定的 Runtime 输入 |
 | `CORE_DISTRIBUTION_CODEX_IMAGE`、`CORE_DISTRIBUTION_CLAUDE_IMAGE`、`CORE_DISTRIBUTION_MCODE_IMAGE` | 使用现有 Harness 镜像，而不是构建这些镜像；值必须是以不可变 `sha256:` 镜像 ID 表示的现有镜像。三个变量必须全部设置或全部不设置；每个镜像都必须包含由该提交构建的守护进程 |
-| `OAC_NATIVE_INSTALLER_BUILD_DIR` | 原生安装器目录；请参阅[原生安装器](#native-installers) |
+| `OAC_NATIVE_INSTALLER_BUILD_DIR` | 原生安装程序目录；请参阅[原生安装程序](#native-installers) |
 | `CORE_DISTRIBUTION_BUILD_DIR` | `~/.oac` 下的输出目录。默认值：`~/.oac/build/core-distribution` |
 | `CORE_DISTRIBUTION_BUILD_NETWORK` | Docker 构建网络：`default`、`host` 或 `none` |
 | `CORE_DISTRIBUTION_MICROSANDBOX_ARCHIVE` | 已缓存的 microsandbox 发布归档。默认值：`~/.oac/cache/microsandbox-v0.7.8-linux-x86_64.tar.gz`，缺失时下载 |
 | `CORE_DISTRIBUTION_DATABASE_IMAGE` | PostgreSQL 16 镜像；默认值为 `deploy/compose/database-image.txt` 中索引的 linux/amd64 清单 |
 
-构建过程会复用 Core、Web、Runtime、SDK 和辅助程序构建器。清单会记录提交、其提交时间（`source_time`，用于在升级时为发布版本排序）和源代码树、镜像配置及 OCI 清单摘要、Runtime OCI 清单摘要、microsandbox 运行时和固件哈希，以及每个 Runtime 和节点构件的大小与 SHA-256；原生安装器在[目录](#native-installers)中仅记录其 SHA-256。输出包括控制归档及其 `.sha256`、可选的离线归档，以及带版本号的 Runtime、节点和原生安装器资源。此过程不会发布任何内容。如果目标目录中已包含此提交的分发包，重建会拒绝执行。
+构建过程会复用 Core、Web、Runtime、SDK 和辅助程序构建器。清单会记录提交及其源代码树、镜像配置及 OCI 清单摘要、Runtime OCI 清单摘要、microsandbox 运行时和固件哈希，以及每个 Runtime 和节点构件的大小与 SHA-256；原生安装程序在[目录](#native-installers)中仅记录其 SHA-256。输出包括控制归档及其 `.sha256`、可选的离线归档，以及带版本号的 Runtime、节点和原生安装程序资源。此过程不会发布任何内容。如果目标目录中已包含此提交的分发包，重建会拒绝执行。
 
 ingress 镜像仅包含 `oac` 和四个节点元数据文件：`manifest.json`、`SHA256SUMS`、`node-install.pyz` 与 `runtime/seccomp.json`。构建流程根据与分发包相同的 Runtime 和构件身份生成其清单，再禁用网络验证初始化。节点清单不包含控制平面镜像身份，因此可在 ingress 镜像生成前打包。
 
 控制归档不包含 Runtime 镜像或节点执行构件；离线归档包含这些内容。[下载契约](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md#download-contract)说明了节点如何获取这些内容。
 
-分发包会携带 `scripts/core-distribution-manifest.py` 中 `BUNDLED_DOCS` 列出的文档。随包文档之间的链接保持相对路径；其他所有相对链接都会重写为该捆绑包对应提交在 GitHub 上的同一文件。链接或锚点无法解析时，构建会失败；`make check-distribution` 会对 `example/` 之外每个受 Git 跟踪的 Markdown 文件运行相同检查。添加或移动安装器或其输出所引用的文档时，请更新该列表。
+分发包会携带 `scripts/core-distribution-manifest.py` 中 `BUNDLED_DOCS` 列出的文档。随包文档之间的链接保持相对路径；其他所有相对链接都会重写为该捆绑包对应提交在 GitHub 上的同一文件。链接或锚点无法解析时，构建会失败；`make check-docs` 会对 `example/` 之外每个受 Git 跟踪的 Markdown 文件运行相同检查。添加或移动安装程序或其输出所引用的文档时，请更新该列表。
 
-### 原生安装器 {#native-installers}
+### 原生安装程序 {#native-installers}
 
-自托管机器通过各平台的原生安装器安装 `oac-daemon`：Linux amd64、macOS arm64 和 Windows amd64。每个安装器均由 `native-check` 工作流在各自的操作系统上构建（`scripts/build-native-installer.mjs`，其中的 `pins` 对象会固定 Node.js 和 Harness 版本），并在每次选中的原生检查中得到验证。手动打包运行和发布检查会上传 `oac-native-installer-<OS>-<ARCH>.tar.gz` 并保留七天；普通 PR 和 main 检查即使成功也不会上传软件包。要构建本地分发包，请从该确切提交的一次 `native-check` 运行中下载这三个构件（可以是手动运行或发布运行；PR 运行构建的是合并提交，因此不匹配），然后使用该检出内容组装目录：
+自托管机器通过各平台的原生安装程序安装 `oac-daemon`：Linux amd64、macOS arm64 和 Windows amd64。每个安装程序均由 `native-check` 工作流在各自的操作系统上构建（`scripts/build-native-installer.mjs`，其中的 `pins` 对象会固定 Node.js 和 Harness 版本），并在每次选中的原生检查中得到验证。手动打包运行和发布检查会将该平台的各个归档上传为 `oac-native-installer-<OS>-<ARCH>` 并保留七天；普通 PR 和 main 检查即使成功也不会上传软件包。要构建本地分发包，请从该确切提交的一次 `native-check` 运行中下载这三个构件（可以是手动运行或发布运行；PR 运行构建的是合并提交，因此不匹配），然后使用该检出内容组装目录，输入目录中放入这三个构件的所有归档：
 
 ```sh
 node scripts/build-native-catalog.mjs INPUT_DIR OUTPUT_DIR
 export OAC_NATIVE_INSTALLER_BUILD_DIR=OUTPUT_DIR
 ```
 
-该目录会记录提交、Runtime 协议版本、每个归档的 SHA-256，并在提供发布基址时记录其带版本号的 URL。控制归档和 Core 镜像仅携带 `native-installers/catalog.json`；这些归档会成为独立的 `oac-native-<commit>-<platform>.tar.gz` 发布资源，离线归档则会在 Core 镜像之外为每个平台保留一份副本。如果没有目录，Sessions 会将安装命令报告为不可用，并且发布工作流会拒绝发布。
+每个平台有一个小型基础归档 `<os>-<arch>.tar.gz`（`oac-daemon` 和 `bundle.json`，后者列出每个组件及其每个文件的 SHA-256），以及每个组件一个归档，即 `<os>-<arch>-node` 和 `<os>-<arch>-<harness>`（MiniMax Code 不为 Windows 构建）。`build-native-installer.mjs` 生成它们。Core 按名称提供这些制品，不了解其内容；`oac-daemon install` 下载所需的组件。
+
+该目录会记录提交、Runtime 协议版本、每个制品的 SHA-256，并在提供发布基址时记录其带版本号的 URL。控制归档和 Core 镜像仅携带 `native-installers/catalog.json`；这些归档会成为独立的 `oac-native-<commit>-<artifact>.tar.gz` 发布资源，离线归档则会在 Core 镜像之外保留所有 Linux amd64 归档的一份副本，由其 `install.py` 复制到安装目录中供 Core 提供下载。其他平台由 Core 重定向到对应的发布资源；没有发布基址的目录没有这类 URL，因此其离线归档会保留所有归档。如果没有目录，Sessions 会将安装命令报告为不可用，并且发布工作流会拒绝发布。
 
 ### Runtime 镜像和辅助程序 {#runtime-images-and-helpers}
 
@@ -74,7 +76,7 @@ docker build --platform linux/amd64 -t oac-runtime:codex "${OAC_DEV_HOME:-$HOME/
 
 该脚本会检查软件包版本，为 Linux amd64 构建 `oac-daemon`，并准备一个仅包含守护进程、未修改的原生可执行文件、相关资源、共用的登录 profile 构建步骤和 `services/core/deploy/codex/Dockerfile` 的上下文。
 
-**Claude Code Runtime 镜像。** 必须使用 Node 20 或更高版本以及 pnpm。
+**Claude Code Runtime 镜像。** 必须使用 Node 22.21 或更高版本以及 pnpm。
 
 ```sh
 make build-claude-sdk-runtime
@@ -84,7 +86,7 @@ docker build --platform linux/amd64 -t oac-runtime:claude "${OAC_DEV_HOME:-$HOME
 
 第一步会将适配器和固定版本的 Claude Agent SDK（`packages/claude-sdk-adapter/package.json`）导出为适用于主机平台且带校验和的归档；第二步会验证该归档并添加守护进程。镜像步骤需要 `linux-x64-glibc` 归档，因此必须在带 glibc 的 Linux x86_64 上构建两者。请保持导出的归档不变。
 
-**MiniMax Code Runtime 镜像。** 使用 `packages/mcode-harness/source.json` 中固定修订版本的检出，并使用相同版本的 `@minimax-ai/code` npm 包提供原生依赖，以构建配套程序。配套程序构建可在 Linux x86_64 或 macOS arm64 上运行，并输出到一个新目录；对于 Linux Runtime 镜像，请在 Linux x86_64 上构建它（macOS arm64 仅用于原生安装器）：
+**MiniMax Code Runtime 镜像。** 使用 `packages/mcode-harness/source.json` 中固定修订版本的检出，并使用相同版本的 `@minimax-ai/code` npm 包提供原生依赖，以构建配套程序。配套程序构建可在 Linux x86_64 或 macOS arm64 上运行，并输出到一个新目录；对于 Linux Runtime 镜像，请在 Linux x86_64 上构建它（macOS arm64 仅用于原生安装程序）：
 
 ```sh
 MCODE_NATIVE_SOURCE=/absolute/minimax-code \
@@ -96,7 +98,7 @@ docker build --platform linux/amd64 -t oac-runtime:mcode "${OAC_DEV_HOME:-$HOME/
 
 `scripts/prepare-release-runtimes.sh` 会根据固定版本配置运行配套程序构建。
 
-分发包将三个 Harness 镜像合并到一个 Runtime 镜像（`deploy/distribution/Runtime.Dockerfile`）中：以携带守护进程的 MiniMax Code 镜像为基础，并复制入 Codex 可执行文件及资源和 Claude SDK 包。构建过程会验证每个镜像都携带由同一提交构建的守护进程。
+分发包将三个 Harness 镜像合并到一个 Runtime 镜像（`deploy/distribution/Runtime.Dockerfile`）中：以携带守护进程的 MiniMax Code 镜像为基础，并复制入 Codex 可执行文件及资源和 Claude Code 包。构建过程会验证每个镜像都携带由同一提交构建的守护进程。
 
 **E2B 辅助程序。**
 
@@ -132,13 +134,16 @@ git tag -a v1.2.3 FULL_REVIEWED_COMMIT_SHA -m "OpenAgentCore v1.2.3"
 git push origin v1.2.3
 ```
 
-标签使用 `vMAJOR.MINOR.PATCH` 格式，可选用 `-rc.1` 等预发布后缀以及 `+build.1` 等构建元数据。预发布后缀会创建 GitHub 预发布版。推送标签即表示发布决定。自动检查用于确定构建和测试结果，而不是真实模型资格：推送标签前应评估实际执行证据。模型凭据和私有证书颁发机构绝不能进入 CI 或发布输入，包含它们的验收镜像也不例外。
+```mermaid
+flowchart LR
+  tag[Push tag] --> checks[Full gate and native packaging] --> build[Build distribution and manifest] --> publish[Push images and publish the Release]
+```
 
-发布说明会列出每一项协议版本变更（节点线协议、microsandbox 辅助程序或 Core–Runtime 协议），以及它要求运维人员执行的操作。Core 绝不能依赖只有更新版本的初始化才会创建的密钥或文件：升级会先运行新 Core 的 `check-config`，再运行新的 `init`。Release 发布后，将 `deploy/compose/smoke-pins.json` 设为它的标签及其 `compose.yaml` 的 SHA-256，使 Compose 冒烟测试从最新的已发布版本升级。
+标签使用 `vMAJOR.MINOR.PATCH` 格式，可选用 `-rc.1` 等预发布后缀以及 `+build.1` 等构建元数据。预发布后缀会创建 GitHub 预发布版。推送标签即表示发布决定。自动检查用于确定构建和测试结果，而不是真实模型资格：推送标签前应评估实际执行证据。模型凭据和私有证书颁发机构绝不能进入 CI 或发布输入，包含它们的验收镜像也不例外。
 
-工作流会在带标签的提交上运行 `check`，包括完整的本地门禁、官方客户端和镜像验收，以及启用打包构件的原生平台矩阵。检查成功后，`blacksmith-4vcpu-ubuntu-2204` 上的一个 `build` 作业会准备固定的 Runtime 输入、复用原生安装器、构建分发包，并直接从本地文件发布。此合并作业具有 `contents: write` 和 `packages: write` 权限；检出过程不会保留凭据。只有发布失败或手动构建不发布时，才会把这些文件保留为未压缩的 Actions 构建产物，供恢复使用。
+工作流会在带标签的提交上运行 `check`，包括完整的本地门禁、官方客户端和镜像验收，以及启用打包构件的原生平台矩阵。检查成功后，`blacksmith-4vcpu-ubuntu-2204` 上的一个 `build` 作业会准备固定的 Runtime 输入、复用原生安装程序、构建分发包，并直接从本地文件发布。此合并作业具有 `contents: write` 和 `packages: write` 权限；检出过程不会保留凭据。只有发布失败或手动构建不发布时，才会把这些文件保留为未压缩的 Actions 构建产物，供恢复使用。
 
-分发归档和 Runtime 归档使用 `pigz` 级别 6，最多使用四个压缩工作线程，并且 gzip 头部中不包含文件名或时间戳。发布器会验证归档和原生安装器校验和、解析仓库身份、拒绝使用该标签已有的 Release 或草稿，并创建一个具有固定 ID 的草稿。最多四个资源可并发上传，按从大到小的顺序进行，且不会重试。确认完整的远程资源清单后，发布器会验证所有镜像归档和现有注册表标签，再并发推送最多四个镜像。每个镜像配置和注册表清单都会接受验证；任何错误都会使 Release 保持未发布状态。失败操作返回前，正在进行的传输会完成。发布器会按 ID 发布草稿，并在发布前重新检查版本标签。
+分发归档和 Runtime 归档使用 `pigz` 级别 6，最多使用四个压缩工作线程，并且 gzip 头部中不包含文件名或时间戳。发布器会验证归档和原生安装程序校验和、解析仓库身份、拒绝使用该标签已有的 Release 或草稿，并创建一个具有固定 ID 的草稿。最多四个资源可并发上传，按从大到小的顺序进行，且不会重试。确认完整的远程资源清单后，发布器会验证所有镜像归档和现有注册表标签，再并发推送最多四个镜像。每个镜像配置和注册表清单都会接受验证；任何错误都会使 Release 保持未发布状态。失败操作返回前，正在进行的传输会完成。发布器会按 ID 发布草稿，并在发布前重新检查版本标签。
 
 ### 容器注册表 {#container-registry}
 
@@ -174,11 +179,11 @@ gh workflow run core-release --repo MiniMax-AI/OpenAgentCore --ref main \
 
 | 组 | 检查和使用方 |
 | --- | --- |
-| `hygiene` | 名称、仓库链接、随包文档完整性以及 CI 计划器/门禁测试；每次变更都会运行 |
-| `distribution` | Harness 目录和安装器模式、安装/应用/恢复/清理测试、Compose 解析和初始化固定数据、发布/下载和捆绑包契约、Go 控制台测试与构建；模板解析需要 Docker Compose，不需要 pnpm install 或浏览器 |
-| `compose` | 使用从当前检出构建的镜像从空数据卷实际启动、登录和 API 访问、上传文件和下载节点安装器，然后在保留凭据和数据的同时重新配置 URL 并重新创建容器，并从固定的已发布版本原地升级；需要 Docker、Go 和网络访问，不需要模型凭据 |
+| `hygiene` | 仓库链接、随包文档完整性以及 CI 计划器/门禁测试；每次变更都会运行 |
+| `distribution` | Harness 目录和安装程序模式、安装/应用/恢复/清理测试、Compose 解析和初始化固定数据、发布/下载和捆绑包契约、Go 控制台测试与构建；模板解析需要 Docker Compose，不需要 pnpm install 或浏览器 |
+| `compose` | 使用从当前检出构建的镜像从空数据卷实际启动、登录和 API 访问、上传文件和下载节点安装程序，然后在保留凭据和数据的同时重新配置 URL 并重新创建容器；需要 Docker、Go 和网络访问，不需要模型凭据 |
 | `backend` | 并行部分，每部分都有专用 PostgreSQL 保护检查：`runtime`（sqlc 新鲜度、Runtime/共享 Go 测试、Linux microsandbox 辅助程序、守护进程构建）、`core`（独立 Core 构建、Core 服务和客户端测试），以及串行 Core 集成测试包的三个 `integration` 分片 |
-| `harness` | Claude SDK 测试和打包、MiniMax 配套脚本 |
+| `harness` | Claude Code adapter 测试和打包、MiniMax 配套脚本 |
 | `example` | 可选的应用程序类型检查、测试、构建和隔离的浏览器验收 |
 | `web` | TypeScript、Web/客户端测试和 Web 构建 |
 | `website` | 针对网站、已发布文档和依赖项变更的网站构建与输出检查 |
@@ -189,21 +194,39 @@ gh workflow run core-release --repo MiniMax-AI/OpenAgentCore --ref main \
 
 `.github/actionlint.yaml` 会选择 hygiene 和 lint。已知工作流变更会选择其使用方：CI review 和 actionlint 工作流运行 hygiene 和 lint；原生工作流变更会添加原生检查；API 验收工作流变更会添加启用容器验收的 API 检查；网站工作流变更会添加网站检查。共享 Node 操作会选择使用它的每个作业以及 lint。新工作流或未分类的工作流/操作会选择完整门禁，直至在计划器中声明其使用方。计划器测试和 CI 测量脚本运行 hygiene；更改计划器本身会运行完整门禁。
 
-Compose 模板和 Compose 测试发生变更时，会同时选择 `distribution` 固定数据和 `compose` 冒烟作业；Core、Web、共享 Go 软件包和镜像 Dockerfile 的变更也会选择冒烟作业。安装 Docker 后，可在本地运行 `python3 scripts/compose-smoke.py` 重复该测试。该脚本使用唯一的项目、自动分配的回环端口，并将在 `~/.oac/tests/` 下生成构件；退出时移除其容器和数据卷。CI 还会在冒烟步骤失败或中断后执行清理。诊断信息会显示容器状态，但不会打印 HTTP 响应正文或登录密钥。Core、Web 和 ingress 镜像都从当前检出构建，并带有当前检出提交的节点元数据；Web 提供占位页面而不是控制台构建，初始化容器禁用网络运行。升级阶段使用 `deploy/compose/smoke-pins.json` 中按标签和 SHA-256 固定的发布版本的已发布 `compose.yaml` 启动一个新安装，创建一个 Project、一个 Project 密钥和一个文件，然后使用当前检出的镜像运行安装器的预检（先 `core check-config`，再 `init`）和 `up --wait`。它会检查安装 ID、Core 密钥、Project、Project 密钥和文件均被保留，Core 和节点载荷报告当前检出的提交，并且数据库架构处于最新迁移。冒烟矩阵使用 Linux amd64 和 arm64 原生 runner；原生矩阵在 Linux、macOS 和 Windows 上构建并测试共享的 Core 安装器。
+Compose 模板和 Compose 测试发生变更时，会同时选择 `distribution` 固定数据和 `compose` 冒烟作业；Core、Web、共享 Go 软件包和镜像 Dockerfile 的变更也会选择冒烟作业。安装 Docker 后，可在本地运行 `python3 scripts/compose-smoke.py` 重复该测试。该脚本使用唯一的项目、自动分配的回环端口，并将在 `~/.oac/tests/` 下生成构件；退出时移除其容器和数据卷。CI 还会在冒烟步骤失败或中断后执行清理。诊断信息会显示容器状态，但不会打印 HTTP 响应正文或登录密钥。Core、Web 和 ingress 镜像都从当前检出构建，并带有当前检出提交的节点元数据；Web 提供占位页面而不是控制台构建，初始化容器禁用网络运行。冒烟矩阵使用 Linux amd64 和 arm64 原生 runner；原生矩阵在 Linux、macOS 和 Windows 上构建并测试共享的 Core 安装程序。
 
-Go 模块和工作区输入会选择后端、API（包括容器）、原生和分发检查。每个 Node 模块都拥有自己的清单和锁文件。网站依赖项会选择网站检查；Web 依赖项会选择 Web 和浏览器检查；示例依赖项会选择示例检查；共享 TypeScript 客户端依赖项会选择 Web、浏览器和示例检查；Claude 适配器依赖项会选择 Harness、原生和分发检查。共享包管理器配置会选择所有 Node 使用方。根 TypeScript 配置会选择 Web 和示例检查；适配器 TypeScript 配置会选择 Harness 和原生检查。每个所选集合都包含 hygiene。混合变更会累加其使用方，并且每个作业都读取同一计划，而不是维护各自的路径列表。例如，仅修改通知的 PR 会跳过数据库、浏览器和原生作业，而同时修改通知和 Core 的 PR 会添加后端和 API 检查。
+`scripts/ci_plan.py` 根据变更路径选择检查组。每个所选集合都包含 `hygiene`，混合变更会累加其使用方，并且每个作业都读取同一计划，而不是维护各自的路径列表。仅修改通知的 PR 会跳过数据库、浏览器和原生作业；同时修改通知和 Core 的 PR 会添加后端和 API 检查。
 
-`docs/` 和 `contracts/` 下已发布的文档和资源，以及 `docs.json`，会选择 hygiene 和 website。其他普通 Markdown 文件（包括源代码目录中的文档）仅选择 hygiene。生成的目录文件和配置参考章节会保留其分发新鲜度检查。Core `.go`、`.sql`、辅助脚本和配置输入会选择后端/API 检查；Web 源代码、样式和资源会选择 Web 检查。嵌入式原生资源和声明的测试固定数据目录无论后缀如何都会选择其使用方，其中包括 Markdown 提示和没有扩展名的数据。安装器变更会添加分发检查。Web 变更会添加 Web 检查和所有浏览器分片；Core/DB 变更会添加后端和官方客户端验收。共享契约、SDK、Runtime 输入和依赖项会根据计划器传播到其使用方。生成的目录和协议输入包括安装器、客户端和 UI 使用方。不要在可复用工作流中重复路径列表，也不要在必需工作流上添加 `paths` 过滤器。
+| 变更输入 | 所选检查组 |
+| --- | --- |
+| `docs/` 和 `contracts/` 下已发布的文档和资源，以及 `docs.json` | `hygiene`、`website` |
+| 其他普通 Markdown 文件，包括源代码目录中的文档 | `hygiene` |
+| Core `.go`、`.sql`、辅助脚本和配置输入 | `backend`、`api` |
+| Web 源代码、样式和资源 | `web`、`web-acceptance`（所有浏览器分片） |
+| 安装程序 | `distribution` |
+| 嵌入式原生资源和声明的测试固定数据目录，无论后缀 | 其使用方 |
+| 共享契约、SDK、Runtime 输入和依赖项；生成的目录和协议输入 | 其使用方，包括安装程序、客户端和 UI |
+| Go 模块和工作区输入 | `backend`、`api`（包括容器）、`native`、`distribution` |
+| 网站依赖项 | `website` |
+| Web 依赖项 | `web`、`web-acceptance` |
+| 示例依赖项 | `example` |
+| 共享 TypeScript 客户端依赖项 | `web`、`web-acceptance`、`example` |
+| Claude 适配器依赖项 | `harness`、`native`、`distribution` |
+| 共享包管理器配置 | 所有 Node 使用方 |
+| 根 TypeScript 配置 | `web`、`example` |
+| 适配器 TypeScript 配置 | `harness`、`native` |
+| Core/DB 变更 | `backend`、`api` 中的官方客户端验收 |
+
+不要在可复用工作流中重复路径列表，也不要在必需工作流上添加 `paths` 过滤器。生成的目录文件和配置参考章节会保留其分发新鲜度检查。
 
 即使计划或依赖项失败，最终 `check` 仍会运行。它要求计划有效且成功、每个所选作业均成功，并且每个未选择作业均被跳过。失败、取消、作业缺失、意外跳过或意外执行都会导致门禁失败。API/原生可复用工作流是此门禁的直接依赖项。同一 PR 上较新的运行会取消之前的运行。发布检查在请求的不可变 ref 上运行；原生打包在这些检查中执行一次，分发构建会等待其完成。
 
-要手动执行完整检查，请使用 **Actions → core-check → Run workflow**。遇到暂时性故障时，请使用 GitHub 的 **Re-run failed jobs**，这样已成功的作业可保持完成状态。PR 更新后，Actions 并发机制会取消已被取代的运行。构建和依赖项缓存可加快执行，但不能替代成功的测试。原生发布安装器通过 Actions 构建产物在同一发布工作流的不同作业之间传递。
-
-`CI review and Feishu notification` 工作流在 PR 合入 main 后运行。矩阵中的 **Code review** 和 **Docs review** 使用独立的 LLM 上下文，并设置 `fail-fast: false`。两者读取合并后的提交和 PR 差异。代码审查检查实现、仓库规则和已有 CI 结果，不触发新一轮测试。文档审查会核对行为变化与文档是否一致，即使没有修改文档；修改文档时，还会检查矛盾、重复维护的事实、CONTRIBUTING 规定的主题归属及中英文含义。每项问题包含文件和行号、依据及最小修改建议。审查只读取仓库，不修改文件。
+要手动执行完整检查，请使用 **Actions → core-check → Run workflow**。遇到暂时性故障时，请使用 GitHub 的 **Re-run failed jobs**，这样已成功的作业可保持完成状态。PR 更新后，Actions 并发机制会取消已被取代的运行。构建和依赖项缓存可加快执行，但不能替代成功的测试。原生发布安装程序通过 Actions 构建产物在同一发布工作流的不同作业之间传递。
 
-每项审查返回结构化结果（`ok`、`issues` 或 `incomplete`）及分项中文结论，作为 Actions 构建产物保留七天。**Combined Feishu notification** 等待两项审查结束，通过已有的 `FEISHU_WEBHOOK_URL` 发送一张包含两份结果的 Card 2.0 卡片；可选的 `FEISHU_WEBHOOK_SECRET` 用于签名。卡片固定分为 PR 信息、行为变化、代码与仓库规则、CI 结果和文档审查，各区之间使用分隔线。未发现问题时标题为绿色，发现问题时为红色，审查未完成且尚未发现问题时为黄色。只有通知 job 能读取 webhook 密钥。审查失败、报告缺失或格式无效时标为未完成，另一项已有的结果照常展示。某项审查失败时，通知 job 仍会运行。只有飞书返回 `code=0` 才确认送达；请求失败或送达状态不明时不自动重试，以免重复发消息。每项审查的执行超时为 25 分钟。审查和发送失败不会阻止合并；关闭未合并的 PR 不触发此流程。持有通知凭据时，工作流只检出合并后的提交。
+`CI review and Feishu notification` 工作流仅在 PR 合并到 main 后运行一次。它检出合并后的提交，读取该 PR 已有的检查和日志，通过 `FEISHU_WEBHOOK_URL` 发送一张飞书卡片，概述本次改动、是否符合仓库规则以及实际 CI 状态。它不会触发另一轮测试；审查或发送失败不会让作业失败，也不会阻止合并。关闭未合并 PR 不触发审查。该工作流只针对合并事件使用 `pull_request_target`，绝不在持有通知凭据时检出未合并 PR 的 head。
 
-浏览器作业各自拥有独立的固定数据和服务；对共享可变固定数据增加 worker 数不安全。失败的浏览器作业保留报告与 trace 七天。原生失败阶段摘要保留七天，详细输出留在 Actions 日志中；凭据和临时安装目录不上传。成功的原生归档仅用于显式手动打包或发布时上传，不重新压缩已压缩的归档。发布分发产物保留现有恢复策略；失败发布可以按前述方式复用原构建。
+浏览器作业各自拥有独立的固定数据和服务；对共享可变固定数据增加 worker 数不安全。失败的浏览器作业保留报告与 trace 七天。原生失败阶段摘要保留七天，详细输出留在 Actions 日志中；凭据和临时安装目录不上传。原生归档仅在显式手动打包或发布时构建并上传，不重新压缩已压缩的归档。发布分发产物保留现有恢复策略；失败发布可以按前述方式复用原构建。
 
 本地 Node 复合操作会安装固定版本的 pnpm，并根据锁文件、OS、架构、Node 版本和 pnpm 版本缓存其软件包存储。它缓存下载的软件包，而不是 `node_modules`；安装仍保持冻结状态。Go 分区会保留[发布](#publish-a-version)部分所述的现有模块/编译器缓存。三个原生平台独立运行；并行执行可缩短总耗时，但不会减少机器总时间。
 
diff --git a/docs/zh/runtime-bootstrap.md b/docs/zh/runtime-bootstrap.md
index 785208d98..4b492fed5 100644
--- a/docs/zh/runtime-bootstrap.md
+++ b/docs/zh/runtime-bootstrap.md
@@ -1,10 +1,42 @@
 ---
 title: "Runtime 引导"
 source: docs/runtime-bootstrap.md
-source_hash: 537197f388a57bb983c0e7e0b8a3bfe66b1e8e0ef7f4f1fef572ad7dcf724cb3
+source_hash: ea492d111c289832559930079861c512fd518f85b0886f7b3d6a93f33f752773
 ---
 
-沙箱提供商通过交付一个引导文件来启动托管 Runtime。本文负责提供商到 Runtime 的启动输入。类型与验证器位于 [`internal/runtimebootstrap`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/runtimebootstrap/bootstrap.go)；Go 提供商使用 [`runtime_bootstrap.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/sandbox/runtime_bootstrap.go) 中的 `sandbox.Bootstrap.RuntimeConnection()` 构造输入，SDK helper 原样转发序列化对象。提供商不读取或写入 Runtime 的私有认证存储。
+Runtime 引导协议连接沙箱提供商与其启动的托管 Runtime。提供商向 Runtime 交付一个引导文件，该文件是此次启动中 Runtime 唯一的认证输入。
+
+| 属性 | 内容 |
+| --- | --- |
+| 调用方 | 沙箱提供商。Go 提供商使用 [`runtime_bootstrap.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/sandbox/runtime_bootstrap.go) 中的 `sandbox.Bootstrap.RuntimeConnection()` 构造输入；SDK helper 原样转发序列化对象。 |
+| 实现方 | Runtime，以及[参考实现](#reference-implementations)中列出的提供商 |
+| 代码 | [`internal/runtimebootstrap`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/runtimebootstrap/bootstrap.go)：类型与验证器 |
+| 传输 | 一个 JSON 文件，其绝对路径传给 `oac-daemon connect --bootstrap-file` |
+| 版本规则 | 精确的 `version`（[启动输入](#launch-input)） |
+
+## 职责与就绪状态 {#responsibilities-and-readiness}
+
+| 参与方 | 拥有 | 绝不 |
+| --- | --- | --- |
+| 沙箱提供商 | 账户、挂载和工作区；交付该文件；Runtime 的资源与 Environment 绑定配置；以无特权 Runtime 账户启动 daemon | 读取或写入 Runtime 的私有认证存储 |
+| Runtime | 验证输入、认证和连接 | 为同一次启动接受第二个认证来源 |
+
+启动成功仅证明交付完成：经过认证的连接、已准备的能力和执行就绪是 [Core–Runtime 协议](runtime-protocol.md) 下的独立观测；[沙箱提供商协议](sandbox-provider.md#four-distinct-readiness-facts) 列出各自证明的事实。
+
+自托管执行器和运维人员供应的设备通过其他方式获取 daemon 身份；[机器连接 API](../../contracts/agents-api/zh/machine-api.md#credentials) 列出所有凭据来源。它们都进入同一 Runtime 执行循环。
+
+## 启动顺序 {#startup-order}
+
+```mermaid
+sequenceDiagram
+    participant P as Sandbox Provider
+    participant R as Runtime daemon
+    participant C as Core
+    Note over P: Write the bootstrap file
+    P->>R: start oac-daemon connect --bootstrap-file PATH
+    Note over R: Validate the file, read the credential into memory
+    R->>C: Connect over the Core-Runtime protocol
+```
 
 ## 启动输入 {#launch-input}
 
@@ -22,19 +54,26 @@ oac-daemon connect --bootstrap-file /home/runtime/runtime-bootstrap.json
 | `harness` | 会话固定选择的 Harness 标识；托管 Runtime 只探测并注册此 Harness |
 | `credential` | Core 签发的非空 daemon 凭据，不含空白或 NUL |
 
-解码器拒绝未知、重复、缺失和大小写别名字段，拒绝其他版本及超过 `runtimebootstrap.MaxBytes`（16 KiB）的文档。错误不包含提交的值。文件缺失或格式错误时，daemon 在连接前失败。
+解码器拒绝未知、重复、缺失和大小写别名字段，拒绝其他版本及超过 `runtimebootstrap.MaxBytes`的文档。错误不包含提交的值。文件缺失或格式错误时，daemon 在连接前失败。
 
 该文件是此次启动唯一的认证输入：daemon 拒绝将其与自托管注册选项组合使用，并将凭据读入内存而不保存到存储的 profile。凭据不进入命令参数、环境变量或回执。提供商为进程重启保留该文件，仅在明确清理自己拥有的资源时删除。
 
-## 职责与就绪状态 {#responsibilities-and-readiness}
+## 超时与限制 {#timeouts-and-limits}
 
-提供商创建账户、挂载和工作区，交付该文件，设置 Runtime 的资源与 Environment 绑定配置，然后以无特权 Runtime 账户启动 daemon。Docker 将文件写入 Runtime 拥有的 home volume；microsandbox 和 E2B 在启动同一命令之前交付文件。
+| 数值 | 适用对象 | 超出时 |
+| --- | --- | --- |
+| 16 KiB（`runtimebootstrap.MaxBytes`） | 引导文档 | 解码器拒绝该文档，daemon 在连接前失败。 |
 
-Core 从分配所属会话派生 `harness`。组合镜像可以包含多个 Harness，但托管 Runtime 只探测所选 Harness；未知、缺失或不可用的选择会失败，不探测其他 Harness。启动协议版本为 2，Core、提供商辅助程序和新启动的 Runtime 镜像需配套升级；已有分配保留原启动文件和 Runtime。自托管安装仍探测已安装的 Harness 集合。
+Core 从分配所属会话派生 `harness`。组合镜像可以包含多个 Harness，但托管 Runtime 只探测所选 Harness；未知、缺失或不可用的选择会失败，不探测其他 Harness。启动协议版本为 2，Core、提供商辅助程序和 Runtime 镜像必须配套部署；安装不支持从另一发行版升级。自托管安装仍探测已安装的 Harness 集合。
 
 Runtime 验证输入，并负责认证与连接。启动成功仅证明交付完成：经过认证的连接、已准备的能力和执行就绪是 [Core–Runtime 协议](runtime-protocol.md) 下的独立观测；[Sandbox Provider 指南](sandbox-provider.md#four-distinct-readiness-facts) 列出各自证明的事实。
 
-自托管执行器和运维人员供应的设备通过其他方式获取 daemon 身份；[机器连接 API](../../contracts/agents-api/zh/machine-api.md#credentials) 列出所有凭据来源。它们都进入同一 Runtime 执行循环。
+## 参考实现 {#reference-implementations}
+
+| 提供商 | 交付方式 |
+| --- | --- |
+| Docker | 将文件写入 Runtime 拥有的 home volume。 |
+| microsandbox、E2B | 在启动同一命令之前交付文件。 |
 
 ## 托管暂停控制 {#hosted-suspension-control}
 
diff --git a/docs/zh/runtime-protocol.md b/docs/zh/runtime-protocol.md
index 777cfbb58..c0d1e047a 100644
--- a/docs/zh/runtime-protocol.md
+++ b/docs/zh/runtime-protocol.md
@@ -1,12 +1,18 @@
 ---
 title: "Core–Runtime 协议"
 source: docs/runtime-protocol.md
-source_hash: ed661e1a73a2a96d7a5d654e79be78ae3a36378a20b182c8c6165e1e804aaa5b
+source_hash: 6d12d0da86e8f5a14ac283baf79e49902027e0510e95a9d70cca998f8d2584e9
 ---
 
-此协议在 Runtime daemon 获取机器凭据后连接 Core 与 daemon，定义 daemon 连接上消息的含义和顺序。wire 类型、限制和验证器仅在 [`internal/agentdaemon/proto`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/internal/agentdaemon/proto) 中定义一次；Core 的 [gateway](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/runtimegateway) 与参考 Runtime 的 [dispatcher](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/apps/daemon/internal/dispatch) 都使用它们，因此无需同步第二套 payload schema。签发凭据和打开连接的 HTTP 路由见[机器连接 API](../../contracts/agents-api/zh/machine-api.md)。
+Core–Runtime 协议连接 Core 与 Runtime daemon，定义 daemon 连接上消息的含义和顺序。托管和自托管 Runtime 使用同一协议。
 
-托管和自托管 Runtime 使用同一协议。Harness 通过 [Harness adapter 契约](../../contracts/agents-api/zh/harness-onboarding.md)接入，该契约负责 Runtime registry 后的 Executor 和 Turn 生命周期义务。
+| Property | Value |
+| --- | --- |
+| 调用方 | Core 的 [gateway](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/runtimegateway) |
+| 实现方 | 参考 Runtime 的 [dispatcher](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/apps/daemon/internal/dispatch)。Harness 通过 [Harness 协议](../../contracts/agents-api/zh/harness-onboarding.md)接入，该协议负责 Runtime registry 后的 Executor 和 Turn 生命周期义务。 |
+| 代码 | [`internal/agentdaemon/proto`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/internal/agentdaemon/proto)：wire 类型、限制和验证器仅定义一次，供两端共用，因此无需同步第二套 payload schema |
+| 传输 | 通过 `/api/v1/agent-daemon/ws` 的 WebSocket 传输 JSON [envelope](#envelope-and-identity)。签发凭据和打开连接的 HTTP 路由见[机器连接 API](../../contracts/agents-api/zh/machine-api.md)。 |
+| 版本规则 | `proto.Version` 精确匹配（[版本](#versioning)） |
 
 连接帧受 `proto.MaxFrameBytes` 的 4 MiB 上限约束。Core 会完整记录传输范围内的事件，不截断 payload。普通 journal 批次最多包含 64 个事件、合计 1 MiB；更大的单个事件独立存储。每个 Turn 仍限制为 65,536 个事件和 32 MiB，并在限制之外预留一条终态记录。journal 失败会使 Turn 失败并保留已提交的 Items。`execution journal failed` 日志记录 Project、Session、Turn ID、追踪上下文、阶段、事件类型、字节数、journal 位置以及有限的失败分类或 SQLSTATE；不记录事件 payload 或原始错误文本。
 
@@ -14,71 +20,59 @@ source_hash: ed661e1a73a2a96d7a5d654e79be78ae3a36378a20b182c8c6165e1e804aaa5b
 
 ## 所有权与连接 {#ownership-and-connection}
 
-Core 拥有持久化的 Session、Turn、input 和 Environment 记录、调度与协调。Runtime 拥有原生 Executor、活动 Turn、传输状态和清理责任，直到完成结算。沙箱提供商拥有执行位置与外围计算资源。释放执行准入或关闭 Executor 不会删除、暂停或回收沙箱。daemon 不是隔离边界；参见 [Runtime 与外层隔离](concepts.md#runtime-and-outer-isolation)。
+| 参与方 | 拥有 | 绝不 |
+| --- | --- | --- |
+| Core | 持久化的 Session、Turn、input 和 Environment 记录、调度与协调 | 重连后重放 input、初始化、transfer 或未决 mutation |
+| Runtime | 原生 Executor、活动 Turn、传输状态和清理责任，直到完成结算 | 因释放执行准入或关闭 Executor 而删除、暂停或回收沙箱；daemon 不是隔离边界（参见 [Runtime 与外层隔离](concepts.md#runtime-and-outer-isolation)） |
+| 沙箱提供商 | 执行位置与外围计算资源 | 拥有 Executor 或 Turn |
 
 Runtime 按以下顺序连接：
 
-1. 获取 daemon 凭据和 device ID。[机器连接 API](../../contracts/agents-api/zh/machine-api.md#credentials) 列出凭据类型；项目 API 密钥和 Core 密钥都不是 Runtime 凭据。
-2. 调用 `POST /api/v1/agent-daemon/bootstrap`，通过 Bearer header 提供凭据，并提供 device ID。使用返回的连接 URL。
-3. 连接 `/api/v1/agent-daemon/ws` 的 WebSocket，传入 `device_id`、`version` 查询参数和 Bearer header。凭据不得出现在 URL、payload 日志或 trace 中。
-4. 立即发送 heartbeat，之后按 bootstrap 返回的间隔发送。每个 heartbeat 声明 `supported_agent_kinds`、其可用性和[能力](#capability-declarations)。第一个 heartbeat 之前能力未知；heartbeat 中缺失的 kind 视为未声明。两者都不允许推断。
-5. 交换有序 JSON [envelope](#envelope-and-identity)。Heartbeat 仅证明存活，不证明执行进度，也不充当此前消息的回执。
-
 wire 版本为 [`proto.Version`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/version.go)，独立于 heartbeat 报告的 Runtime 构建版本。Core 仅接受精确匹配，包括 patch 部分。不匹配时，在任何 dispatch 前返回 HTTP 426 `incompatible_version`；daemon 将其视为永久错误并停止重连。破坏性变更仍要求两端版本匹配。新增的传输能力可通过本文定义的显式、带版本的协商启用，无需改变基础 wire 版本。
 
-每条物理连接拥有新的路由、admission handle 和传输状态。同一设备的新连接替代旧连接：Core 隔离 owner lease，移除旧 Run 路由，新连接不继承这些状态。有效凭据和连接不授权选择其他 Session 或 Environment 绑定。
+- [机器连接 API](../../contracts/agents-api/zh/machine-api.md#credentials) 列出凭据类型；项目 API 密钥和 Core 密钥都不是 Runtime 凭据。
+- 两个请求都通过 Bearer header 提供凭据。凭据不得出现在 URL、payload 日志或 trace 中。
+- 立即发送第一个 heartbeat，之后按 bootstrap 返回的间隔发送。每个 heartbeat 声明 `supported_agent_kinds`、其可用性和[能力](#capability-declarations)。第一个 heartbeat 之前能力未知；heartbeat 中缺失的 kind 视为未声明。两者都不允许推断。
+- Heartbeat 仅证明存活，不证明执行进度，也不充当此前消息的回执。
+
+每条物理连接拥有新的路由、admission handle 和传输状态。同一设备的新连接替代旧连接：Core 移除旧 Run 路由，新连接不继承这些状态。有效凭据和连接不授权选择其他 Session 或 Environment 绑定。
+
+## 版本 {#versioning}
+
+wire 版本为 [`proto.Version`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/version.go)，独立于 heartbeat 报告的 Runtime 构建版本。Core 仅接受精确匹配，包括 patch 部分。不匹配时，在任何 dispatch 前返回 HTTP 426 `incompatible_version`；daemon 将其视为永久错误并停止重连。应一起部署版本匹配的两端；payload 或其语义的任何变更都会改变 `proto.Version`。
 
 ## 能力声明 {#capability-declarations}
 
-[`inbound.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) 中的 `AgentKindCapabilities` 描述一个 Runtime 与 Harness 组合，独立于 `available` 和 Core 的 engine profile。每个字段都是 `CapabilitySupport`：支持或不支持。零值表示未指定且无效，即使 Harness 不可用也如此。注册在修改 registry 前验证完整声明；不存在隐含的基础 descriptor。
+[`inbound.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) 中的 `AgentKindCapabilities` 描述一个 Runtime 与 Harness 组合，独立于 `available`。它以 Harness 声明的能力为起点，即其最大能力范围，发现过程只会把它收窄到该安装已验证的范围。每个字段都是 `CapabilitySupport`：支持或不支持。零值表示未指定且无效，即使 Harness 不可用也如此。注册在修改 registry 前验证完整声明；不存在隐含的基础 descriptor。
 
 wire 上每个字段都是 JSON boolean，所有字段都必须出现，包括 `false`。不完整声明编码失败。解码拒绝省略、null、无效和未知字段，以及缺失的 capability 对象。无效 heartbeat 会清空连接的 admission snapshot 并关闭 transport；这不证明原生完成或取消结果。
 
 每个已准入的 Executor 和 Turn 保留准入时的声明。后续 heartbeat 不能给已有 owner 增加操作。可选操作在任何原生调用前检查此快照；存在 Go interface 不代表支持。已声明操作返回 `agent.ErrUnsupportedOperation` 属于契约违规，与不可用、原生调用失败或不确定写入不同。不确定操作保留回执与所有权，绝不自动重放。工作区支持包括公共 Runtime 工作区实现，因此原生 adapter 不支持的 workspace 方法不会禁用该组合。
 
-新增字段要求每个生产声明都作出明确决定。契约测试为注册、wire 往返和持久化 boolean 投影逐一枚举字段；共享测试 fixture 单独列出字段，不为未来字段提供默认值。[Harness 接入](../../contracts/agents-api/zh/harness-onboarding.md)负责各声明的 adapter 侧规则。
+新增字段要求每个生产声明都作出明确决定。契约测试为注册、wire 往返和持久化 boolean 投影逐一枚举字段；共享测试 fixture 单独列出字段，不为未来字段提供默认值。[Harness 协议](../../contracts/agents-api/zh/harness-onboarding.md#register-the-adapter)负责各声明的 adapter 侧规则。
 
-声明描述 Runtime 能做什么。Core 仅在 Harness 的 engine profile 也通过资格验证时准入公开功能，并在设备选择及领取 Turn 前的最终检查中检查选定设备的声明：
+声明描述 Runtime 能做什么。Core 仅在 Harness 的声明也准入时准入公开功能，并在设备选择及领取 Turn 前的最终检查中检查选定设备的声明：
 
 | 能力 | Core 何时要求 |
 | --- | --- |
-| `streaming`, `steering`, `durable_turns`, `durable_input_receipts`, `preparation`, `execution_controls`, `tool_observations` | 始终要求，适用于该 Harness 上每次执行（`available` 为 true） |
+| `streaming`, `durable_turns`, `durable_input_receipts`, `preparation`, `execution_controls`, `tool_observations` | 始终要求，适用于该 Harness 上每次执行（`available` 为 true） |
 | `environment_none` | Environment 类型为 `none` |
 | `local_environment`, `workspace_read_preparation`, `workspace_output_export` | Environment 类型为 `openai_hosted` 或 `self_hosted` |
 | `workspace_read_preparation` | 空闲 Files 目录读取需要只读 preparation |
 | `native_session_recovery` | Session 已启动过 Turn，但未记录原生 Session ID |
-| `retained_native_history` | Environment 使用外部工作区绑定；自带工作区存储不要求此能力 |
-| `web_search_control`, `text_verbosity` | Harness 的 engine profile 声明该控制 |
-| `structured_output` 和 `message_items` | Agent 请求 `json_schema` 输出 |
+| `retained_native_history` | Environment 使用外部工作区绑定；提供商自有磁盘不要求此能力 |
+| `structured_output` 和 `message_items` | Agent 请求 `json_schema` 输出。声明 `message_items` 的 Runtime 会给文本 delta 标注原生 item ID，并通过 `output_message` frame 报告消息开始、完成、phase 和完成文本 |
 | `subagent_observations` | `multi_agent.enabled` 为 true |
 | `subagent_control` | `multi_agent.enabled` 为 false |
 | `tool_search` | Agent 启用 tool search 或延迟 function 加载 |
-| `programmatic_tool_calling_disable` | Agent 明确禁用 programmatic tool calling |
 | `function_tools` | Agent 声明 function tool |
 | `message_images`, `function_result_images` | 消息或 function result 携带图像 |
-| `mcp_http_tools`, `mcp_http_required`, `mcp_http_bearer_auth` | Agent 声明 HTTP MCP server；其中一个为 `required`；其中一个选用了 Vault 凭据 |
+| `mcp_http_tools`, `mcp_http_required`, `mcp_http_bearer_auth` | Agent 声明 MCP server（HTTP 或 stdio）；其中一个为 `required`；其中一个选用了 Vault 凭据 |
 
 `retained_native_history` 表示 Runtime 与 Harness 组合可在确认原生进程关闭后，从私有持久状态重新打开同一个原生 Session。它不保证恢复进程内存、后台进程或外部连接。所选文件系统还必须独立提供持久存储。Core 根据旧设备已持久化的声明判断能否释放计算而不终结 Session，并在准入执行前验证新 Runtime。原生历史缺失或无效时明确失败，绝不授权新建原生会话或重放此前输入。
 
 Core 对 `usage` 和 `resume` 没有准入规则。
 
-`execution_prepare` 的配置携带 Core 为各 Run 设置的显式启用项：
-
-| 字段 | Core 设置方式 |
-| --- | --- |
-| `agent_options` | 始终设置 Agent 的 `model` 和 `system_prompt`；Session 冻结了模型提供商时设置 `model_provider`；Agent 设置 `x_agents_core.harness_config` 时设置 `harness_config`。Core 不发送其他键；Runtime 在准备之前以 `unsupported_configuration` 拒绝任何其他键 |
-| `execution_controls` | 始终设置：web search 为 `disabled`、解析后的 text verbosity（默认 `medium`）、明确禁用 programmatic tool calling，以及任何 `json_schema` 输出格式。原生选项名称由 adapter 负责 |
-| `observe_messages` | Runtime 声明 `message_items` 时设置。文本 delta 随后携带原生 item ID，`output_message` frame 报告消息开始、完成、phase 和完成文本 |
-| `observe_subagent_identities`, `disable_subagents` | 根据 Agent 的 `multi_agent.enabled` 设置 |
-| `disable_execution_environment` | Environment 类型为 `none` 时设置 |
-| `local_environment` | 为 `openai_hosted` 和 `self_hosted` 设置，包含精确的 Environment 绑定。请求不携带 working directory；Runtime 按自身绑定检查 `workspace_directory` |
-| `require_existing_native_session` | 需要恢复原生 Session 时设置 |
-| `prompt_steer` 上的 `durable_receipt` | Core 交付的每个活动输入都设置 |
-
-执行配置必须且只能包含 `local_environment` 和 `disable_execution_environment` 之一；两者都缺失或同时存在时，`execution_prepare` 以 `unsupported_configuration` 拒绝。
-
-未携带显式启用项的请求保留未启用时的 frame 和字段。只要 adapter 映射了原生工具，`tool_call` frame 就携带与 engine 无关的 `observation`。
-
 ## Envelope 与身份 {#envelope-and-identity}
 
 每个数据 frame 都是一个 JSON [`Envelope`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/envelope.go)：`type`、随类型变化的 `id`、类型化 `payload` 和可选 W3C `trace`。trace 仅用于诊断关联；trace 数据缺失或无效时创建本地 trace，不改变所有权。不要将 trace ID 用作 request ID。
@@ -104,42 +98,131 @@ Core 对 `usage` 和 `resume` 没有准入规则。
 | --- | --- | --- |
 | `runtime_prepare` | `runtime_prepare_result` | [初始化与能力传输](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/runtime_prepare.go) |
 | `execution_prepare`, `execution_start`, `execution_release` | `preparation_status` | [执行准入](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/preparation.go) |
-| `prompt_cancel` | `delta`, `thinking`, `output_message`, `tool_call`, `usage`, `error`, `done`, `heartbeat`, `interaction_decision_ack` | [请求](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/outbound.go)、[事件与能力](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) |
+| `prompt_cancel` | `delta`, `reasoning`, `output_message`, `tool_call`, `usage`, `error`, `done`, `heartbeat`, `interaction_decision_ack` | [请求](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/outbound.go)、[事件与能力](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) |
 | `prompt_steer` | `prompt_steer_ack` | [活动输入回执](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/steering.go) |
-| `function_result` | `function_call`, `interaction_decision_ack` | [Function 调用](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/functions.go) |
+| `function_result` | `function_call`, `function_call_withdrawn`, `interaction_decision_ack` | [Function 调用](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/functions.go) |
 | `workspace_read`, `workspace_write`, `workspace_export` | 对应的 `*_result` | [读取](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/workspace_read.go)、[写入](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/workspace_write.go)、[导出](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/workspace_export.go) |
 | `environment_quiesce`, `environment_resume` | `environment_quiesced`, `environment_resumed` | [暂停 fencing](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/suspend.go) |
 
 初始、已准备和活动输入使用同一[有序 MessageInput](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/message_input.go)。Adapter 保留消息与内容顺序，并明确拒绝不支持的内容；仅文本 transport 拒绝图像内容而不丢弃它。[消息输入契约](../../contracts/agents-api/zh/message-content.md)负责公开图像 profile、空白规则和各 Harness 的原生转换。
 
+Subagent 发起调用时，`function_call` 携带 `native_id` 和 `turn_id`，含义与 `subagent_turn` 中相同；Run 自身发起的调用两者均为空。Adapter 在调用之前发送该子级的 `subagent_identity` 和 `subagent_turn`，Core 用同一个 `call_id` 的 `function_result` 作答。
+
+`function_call_withdrawn` 携带某个 `function_call` 的 `call_id`、`native_id` 和 `turn_id`，表示原生 Harness 永远不会为它应用结果，例如 Codex Subagent 的 Turn 已结束且原生丢弃了其请求。Core 不再要求回答该调用，并拒绝之后为它提交的结果。adapter 以 `not_pending` 确认已在传输中的 `function_result`，Core 随后等待撤回或 Turn 结束，既不让 Turn 失败，也不重发该结果。
+
+`reasoning` frame 按原生 `id` 报告 Run 的一个原生推理 item。状态为 `in_progress` 的 frame 在 `delta` 中携带原生部分 `index` 的下一段文本，`index` 从 0 开始，取当前部分或下一个部分；状态为 `completed` 的 frame 结束该 item 且不带文本。适配器不上报没有文本的推理，并且只有 `execution_controls` 设置了推理摘要时，才发送 `reasoning` frame 或 `reasoning` Subagent Item 快照。文本内容见 [OpenAI 兼容性](../../contracts/agents-api/zh/index.md#differences-from-openai)。
+
 Usage frame 和最终 usage snapshot 都携带当前执行的累计测量，替换之前的快照；不要相加。缺失的测量表示未知，不是零。
 
 ## 准备与执行顺序 {#preparation-and-execution-order}
 
-无论托管还是用户自有环境，每条连接都通过 `runtime_prepare` 初始化 Environment；[Environment 契约](../../contracts/agents-api/zh/environments.md#runtime-capability-preparation)负责准备内容和时机。传输文件或 archive 时，发送 `begin`，等待 `ready`，发送有序 chunk 并等待每个匹配的 `received` offset，再发送 `commit` 并等待 `completed`。初始化和终结阶段使用不含文件数据的类型化 header。每个 `begin` 必须携带 `budget_ms`，取值为 1 至 1800000 的整数，表示 Core 所拥有的初始化预算剩余毫秒数；chunk 和 commit 不携带该字段。Runtime 从收到 `begin` 起执行此相对预算，Core 的等待不超过原操作期限。完整的 `begin`–`commit` 暂存阶段另有两分钟限制；应用已提交操作及等待 `completed` 使用剩余初始化预算，不受暂存期限限制。应用前到期会拒绝传输；应用中到期则在本地变更停止后报告 `unknown`，绝不授权重放。使用共享 validator 验证预期结果、offset、size 和有限错误 code。每条连接允许一个 transfer。chunk 回执确认暂存字节，不确认安装；完成的 commit 确认该操作，不证明后续 Turn 已运行。
+无论托管还是用户自有环境，每条连接都通过 `runtime_prepare` 初始化 Environment；[Environment 契约](../../contracts/agents-api/zh/environments.md#runtime-capability-preparation)负责准备内容和时机。文件或 archive 通过一次 transfer 传输，流程如下。
+
+```mermaid
+sequenceDiagram
+    participant C as Core
+    participant R as Runtime
+    C->>R: runtime_prepare begin (budget_ms)
+    R-->>C: runtime_prepare_result ready
+    loop each chunk
+        C->>R: runtime_prepare chunk (offset)
+        R-->>C: runtime_prepare_result received (offset)
+    end
+    C->>R: runtime_prepare commit
+    R-->>C: runtime_prepare_result completed
+```
+
+初始化和终结阶段使用不含文件数据的类型化 header。每个 `begin` 携带 `budget_ms`，表示 Core 所拥有的初始化预算剩余毫秒数；chunk 和 commit 不携带该字段。Runtime 从收到 `begin` 起执行此相对预算，Core 的等待不超过原操作期限。`begin`–`commit` 暂存阶段另有独立限制；应用已提交操作及等待 `completed` 使用剩余初始化预算，不受暂存限制约束。应用前到期会拒绝传输；应用中到期则在本地变更停止后报告 `unknown`，绝不授权重放。使用共享 validator 验证预期结果、offset、size 和有限错误 code。每条连接允许一个 transfer。chunk 回执确认暂存字节，不确认安装；完成的 commit 确认该操作，不证明后续 Turn 已运行。
+
+执行 Turn 流程如下。Core 在发送 `execution_prepare` 之前订阅 preparation status，在发送 `execution_start` 之前订阅 Run，因为输出可能与 status 竞争。
+
+```mermaid
+sequenceDiagram
+    participant C as Core
+    participant R as Runtime
+    participant H as Harness adapter
+    Note over C: Subscribe to preparation status
+    C->>R: execution_prepare (Session configuration, no Run input)
+    alt new Executor
+        R-->>C: preparation_status preparing
+        R->>H: ExecutorFactory
+        R-->>C: preparation_status ready (Executor ID, handle, revision, expiry)
+    else reused healthy Executor
+        R-->>C: preparation_status ready
+    end
+    alt abandon before start
+        C->>R: execution_release
+        R-->>C: preparation_status released
+    else start
+        Note over C: Subscribe to the Run
+        C->>R: execution_start (Executor ID, handle, Run ID, input)
+        R-->>C: preparation_status starting
+        R->>H: StartTurn
+        R-->>C: preparation_status started
+        loop until a native terminal outcome
+            R-->>C: delta, tool_call, usage, error
+        end
+        alt Run ends
+            R-->>C: done
+        else cancel during the Run
+            C->>R: prompt_cancel
+            R-->>C: interaction_decision_ack
+        end
+    end
+```
+
+- `preparing` 表示 Runtime 拥有 preparation。`ready` 提供 Executor ID、admission handle、revision 和 expiry。两者都不提交用户输入。
+- 有效的 `execution_start` 将预约转移一次。`started` 确认转移给 Turn，不确认完成。
+- 消费 Run 事件，直到原生终结结果或观测丢失。执行 error 后跟随 `done`，关闭流；之前的 error 仍属于结果的一部分。
+- start 前放弃时发送 `execution_release`。所有权转给 Run 后使用 `prompt_cancel`；释放旧 handle 不能取消后继 Turn。
+
+preparation 预约每个 Turn 的准入，而不是新 Executor。它携带明确 Session 身份和不可变配置，不包含模型输入或 Run ID。新请求返回连接本地 handle 与所属 Executor ID；复用健康 Executor 时直接返回 `ready`，无需原生 preparation。每个 handle 的 revision 决定 status 观测顺序：忽略旧的或重复的 revision，不将 status 应用于其他 handle。admission 按下列状态转移。`rejected` 控制操作携带 `operation` 和 error code，不替代 handle 的当前 revision。释放 admission 仅放弃该 admission；不关闭 Session 的空闲 Executor，也不取消后续 Turn。
+
+```mermaid
+stateDiagram-v2
+    direction LR
+    [*] --> preparing: execution_prepare
+    [*] --> ready: reused Executor
+    preparing --> ready
+    ready --> starting: execution_start
+    starting --> started
+    starting --> failed
+    preparing --> released: execution_release
+    ready --> released: execution_release
+    preparing --> expired
+    ready --> expired
+    preparing --> failed
+    ready --> failed
+```
+
+preparation 和 start 在 receive loop 与 router lock 之外运行。admission 在固定截止时间到期，重试不延长该时间；到期不解除 Runtime 完成清理结算的义务。Runtime 分别限制活动 preparation、execution 和保留的空闲资源，关闭中或不确定资源持续计入限制，直到清理成功。明确的 `execution_prepare` 拒绝若为 `preparation_capacity`，会让排队 Turn 保持未领取，供 Worker 重试，包括清理占用容量的情况；其他错误或不确定交付都不授权重放。Runtime 保留有限数量的 admission 记录，旧 handle 不会消耗替代项的 admission。这些记录仅属于连接，不是持久化输入重放。
 
-执行 Turn 分为五步：
+Executor 空闲到期属于 Runtime 资源策略，与 Core 的活动 Turn 并发限制独立。关闭时 Runtime 关闭活动和空闲 Executor，保留关闭失败的目标，并允许稍后串行重试。普通断连会关闭失败的 transport 并保留原 router，直到 shutdown 成功；等待超时或清理失败不授权重连，进程 shutdown 继续等待，不丢弃自己拥有的原生资源。对于 Runtime 初始化，shutdown 会等待同步 apply 操作和回执发送结束后才释放连接；`unknown` 结果仍是不确定结果，并阻止该 Router 上的后续准备，但本地变更停止后不再阻止重连。Core 保留失败的初始化状态，绝不重放初始化。工作区操作在跨 Turn 和 Executor 关闭后仍保留绑定与结算规则。
 
-1. 订阅 preparation status，再发送 `execution_prepare`，携带不可变 Session 配置，不包含 Run 输入。
-2. `preparing` 表示 Runtime 拥有 preparation。`ready` 提供 Executor ID、admission handle、revision 和 expiry。两者都不提交用户输入。
-3. 订阅 Run，再发送 `execution_start`，携带该 Executor ID、handle、Run ID 和有序输入。有效 start 将预约转移一次。`started` 确认转移给 Turn，不确认完成；输出可能与 status 竞争，因此必须事先有 subscriber。
-4. 消费 Run 事件，直到原生终结结果或观测丢失。执行 error 后跟随 `done`，关闭流；之前的 error 仍属于结果的一部分。
-5. start 前放弃时发送 `execution_release`。所有权转给 Run 后使用 `prompt_cancel`；释放旧 handle 不能取消后继 Turn。
+挂起先关闭准入、排空已接纳工作与回执，同时保留已结算的空闲 Executor，随后才确认 `environment_quiesced`。活动、准备中、失效或其他未结算的所有者会阻止挂起。整个挂起期间停止空闲到期计时并隔离其回调；精确匹配且已认证的 `environment_resume` 为同一批所有者恢复一个新的空闲计时间隔。只有这种计划性重连跨 socket 保留 Router 与原生所有者；普通断连、shutdown 和连接生命周期取消仍要求确认清理完成。排空失败后，准入保持关闭直到 shutdown。恢复后的准备仍检查相同的原生身份与不可变配置，包括凭据冲突；绝不静默替换配置冲突的驻留 Executor。沙箱提供商仍负责其 checkpoint 实现的文件系统刷新和计算停止保证；Runtime 静止本身既不证明这些保证，也不证明原生 RAM 或外部网络连接已恢复。
 
-preparation 预约每个 Turn 的准入，而不是新 Executor。它携带明确 Session 身份和不可变配置，不包含模型输入或 Run ID。新请求返回连接本地 handle 与所属 Executor ID；复用健康 Executor 时直接返回 `ready`，无需原生 preparation。每个 handle 的 revision 决定 status 观测顺序：忽略旧的或重复的 revision，不将 status 应用于其他 handle。典型状态转移为 `preparing → ready → starting → started`，或由 `released`、`expired`、`failed` 终止。`rejected` 控制操作携带 `operation` 和 error code，不替代 handle 的当前 revision。释放 admission 仅放弃该 admission；不关闭 Session 的空闲 Executor，也不取消后续 Turn。
+### 执行配置 {#execution-configuration}
 
-preparation 和 start 在 receive loop 与 router lock 之外运行。admission 在授予五分钟后到期，重试不延长截止时间；到期不解除 Runtime 完成清理结算的义务。Runtime 分别限制活动 preparation、execution 和保留的空闲资源，关闭中或不确定资源持续计入限制，直到清理成功。明确的 `execution_prepare` 拒绝若为 `preparation_capacity`，会让排队 Turn 保持未领取，供 Worker 重试，包括清理占用容量的情况；其他错误或不确定交付都不授权重放。Runtime 最多保留 64 条 admission 记录，旧 handle 不会消耗替代项的 admission。这些记录仅属于连接，不是持久化输入重放。
+`execution_prepare` 的配置携带 Core 为各 Run 设置的显式启用项：
 
-Executor 空闲到期属于 Runtime 资源策略，与 Core 的活动 Turn 并发限制独立。关闭时 Runtime 关闭活动和空闲 Executor，保留关闭失败的目标，并允许稍后串行重试。普通断连会关闭失败的 transport 并保留原 router，直到 shutdown 成功；等待超时或清理失败不授权重连，进程 shutdown 继续等待，不丢弃自己拥有的原生资源。对于 Runtime 初始化，shutdown 会等待同步 apply 操作和回执发送结束后才释放连接；`unknown` 结果仍是不确定结果，并阻止该 Router 上的后续准备，但本地变更停止后不再阻止重连。Core 保留失败的初始化状态，绝不重放初始化。工作区操作在跨 Turn 和 Executor 关闭后仍保留绑定与结算规则。
+| 字段 | Core 设置方式 |
+| --- | --- |
+| `agent_options` | 始终设置 Agent 的 `model` 和 `system_prompt`；Session 冻结了模型提供商时设置 `model_provider`；Agent 设置 `x_agents_core.harness_config` 时设置 `harness_config`。Core 不发送其他键；Runtime 在准备之前以 `unsupported_configuration` 拒绝任何其他键 |
+| `execution_controls` | 始终设置：解析后的 text verbosity（默认 `medium`），以及 Agent 设置的每个选项，包括 web search（mode、`context_size`、`allowed_domains`、`location`）、programmatic tool calling、reasoning effort 和 summary、非 `auto` 的 service tier，以及 `json_schema` 输出格式。Core 在分发前按 Harness 声明校验每个值；原生选项名称属于适配器 |
+| `observe_subagent_identities`, `disable_subagents` | 根据 Agent 的 `multi_agent.enabled` 设置 |
+| `disable_execution_environment` | Environment 类型为 `none` 时设置 |
+| `local_environment` | 为 `openai_hosted` 和 `self_hosted` 设置，包含精确的 Environment 绑定。请求不携带 working directory；Runtime 按自身绑定检查 `workspace_directory` |
+| `require_existing_native_session` | 需要恢复原生 Session 时设置 |
 
+执行配置必须且只能包含 `local_environment` 和 `disable_execution_environment` 之一；两者都缺失或同时存在时，`execution_prepare` 以 `unsupported_configuration` 拒绝。
 
-挂起先关闭准入、排空已接纳工作与回执，同时保留已结算的空闲 Executor，随后才确认 `environment_quiesced`。活动、准备中、失效或其他未结算的所有者会阻止挂起。整个挂起期间停止空闲到期计时并隔离其回调；精确匹配且已认证的 `environment_resume` 为同一批所有者恢复一个新的空闲计时间隔。只有这种计划性重连跨 socket 保留 Router 与原生所有者；普通断连、shutdown 和连接生命周期取消仍要求确认清理完成。排空失败后，准入保持关闭直到 shutdown。恢复后的准备仍检查相同的原生身份与不可变配置，包括凭据冲突；绝不静默替换配置冲突的驻留 Executor。沙箱提供商仍负责其 checkpoint 实现的文件系统刷新和计算停止保证；Runtime 静止本身既不证明这些保证，也不证明原生 RAM 或外部网络连接已恢复。
+未携带显式启用项的请求保留未启用时的 frame 和字段。只要 adapter 映射了原生工具，`tool_call` frame 就携带与 engine 无关的 `observation`。
 
 ## 执行事件流控 {#execution-event-flow-control}
 
-本可选扩展保持基础 wire 协议为 `0.16.0`。支持流控的 Runtime 在经过认证的 WebSocket upgrade 中发送且仅发送一个 `X-Oac-Execution-Flow: credit-v1` header。Core 在 101 响应中返回同一 header 表示选择；两端在该物理连接内固定选择结果。缺少请求声明或响应选择时，明确使用基础协议，不发送事件额度消息，也不等待额度。未知、空值或重复声明返回 HTTP 400；响应选择无效属于永久握手失败。重连时重新协商。只有新 Runtime 连接到选择了该能力的 Core 才启用流控。旧 Runtime 连接保持原有 256 帧订阅上限和溢出行为；单独升级 Core 不能修复其生产者行为。
+本可选扩展保持基础 wire 协议为 `0.21.0`。支持流控的 Runtime 在经过认证的 WebSocket upgrade 中发送且仅发送一个 `X-Oac-Execution-Flow: credit-v1` header。Core 在 101 响应中返回同一 header 表示选择；两端在该物理连接内固定选择结果。缺少请求声明或响应选择时，明确使用基础协议，不发送事件额度消息，也不等待额度。未知、空值或重复声明返回 HTTP 400；响应选择无效属于永久握手失败。重连时重新协商。只有选择该扩展的连接才启用流控。未选择该扩展的连接保持 256 帧订阅上限和溢出行为。
 
-先升级 Core，再选择新的不可变 Runtime 模板。现存 allocation 保留旧 Runtime，并继续按基础协议连接；新 allocation 使用新模板。新 Runtime 连接旧 Core 时也使用基础协议，因此回滚 Core 不会仅因本扩展而使 Session 无法连接。模板变更不改写保留的沙箱、文件或原生历史。这是本扩展明确约定的升级契约，不代表接受任意基础版本。
+事件流协商仅适用于基础 wire version 相同（`0.21.0`）的双方。部署匹配的 Core 与 Runtime 构建。缺少流控协商仅影响这个可选传输扩展，不允许旧基础协议建立连接。
 
 选择事件额度后，每个 `execution_start` 为一个 Run 打开连接内窗口：最多 256 条未消费执行帧和 4 MiB + 64 字节的计量存储（保证最大合法 wire 帧仍可容纳）。同一活动 Run 的重复 start 不重置额度。Runtime transport 每条连接最多接纳 1024 个活动窗口；终结 `done` 或 `execution_events_stop` 释放窗口。共享的[流控定义](../../internal/agentdaemon/proto/event_flow.go)声明覆盖的帧类型和字节算法，包括规范化 JSON wire 编码及 envelope 元数据。所有覆盖帧，包括 `error`、`done`、function call 和输入回执，进入共享 socket writer 前都消耗额度。阻塞的生产者只暂停自己的 Run；heartbeat、preparation status 以及取消/function-result 应用回执保持独立。
 
@@ -149,7 +232,7 @@ Core 离开 delivery 时，发送带 Run ID 的 `execution_events_stop`，释放
 
 ## 活动输入回执 {#active-input-receipts}
 
-Core 通过 `prompt_steer` 交付活动输入，设置 `durable_receipt: true`，每个 Run 一次交付一个输入，并等待回执后再发送下一个：
+Core 通过 `prompt_steer` 交付活动输入，每个 Run 一次交付一个输入，并等待回执后再发送下一个。
 
 | 阶段 | 定时器 |
 | --- | --- |
@@ -159,7 +242,27 @@ Core 通过 `prompt_steer` 交付活动输入，设置 `durable_receipt: true`
 | 原生接受 | `accepted` 在 Turn 生命周期内到达，不自动重新交付 |
 | Done | Runtime 在原生 Turn 结算完成、且正在处理的输入的回执发送结束后才发送 `done`；原生写入仍有时间限制，回执投递遵循事件流量控制 |
 
-`written` 和发送失败都不会推进 Core 的 input cursor。取消发出后，即使输入先变为未知，终结结果也由取消回执负责；15 秒内没有取消确认时，Core 记录 `cancel_unconfirmed`。未发出 `done` 时，取消回执携带已停止 Turn 的已确认 continuity snapshot。
+```mermaid
+sequenceDiagram
+    participant C as Core
+    participant R as Runtime
+    participant H as Harness adapter
+    C->>R: prompt_steer
+    Note over C,R: written wait limit, from delivery
+    R->>H: SteerWithReceipt
+    Note over R,H: native write limit
+    H-->>R: write complete
+    Note over R,C: receipt send limit
+    R-->>C: prompt_steer_ack written
+    H-->>R: native application receipt
+    Note over R,C: receipt send limit
+    R-->>C: prompt_steer_ack accepted
+    R-->>C: done after Turn settlement
+```
+
+`accepted` 在 Turn 生命周期内到达，不自动重新交付。Runtime 在原生 Turn 结算完成、且正在处理的输入的回执发送结束后才发送 `done`；该输入受原生写入与回执发送限制约束。限制数值见[超时与限制](#timeouts-and-limits)。
+
+`written` 和发送失败都不会推进 Core 的 input cursor。取消发出后，即使输入先变为未知，终结结果也由取消回执负责；取消确认限制到期仍无确认时，Core 记录 `cancel_unconfirmed`。未发出 `done` 时，取消回执携带已停止 Turn 的已确认 continuity snapshot。
 
 ## 每类确认所证明的事实 {#what-each-acknowledgement-proves}
 
@@ -207,19 +310,43 @@ Core 在 Turn outcome 中将接受的值保存为 `engine_error_code` 和 `engin
 
 无需运行 Turn 的工作区读取使用只读 preparation profile：带 `workspace_read_only` 的 `execution_prepare`，要求 `workspace_read_preparation` 能力。仅接受绑定的 Environment 和 resource 身份；不包含 execution option、model 与 MCP 凭据、原生 Session continuation、model 或 tool 输入，owner 拒绝 `execution_start`。Runtime 从绑定的本地工作区提供读取，不启动 Harness 进程。profile 在 Runtime 放弃该 preparation 的所有权后发布 `released`；旧 status snapshot 不发布成功。release 请求、HTTP 断连或远端 socket 关闭本身都不确认释放。
 
-`workspace_read` 在同一已认证设备连接上，针对现有 preparation handle 或它已转移给的 Run，使用精确冻结的 Environment 身份；调用方不能提供 socket、凭据或 workspace root。`operation: directory` 列出一个 workspace 相对目录（空路径选择根目录），字节与条目限制互斥。结果最多携带 1024 个单路径组件 UTF-8 名称，每个最多 255 字节，并包含 entry kind、普通文件大小和明确截断信息；仅在目录访问与 handle 清理结算后返回。此层没有快照、递归或分页。字节读取与目录读取共享目标检查、关联、容量和保留的操作等待。
+`workspace_read` 在同一已认证设备连接上，针对现有 preparation handle 或它已转移给的 Run，使用精确冻结的 Environment 身份；调用方不能提供 socket、凭据或 workspace root。`operation: directory` 列出一个 workspace 相对目录（空路径选择根目录），字节与条目限制互斥。结果携带有限数量的单路径组件 UTF-8 名称，并包含 entry kind、普通文件大小和明确截断信息；仅在目录访问与 handle 清理结算后返回。此层没有快照、递归或分页。字节读取与目录读取共享目标检查、关联、容量和保留的操作等待。
 
-准入前，请求 payload 限制为 8 KiB，correlation ID 限制为 128 字节；过长 ID 不回显，过大的 trace metadata 不进入回复。原始 read result 限制为 1 MiB，位于 4 MiB transport frame 内。这些是私有 transport 限制，不是公开 Files 参数。成功读取要求完整字节或明确截断，并确认原生 close。安全的原生拒绝不携带字节；中断或有歧义的读取保持未知，并停止该 owner 的后续读取。已 dispatch 的读取在 observer 取消以及资源转移或释放后仍保留有限时等待方，资源关闭阻止新准入。gateway 限制订阅，不在重连后重试或重放读取；重复的 pending operation ID 不能启动另一次读取。
+准入前，请求 payload 与 correlation ID 受限；过长 ID 不回显，过大的 trace metadata 不进入回复。原始 read result 受限于 transport frame 之内。这些是私有 transport 限制，不是公开 Files 参数。成功读取要求完整字节或明确截断，并确认原生 close。安全的原生拒绝不携带字节；中断或有歧义的读取保持未知，并停止该 owner 的后续读取。已 dispatch 的读取在 observer 取消以及资源转移或释放后仍保留有限时等待方，资源关闭阻止新准入。gateway 限制订阅，不在重连后重试或重放读取；重复的 pending operation ID 不能启动另一次读取。
 
 Core 在 Worker 的 Session 调度预约上运行空闲目录读取，活动执行时针对精确 Run。它在有限时 read 与 release 期间保留预约，仅在确认 close 后返回数据（不完整读取或不确定清理返回 unavailable，不包含数据），在交付结果前释放预约，并在完成或失败后撤销限定作用域的读取凭据。Runtime 保留不确定清理的所有权和容量。[Environment Files 契约](../../contracts/agents-api/zh/environment-files.md)负责公开授权、路径和分页。
 
-`workspace_write` 在原生 writer 运行前，通过已确认的 64 KiB frame 传输完整且有界的 body，验证声明的 digest，不运行模型。私有 transfer 限制为 50 MiB，与公开 API 在任何 Runtime 工作前检查的 5 MiB decoded inline 限制独立。Runtime 在接收或应用写入时排除执行；格式错误、不完整或到期的 transfer 不会到达 installer。精确的 commit 或拒绝回执释放 mutation owner。缺失或有歧义的回执保留不确定性：observer 取消和本地进程退出不能证明没有改变任何内容。公开准入前，Core 在 Session lock 下持久预约写入，跨重启阻止后继 mutation，直到精确结算；请求不重放。各平台都使用 daemon 的 Go 实现进行有界读取、目录列举、文件创建与输出导出，不使用外部 helper 或 staging directory。
+`workspace_write` 在原生 writer 运行前，通过已确认的 frame 传输完整且有界的 body，验证声明的 digest，不运行模型。私有 transfer 限制与公开 API 在任何 Runtime 工作前检查的 decoded inline 限制相互独立。Runtime 在接收或应用写入时排除执行；格式错误、不完整或到期的 transfer 不会到达 installer。精确的 commit 或拒绝回执释放 mutation owner。缺失或有歧义的回执保留不确定性：observer 取消和本地进程退出不能证明没有改变任何内容。公开准入前，Core 在 Session lock 下持久预约写入，跨重启阻止后继 mutation，直到精确结算；请求不重放。各平台都使用 daemon 的 Go 实现进行有界读取、目录列举、文件创建与输出导出，不使用外部 helper 或 staging directory。
 
 `workspace_export` 从已授权的 preparation 拉取一条有界归档流。daemon 将 exporter 的短写聚合为 64 KiB 分块，最后一块可以不足 64 KiB；只有源端正常 EOF 才允许完成。gateway 在消费者存储当前分块时最多请求下一块，只保留当前数据和一个有界回执。消费者失败、取消或断连会停止传输；即使归档内容完整，发布前仍必须收到 exporter 的完成回执。Core 采集（包括准备和存储）、gateway 导出与 daemon 导出共用十分钟预算；更早的父级取消或期限仍优先。导出获准后，其拥有的 preparation 暂停空闲过期计时，避免空闲准备上限截断传输；已开始过期的 preparation 不允许发起导出。导出结算后恢复原空闲期限，不续期 handle。随后的只读 release 将通过身份校验、无 Run 且无错误的 `expired` 回执视为已确认清理，仍保留导出自身的失败；显式 release 与 daemon shutdown 仍会取消活跃导出。整个传输仍受归档大小上限约束。
 
 ## MCP 连接权限 {#mcp-connection-authority}
 
-`execution_prepare` 配置中每个公开 `MCPHTTPServer` 都携带明确的 `connection_origin`；值缺失或未知时拒绝，不选择默认值，Core 在 dispatch 前冻结公开默认值。Runtime 在选择 factory 前用公共 validator 验证 origin，并将公开和已安装 MCP 解析为临时 effective binding。[Environment 契约](../../contracts/agents-api/zh/environments.md#public-mcp-connection-origin)负责支持的组合、原生限制和故障所有权。
+`execution_prepare` 配置中每个公开 `MCPHTTPServer` 都携带明确的 `connection_origin`；值缺失或未知时拒绝，不选择默认值，Core 在 dispatch 前冻结公开默认值。`MCPHTTPServer.headers` 携带非机密的字面标头；凭据只通过 `bearer_token` 传递。`MCPHTTPServer.stdio`（`command`、`args`、`cwd`、`env_vars`）声明 Environment 的进程而非 URL：它要求 `environment` 来源，不带标头或 bearer，`env_vars` 只列进程继承的变量名，不含其值。Runtime 在选择 factory 前用公共 validator 验证 origin，并将公开和已安装 MCP 解析为临时 effective binding。[Environment 契约](../../contracts/agents-api/zh/environments.md#public-mcp-connection-origin)负责支持的组合、原生限制和故障所有权。
+
+## 超时与限制 {#timeouts-and-limits}
+
+本协议中的所有数值都在此处给出。Turn 生命周期中 Harness 一侧的限制见 [Harness 协议](../../contracts/agents-api/zh/harness-onboarding.md#timeouts-and-limits)。
+
+| 数值 | 适用对象 | 到期或超出时 |
+| --- | --- | --- |
+| 5 分钟 | 执行 admission，自授予起算；重试不延长 | admission 变为 `expired`。Runtime 仍须完成清理结算。 |
+| 64 条记录 | Runtime 在每条连接上保留的 admission 记录 | `execution_prepare` 被 `preparation_capacity` 拒绝，Core 让排队 Turn 保持未领取，供 Worker 重试。 |
+| 64 个 frame | Turn 的有界输出 channel | 由原生 Start 之前启动的单个消费者排空。 |
+| 10 秒 | Runtime 围绕 Turn 的结算等待 | 超时不证明已静默；资源保持被占用，直到清理得到确认。 |
+| 1 至 1,800,000 ms | `runtime_prepare` `begin` 的 `budget_ms`：Core 所拥有的初始化预算剩余量 | 应用前到期会拒绝传输；应用中到期报告 `unknown`，绝不重放。 |
+| 2 分钟 | 一次 `runtime_prepare` transfer 的 `begin`–`commit` 暂存阶段 | 传输被拒绝。 |
+| 64 KiB | `runtime_prepare` transfer 或 `workspace_write` body 的单个 chunk | 更大的 chunk 验证失败。 |
+| 50 MiB | 一次 `runtime_prepare` transfer 或 `workspace_write` body（私有限制） | 传输在到达 installer 前被拒绝。 |
+| 5 MiB | 公开写入的 decoded inline body，由 API 在任何 Runtime 工作前检查 | API 拒绝请求。 |
+| 4 MiB | 单个入站 transport frame | frame 被拒绝。 |
+| 8 KiB、128 字节 | `workspace_read` 请求 payload 与 correlation ID，在准入前检查 | 请求被拒绝；过长 ID 不回显，过大的 trace metadata 不进入回复。 |
+| 1 MiB | `workspace_read` 的原始结果，位于 transport frame 内 | 结果明确截断。 |
+| 1024 个名称，每个 255 字节 | 一次目录结果 | 结果明确截断。 |
+| 10 秒 | adapter 对活动输入的原生写入；写入完成后停止计时 | Runtime 确认 `outcome_unknown`，绝不自动重新交付该输入。 |
+| 30 秒 | Core 自交付起等待 `written` | 输入结果未知。 |
+| 5 秒 | 每次回执发送，感知 shutdown | 发送失败；发送失败不会推进 Core 的 input cursor。 |
+| 15 秒 | Core 等待取消确认 | Core 记录 `cancel_unconfirmed`。 |
 
 ## 契约验证 {#contract-verification}
 
@@ -229,4 +356,4 @@ Core 在 Worker 的 Session 调度预约上运行空闲目录读取，活动执
 
 套件覆盖不兼容版本、preparation 失败、取消结算、连接丢失而不虚构终结事件、重连而不重放、陈旧或重复 handle 与回执、清理失败、有界 transfer 验证，以及超时后的资源所有权。详细故障注入测试放在所测 gateway 和 dispatcher 代码旁。
 
-其他 Runtime 对接脚本化 Core 重放同一组 scenario，再对每个声明的能力运行原生验收。受控 adapter 测试证明 transport 契约，不证明原生 Harness 行为、操作系统支持、提供商认证或沙箱隔离。共享类型、本文和契约检查应一起修改。Harness adapter 还需运行 [Harness 接入](../../contracts/agents-api/zh/harness-onboarding.md)中描述的共享文本断言。
+其他 Runtime 对接脚本化 Core 重放同一组 scenario，再对每个声明的能力运行原生验收。受控 adapter 测试证明 transport 契约，不证明原生 Harness 行为、操作系统支持、提供商认证或沙箱隔离。共享类型、本文和契约检查应一起修改。Harness adapter 还需运行 [Harness 协议](../../contracts/agents-api/zh/harness-onboarding.md#qualify-the-adapter)中描述的共享文本断言。
diff --git a/docs/zh/sandbox-provider.md b/docs/zh/sandbox-provider.md
index 50f477db6..19b5b4263 100644
--- a/docs/zh/sandbox-provider.md
+++ b/docs/zh/sandbox-provider.md
@@ -1,30 +1,45 @@
 ---
-title: "添加沙箱提供商"
+title: "沙箱提供商协议"
 source: docs/sandbox-provider.md
-source_hash: 551e0c9a91255e4126456a93971c04791fd662fc0ee27dfd1023bc0541db4b88
+source_hash: cb12026253f12b8b7b808c146b19dc0769492f6b21cc04a78757801ae568aa0c
 ---
 
-**沙箱提供商** 为 Core 管理的 Environment 提供 Runtime daemon 运行所需的外层计算资源，以及启动 daemon 的有界引导流程。本指南说明如何添加提供商，并作为 Core 驱动提供商的参考。接口为 [`SandboxProvider`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/sandbox/sandbox_provider.go)。
+沙箱提供商协议连接 Core 与为 Core 管理的（`openai_hosted`）Environment 提供计算资源的 adapter，并由该 adapter 运行启动 Runtime daemon 的有界引导流程。本页面向 adapter 作者：说明提供商必须实现什么，以及可以依赖 Core 做什么。Docker、microsandbox 和 E2B 实现了该协议。
+
+| | |
+| --- | --- |
+| 调用方 | Core 的 runtime manager 与 execution Worker |
+| 实现 | Docker 和 microsandbox（node adapter），以及 E2B（direct adapter）；见[参考 adapter](#reference-adapters) |
+| 代码 | `sandbox_provider.go` 中的 [`SandboxProvider`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/sandbox/sandbox_provider.go)，以及 setup 阶段的 `ConfigurationAdapter` |
+| 传输 | direct adapter 在进程内被调用。node adapter 运行在沙箱节点上，通过[沙箱节点协议](../../contracts/agents-api/zh/node-generation-protocol.md#provider-requests)接收同样的调用 |
+| 版本规则 | 进程内接口没有 wire 版本。沙箱节点协议和各 helper 协议要求精确版本匹配 |
 
 | 术语 | 含义 |
 | --- | --- |
-| Environment | Core 拥有的持久执行场所；参见 [Environment](../../contracts/agents-api/zh/environments.md) |
+| Environment | Core 拥有的持久执行场所；参见 [Environment 与模板](../../contracts/agents-api/zh/environments.md) |
 | Allocation | Core 为 Environment 拥有的一份计算资源租约，由 `Reference` 标识 |
-| Runtime | Environment 内的 daemon；准备能力并执行 Turn |
 | Deployment | 整个部署唯一的提供商选择；参见[沙箱部署](../../contracts/agents-api/zh/sandbox-deployment.md) |
 
-Core 拥有持久 Environment、allocation、placement 和 cleanup 状态；提供商仅负责计算资源与引导。Runtime 通过 [Core–Runtime 协议](runtime-protocol.md)准备能力并运行 Turn，提供商通过 [Runtime 引导](runtime-bootstrap.md)文件交付身份。提供商不运行 Environment 初始化、Skill、Plugin、MCP 设置、初始文件、execution 或 Files；这些操作使用 Runtime。隔离属于提供商基础设施，不属于 daemon；参见 [Runtime 与外层隔离](concepts.md#runtime-and-outer-isolation)。使用薄 adapter 封装厂商维护的 SDK。
-
-## 步骤 {#steps}
+## 实现提供商 {#implement-a-provider}
 
 1. **阅读契约。** 实现每个方法，支持必需操作，并按[实现接口](#implement-the-interface)对其余每项操作声明决定。
 2. **编写 adapter 包**，放在 `services/core/internal/sandbox/<kind>`：包括原生 SDK 调用、所有权检查、身份转换、私有配置，以及 node adapter 的 node-local 构造。声明 `var _ sandbox.SandboxProvider = (*YourAdapter)(nil)`。进程外 helper 放在 `services/core/tools/<kind>-provider`。
 3. **注册 kind** 一次，遵循[注册提供商 kind](#register-the-provider-kind)。注册是明确构造，不是 init 时 plugin registry。
 4. **标记所属资源**，使用 [Runtime 名称](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#openagentcore-runtime-names)表中的提供商 ownership label，不接受旧 label 名称作为回退。
-5. **运行契约套件** `make check-sandbox-provider-contract`；参见[验证集成](#validate-the-integration)。
+5. **运行契约套件** `make check-sandbox-provider-contract`；参见[一致性测试](#conformance)。
 6. **对真实计算资源运行原生验收**，再运行 `make check`。
 7. **在 adapter 旁编写文档**，参考[参考 adapter](#reference-adapters)。
 
+## 角色 {#roles}
+
+| 参与方 | 拥有 | 从不 |
+| --- | --- | --- |
+| Core | 持久 Environment、allocation、placement 和 cleanup 状态；lifecycle 串行化；创建、暂停、恢复或释放的每项决定 | 调用提供商声明为不支持的操作，或在离线 node、超时或空读取时释放 allocation |
+| 沙箱提供商 | allocation 的计算资源、有界 Runtime 引导、原生身份与所有权检查，以及 Core 观察和清理所需的 receipt | 运行 Environment 初始化、Skill、Plugin、MCP 设置、初始文件、execution 或 Files，或凭裸原生 ID、名称或路径定位资源 |
+| Runtime | 通过 [Core–Runtime 协议](runtime-protocol.md)准备能力并执行 Turn，身份由提供商通过 [Runtime 引导](runtime-bootstrap.md)文件交付 | 分配或销毁计算资源 |
+
+隔离属于提供商基础设施，不属于 daemon；参见 [Runtime 与外层隔离](concepts.md#runtime-and-outer-isolation)。使用薄 adapter 封装厂商维护的 SDK。
+
 ## 实现接口 {#implement-the-interface}
 
 `sandbox_provider.go` 包含 Core–Sandbox Provider 协议：负责 allocation、暂停和观测的 `SandboxProvider` 接口及其请求与结果类型，以及 setup 阶段的 `ConfigurationAdapter` 及其类型化错误。Core 在此边界之外也使用的值类型，例如 `DeploymentSpec` 和 `CallFence`，位于同一 package 的独立文件中。每个方法在编译期都必须实现，`ProviderOperations()` 声明 Provider 支持哪些方法。以下五项操作始终支持：
@@ -39,6 +54,8 @@ Core 拥有持久 Environment、allocation、placement 和 cleanup 状态；提
 
 Docker 等没有原生可续期租约的 backend 仍遵守 Core 的 hosted expiry 和 cleanup 要求。每个 adapter 都实现 `RunCommand`，测试也执行它，但 Core 编排不调用它；只有 node transport 转发。机密命令输入通过 `Command.Stdin` 传输，不放在参数或日志中；结果保留字节顺序、有界输出和实际退出状态。
 
+`Bootstrap.Workspace` 和 `ResumeRequest.Workspace` 仅当提供商的 `DeploymentPolicy.Workspace` 已声明时才携带外部工作区绑定；提供商对此的义务见[挂载](workspace-provider.md#attachment)。
+
 ### 明确的操作契约 {#explicit-operation-contracts}
 
 每个提供商返回完整的 `ProviderOperations()` 声明，`SandboxProvider` 中除 `ProviderOperations` 本身外的每个方法各占一项。接口的方法集就是操作清单，`sandbox.ValidateOperations` 根据它检查声明。下表中的分组是协议文件中的列表，由测试保证它们与该方法集一致，因此新增方法必须加入其中一组。
@@ -48,16 +65,19 @@ Docker 等没有原生可续期租约的 backend 仍遵守 Core 的 hosted expir
 | `Create`、`GetInfo`、`Renew`、`Kill`、`RunCommand` | 支持 | Allocation 生命周期与有界命令 |
 | `Observe` | 明确决定 | 检查所有权、只读地观测一个 allocation |
 | `Initial`、`NewCompute`、`GetCompute`、`RenewCompute`、`Suspend`、`Resume`、`ResumeCompute`、`KillCompute`、`DeleteRetained`、`RunCommandCompute` | 全部十项暂停方法决定一致；`nodes` 与 `direct` 模式均可支持 | 精确计算实例、捕获与恢复、保留源恢复和清理 |
+| `RestorePreparation`、`SavePreparation` | 两者决定一致 | 复用已完成的 Environment 准备结果 |
 
 `Initial` 和 `NewCompute` 构造 compute reference，不分配资源；`ResumeCompute` 在暂停中止后仅解冻同一驻留实例；`RunCommandCompute` 在一个精确 compute incarnation 中运行有界命令。Core 使用 `RunCommandCompute` 在恢复后唤醒 parked daemon（[`runtime_compute_wake.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/execution/runtime_compute_wake.go)）。
 
+`SavePreparation(reference, key)` 在准备完整完成后保存该分配初始 compute 中准备写入 `/environment` 的内容（workspace、packages 和 initialization，从不包括 Runtime 状态），`RestorePreparation(reference, key)` 把已保存的内容放回，没有有效条目时返回 `false`。`key` 是不透明的：Core 由 Project 和所有进入准备的内容推导它，从不使用 Environment、Session、Harness 或 Agent，提供商也从不解释它。存储、按 Runtime 镜像划分范围、过期和淘汰由提供商负责。条目在保存后 24 小时内有效，恢复不得使用已过期的条目。Core 在 Runtime 连接后调用 `RestorePreparation`，命中时只发送 `finalize` 操作即完成初始化。未命中时完整准备并调用 `SavePreparation`；保存错误只记录日志，不会使 Session 失败。两者都未声明的提供商始终完整准备。microsandbox 适配器在 Runtime home 下的私有目录中为每个 key 保存一个归档。
+
 每个声明项为不带 reason 的 `state: supported`，或带 authored reason code 的 `state: unsupported`。缺失、零值、未知或不安全项都会验证失败。给 `SandboxProvider` 添加方法时，必须在每个 adapter 中明确决定并实现；不提供 base type，也不生成笼统的不支持实现。
 
 不支持的方法在任何原生 I/O 前返回 `providercontract.UnsupportedError`。错误指明精确操作和安全 code，不包含原生消息、资源身份、endpoint 或凭据。空结果、nil error、`Unavailable` 或未知 mutation 结果都不能代替 unsupported，五项必需方法不能返回 unsupported。
 
 每个 adapter 拥有一个 `Operations()` 函数，由实例和注册共享。`providers.ValidateBinding` 根据接口并相互对照检查两者，Runtime admission 与 node generation 加载也拒绝不完整提供商。调用方在调用操作前用 `providercontract.Require` 检查声明，从不使用 type assertion。
 
-`Observe` 读取一个 allocation，不续期、启动、准备或停止计算资源；参见[观测契约](../../contracts/agents-api/zh/runtime-observability.md)。
+`Observe` 读取一个 allocation，不续期、启动、准备或停止计算资源；参见 [Runtime 可观测性](../../contracts/agents-api/zh/runtime-observability.md)。
 
 契约测试在未配置原生 client 时调用每个声明不支持的方法，要求匹配错误和零值结果，并拒绝不完整或矛盾的声明。支持的行为仍需要原生和生命周期测试。
 
@@ -89,7 +109,7 @@ Microsandbox 在返回创建不存在回执前永久关闭初始 Create 准入
 | `Kill` | 所属计算资源与保留存储已移除；重复已确认不存在时成功 | error 保留所有权与清理意图；所有权不匹配不删除外来资源 | 未决创建或 mutation 已隔离后重试同一 `Reference` 的清理；不提前释放 owner |
 | `RunCommand`, `RunCommandCompute` | 收集到输出和实际 exit code；非零退出是已结算命令失败 | 缺失原生完成为 `ErrCommandUnconfirmed`；部分输出不是成功 | 不重放。无法证明完成时保留 owner，并在复用前回收 |
 
-`ErrInvalid`、`ErrOwnership`、`ErrExists`、`ErrNotFound`、`ErrComputeUnconfirmed` 和 `ErrCommandUnconfirmed` 保持其定义含义。未分类原生或 transport error 表示未知，不授权重试 mutation。Core 不将提供商 diagnostics 读作生命周期事实，也不暴露原生错误文本或凭据；node transport 将错误映射为固定 code，直接 SDK 细节保持私有。
+`ErrInvalid`、`ErrOwnership`、`ErrExists`、`ErrNotFound`、`ErrComputeUnconfirmed`、`ErrCommandUnconfirmed`，以及仅用于 `Resume` 的 `ErrCheckpointUnusable` 保持其定义含义。未分类原生或 transport error 表示未知，不授权重试 mutation。Core 不将提供商 diagnostics 读作生命周期事实，也不暴露原生错误文本或凭据；node transport 将错误映射为固定 code，直接 SDK 细节保持私有。
 
 暂停支持增加精确的 `Compute` 代次、名称和 ID，以及不透明的 `RetainedState` 收据。原样持久化操作 ID 和 Provider 保留状态的来源。暂停或恢复中的 `ReconcileOnly` 观察原始尝试，不会开始另一次捕获或恢复。`ResumeCompute` 仅解冻保留的源实例，绝不冷启动已停止的源实例。清理针对精确计算实例和保留状态，而非当前恰好同名的实例。只有所属节点已验证精确 incarnation 不再存在时，`GetCompute` 才返回 `ErrNotFound`；同名但 native ID 不同的实例为 `ErrOwnership`，节点或后端不可达属于未知结果。`ComputeState.Status` 为 `stopped` 或 `crashed` 表示 adapter 已验证该精确 incarnation 的进程不再存在；其记录或磁盘可保留到 `KillCompute` 将其移除。`paused`、没有 Runtime 连接的 `running` 和未知状态均不证明进程已终止。声明支持前请阅读 [`runtime_compute.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/execution/runtime_compute.go) 及其失败测试。
 
@@ -106,16 +126,17 @@ Microsandbox 在返回创建不存在回执前永久关闭初始 Create 准入
 
 ## 注册提供商 kind {#register-the-provider-kind}
 
-`sandbox/providers/registry.go` 是唯一注册表。每项绑定 adapter 的 specification 与 resource validator、`sandbox.ConfigurationAdapter`、部署模式（`nodes` 或 `direct`）、`sandbox.DeploymentPolicy`（磁盘限制、Runtime 输入，以及 setup 推荐的默认大小）、operation 声明，以及 node-local（`BuildLocal`）或 direct（`BuildDirect`）constructor。`providers.Build` 和 `providers.BuildDirect` 构造 adapter，不分配计算资源。没有 init 时注册或 plugin 加载。
+`sandbox/providers/registry.go` 是唯一注册表。每项绑定 adapter 的 specification 与 resource validator、`sandbox.ConfigurationAdapter`、部署模式（`nodes` 或 `direct`）、`sandbox.DeploymentPolicy`（磁盘限制、可选的外部工作区要求，以及 setup 推荐的默认大小）、operation 声明，以及 node-local（`BuildLocal`）或 direct（`BuildDirect`）constructor。`providers.Build` 和 `providers.BuildDirect` 构造 adapter，不分配计算资源。没有 init 时注册或 plugin 加载。
 
 新提供商执行以下步骤：
 
 1. 在 adapter 包中实现 operation 契约，并编写原生契约测试。
 2. 添加 specification 和 resource validator。
 3. 基于类型化原生配置实现 `sandbox.ConfigurationAdapter`。`DecodeInput` 严格解析请求中独立的公开 `configuration` 与只写 `credential` 对象。`Encode` 生成白名单公开 selector、只读观测和独立 secret bytes，不透传请求 JSON。`Decode` 恢复已存储 selector 并保留对所属资源的访问，不做远程 admission 或新模板验证。`Normalize` 修改前复制输入。`ResolveChange`、`Equal` 和 `WithCredential` 负责继承、身份与凭据组合。`CredentialAccessEqual` 比较规范化的凭据和所有决定资源访问的连接 selector，排除模板、容量和发现 metadata；它校验两个配置，对无效输入返回错误。调用方另外保留显式提交凭据的意图。`Requirements` 声明是否需要凭据和公开 Core origin，以及支持哪些 setup 操作：`Discovery` 对应 `DiscoverConfiguration`，`SelectionDiscovery` 对应 `DiscoverSelection`，`CredentialVerification` 对应 `VerifyCredential`。`DiscoverConfiguration` 验证 query 并返回安全 catalog，不做 mutation 或 admission decision；Core 保留授权、输入限制与 deadline。`DiscoverSelection` 在提交前解析候选项省略的原生值，`VerifyCredential` 验证凭据对所属资源的访问，不修改资源。两者都接收候选项的 `sandbox.DirectConfig`，原生 client 只为该次调用构造。node provider 仅接受空公开对象，拒绝凭据，对每项 setup 操作和 credential replacement 返回 Unsupported。
-4. node adapter 从自己的包中导出 `BuildLocal` constructor、它解码的类型化 `native` 对象，以及它在共享 node artifact 之外添加的原生文件。node-local 设置（如主机路径）只存放在该对象中；resources 和 Runtime release 从 node 配置的 `specification` 读取。
+4. node adapter 从自己的包中导出 `BuildLocal` constructor、它解码的类型化 `native` 对象，以及它在共享 node artifact 之外添加的原生文件。node-local 设置（如主机路径）只存放在该对象中；resources 从 node 配置的 `specification` 读取，Runtime image 也来自同一对象。
 5. 在 `providers/registry.go` 中注册 constructor、policy、configuration adapter 和 operation 声明。其键即 provider kind，也用于标记该 Provider 的观测；暂停支持读取此项。生成的投影组合每个已注册的部署模式和 deployment policy 与 `sandbox/deployment_contract.go` 中的共享 field bound：installer 从 `deploy/node/node_spec.py` 读取，TypeScript 客户端和 Web 从 `packages/agents-client/src/deployment-contract.ts` 读取，因此 Web 读取这些声明，而不比较 provider kind。通过 `go run ./services/core/cmd/specification-contract -write` 重新生成两者。
 6. 提供 adapter 和 helper 的发行产物，通过已注册 configuration 契约向运维人员提供 provider。
+7. Web 的 setup 步骤、部署摘要和客户端投影仍按提供商列出配置。在协议声明配置字段之前，将新提供商加入 `apps/web`。
 
 **已知设计缺口：** Web 仍在 setup 向导的提供商选择、Docker 确认，以及所有显示或解析 E2B 配置字段的地方（带服务预设的 setup 步骤、部署摘要和客户端的部署投影）中指名提供商，因为协议尚未声明配置字段。通过该界面提供另一提供商目前需要修改共享的 Web。此耦合不符合[复杂性留在 adapter 内](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#complexity-stays-in-the-adapter)；新集成必须通过协议表达配置，把厂商专有行为留在 adapter。不得添加 Session 或 Turn 调度路径、厂商专有 column 或 API field，或 store 中的厂商 switch。
 
@@ -127,13 +148,14 @@ node 配置 `sandbox.NodeConfig` 包含 `provider`、`generation`、`installatio
 
 - `nodes` 注册仅有 `BuildLocal`，`direct` 注册仅有 `BuildDirect`；缺失、混合或未知 mode 被拒绝。
 - specification 和 resource validator、configuration adapter 与完整 operation 声明都是必需项，因此不完整注册不能发布部分投影。声明的默认大小必须通过 adapter 的 resource validator。
-- Runtime input policy 要么接受固定 Runtime，要么给出 adapter 拒绝它的固定原因，不能两者兼有。
 - 完整生命周期声明支持时，`nodes` 与 `direct` 模式都准入暂停。注册不携带 suspension 数值；Core 对所有支持的 Provider 应用同一个 [暂停策略](#suspension)。
 
 configuration adapter 必须非 nil，包括其具体值。每个 `ConfigurationRequirements` 字段都需要明确有效的决定：`Credential` 和 `PublicOrigin` 为 `Required` 或 `NotRequired`，`Discovery`、`SelectionDiscovery` 和 `CredentialVerification` 使用共享 supported 或 unsupported 声明并携带安全 reason。新增 requirement field 需要明确更新验证，不继承已有决定。要求凭据不承诺支持 `VerifyCredential` 操作。这些检查证明注册完整，不证明原生 SDK 行为正确；constructor 和 adapter 契约测试仍然适用。
 
 ### 配置存储与构造 {#configuration-storage-and-construction}
 
+`Selection.ComputeProfiles` 包含可选的管理员批准资源档位。注册表仅允许 direct 模式使用，复制默认 Runtime/workspace receipt，组合默认凭据，并要求凭据访问端点一致。每个档位遵循与默认选择相同的 `SelectionDiscovery` 声明：声明支持发现时验证原生不可变选择，否则使用规范化选择。node 模式明确拒绝非空档位。公共存储将每个批准的档位物化为不可变 generation，当前部署仅保存名称到 generation 的引用。公共选择、冻结和 GC 由[计算规格协议](../../contracts/agents-api/zh/sandbox-deployment.md#compute-profiles)定义。
+
 预览和持久化使用 `providers.Normalize` 与 `providers.Describe`。`providers.DiscoverSelection` 在提交前解析省略的原生值，持久化时再次验证完整 specification。`providers.ResolveChange` 负责配置继承，比较使用 normalized selector，使预览、重试和提交共享默认值。store 负责事务、凭据加密、generation fencing、资源所有权和通用对象存储：仅 adapter 解释 `provider_config` 与 `provider_metadata`，`provider_credential` 保存绑定到安装实例与 generation 的密文。保留 generation 保持原公开配置和 metadata，通过 adapter 组合当前凭据，因此替换凭据不重写保留 selector。数据库约束检查对象结构，不检查注册列表。
 
 具有凭据的 direct adapter 始终验证已提交的所有权锚点和候选选择。显式提交凭据或 `CredentialAccessEqual` 表明访问发生变化时，还会验证全部保留 generation 与 allocation reference；否则模板和资源更新保留原有资源路由，不做全量扫描。公共 `sandbox.CallFence` 排除原生调用并等待 helper 完成，包括调用方已超时的调用；execution 调用已准备的 verification 和 fencing callback，不按厂商分支。
@@ -148,25 +170,59 @@ backend fingerprint 标识原生资源命名空间，不表示容量。Core 保
 
 launcher 从[派生进程环境](configuration.md)提供 `sandbox.ProcessPaths`。Core 读取这些路径一次，并传给 direct construction 和 setup 操作。它们是固定发行属性，不是部署设置或用户可选 helper 路径。每个 adapter 解析自己的相对 helper 和 state 位置；E2B 使用 `e2b/oac-e2b-provider` 和 `e2b/`。root 缺失或不是绝对路径时，在执行 helper 前失败。提供商构造与发现不读取进程环境变量。
 
-## 托管生命周期 {#managed-lifecycle}
+## Core 对提供商的保证 {#what-core-guarantees-to-a-provider}
 
-这是 Core 对每个提供商执行的公共流程。Adapter 不实现这些流程，但依赖它们。
+adapter 不实现这些行为，但依赖它们。代码层面的机制见 [Core implementation constraints](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/IMPLEMENTATION.md#hosted-sandboxes)。
 
-### 部署发布 {#deployment-publication}
+- Core 在调用 `Create` 之前提交 allocation、其 daemon 凭据摘要和 Session 绑定。只有新的 allocation receipt 才允许 `Create`；重试和 Core 重启只观察同一个 `Reference`，不重放 `Create`，也不轮换凭据。
+- 每个 node 有一个串行 lifecycle worker，同一 node 的调用从不并发；E2B allocation 共用一个 worker。某个 node 上卡住的提供商不会阻塞其他 node。
+- Core 从不根据引擎或提供商名称推断引导完成；由 adapter 通过 `Info.BootstrapComplete` 声明。
+- Core 只在撤销 device 权限、结清待处理 input 并请求取消之后才调用 `Kill`。临时提供商故障、未知的 `Create` 结果和已停止的计算资源都不证明永久失败。
+- Core 只有在确认清理 allocation 的计算资源与 volume，并证明原始 `Create` 已结算后才释放 allocation。在此之前它保留清理归属，包括观察到资源不存在之后，有界扫描继续捕获迟到的资源，不再次 `Create`。公开删除 Session 之后同样适用。
+- Core 从不在离线 node、超时或空读取时释放 allocation，也不对不[在线](../../contracts/agents-api/zh/node-generation-protocol.md#connection)的 node 执行 lifecycle 操作。保留的归属需要精确的提供商证据：socket 路径、实例缺失或空列表都不证明已清理，也不授权替代。
+- Placement 是自动的，调用方不能选择 node。活动 allocation 即使离线也保留原 node。确认释放后，符合条件的保留 Session 可以再次预约兼容容量，包括在其他 node 上。释放 active 容量前必须确认 source 已拆除，未知操作保留其预约。等待、排序和 generation 选择由[部署契约](../../contracts/agents-api/zh/sandbox-deployment.md#generation-ownership-and-rollout)负责。
+- 在 Turn 之间，Core 观察已连接的计算资源仍是其 Session 的 running allocation。该检查不改变任何状态。运行中的计算资源从不到期，没有[确认](#confirmed-compute-loss)的不可达、已停止或缺失实例不授权丢弃保留的工作区或历史，也不授权选择替代计算资源。
+- Core 在一个[暂停策略](../../contracts/agents-api/zh/sandbox-deployment.md#suspension-policy)下，暂停每个声明 checkpoint 支持的提供商的空闲 allocation。
+- 禁用提供商会停止新的托管准入和引导，但从不阻塞既有 Session 的取消、函数结果或 input 重试结果。
 
-启动时 Core 在选择提供商前领取稳定 installation identity 和新的 owner epoch。runtime manager 保留了解 generation 的提供商 facade。初始 setup 与 replacement 在任何数据库写入前准备并验证 candidate；candidate 被拒绝时不改变活动配置或 worker。backend replacement 使用 deployment mutation gate：暂停 manager admission，排空旧调用与循环，再在 commit transaction 中重复 resource 与 generation guard；新选择、其 generation、旧 node 和未使用 enrollment token 的退役一起提交。提交后，Core 在 manager mutex 下发布预验证配置和共享 observation、bootstrap cache，没有进一步外部工作或可失败步骤，因此提交后取消的请求不能丢弃配置。中断的 drain 保留为重试 barrier。提供商 I/O 和 drain 不持有数据库事务或 manager map mutex。
+```mermaid
+stateDiagram-v2
+    [*] --> creating: allocation committed before Create
+    creating --> running: matching running compute with completed bootstrap
+    creating --> cleanup_pending: cleanup requested
+    running --> cleanup_pending: cleanup requested
+    cleanup_pending --> released: cleanup confirmed and Create settled
+    released --> [*]
+```
 
-本地提供商依赖不可用时，现有 scan 等待修复，hosted admission 保持关闭；管理员恢复仍可使用，重启后也如此。数据库和所有权错误仍是失败。未配置的部署以 503 `execution_unavailable` 拒绝 hosted admission，且不创建 Session 状态。Core 从 installation public URL 派生 Runtime bootstrap 和 daemon WebSocket 地址，不使用请求 header；从数据库读取当前选择，不使用 startup file。
+当 Session 被删除或归档、Environment 失败或到期，或管理员重置部署时，allocation 进入 `cleanup_pending`。`released` 要求 `CreateSettled`；参见[身份与资源所有权](#identity-and-resource-ownership)。
 
-Node readiness 绑定到精确 generation、当前连接和 owner epoch。持久 serving pin 仅在部署串行化下为当时目标的 readiness 提升，因此已被替代目标的延迟报告不获得 pin。
+## 检查点生命周期 {#checkpoint-lifecycle}
 
-### Allocation 生命周期 {#allocation-lifecycle}
+声明了 checkpoint 操作（`Initial`、`NewCompute`、`GetCompute`、`RenewCompute`、`Suspend`、`Resume`、`ResumeCompute`、`KillCompute`、`DeleteRetained`、`RunCommandCompute`）的提供商，使 Core 能把空闲 allocation 暂停为保留状态。direct Provider 通过所属 adapter 恢复；可转移检查点可以在同一或另一个兼容 node 上恢复。Core 记录 allocation 的 `compute_phase`；未声明 checkpoint 支持的提供商为 `disabled`，其余阶段按下图变化。删除、归档、重置和保留期到期会在完成[Core 对提供商的保证](#what-core-guarantees-to-a-provider)中描述的清理后，从任意阶段释放 allocation。
 
 Core 在 `Bootstrap.Harness` 中传递所属会话固定选择的 Harness；所有提供商都将其投影到 [Runtime 启动输入](./runtime-bootstrap.md)，不自行选择实现。
 
 allocation、专用 daemon credential digest 和精确 Session binding 在 `Create` 前、execution lease 与 Session lock 下原子提交。只有新 allocation receipt 允许 `Create`；重试和 Core 重启观察同一 reference，不重放或轮换凭据。allocation 是私有计算资源所有权，与公开 Environment connection 和原生 readiness 独立；adapter 验证 bootstrap completion，Core 不从 engine 或 provider name 推断。
 
-配置提供商后，Worker 扫描已提交且没有 allocation 的 pending hosted Environment，涵盖空闲 Session 创建以及 commit 与 bootstrap 之间中断后的恢复；已有 allocation 不重新进入此路径。scan 有界，由 lifecycle owner 串行化，不需要调用方操作。没有 Turn 的初始预约让 Session 保持空闲，daemon 连接不被当作原生 readiness。同一 scan 在验证精确 Session、device binding 和已结算 bootstrap 后，发布带持久 generation 的认证连接观测。
+```mermaid
+stateDiagram-v2
+    [*] --> disabled: allocation created
+    disabled --> running: checkpoint Provider, compute running and bootstrapped
+    running --> quiescing: idle
+    quiescing --> suspending: daemon quiesced
+    quiescing --> running: daemon rejected quiesce
+    quiescing --> waking: new work or lost acknowledgement
+    suspending --> suspended: Suspend reports ResourcesReleased and SuspendSettled
+    suspending --> waking: capture cancelled or source still running
+    suspended --> restoring: new work or file access
+    restoring --> waking: Resume reports running
+    waking --> running: daemon resumed
+    running --> [*]: confirmed compute loss releases the allocation
+    suspended --> [*]: cold replacement after retention
+```
+
+暂停与唤醒流程按下列顺序调用提供商。Core 在每个效果发生之前先持久化相应阶段。
 
 Core 在 Turn 之间检查已连接且已观察的计算资源仍是其 Session 正在运行的 allocation；该检查不做任何修改，也不复活 cleanup 请求。正在运行的计算资源不会到期：显式生命周期清理、保留状态期限策略和[已确认的计算资源丢失](#confirmed-compute-loss)管理资源回收。不可达的 container，以及未经该确认的停止或缺失 container，不授权丢弃保留工作区或历史，也不授权选择替代计算资源。禁用 provider 停止新 hosted admission 与 bootstrap，但不阻止现有 Session 的取消、function result 或 input retry outcome。
 
@@ -200,7 +256,7 @@ placement 自动完成：Session 创建提交持久的 pending 工作，共同
 
 Core 对所有声明暂停支持的 Provider 应用统一共享策略：[可配置的空闲时长](../../contracts/agents-api/zh/sandbox-deployment.md#suspension-policy)默认为 5 分钟（300 秒），保留状态期限为 24 小时（86400 秒）；部署的 [`suspension`](../../contracts/agents-api/zh/sandbox-deployment.md#safe-response) 返回这些值。Core 暂停已经初始化的 Environment，包括尚未执行 Turn 的 Environment，前提是没有 root 或 Subagent Turn 排队、执行或等待，没有输入、文件操作或初始化待处理，且真实活动已空闲达到该时长。空闲时钟不早于 allocation 进入 running compute phase 的时刻，包括唤醒后。Core 在同一事务中使用数据库时钟记录 allocation 的初始化完成和 root 或 child 终结转换。候选筛选和持有 Session 锁的复查比较数据库经过时间与空闲时长，初始保留状态期限也锚定同一数据库观测，因此 Core 与数据库主机的时钟无需一致。公开历史中的原生完成时间戳保持不变，但不驱动空闲准入，心跳也不重置活动时间。确认计划暂停前，daemon 关闭准入并排空原生清理、输出收据和文件工作。
 
-容量压力可以让已经空闲的 node allocation 在通常超时之前暂停，但仍需经过 15 秒无活动宽限期。Session 锁内的决策重新检查 pending work、wake request 和 activity，再获取共享 deployment 容量锁并确认兼容的等待需求。它不会中断活动 Turn，也不会在普通 quiesce、capture 和 source-stop 证明完成前释放容量。压力触发的回收采用保守策略：只有进行中回收所属的节点当前有资格服务同一需求时，它才会推迟另一次回收。不可用或不兼容的节点保留其 ownership receipt，但不会阻挡健康节点的容量。如果暂停无法使容量可用，等待请求仍保留原始期限。
+提供商依赖以下规则：
 
 Worker 租约、Session 锁和每个 node 的 gate 负责所有 Provider 的暂停。新 Turn claim、文件写入意图和捕获准入在 Session 锁下串行化，共享计算阶段检查；新待处理工作取消捕获并唤醒同一源实例。正常准备在经过认证的恢复握手后等待计算阶段变为 running；待处理输入的提升与生命周期转换冲突时，输入保持 pending。计算阶段和经 revision 校验的收据存储在 allocation 中。Core 在副作用前持久化静止、捕获和恢复意图，仅新收据执行捕获或恢复；恢复流程观察精确尝试，不重试结果未知的创建、捕获或恢复。已消费的保留状态不会使运行中的代次回滚。删除、撤销和保留期到期始终优先于唤醒，直至最后的数据库 compare-and-swap；未知清理身份会一直保留，直到确认所属资源已不存在。已消费产物和旧计算实例会被删除，因此暂停循环不会累积可写磁盘链。
 
@@ -214,7 +270,34 @@ Worker 租约、Session 锁和每个 node 的 gate 负责所有 Provider 的暂
 
 ### 协调协议升级 {#coordinated-protocol-upgrade}
 
-Core 与 node 一同升级到 node wire version 8；E2B helper 使用 private wire version 4，并重建包含托管暂停控制的模板；microsandbox helper 使用 private wire version 5。所有 Provider 交付 Runtime bootstrap version 2。每个边界独立验证自身契约，不同边界的版本号不能互换。激活前，使用此前兼容的版本对不兼容的未释放 allocation 完成正常清理。启动栅栏保留其持久收据及 Session 历史，不通过 Provider 调用迁移它们。
+Core 与 node 一同升级到 node wire version 9；E2B helper 使用 private wire version 4，并重建包含托管暂停控制的模板；microsandbox helper 使用 private wire version 7。所有 Provider 交付 Runtime bootstrap version 2。每个边界独立验证自身契约，不同边界的版本号不能互换。激活前，使用此前兼容的版本对不兼容的未释放 allocation 完成正常清理。启动栅栏保留其持久收据及 Session 历史，不通过 Provider 调用迁移它们。
+
+```mermaid
+sequenceDiagram
+    participant C as Core
+    participant R as Runtime
+    participant P as Provider
+    Note over C: idle, phase running
+    C->>C: persist quiescing
+    C->>R: environment_quiesce
+    R-->>C: environment_quiesced
+    C->>C: persist suspending
+    C->>P: Suspend(OperationID, Source)
+    P-->>C: RetainedState, ResourcesReleased, SuspendSettled
+    C->>C: persist suspended
+    Note over C: new work or live file access
+    C->>C: persist restoring, reserve destination
+    C->>P: NewCompute, then Resume(RetainedState, Target)
+    P-->>C: running Compute
+    C->>C: persist waking
+    C->>P: RunCommandCompute wakes a parked daemon
+    C->>R: environment_resume
+    R-->>C: environment_resumed
+    C->>P: DeleteRetained
+    C->>C: persist running
+```
+
+存在兼容的等待需求时，容量压力可以在[超时与限制](#timeouts-and-limits)所列的无活动宽限期之后，提前暂停已经空闲的 node allocation。没有空闲 active slot、但有空闲 retained slot 的 node 还会保留一个空闲 active slot：达到[超时与限制](#timeouts-and-limits)所列的空闲 slot 无活动时间后，即使没有等待需求，Core 也可以暂停空闲的 allocation，让下一个 Session 不必等待暂停。如果已放置到该 node 的 Session 还在等待创建沙箱或完成初始化，则不会这样做，否则 node 要等这次暂停完成后才会为那个 Session 创建沙箱和执行准备。它从不打断活动 Turn，也不会在常规 quiesce、capture 和 source-stop 证明完成之前释放容量。如果暂停无法让容量可用，等待中的请求保留原有期限。retained slot 已满时，容量压力可以[释放空闲检查点](#cold-replacement-after-checkpoint-retention)，并且只暂停其检查点随后可被释放的 allocation。
 
 ### 检查点转移 {#checkpoint-transfer}
 
@@ -222,9 +305,11 @@ Core 与 node 一同升级到 node wire version 8；E2B helper 使用 private wi
 
 对于可转移检查点，`Suspend` 只有在持久发布已验证的完整归档、停止精确 source compute，并结清 source 本地 capture 与 cleanup 义务后，才能报告 `ResourcesReleased` 和 `SuspendSettled`。Core 先持久化绑定的保留状态，再标记 suspended；仅原生资源不存在并不足够。`Suspend.ReconcileOnly` 可以为同一 operation 已验证的快照完成归档发布和源清理，但不能重新捕获快照，也不能停止已经恢复 running 的源。此前已发布的归档缺失或损坏时，`Suspend.ReconcileOnly` 可以返回其精确持久 ownership receipt，标记 `Status: unknown` 和 `ResourcesReleased: false`，供清理使用；该 receipt 不证明归档当前可用，也不证明源不存在。`Resume` 仍在执行前验证归档。完成源结清屏障后，source node 不可用不再阻止恢复。删除和正常到期可以将空闲 suspended allocation 的清理路由转给同一 artifact domain 内的在线 node；删除不要求 execution class 匹配。清理目标必须已提供同一不可变 generation，且有 retained 容量。没有这样的 node 时，清理保持 pending，不释放所有权；运维需恢复符合条件的 node 或其容量。未知 running 或 restoring writer 不会仅因 node 不可达而迁移。
 
-恢复用 `Resume.ReconcileOnly` 观察已持久化的 target 与 operation。`RestoreAttemptClosed` 是精确 operation ID，不是通用 absence 标志：adapter 只有在持久关闭从未进入原生执行的 attempt，并隔离该 ID 的所有迟到请求后才能返回。如果 adapter 能证明当前调用在派发原生恢复之前失败，也可以关闭已持久 admitted 的 attempt。microsandbox adapter 仅在 fresh 请求的 wire deadline 于原生派发之前到期时执行这种关闭；归档损坏、资格错误和不透明 SDK 失败都不授权自动重试。Core 随后先持久化新的 operation ID，再尝试执行。一旦已派发原生恢复，结果未知的 attempt 保留相同 target、所有权与原始 retention deadline；原生列表缺失、helper 死亡或超时都不授权重放。这种恢复可能一直不可用，直到显式删除或正常保留期到期；等待中的 input 可能达到其公共 deadline。用户删除仍需精确原生 settlement，之后才能释放资源与所有权。 原地恢复的 adapter 可以保留非空 native ID：关闭证明必须与请求的 ID、逻辑代次、名称和保留状态来源完全一致。该证明说明本次恢复未派发，不表示底层已暂停源实例不存在。
+恢复用 `Resume.ReconcileOnly` 观察已持久化的 target 与 operation。`RestoreAttemptClosed` 是精确 operation ID，不是通用 absence 标志：adapter 只有在持久关闭从未进入原生执行的 attempt，并隔离该 ID 的所有迟到请求后才能返回。如果 adapter 能证明当前调用在派发原生恢复之前失败，也可以关闭已持久 admitted 的 attempt。microsandbox adapter 对创建该 admission 的 fresh 请求，在派发原生恢复之前的任何失败上执行这种关闭。wire deadline 到期或未分类失败会关闭该 attempt，Core 随后持久化新的 operation ID。快照缺失、未通过身份或完整性校验，或未通过 adapter 对当前 generation 的资格检查（例如资源、workspace 或 runtime image 不匹配）时，也会关闭该 attempt，并报告为 `ErrCheckpointUnusable`。该结果是持久的：同一 operation 的 `Resume.ReconcileOnly` 会再次报告它，该 operation ID 的迟到请求仍被隔离。一旦已派发原生恢复，提供商不会返回它。收到 `ErrCheckpointUnusable` 后，Core 不再恢复该快照，并[立即结束其保留](#cold-replacement-after-checkpoint-retention)。一旦已派发原生恢复，结果未知的 attempt 保留相同 target、所有权与原始 retention deadline；原生列表缺失、helper 死亡或超时都不授权重放。这种恢复可能一直不可用，直到显式删除或正常保留期到期；等待中的 input 可能达到其公共 deadline。用户删除仍需精确原生 settlement，之后才能释放资源与所有权。
+
+原地恢复的 adapter 可以保留非空 native ID：关闭证明必须与请求的 ID、逻辑代次、名称和保留状态来源完全一致。该证明说明本次恢复未派发，不表示底层已暂停源实例不存在。
 
-microsandbox adapter 要求显式的私有 `checkpoint_root`，位于所有 guest 可访问文件系统之外。目录权限为 `0700`，私有 namespace marker 标识真实归档存储。默认安装创建 node 本地私有 store。跨 node 恢复要求运维为参与 node 挂载同一个私有 store，挂载路径可以不同。Runtime state 目录与 workspace binding 都不用于推导该 root。adapter 在恢复前再次验证归档、外部文件系统身份和原生 execution class。恢复 RAM 与文件描述符不保证外部 TCP 连接连续，也不保证应用副作用可安全重放。
+microsandbox adapter 要求显式的私有 `checkpoint_root`，位于所有 guest 可访问文件系统之外。目录权限为 `0700`，私有 namespace marker 标识真实检查点存储。默认安装创建 node 本地私有 store。跨 node 恢复要求运维为参与 node 挂载同一个私有 store，挂载路径可以不同。每个保留的检查点都是 guest 内存与根磁盘层的未压缩原生快照，因此共享 store 要为每次挂起和跨 node 恢复承载这部分数据量。Runtime state 目录与 workspace binding 都不用于推导该 root。adapter 在恢复前再次验证检查点、外部文件系统身份和原生 execution class。恢复 RAM 与文件描述符不保证外部 TCP 连接连续，也不保证应用副作用可安全重放。
 
 ### 检查点保留期后的冷替换 {#cold-replacement-after-checkpoint-retention}
 
@@ -232,25 +317,35 @@ microsandbox adapter 要求显式的私有 `checkpoint_root`，位于所有 gues
 
 Core 在释放 allocation 和 placement 归属前，确认原始创建已结算且所属计算资源与保留状态均已清理。替代计算资源准入前撤销旧 device 的权限。Create、Kill 或 DeleteRetained 的结果尚未确认时，Core 保留归属，不准入替代写入方。可恢复的 Session 与 Environment 保持断连，保留同一文件系统对象和初始化结果。归档、重置和删除优先，唤醒请求不能撤销它们。
 
-容量压力不会缩短检查点保留期。在配置的期限到达前，已挂起的 allocation 保留快照并继续占用 retained slot；容量不足或节点不兼容不允许降级为冷替换。等待请求保持原有的输入期限。保留期到期后，常规 expiry cleanup 必须确认资源已删除，其他 allocation 才能预留该 slot；文件与已验证的原生历史继续保留。
+不可用的检查点（恢复中的 allocation 的 `Resume` 报告 `ErrCheckpointUnusable`）会立即结束保留，如同其 deadline 已到。Core 通过正常的到期清理删除 target 与快照；符合条件的 Session 按下文继续，不符合条件的则如正常到期一样结束。
+
+仅当等待中的放置需求被节点已满的 retained slot 阻塞时，容量压力才会提前结束保留期，且只针对该节点上最早挂起、空闲并满足上述条件的 allocation。Core 将其视为已过期，每个被阻塞的需求只释放一个；其他已挂起的 allocation 在配置的期限到达前保留快照并继续占用 retained slot。恢复时缺少容量或兼容节点的检查点不会因此被冷替换。等待请求保持原有的输入期限。常规 expiry cleanup 必须确认资源已删除，其他 allocation 才能预留该 slot；文件与已验证的原生历史继续保留。
 
-新 input 或实时 Environment 文件访问会在兼容 node 上预约新 allocation，并引导新的 Runtime device。准备流程复用同一文件系统和已完成的初始化，不重放初始化。验证替代 Runtime 的声明后，执行从保留历史续接同一原生 Session。原生历史缺失或无效时明确失败；Core 不替换为新的原生 Session，也不重放已完成的 input。读取历史和已发布 Artifact 不预约计算资源。此路径不保留 VM 内存、后台进程或开放连接，也不为未声明能力的 Runtime、Harness 或文件系统组合提供资格。
+Core 在释放 allocation 和 placement 归属前，确认原始创建已结算且所属计算资源与快照均已清理。替代计算资源准入前撤销旧 device 的权限。Create、Kill 或 DeleteRetained 的结果尚未确认时，Core 保留归属，不准入替代写入方。可恢复的 Session 与 Environment 保持断连，保留同一文件系统对象和初始化结果。归档、重置和删除优先，唤醒请求不能撤销它们。
+
+新 input 或实时 Environment 文件访问会在兼容 node 上预约新 allocation，并引导新的 Runtime device。准备流程复用同一文件系统和已完成的初始化，不重放初始化。验证替代 Runtime 的声明后，执行从保留历史续接同一原生 Session。原生历史缺失或无效时明确失败；Core 不替换为新的原生 Session，也不重放已完成的 input。读取历史和已发布 Artifact 不预约计算资源。此路径不保留 VM 内存、后台进程或开放连接，也不为未声明能力的 Runtime、Harness 或文件系统组合提供资格。它同样不提供 node 级 drain、从不可达写入方 failover、并发写入方、多活 Core、自动扩缩容或快照复制。
 
 ### 已确认的计算资源丢失 {#confirmed-compute-loss}
 
 正在运行的计算资源没有保留期限，因此主机崩溃或重启后，其 allocation 原本会无限期保持归属。所属节点重新上线后，对于计算阶段为 `running` 且支持检查点的 allocation，只有同时满足以下条件时，`GetCompute` 对已持久化的精确 incarnation 返回 `ErrNotFound` 或已验证的 `stopped`、`crashed` 状态才会释放该 allocation：原始创建已结算，该 incarnation 有 native ID，未记录 capture、restore 或 rollback 意图，allocation 的 device 没有已认证的 Runtime 连接，且 Session 满足[冷替换](#cold-replacement-after-checkpoint-retention)条件。随后 Core 对该精确 incarnation 调用 `KillCompute`。只有其结果得到确认，才允许一次持有 Session 锁的提交：重新检查计算 revision 与上述条件，撤销 device，并释放 allocation 和 placement。Session、Environment、等待中的 input、原生 Session 身份和文件系统均保留，新 input 或实时文件访问按冷替换续接。
 
-其他观察结果均保留归属及其诊断：`paused`、`running` 或未知原生状态、身份不匹配、超时或传输错误、未知创建、已记录的 restore、存在 Runtime 实时连接、自带工作区存储、初始化未完成、Session 已终结，或缺少 `retained_native_history` 声明。`KillCompute` 失败时不做任何修改，并发的归档、删除或计算阶段变更优先。节点离线时 Core 从不执行此操作，因为没有节点就无权停止计算资源。续接保留文件系统并使用已记录的原生 Session ID；Harness 恢复出错时执行失败，不创建另一个原生 Session。Core 不重放已中断或已完成的输入。[覆盖台账](../../contracts/agents-api/zh/index.md)记录已通过资格验证的续接场景，包括完成确认后立即崩溃。任意崩溃受损原生历史的完整性仍未通过资格验证；身份检查无法检测已截断但仍可解析的历史尾部。
+其他观察结果均保留归属及其诊断：`paused`、`running` 或未知原生状态、身份不匹配、超时或传输错误、未知创建、已记录的 restore、存在 Runtime 实时连接、自带工作区存储、初始化未完成、Session 已终结，或缺少 `retained_native_history` 声明。`KillCompute` 失败时不做任何修改，并发的归档、删除或计算阶段变更优先。节点离线时 Core 从不执行此操作，因为没有节点就无权停止计算资源。续接保留文件系统并使用已记录的原生 Session ID；Harness 恢复出错时执行失败，不创建另一个原生 Session。Core 不重放已中断或已完成的输入。[OpenAI 兼容性](../../contracts/agents-api/zh/index.md)记录已通过资格验证的续接场景，包括完成确认后立即崩溃。任意崩溃受损原生历史的完整性仍未通过资格验证；身份检查无法检测已截断但仍可解析的历史尾部。
 
-### 重置与归档 {#reset-and-archive}
+## 超时与限制 {#timeouts-and-limits}
 
-[reset](../../contracts/agents-api/zh/sandbox-deployment.md#reset) 是 runtime manager 在计数工作之外推进的持久 execution state。start、escalation、cancellation、setup、update 和 finalization 通过 mutation gate 串行化。空闲状态先在 Session lock 再在 deployment lock 下复查，finalization 时不反向加锁。工作使用 keyset paging，绑定 reset request time 和 generation，并持久化 absolute deadline 与已验证 audit provenance。
+| 值 | 适用于 | 到期或超出时 |
+| --- | --- | --- |
+| 有界 context | 每个提供商调用 | 结束调用方的等待，不证明已回滚、停止、清理或不存在。adapter 从不分离未跟踪的 mutation，也不重放已超时的命令 |
+| 空闲超时与快照保留期 | 支持检查点的 allocation，由[暂停策略](../../contracts/agents-api/zh/sandbox-deployment.md#suspension-policy)设定 | 空闲超时到达时 Core 开始[暂停](#suspension)。保留期结束时 Core 清理快照，并对符合条件的 Session 通过[冷替换](#cold-replacement-after-checkpoint-retention)替换计算资源 |
+| 15 s | 空闲 node allocation 在容量压力暂停之前的无活动时间 | 存在兼容的等待需求时，Core 可以早于空闲超时暂停它 |
+| 2 min | 所在 node 没有空闲 active slot 但有空闲 retained slot 时，空闲 allocation 的无活动时间 | Core 可以早于空闲超时、在没有等待需求时暂停它，让下一个 Session 找到空闲 slot |
+| 50 MiB 加 32 字节（`MaxCommandInputBytes`） | `Command.Stdin` | 命令无效 |
 
-一个 snapshot 和 timestamp 对持有资源分区。离线 ownership 来自 allocation 或 active placement 的 node，与 online presence 使用同一 45 秒 connection 和 owner-epoch predicate，独立于提供商 readiness；cleanup failure、offline state 或空 read 都不授权合成 release。held resource 为零时，Core 在数据库事务外 drain，在 deployment lock 下复查，并在一个事务中清空 deployment，再发布携带 generation 的空提供商，没有可失败工作。最终 write 或 drain 失败时，在释放 mutation gate 前使用有界 owner context 恢复已提交提供商；恢复失败时 admission 保持 fenced，owner 停止。
+在线窗口和其他节点计时器见[沙箱节点协议](../../contracts/agents-api/zh/node-generation-protocol.md#timeouts-and-limits)。
 
 管理员 [Session archive](../../contracts/agents-api/zh/admin-api.md#session-archive) 在 Session-first transaction 中保留 Project scope 与 hosted eligibility 检查，并一起处理 Environment expiry、cancellation、Runtime authority revocation 和 audit；reset 的后台 archive 从可信记录重建实际 Project scope，保留请求方 provenance。普通 provider lifecycle 释放 compute 和保留状态。archive cancellation 在 terminal commit 前保留健康 receipt path：仅首次撤销 device 的 archive 记录精确 `archive_cancel_turn_id`（普通 revocation 清空它，重复 cleanup 保留它），现有已认证 delivery 可从 Turn 原 `cancel_requested_at` 起最多 20 秒排空该 cancellation。Core 独立于 subscription removal，通过 `done`、cancellation acknowledgement 和 terminal commit 跟踪 delivery，不授予新 connection、input、file 或 MCP authority，也不续期 lease。事务或 lifecycle gate 不等待 receipt，peer 丢失、到期或重启回到普通 failure 与 cleanup，不虚构 cancelled outcome。
 
-## 验证集成 {#validate-the-integration}
+## 一致性测试 {#conformance}
 
 installer 与 Go adapter 的 E2B 模板和 endpoint validator 消费共享 [selector fixture](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/sandbox/e2b/testdata/configuration-selectors.json)。任何验证修改都扩展这些 case，使两处入口接受相同 selector。
 
@@ -285,11 +380,3 @@ node 使用 [提供商配置](configuration.md#docker-node-configuration)中的
 ### Seccomp profile {#seccomp-profile}
 
 [`seccomp.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/codex/seccomp.json) 是 [revision 65adc7e](https://github.com/moby/profiles/blob/65adc7e022c97f55e45c054ff012988027733b87/seccomp/default.json) 的 Moby default profile（Apache-2.0，参见 [seccomp.LICENSE](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/codex/seccomp.LICENSE)；上游文件 SHA-256 为 `785b2429264afba4d594320337cb17f144f3c7d51585f9805eef72e28f4f9334`），追加一条允许 `clone`、`unshare`、`setns`、`mount`、`umount2` 和 `pivot_root` 的规则。发行包将此文件作为 `runtime/seccomp.json` 交付每个 Docker node。
-
-## 独立工作区挂载 {#independent-workspace-attachment}
-
-`Bootstrap.Workspace` 和 `ResumeRequest.Workspace` 可携带[工作区文件系统绑定](workspace-provider.md)。未提供时使用提供商自有的 Environment 磁盘；提供时选择精确的外部对象，不得回退到自有磁盘。提供商在解析前校验租户、Environment、绑定及其配置回执。`LocalOptions.Workspace` 注入文件系统解析器；沙箱提供商不解释文件系统适配器参数或原生回执。
-
-`DeploymentPolicy.Workspace` 声明挂载要求；未声明表示不支持外部存储。派生的不可变 `DeploymentSpec.Workspace` 回执选择代次的模式和能力；[部署流程](../../contracts/agents-api/zh/sandbox-deployment.md#resources)不会将文件系统配置复制进代次。Microsandbox 要求 `host_directory` 和 `user_xattr`；Docker 和 E2B 拒绝外部挂载。`ValidateWorkspacePolicy` 使用文件系统协议的组合校验器：不强制容量配额的外部文件系统拒绝正值 `EnvironmentDiskMiB`，零表示不请求配额。根磁盘容量仍为必需。未提供外部声明时，继续使用自有磁盘的容量边界。
-
-Microsandbox 在每次 Create 和 Resume（包括观察中断的恢复）时解析绑定，仅向私有 helper 传递本地目录和不可变 ObjectID。Helper 挂载整个 `/environment`；保留内容与私有原生历史遵循[工作区文件系统范围](workspace-provider.md#lifetime-and-filesystem-scope)和 [Runtime 资源目录](configuration.md#runtime-resource-directories)。私有 HOME、凭据和计算根磁盘不是持久历史存储。原生资源通过明确的模式、对象和路径标签校验，不根据挂载形状推断模式。检查点恢复校验快照对象，通过 SDK `Volumes` 重映射 `/environment`，要求严格外部挂载策略，并拒绝任何恢复警告。恢复部分失败时保留精确目标身份用于清理，不证明就绪。未知结果继续观察原操作。原生 Bind 检查点及 guest 内 flock 连续性不证明对未知 writer 的隔离。
diff --git a/docs/zh/web/console-api-usage.md b/docs/zh/web/console-api-usage.md
index 7a2e82c98..19f1330f1 100644
--- a/docs/zh/web/console-api-usage.md
+++ b/docs/zh/web/console-api-usage.md
@@ -1,16 +1,16 @@
 ---
 title: "控制台 API 使用"
 source: docs/web/console-api-usage.md
-source_hash: 77a5047c028ea755622714bf89f92066f9b331b7832f0295dec85390e13b182e
+source_hash: d14848610e56678c0de35ed6796b4631c5cd42b8a1f0d25366e224a4ff878e44
 ---
 
-本页列出各控制台页面读取和写入的 Core 路由，以及控制台如何限定读取范围。[administrator API contract](../../../contracts/agents-api/zh/admin-api.md) 定义了路由、响应结构、分页和审计记录；[API namespaces and credentials](../api/index.md) 定义了本文使用的术语。
+本页列出各控制台页面调用的 Core 路由，以及控制台如何限定读取范围。本页面向控制台开发者；运维人员请阅读 [Web 控制台](index.md)。[Core 管理 API](../../../contracts/agents-api/zh/admin-api.md) 定义了路由、响应结构、分页和审计记录；[API 命名空间和凭据](../api/index.md) 定义了本文使用的术语。
 
 ## 接口 {#interfaces}
 
 | 接口 | 路径 | 身份验证 | 控制台用途 |
 | --- | --- | --- | --- |
-| Console server | `/console/auth`、`/console/auth/{login,logout}`、`/console/config`、`/node-install/manifest.json` | 登录时使用 Core 密钥，随后使用控制台会话 Cookie；`/node-install/manifest.json` 无需登录 | 登录和退出；**添加节点** 所用的节点安装程序和节点构件；用于 Docker 和 microsandbox 设置以及 **设置** → **沙箱与调度** 中 Runtime 行的发行版 Runtime release。参见 [console server](console-server.md) |
+| Console server | `/console/auth`、`/console/auth/{login,logout}`、`/console/config` | 登录时使用 Core 密钥，随后使用控制台会话 Cookie | 登录和退出；**添加节点** 所用的节点安装程序和节点构件。参见 [控制台服务器](console-server.md) |
 | Administrator API | `/core/v1/**`，不包括 `/core/v1/sandbox` | Core 密钥，由控制台服务器添加 | 项目、密钥、资源读取和删除、诊断、执行器凭据和安装命令、来源信息、汇总、Core 指标、安装信息、默认模型 |
 | Sandbox administration | `/core/v1/sandbox/**` | Core 密钥，由控制台服务器添加 | 沙箱配置；**节点**；**概览** 上的机群与容量摘要；**沙箱监控** 中每个项目的 Runtime 观测 |
 | Agents API | `/v1/**` | 项目 API 密钥 | 不使用。控制台会向开发者说明如何调用它（参见 [Provenance and monitoring](#provenance-and-monitoring)） |
@@ -56,14 +56,14 @@ source_hash: 77a5047c028ea755622714bf89f92066f9b331b7832f0295dec85390e13b182e
 
 ## 执行器凭据和主机连接 {#executor-credentials-and-host-connection}
 
-仅当 Session 的 Environment 为 `self_hosted` 时，Session 页面才会显示 **执行器凭据** 区段，并针对该 Session 的 `project_id` 和 `environment.id` 读取凭据。[执行器凭据契约](../../../contracts/agents-api/zh/environment-executor-credentials.md) 定义了路由、404 和 409 响应以及凭据文件。
+仅当 Session 的 Environment 为 `self_hosted` 时，Session 页面才会显示 **执行器凭据** 区段，并针对该 Session 的 `project_id` 和 `environment.id` 读取凭据。[执行器凭据](../../../contracts/agents-api/zh/environment-executor-credentials.md) 定义了路由、404 和 409 响应以及凭据文件。
 
 | 操作 | 路由 | 控制台用途 |
 | --- | --- | --- |
 | 列出凭据 | `GET /core/v1/projects/{project_id}/environments/{environment_id}/executor-credentials` | 可见时每 5 秒读取一次。表格显示每个凭据的短 `key_id` 及其复制按钮、创建时间（`created_at`，轮换不会改变该值）和状态（Active，或 Revoked 及其时间），并优先显示活动凭据；绝不会列出凭据本身。同一次读取中的 `connection` 观测值用于驱动主机连接面板：never connected、connected、disconnected、bound credential revoked 和 unknown 保持为不同状态，且只有重新读取并得到 connected 才会将主机标记为已连接 |
 | 签发或轮换 | `POST …/executor-credentials`，请求体为 `{"key_id", "rotate"}` | Issue 会在提交前保留生成的密钥 ID。轮换前会确认旧凭据将停止工作；轮换已吊销的凭据会恢复该凭据并生成新密钥。私有 JSON 仅显示一次，供下载或复制，绝不会存储在浏览器存储或查询缓存中，并在 Done 时清除 |
 | 吊销 | `DELETE …/executor-credentials/{key_id}` | **撤销**，需确认（执行器会断开连接且不会重试；其守护进程会保持停止状态，直到操作员将其停止），随后再次读取列表，并显示凭据为 Revoked |
-| 安装命令 | `GET /core/v1/projects/{project_id}/environments/{environment_id}/installation` | **连接主机**：按 Core 返回的原始内容显示短效 Linux/macOS 和 PowerShell 命令，并提供平台选择器以及指向 [native installation guide](../getting-started/self-hosted.md) 的链接。这些命令会安装守护进程及其 Harnesses、启动守护进程并检查连接；其授权在 30 分钟后过期，控制台每 20 分钟重新读取一次。如果没有可用且未过期的响应，该区段会说明命令不可用。已归档项目不会读取该信息 |
+| 安装命令 | `GET /core/v1/projects/{project_id}/environments/{environment_id}/installation` | **连接主机**：按 Core 返回的原始内容显示短效 Linux/macOS 和 PowerShell 命令，并提供平台选择器以及指向 [运行自托管 Session](../getting-started/self-hosted.md) 的链接。这些命令会安装守护进程及其 Harnesses、启动守护进程并检查连接；其授权在 30 分钟后过期，控制台每 20 分钟重新读取一次。如果没有可用且未过期的响应，该区段会说明命令不可用。已归档项目不会读取该信息 |
 
 在已归档项目中，该区段会通过提示隐藏 **签发凭据** 和 **轮换**，但保留列表和 **撤销**，因为 Core 仍允许吊销。
 
@@ -75,7 +75,7 @@ source_hash: 77a5047c028ea755622714bf89f92066f9b331b7832f0295dec85390e13b182e
 | 写入操作 | `GET /core/v1/projects/{project_id}/write-operations` | 项目的写入历史，按最新优先，可按密钥和资源类型筛选，每页 50 条 |
 | 汇总 | `GET /core/v1/summary` | **概览**（按项目）、**Agent** 列表（`group_by=agent`）、项目页面（按项目并使用 `group_by=key`）、**Agent 监控**（跳过空闲项目，并统计从范围开始以来按创建密钥划分的使用量）、**项目与密钥** 列表（最近活动） |
 | 安装 | `GET /core/v1/installation` | **设置 → 服务与部署** 的 **安装** 信息（`public_url`、`api_base_url`、`installation_id`、`source_commit`）和只读 **启动设置**（`configuration.settings`；敏感设置仅显示其是否为 `configured`）；调用示例中的 `api_base_url`；作为下载来源以及节点安装和卸载命令中 `--source-url` 的 `public_url`（还包括安装命令中的 `--core-url`）。如果敏感设置包含值，或存在未知成员，读取会失败 |
-| Core 指标 | `GET /core/v1/metrics?range=` | **Core 监控** 页面。不存在该路由的 Core（404）会显示为未报告数据。[Core 指标契约](../../../contracts/agents-api/zh/core-metrics.md) 定义了每项度量 |
+| Core 指标 | `GET /core/v1/metrics?range=` | **Core 监控** 页面。不存在该路由的 Core（404）会显示为未报告数据。[Core 指标](../../../contracts/agents-api/zh/core-metrics.md) 定义了每项度量 |
 
 如果为 `local_only`，或者没有 `public_url`，**添加节点** 将无法签发命令，**清理主机** 也无法提供命令。随后 **概览**、**节点** 和 **设置** 会显示醒目警告，并通过 **查看公开地址** 前往 **设置 → 服务与部署**。**节点** 会禁用 **添加节点** 并显示明确原因，**新手引导** 则将沙箱步骤保留为待办项。
 
@@ -99,24 +99,24 @@ source_hash: 77a5047c028ea755622714bf89f92066f9b331b7832f0295dec85390e13b182e
 
 ## 工作区存储 {#workspace-storage}
 
-**设置 → 工作区存储** 通过 `GET`、`PUT /core/v1/workspace-storage` 读取和选择配置，并更新租户容量。参数和只写凭据由 adapter 验证；Web 不定义提供商专属字段。表单不回显凭据，也不自动重试结果不确定的写入。完整语义见[管理 API](../../../contracts/agents-api/zh/admin-api.md#workspace-storage)。
+**设置 → 工作区存储** 通过 `GET`、`PUT /core/v1/workspace-storage` 读取和选择配置，并更新租户容量。参数和只写凭据由 adapter 验证；Web 不定义提供商专属字段。表单不回显凭据，也不自动重试结果不确定的写入。完整语义见[Core 管理 API](../../../contracts/agents-api/zh/admin-api.md#workspace-storage)。
 
 ## Sandbox 管理 {#sandbox-administration}
 
 | 操作 | 路由 | 控制台用途 |
 | --- | --- | --- |
-| 部署 | `GET`、`POST`、`PUT /core/v1/sandbox/deployment` | 读取提供商、只读 `core_url`（即 `OAC_PUBLIC_URL`，会显示在设置审核中且绝不发送）、重置状态、安装 ID 和规范；409 `sandbox_configuration_error`（E2B 搭配回环地址形式的 `public_url`）会在设置向导中显示共享客户端固定的安全地址配置消息，并通过 **在设置中管理** 前往 **设置 → 服务与部署**，且无需确认；使用 `resources` 以及 Docker 或 microsandbox 的 `runtime` release 初始化部署，或者使用 E2B 账户且不提供 `resources`（Core 采用模板构建的 CPU 和内存）；使用预期的 generation 更改设置。E2B 的 `metadata.template_build`（状态、CPU、内存、磁盘）会显示在 **设置 → 沙箱与调度** 和 **沙箱监控** 中；当缺少 `specification.resources` 时，它还会确定每个 Sandbox 的大小；microsandbox 的 `suspension`（空闲和保留秒数）会显示在 **设置 → 沙箱与调度** 中 |
+| 部署 | `GET`、`POST`、`PUT /core/v1/sandbox/deployment` | 读取提供商、只读 `core_url`（即 `OAC_PUBLIC_URL`，会显示在设置审核中且绝不发送）、重置状态、安装 ID 和规范；409 `sandbox_configuration_error`（E2B 搭配回环地址形式的 `public_url`）会在设置向导中显示共享客户端固定的安全地址配置消息，并通过 **在设置中管理** 前往 **设置 → 服务与部署**，且无需确认；使用 Docker 或 microsandbox 的 `resources` 初始化部署，或者使用 E2B 账户且不提供 `resources`（Core 采用模板构建的 CPU 和内存）；使用预期的 generation 更改设置。E2B 的 `metadata.template_build`（状态、CPU、内存、磁盘）会显示在 **设置 → 沙箱与调度** 和 **沙箱监控** 中；当缺少 `specification.resources` 时，它还会确定每个 Sandbox 的大小；microsandbox 的 `suspension`（空闲和保留秒数）会显示在 **设置 → 沙箱与调度** 中 |
 | E2B 发现 | `POST /core/v1/sandbox/providers/e2b/discovery` | 设置向导先列出输入的 E2B 密钥可见的模板，再列出所选模板的可用构建。该密钥只会通过这些请求体和部署写入请求传输 |
 | 重置 | `POST`、`DELETE /core/v1/sandbox/deployment/reset` | 显式清除托管资源，或在观测到的 generation 处取消剩余清除；显示 Core 的剩余资源和离线预测 |
-| 节点 | `GET /core/v1/sandbox/nodes` | **节点** 页面；**概览** 上的机群；**沙箱监控** 中每个托管 Runtime 所在的节点。在线节点的 `diagnostic`（一个[就绪状态码](../getting-started/nodes.md#readiness-codes)；任何其他值均读取为 `provider_unavailable`）会将其标记为降级，并在 **节点** 列表及节点页面中，紧邻状态的帮助提示里说明原因和修复方法。如果节点的 `core_url`（其注册时使用的地址）与部署的 `core_url` 不同，**节点** 页面会将其标记为绑定到旧地址，需要移除后重新添加；此时它在该页面和节点页面中的状态会显示 **地址已过期**，而不是健康状态。**添加节点** 仅跟踪 `enrollment_id` 与其命令所含 `enrollment_id` 相等的节点 |
-| 节点详情 | `GET /core/v1/sandbox/nodes/{node_id}?range=1h\|6h\|24h` | **节点** 中的节点页面：主机最近一次心跳报告的 CPU 忙碌占比、内存使用量和可用磁盘，以及 1 小时、6 小时或 24 小时内 CPU 与内存的历史记录；页面可见时每 30 秒刷新一次。**编辑节点** 读取 `host.effective_cpu_cores` 和 `host.total_memory_bytes`，用于在每个 Sandbox 大小旁显示主机容量，以及最多可容纳多少个该大小的 Sandbox |
+| 节点 | `GET /core/v1/sandbox/nodes` | **节点** 页面；**概览** 上的机群；**沙箱监控** 中每个托管 Runtime 所在的节点。`provider_ready` 为 false 的在线节点为降级；**节点** 列表及节点页面中紧邻其状态的帮助提示显示 *沙箱提供商不可用*，目标准备原因（`rollout.diagnostic`，一个[就绪状态码](../getting-started/nodes.md#readiness-codes)）显示在其目标状态中。如果节点的 `core_url`（其注册时使用的地址）与部署的 `core_url` 不同，**节点** 页面会将其标记为绑定到旧地址，需要移除后重新添加；此时它在该页面和节点页面中的状态会显示 **地址已过期**，而不是健康状态。**添加节点** 仅跟踪 `enrollment_id` 与其命令所含 `enrollment_id` 相等的节点 |
+| 节点详情 | `GET /core/v1/sandbox/nodes/{node_id}?range=1h\|6h\|24h` | **节点** 中的节点页面：主机最近一次心跳报告的 CPU 忙碌占比、内存使用量和可用磁盘，以及 1 小时、6 小时或 24 小时内 CPU 与内存的历史记录；页面可见时每 30 秒刷新一次。**编辑节点** 读取节点的 `recommended_capacity` 作为推荐值 |
 | 分配 | `GET /core/v1/sandbox/nodes/{node_id}/allocations` | **节点** 页面；**沙箱监控**。节点页面根据 `compute_phase_changed_at` 显示每个分配处于计算阶段的时间；时间为 null 时显示短横线。它不会根据阶段时间或部署的 `suspension.retention_seconds` 推算快照到期时间 |
-| 注册 | `POST /core/v1/sandbox/enrollment-tokens` | **添加节点**：管理员先设置节点的 Sandbox 限制（`max_active`；`max_retained` 仅适用于 microsandbox，在 Docker 下等于 `max_active`），然后 Core 才会把一次性令牌放入命令中；该命令会验证安装程序校验和，并包含命令的 `enrollment_id`，节点注册时会报告此 ID。命令使用 sudo 运行安装程序（作为系统服务），并通过标准输入传递令牌；以 root 运行时则直接执行。界面不提供普通用户安装或移除入口，日志提示始终指明系统服务。命令从安装的 `public_url` 下载安装程序。只有成功读取安装信息后才会请求令牌；如果安装信息无法读取、安装为 `local_only`（或其 `public_url` 不是有效的 HTTP 或 HTTPS 来源），或者 `/console/config` 列出的 `node_artifacts` 不包含部署的提供商，则不会请求令牌。对话框在打开时和窗口重新获得焦点时，会再次读取这两项信息 |
+| 注册 | `POST /core/v1/sandbox/enrollment-tokens` | **添加节点**：管理员保留推荐上限（请求体不含上限，由 Core 在节点注册时推导）或同时设置两个上限（`max_active`；`max_retained` 仅适用于 microsandbox，在 Docker 下等于 `max_active`），然后 Core 才会把一次性令牌放入命令中；该命令会验证安装程序校验和，并包含命令的 `enrollment_id`，节点注册时会报告此 ID。命令使用 sudo 运行安装程序（作为系统服务），并通过标准输入传递令牌；以 root 运行时则直接执行。界面不提供普通用户安装或移除入口，日志提示始终指明系统服务。命令从安装的 `public_url` 下载安装程序。只有成功读取安装信息后才会请求令牌；如果安装信息无法读取、安装为 `local_only`（或其 `public_url` 不是有效的 HTTP 或 HTTPS 来源），或者 `/console/config` 列出的 `node_artifacts` 不包含部署的提供商，则不会请求令牌。对话框在打开时和窗口重新获得焦点时，会再次读取这两项信息 |
 | 更新节点 | `PATCH /core/v1/sandbox/nodes/{node_id}` | **编辑节点**：同时修改名称和 Sandbox 限制（保留数量限制仅适用于 microsandbox；在 Docker 下，Core 会将其设为活动数量限制） |
 | 移除节点 | `DELETE /core/v1/sandbox/nodes/{node_id}` | 确认后移除节点；只有 Core 确认删除后该行才会消失，随后 **清理主机** 对话框会提供主机的卸载命令（需要 root 或 sudo；对于使用不同于部署地址的地址注册的节点，还需要使用 `--force`，以跳过安装程序与 Core 的确认） |
 | Runtime 观测 | `GET /core/v1/sandbox/runtime-observations` | **沙箱监控**：每个项目的托管 Runtime，每项均以所属项目为标签；E2B Sandbox 对话框还会将 `observation.disk` 显示为已用量／限制值（其他位置为 null） |
 
-E2B 部署没有节点；其 API 密钥为只写。**概览** 和 **沙箱监控** 根据部署的 `resources.allocations` 和 `resources.pending` 统计其正在运行和正在启动的 Sandbox，而托管 Runtime 行来自 Runtime 观测。两个来源独立刷新，因此控制台不会根据两者之间的差异推断保留或清理状态。用于 Docker 和 microsandbox 的 Runtime 版本来自控制台自身的 `GET /node-install/manifest.json`；如果无法获取该信息，管理员需在高级设置中输入 release。**设置** → **沙箱与调度** 只为已保存 `specification.runtime` 的部署读取该清单，并且只在两个 release 不同时显示 Runtime 行；**使用本安装的 Runtime** 通过同一个 `PUT` 发送清单中的 release。
+E2B 部署没有节点；其 API 密钥为只写。**概览** 和 **沙箱监控** 根据部署的 `resources.allocations` 和 `resources.pending` 统计其正在运行和正在启动的 Sandbox，而托管 Runtime 行来自 Runtime 观测。两个来源独立刷新，因此控制台不会根据两者之间的差异推断保留或清理状态。
 
 ## 写入 {#writes}
 
diff --git a/docs/zh/web/console-server.md b/docs/zh/web/console-server.md
index 004ff4291..dd2518afa 100644
--- a/docs/zh/web/console-server.md
+++ b/docs/zh/web/console-server.md
@@ -1,12 +1,14 @@
 ---
 title: "控制台服务器"
 source: docs/web/console-server.md
-source_hash: 993473f539d1c78c5cfbccb112f3594d570b2898a1e324f8b14010ae6be338be
+source_hash: 2c8b3bfed09d29c70cfee4b3381a248befd722c8336c4964a079e20c073f1a4a
 ---
 
-控制台服务器（`services/web`、`oac-web` 进程）提供构建后的控制台，使用 Core 密钥认证管理员，并将已登录浏览器的 `/core/v1` 请求携带该密钥转发到 Core。浏览器不持有 Core 密钥或任何 API 密钥。应用、节点和自托管执行器经控制台到达 Core，控制台原样转发 `/v1`、`/api/v1` 和 `/docs`。
+控制台服务器（`oac-web`）提供 Web，使用 Core 密钥认证管理员，并将浏览器的 `/core/v1` 请求转发到 Core。本参考面向不使用安装程序运行 Web 的运维人员，以及评审其安全边界的人员。
 
-[配置](../configuration.md#appendix-web-environment-without-the-installer)定义其进程设置和默认值。
+它对应 `services/web` 进程。浏览器不持有 Core 密钥或任何 API 密钥。应用、节点和自托管执行器经控制台到达 Core，控制台原样转发 `/v1`、`/api/v1` 和 `/docs`。
+
+[配置参考](../configuration.md#appendix-web-environment-without-the-installer)定义其进程设置和默认值。
 
 ## 请求边界 {#request-boundary}
 
@@ -27,7 +29,7 @@ flowchart LR
   core <--> database
 ```
 
-部署的反向代理把所有路径发给控制台。控制台把 `/v1`、`/api/v1` 和 `/docs` 转发到 Core，其余由自己提供；[安装选项](../getting-started/install-options.md#https-and-the-reverse-proxy)列出对反向代理的要求。控制台按如下方式处理路径：
+部署的反向代理把所有路径发给控制台。控制台把 `/v1`、`/api/v1` 和 `/docs` 转发到 Core，其余由自己提供；[配置公开地址](../getting-started/public-address.md#https-and-the-reverse-proxy)列出对反向代理的要求。控制台按如下方式处理路径：
 
 | 路径 | 需要登录 | 处理方式 |
 | --- | --- | --- |
@@ -58,7 +60,7 @@ flowchart LR
 
 - 移除浏览器的 `Authorization`、`Proxy-Authorization`、`Cookie`、`Origin` 和 `Referer` 请求头；
 - 发送 `Authorization: Bearer <Core key>`；
-- 设置 `X-Core-Console-Actor: console`，替换浏览器提供的值。Core 将它记录为仅用于展示的审计标签（[管理员 API](../../../contracts/agents-api/zh/admin-api.md)）；
+- 设置 `X-Core-Console-Actor: console`，替换浏览器提供的值。Core 将它记录为仅用于展示的审计标签（[Core 管理 API](../../../contracts/agents-api/zh/admin-api.md)）；
 - 忽略环境中的 HTTP 代理设置，确保 Core 密钥仅发送到配置的 Core；
 - 流式转发响应，不缓冲。
 
@@ -92,15 +94,15 @@ flowchart LR
 | --- | --- |
 | `node_installer` | 控制台是否提供节点安装文件 |
 | `node_installer_sha256` | 文件中 `node-install.pyz` 的 SHA-256；**添加节点** 命令执行安装程序前验证它 |
-| `node_artifacts` | 文件中包含节点资产的提供商（`docker`、`microsandbox`），资产在本地或通过固定发行下载提供。每次请求都读取，因此重新运行安装程序新增的资产无需重启即可出现 |
+| `node_artifacts` | 文件中包含节点资产的提供商（`docker`、`microsandbox`），资产在本地或通过发行下载提供。每次请求都读取，因此重新运行安装程序新增的资产无需重启即可出现 |
 
 ## 节点安装文件 {#node-installation-payload}
 
-设置 `OAC_WEB_NODE_PAYLOAD_DIR` 后，控制台在 `/node-install/` 无需登录地提供匹配发行版的节点文件：`node-install.pyz`、`manifest.json`、`SHA256SUMS`、`runtime/seccomp.json`，以及清单声明的 `artifacts/` 下节点资产。本地缺失的资产重定向（307）到固定发行下载地址。节点安装和卸载命令从 `<public_url>/node-install/` 下载，因此反向代理必须将该路径发给控制台。节点自行验证每个校验和。
+设置 `OAC_WEB_NODE_PAYLOAD_DIR` 后，控制台在 `/node-install/` 无需登录地提供匹配发行版的节点文件：`node-install.pyz`、`manifest.json`、`SHA256SUMS`、`runtime/seccomp.json`，以及清单声明的 `artifacts/` 下节点资产。本地缺失的资产重定向（307）到其发行下载地址。节点安装和卸载命令从 `<public_url>/node-install/` 下载，因此反向代理必须将该路径发给控制台。节点自行验证每个校验和。
 
 ## 公开地址 {#public-address}
 
-控制台不配置域名，也不申请证书。运维人员的反向代理或托管平台终止 HTTPS 并把流量转到控制台，`OAC_PUBLIC_URL` 记录浏览器、应用、节点和执行器使用的源地址。控制台只接受该地址的主机，因此 DNS 重绑定不能访问它。
+运维人员的反向代理或托管平台终止 HTTPS 并把流量转到控制台（[配置公开地址](../getting-started/public-address.md)），`OAC_PUBLIC_URL` 记录浏览器、应用、节点和执行器使用的源地址。控制台只接受该地址的主机，因此 DNS 重绑定不能访问它。
 
 ## 验证 {#verification}
 
@@ -108,8 +110,8 @@ flowchart LR
 
 1. 控制台与 Core 的 `GET /healthz`。各自只证明进程响应。
 2. 登录后在浏览器读取 `GET /core/v1/projects`。这证明浏览器到控制台、控制台到 Core 的路径和控制台 Core 密钥有效。
-3. 项目 API 密钥在 `/v1` 有效，在 `/core/v1` 失败。Core 密钥在 `/v1` 失败；发给控制台的 `/v1` 返回 404。
+3. 项目 API 密钥在 `/v1` 有效，在 `/core/v1` 失败。Core 密钥在 `/v1` 失败。
 4. 跨来源控制台写入被拒绝，伪造 `X-Core-Console-Actor` 请求头不会改变审计标签。
 5. 登录成功或读取沙箱部署（`GET /core/v1/sandbox/deployment`）均不能证明模型或沙箱就绪。Runtime 观察与历史独立报告执行情况。
 
-登录失败属于控制台问题。已登录请求收到 Core 的 401，表示控制台 Core 密钥不匹配 Core 摘要，或控制台访问了错误的 Core。[问题排查表](../getting-started/operations.md#troubleshooting)覆盖常见症状。
+登录失败属于控制台问题。已登录请求收到 Core 的 401，表示控制台 Core 密钥不匹配 Core 摘要，或控制台访问了错误的 Core。[故障排查](../getting-started/troubleshooting.md#web-and-api-access)覆盖常见症状。
diff --git a/docs/zh/web/index.md b/docs/zh/web/index.md
index 39161bb33..5b40a5c41 100644
--- a/docs/zh/web/index.md
+++ b/docs/zh/web/index.md
@@ -1,12 +1,12 @@
 ---
-title: "OpenAgentCore Web"
+title: "Web 控制台"
 source: docs/web/index.md
-source_hash: 78038da909a1040224a2303365b2c1eb03e5345a58cbeca5ab7fd651b41a0462
+source_hash: fed3544a6fb993db8fb8a4f6c4dc3f64894ff2a587cd6d2deb3b49b9b74d082f
 ---
 
-Web 是单个 OpenAgentCore 部署的管理员控制台。管理员用它查看健康状态、容量、用量和失败情况，检查各项目的资源与执行历史，并管理项目、密钥、节点和部署设置。应用不使用 Web；它们通过自己的项目 API 密钥调用 Core 的 Agents API（`/v1`）。
+Web 是 OpenAgentCore 安装的管理员控制台：运维人员用 Core 密钥登录，查看健康状态和用量，检查应用创建的内容，并管理项目、密钥、节点和设置。应用使用项目 API 密钥调用 `/v1`，不使用 Web。
 
-![OpenAgentCore Web 概览](../../assets/console-overview-en.webp)
+![OpenAgentCore Web 概览](../../assets/console-overview-zh.webp)
 
 ## 登录 {#sign-in}
 
@@ -14,11 +14,13 @@ Web 是单个 OpenAgentCore 部署的管理员控制台。管理员用它查看
 
 登录后打开 **概览**。仍有未完成步骤时，**新手引导** 清单引导完成四步，顺序不限：沙箱就绪、默认模型提供商、具有活动密钥的项目、首个 Session。可从清单启动可选的控制台导览。
 
+![概览页的新手引导清单](../../assets/console-getting-started-zh.webp)
+
 ## 控制台页面 {#console-pages}
 
 | 分组 | 页面 | 用途 |
 | --- | --- | --- |
-| 监控 | 概览 | 服务状态、运行中的 Session、沙箱槽位和待处理工作；24 小时 Session 活动；以拓扑展示 Core 与节点，各自打开对应页面；需要处理：过去 24 小时内活跃的失败或等待调用方的 Session，每行附一行原因；按项目统计的用量 |
+| 监控 | 概览 | 服务状态、运行中的 Session、**沙箱容量**和待处理工作；24 小时 Session 活动；以拓扑展示 Core 与节点，各自打开对应页面；需要处理：过去 24 小时内活跃的失败或等待调用方的 Session，每行附一行原因；按项目统计的用量 |
 | 监控 | Core 监控 | Core 能否运行 Turn：执行槽位、Turn 队列及其 p95 等待时间、被中断的 Turn、已连接守护进程、数据库延迟、CPU 与常驻内存及其限制、后台任务；Go 堆、goroutine 和数据库连接池位于 **诊断** |
 | 监控 | Agent 监控 | 1 小时、6 小时、24 小时或 7 天的请求、错误、耗时、token、模型、工具、Agent 和 API 密钥 |
 | 监控 | 沙箱监控 | 各项目托管 Runtime 随时间的变化，显示活跃数量与总数，以及各自的状态（活跃、已挂起、切换中、等待分配或已停止）和 CPU、内存观测；E2B 部署还显示 Core 在 E2B 云中持有的沙箱 |
@@ -35,25 +37,38 @@ Web 是单个 OpenAgentCore 部署的管理员控制台。管理员用它查看
 
 | 任务 | 位置 |
 | --- | --- |
-| 为安装设置 HTTPS 地址 | 设置 `OAC_PUBLIC_URL`，并把反向代理指向 Web；参阅[使 Core 可访问](../getting-started/install.md#configure-the-domain-and-https) |
 | 选择沙箱提供商（microsandbox、E2B 或 Docker）、规格和 Runtime，或重置沙箱提供商 | **设置 → 沙箱与调度**；参阅[修改沙箱配置](../getting-started/nodes.md#change-the-sandbox-configuration) |
-| 添加、调整或移除执行节点 | **节点**：**添加节点**、**编辑节点** 和移除；参阅[节点指南](../getting-started/nodes.md) |
+| 添加、调整或移除执行节点 | **节点**：**添加节点**、**编辑节点** 和移除；参阅[添加和管理节点](../getting-started/nodes.md) |
 | 设置 Harness 默认模型 | **设置 → 模型与凭据**；参阅[默认模型](../configuration.md#default-models) |
 | 创建项目并签发 API 密钥 | **项目与密钥**；参阅 [项目和 API 密钥](../getting-started/operations.md#projects-and-api-keys) |
-| 签发、轮换或撤销自托管执行器凭据，或复制安装命令 | **Session 日志** 中的 Session 页面；参阅[自托管执行器](../getting-started/self-hosted.md) |
+| 签发、轮换或撤销自托管执行器凭据，或复制安装命令 | **Session 日志** 中的 Session 页面；参阅[运行自托管 Session](../getting-started/self-hosted.md) |
 | 删除资源，例如泄露的 Credential | 资源列表行或资源页面；文件从 **文件** 列表删除。适用公开删除规则 |
 
-安装不创建项目或密钥。打开控制台不分配计算资源，也不调用模型，安装可以没有节点。Web 不启动 Session，也不发送输入。归档托管 Session 会请求取消和回收；[管理员权限](../concepts.md#what-administrators-can-and-cannot-do)说明管理员能执行与不能执行的操作。
+Web 观察并管理安装。它从不启动 Session，也不发送输入；只有应用调用 `/v1` 时 Agent 才会运行。归档托管 Session 会请求取消并回收沙箱。[概念](../concepts.md#what-administrators-can-and-cannot-do)定义了管理员能做什么。
+
+新项目密钥只显示一次，并附带使用它的调用示例：
+
+![为项目签发的密钥及其调用示例](../../assets/console-issue-key-zh.webp)
+
+每个 Harness 的默认模型在 **设置 → 模型与凭据** 中设置：
+
+![设置 Harness 的默认模型配置](../../assets/console-default-model-zh.webp)
 
 部署的沙箱提供商服务托管 Session。应用的 `self_hosted` Runtime（包括它自己 E2B 账号中的 Runtime）是独立路径，修改沙箱配置不会影响它。
 
 回环公开地址（`local_only`）使节点和远程应用无法访问 Core。控制台仍可通过自己的地址访问，并[展示警告](console-api-usage.md#provenance-and-monitoring)。
 
+## 诊断故障 {#diagnose-a-failure}
+
+**Session 日志** 展示失败的 Turn 及其分类原因和下一步；[Session 诊断](../../../contracts/agents-api/zh/session-diagnostics.md)定义各个类别。**请求日志** 展示 HTTP 一侧的情况，例如状态为 401 的被拒请求。
+
+![Session 日志中失败的 Turn](../../assets/console-session-log-zh.webp)
+
+![请求日志中的 401](../../assets/console-request-log-zh.webp)
+
 ## 更多 {#more}
 
 - [控制台服务器](console-server.md)：请求边界、登录、设置和验证。
 - [控制台 API 使用](console-api-usage.md)：各页面使用的 Core 路由。
 - [Web 包](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/web/README.md)：开发控制台。
-- [管理员 API](../../../contracts/agents-api/zh/admin-api.md)：控制台背后的 `/core/v1` 路由。
-
-OpenAgentCore Web 使用 [MIT 许可证](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/LICENSE)。
+- [Core 管理 API](../../../contracts/agents-api/zh/admin-api.md)：控制台背后的 `/core/v1` 路由。
diff --git a/docs/zh/workspace-provider.md b/docs/zh/workspace-provider.md
index f29da1f80..524801276 100644
--- a/docs/zh/workspace-provider.md
+++ b/docs/zh/workspace-provider.md
@@ -1,10 +1,39 @@
 ---
-title: 工作区文件系统提供商
+title: 工作区文件系统协议
 source: docs/workspace-provider.md
-source_hash: ff018b1117a7f87786a23737212f1ed6b265d17fde43a0ef847f9f104788df2c
+source_hash: 2afa36a287c1b4268fef271f18ae094f74d1fc61d8c841bfbe21e9dbabd86cd6
 ---
 
-独立工作区文件系统边界由 [`workspacefs.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/workspacefs/workspacefs.go) 定义。本文规定必需的集成契约，并不表示所有沙箱提供商或执行位置均已实现。文件系统适配器拥有存储对象与原生挂载解析职责；[沙箱提供商](sandbox-provider.md) 拥有计算资源职责。Core 在分配任一资源前选择并验证二者的组合。
+工作区文件系统协议连接 Core 和沙箱节点与拥有 Environment 持久存储的适配器。Core 创建、观察和删除存储对象；节点将对象解析为主机目录，由其[沙箱提供商协议](sandbox-provider.md)挂载到计算资源。本文面向文件系统适配器和沙箱提供商的作者。
+
+| | |
+| --- | --- |
+| 调用方 | Core（`Control`）和沙箱节点（`Resolver`） |
+| 实现 | 内核 NFS 适配器（`nfs`），注册于 `services/core/internal/workspacefs/providers` |
+| 代码 | [`workspacefs.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/workspacefs/workspacefs.go) |
+| 传输 | 进程内 Go 接口；`Binding` 通过 `Create` 引导和 `Resume` 请求经[沙箱节点协议](../../contracts/agents-api/zh/node-generation-protocol.md#provider-requests)传递 |
+
+Core 在分配任一资源前，选择并验证沙箱提供商与文件系统适配器的组合。
+
+| 沙箱提供商 | 外部工作区存储 |
+| --- | --- |
+| microsandbox | 必需（`host_directory`、`user_xattr`） |
+| Docker、E2B | 不支持；使用提供商自有的 Environment 磁盘 |
+
+## 实现适配器 {#implement-an-adapter}
+
+1. 定义 `Parameters` 和可选凭据，并实现 `Normalize`（[标识与配置](#identity-and-configuration)）。
+2. 在 `Control` 中实现 `Declaration`、`Check`、`Create`、`Observe` 和 `Delete`，在 `Resolver` 中实现 `Resolve`（[操作与结果](#operations-and-outcomes)）。
+3. 声明挂载类型、用户扩展属性支持和配额强制执行（[能力验证](#capability-validation)）。
+4. 每个对象保持单一写入方，仅在 Core 授权时删除（[生命周期与文件系统范围](#lifetime-and-filesystem-scope)）。
+
+## 角色 {#roles}
+
+| 参与方 | 负责 |
+| --- | --- |
+| Core | 标识、持久化的 `Reference`、配置和凭据、已准入容量、生命周期顺序以及每个删除决定 |
+| 文件系统适配器 | 原生存储对象及其回执、原生归属检查和路径解析 |
+| 沙箱提供商 | 计算资源，以及将解析出的目录挂载到计算资源 |
 
 ## 标识与配置 {#identity-and-configuration}
 
@@ -33,7 +62,18 @@ source_hash: ff018b1117a7f87786a23737212f1ed6b265d17fde43a0ef847f9f104788df2c
 | `Delete(ctx, reference)` | Core 授权删除且确认计算资源停止后，收敛到已验证归属对象的终态删除。 |
 | `Resolve(ctx, binding)` | 验证原生归属并为本地计算解析挂载。 |
 
-错误支持 `errors.Is`：`ErrInvalid` 表示无效输入，`ErrOwnership` 表示引用或配置不匹配，`ErrUnavailable` 表示存储不可用，`ErrUnconfirmed` 表示变更结果未知，`ErrNotFound` 表示对象不存在，`ErrUnsupported` 表示不支持的组合。适配器包装错误时保留这些结果。观察到不存在不证明先前变更已结束。超时或上下文取消只结束调用方的等待，不证明原生操作停止或回滚。结果未知时 Core 保留归属。Core 可以使用同一持久化不可变引用和配置重试 `Create` 或 `Delete`，包括收到 `ErrUnconfirmed` 后；绝不能通过替换新对象标识重试结果不确定的操作。
+错误支持 `errors.Is`。适配器包装错误时保留这些结果。
+
+| 错误 | 条件 |
+| --- | --- |
+| `ErrInvalid` | 无效输入 |
+| `ErrOwnership` | 引用或配置不匹配 |
+| `ErrUnavailable` | 存储不可用 |
+| `ErrUnconfirmed` | 变更结果未知 |
+| `ErrNotFound` | 对象不存在 |
+| `ErrUnsupported` | 不支持的组合 |
+
+观察到不存在不证明先前变更已结束。超时或上下文取消只结束调用方的等待，不证明原生操作停止或回滚。结果未知时 Core 保留归属。Core 可以使用同一持久化不可变引用和配置重试 `Create` 或 `Delete`，包括收到 `ErrUnconfirmed` 后；绝不能通过替换新对象标识重试结果不确定的操作。
 
 同一引用的重试与并发收敛是适配器必须提供的保证。`Create` 保留现有对象数据并返回该归属对象的挂载凭据，绝不重新初始化存活对象。重复或并发的 `Delete` 调用收敛到同一终态删除。一旦记录终态删除，并发、延迟或重试的 `Create` 均不得使对象复活，`Resolve` 也不得暴露该对象。允许保留删除元数据，并在先前进行中的操作结束后继续清理。这些保证适用于存储生命周期操作，不表示超时时变更已结束，也不提供分布式计算隔离。
 
@@ -55,11 +95,19 @@ source_hash: ff018b1117a7f87786a23737212f1ed6b265d17fde43a0ef847f9f104788df2c
 
 工作区存储随 Session 保留，直至显式删除 Session。归档、过期、重置和删除计算检查点均不授权删除工作区。Core 仅在显式删除 Session 且确认计算资源停止后调用 `Delete`；未解决的计算或存储变更须保留归属。Session 仍被保留时，创建失败不授权删除其存储。符合条件且未终结的 Session 可以在检查点保留期结束后继续保留，并按[冷替换生命周期](sandbox-provider.md#cold-replacement-after-checkpoint-retention)将同一对象挂载到新的计算资源。此流程不会复活已归档、重置或删除的执行。
 
+## 挂载 {#attachment}
+
+`Bootstrap.Workspace` 和 `ResumeRequest.Workspace` 携带[工作区文件系统绑定](#identity-and-configuration)。策略声明了工作区存储的提供商要求提供绑定，缺失时返回 `ErrInvalid`；未声明的提供商保留自有 Environment 磁盘并拒绝绑定。提供时选择精确的外部对象，不得回退到其他磁盘。提供商在解析前校验租户、Environment、绑定及其配置回执。`LocalOptions.Workspace` 注入文件系统解析器；沙箱提供商不解释文件系统适配器参数或原生回执。
+
+`DeploymentPolicy.Workspace` 已声明表示提供商在外部存储上运行每个 Environment，并给出挂载要求；未声明表示使用提供商自有磁盘、不使用外部存储。派生的不可变 `DeploymentSpec.Workspace` 回执记录所选能力，此类提供商始终具备该回执；未选择存储的部署返回 `ErrWorkspaceRequired`，Core 将其报告为 `workspace_storage_required`；[部署流程](../../contracts/agents-api/zh/sandbox-deployment.md#resources)不会将文件系统配置复制进代次。Microsandbox 要求 `host_directory` 和 `user_xattr`；Docker 和 E2B 拒绝外部挂载。校验使用文件系统协议的组合校验器：`EnvironmentDiskMiB` 仅是容量配额请求，仅当存储声明 `capacity_quota` 时有效，默认值为零，表示不请求配额。根磁盘容量仍为必需。
+
+Microsandbox 在每次 Create 和 Resume（包括观察中断的恢复）时解析绑定，仅向私有 helper 传递本地目录和不可变 ObjectID。Helper 挂载整个 `/environment`；保留内容与私有原生历史遵循[工作区文件系统范围](#lifetime-and-filesystem-scope)和 [Runtime 资源目录](configuration.md#runtime-resource-directories)。私有 HOME、凭据和计算根磁盘不是持久历史存储。原生资源通过对象和路径标签校验。检查点恢复校验快照对象，通过 SDK `Volumes` 重映射 `/environment`，要求严格外部挂载策略，并拒绝任何恢复警告。恢复部分失败时保留精确目标身份用于清理，不证明就绪。未知结果继续观察原操作。原生 Bind 检查点及 guest 内 flock 连续性不证明对未知 writer 的隔离。
+
 ## 内核 NFS 适配器 {#kernel-nfs-adapter}
 
 `nfs` 适配器使用由运维人员预挂载的 Linux 内核 NFS 文件系统。支持的配置是受信任 AUTH_SYS 客户端上的 NFSv4.2，启用 `root_squash`，Core 和节点使用相同导出和绝对挂载路径。适配器不挂载导出，也不管理 NFS 凭据或服务账户。其他操作系统返回 `ErrUnsupported`。[配置文档](./configuration.md#independent-workspace-storage)负责安装步骤和选择方式。
 
-参数包含 `root`、`namespace_id`、`uid`，配额模式下还包含 `quota`。`root` 是规范的绝对挂载路径；`namespace_id` 是非零规范 UUID；`uid` 是 Core 和节点均须使用的非零有效主机 UID。初始部署使用 65532。运维人员将挂载根目录设置为该 UID 所有、权限 `0700`，并准备同 UID 所有、权限 `0600` 的常规文件 `.oac-storage-root`，内容精确为命名空间 UUID 加一个换行符。应由导出服务端管理员在服务端存储上完成此操作；启用 root squash 的客户端不能假定有权变更所有者。根标记声明所选导出的身份，并非凭据或分布式锁。
+参数包含 `root`、`namespace_id`、`uid`，配额模式下还包含 `quota`。`root` 是规范的绝对挂载路径；`namespace_id` 是非零规范 UUID；`uid` 是 Core 和节点均须使用的非零有效主机 UID。Compose 安装使用 65532，即 Core 容器的 UID。运维人员将挂载根目录设置为该 UID 所有、权限 `0700`，并准备同 UID 所有、权限 `0600` 的常规文件 `.oac-storage-root`，内容精确为命名空间 UUID 加一个换行符。应由导出服务端管理员在服务端存储上完成此操作；启用 root squash 的客户端不能假定有权变更所有者。根标记声明所选导出的身份，并非凭据或分布式锁。
 
 构造函数只验证并规范化 JSON，不执行文件系统 I/O。`Check` 验证打开的根目录确实位于内核 NFS，有效 UID 与私有所有权和权限匹配，命名空间标记匹配，并且实际文件描述符上的 `user.*` xattr 设置、读取和删除成功。包括打开根目录和可用性检查在内的所有文件系统操作，共享每进程最多 32 个在途操作的预算。调用者超时后收到 `ErrUnconfirmed`；该操作仍占用名额，直到内核调用返回。预算耗尽返回 `ErrUnavailable`。相对于目录描述符的操作始终锚定已打开的根目录。挂载不可用或配置路径只是本地目录时，验证失败，不创建本地回退。
 
@@ -69,7 +117,7 @@ source_hash: ff018b1117a7f87786a23737212f1ed6b265d17fde43a0ef847f9f104788df2c
 
 ### 配额模式 {#quota-mode}
 
-配额模式通过 NFS 服务端自身文件系统强制执行的 XFS project quota 为每个对象设定上限。`quota` 精确包含 `endpoint`（存储服务器 SSH 服务的 `host:port`）、`user`（受限账户）和 `host_key`（以 authorized-key 格式固定的服务器 OpenSSH 公共主机密钥；注释会被丢弃）。凭据为 `{"ssh_private_key": "..."}`，即一个未加密的 OpenSSH 私钥，服务器仅为 `oac-workspace-quota` 强制命令授权其公钥。服务器准备工作由[配置文档](configuration.md#quota-mode-storage-server)负责。
+配额模式通过 NFS 服务端自身文件系统强制执行的 XFS project quota 为每个对象设定上限。`quota` 精确包含 `endpoint`（存储服务器 SSH 服务的 `host:port`）、`user`（受限账户）和 `host_key`（以 authorized-key 格式固定的服务器 OpenSSH 公共主机密钥；注释会被丢弃）。凭据为 `{"ssh_private_key": "..."}`，即一个未加密的 OpenSSH 私钥，服务器仅为 `oac-workspace-quota` 强制命令授权其公钥。服务器准备工作由[设置工作区存储](getting-started/workspace-storage.md#quota-mode-storage-server)负责。
 
 对于正容量，`Create` 在认领标识并创建对象空的 `staging/` 和 `trash/` 之后、创建任何 stage 或返回现有 `live` 对象之前调用该命令，因此每次重试都会重新验证上限。请求携带完整引用、配置 ID、命名空间 ID、容量以及每 MiB 256 个的 inode 上限；请求无法指定任何路径、project ID、用户或命令。客户端验证固定的主机密钥，仅在内存中保存私钥，每次调用使用一个有界会话。请求发送前失败为 `ErrUnavailable`；发送后缺少或无法解析应答为 `ErrUnconfirmed`，同一引用在重试时收敛。`Check` 同样调用该命令，在选择前证明可达性、主机密钥、命名空间标记、日志库和强制执行状态。
 
@@ -79,6 +127,19 @@ source_hash: ff018b1117a7f87786a23737212f1ed6b265d17fde43a0ef847f9f104788df2c
 
 每个对象拥有 `objects/<ObjectID>/identity`、`staging/`、`live/`、`trash/`，以及删除开始后的 `deleted-marker`。永久标识绑定租户、Environment 和对象 UUID。Create 先准备并同步唯一的私有 staging 封装目录，再原子发布其非空目录为 `live`；重放不会覆盖现有 live 数据。Delete 先持久记录对象本地的终态标记，将 live 数据退役到唯一的对象本地 trash，再先删除数据、后删除其所有权标记。并发删除者收敛。最少量的标识和删除元数据会有意保留；删除不代表所有元数据文件均消失。Create 和 Resolve 拒绝已退役标识。迟到的在途 Create 可能留下空的受控元数据，需要在其系统调用完成后重复 Delete；它不能授权新写入者或复用对象标识。清理只查看该对象的 staging 和 trash，不全量扫描命名空间，也不使用后台服务。
 
+```mermaid
+stateDiagram-v2
+    [*] --> staging: Create
+    staging --> live: publish
+    live --> deleted: Delete (marker written)
+    deleted --> [*]: data removed from trash
+    note right of deleted: Create and Resolve refuse the retired identity
+```
+
 NFS 存储不提供计算 fencing 或自动分布式故障转移。Guest `flock` 不是跨 VM 写入者锁。上述单写入者和显式删除要求仍然必须遵守。确认释放后，可以允许另一兼容 node 上的新 VM 挂载同一对象，但 node 离线或 Create、Kill、快照清理结果未知均不证明旧写入方已停止。原生历史和数据库行为需要对所选 Runtime、Harness、文件系统组合进行资格验证；仅保留文件不保证原生 Session 恢复、跨 node 内存恢复或任意崩溃后的持久性。
 
-所选部署代次使用外部工作区存储时，Core 要求所选 Harness profile 支持 `retained_native_history`。创建流程在持有部署锁时校验该代次，然后才提交 Session 或计算预留。既有 Session 的 Runtime 准入和最终执行检查以不可变工作区绑定为依据。自带工作区存储不要求此能力。
+所选部署代次使用外部工作区存储（每个 microsandbox 代次都是如此）时，Core 要求所选 Harness profile 支持 `retained_native_history`。创建流程在持有部署锁时校验该代次，然后才提交 Session 或计算预留。既有 Session 的 Runtime 准入和最终执行检查以不可变工作区绑定为依据。使用自有磁盘的提供商不要求此能力。
+
+## 一致性测试 {#conformance}
+
+共享校验器和组合检查由 `services/core/internal/workspacefs/workspacefs_test.go` 覆盖，内核 NFS 适配器由 `services/core/internal/workspacefs/nfs` 中的测试覆盖，由 `make check-core-packages` 运行。
diff --git a/example/parsar/README.md b/example/parsar/README.md
index 819d6e149..72eead840 100644
--- a/example/parsar/README.md
+++ b/example/parsar/README.md
@@ -17,9 +17,9 @@ Open http://127.0.0.1:18180. The Core URL is an origin without `/v1`; remote ori
 
 ## Main flow
 
-1. **Models:** enter a Provider name, Base URL and API key, then fetch its `GET /v1/models` list. Select models with checkboxes or add custom model IDs, then save the Provider and selected models together. The dialog shows discovered and selected counts. For manual entry, skip discovery. No default group is created. Keys are stored in the local restricted SQLite file and never returned to the browser; leaving the key blank while editing preserves it. Discovery sends only that Provider's key and does not follow redirects. The list expects the OpenAI-shaped `data: [{id: "..."}]` response. Discovery failures leave manual entry available. Codex and Claude Code workspace Sessions pass the selected Provider URL/key explicitly to Core, using the harness protocol. These Sessions require an HTTPS Base URL and API key. Text-only Sessions and hosted MiniMax Code use Core's deployment connection; the creation dialog states that their Provider is only a catalog group. The example does not yet expose MiniMax Code's required token limits.
+1. **Models:** enter a Provider name, Base URL and API key, then fetch its `GET /v1/models` list. Select models with checkboxes or add custom model IDs, then save the Provider and selected models together. The dialog shows discovered and selected counts. For manual entry, skip discovery. No default group is created. Keys are stored in the local restricted SQLite file and never returned to the browser; leaving the key blank while editing preserves it. Discovery sends only that Provider's key and does not follow redirects. The list expects the OpenAI-shaped `data: [{id: "..."}]` response. Discovery failures leave manual entry available. Workspace Sessions pass the selected Provider URL/key explicitly to Core, using the harness protocol. These Sessions require an HTTPS Base URL and API key. Text-only Sessions use Core's deployment connection; the creation dialog states that their Provider is only a catalog group.
 2. **Skills:** create a SKILL.md resource or upload a ZIP. Inspect versions, upload a new version, and choose the default. Core validates and stores bundles.
-3. **MCP:** save anonymous HTTPS endpoints and bind them to Agents. Hosted Sessions install an inline environment Plugin; text-only Sessions use Core's service-origin MCP. Hosted HTTP MCP supports Claude Code and Codex, not MiniMax Code. Authentication, Vault management and OAuth setup are not included.
+3. **MCP:** save anonymous HTTPS endpoints and bind them to Agents. Hosted Sessions install an inline environment Plugin; text-only Sessions use Core's service-origin MCP. Authentication, Vault management and OAuth setup are not included.
 4. **Runtimes:** choose a Core-managed sandbox, text-only environment, or user machine. User machines select Linux/macOS/Windows and an existing absolute workspace path, plus an optional local capability directory. Each Session gets its own daemon installation and credential; choosing the same workspace path shares the host's files, so use distinct paths for isolated work. These are placement configurations, not online machine identities. Machine enrollment, fixed-node routing and self-hosted registration are omitted.
 5. **Agents:** combine a model, harness, instructions, Skills and MCP services. Create, copy and edit configurations without allocating a runtime.
 6. **Sessions:** open an Agent, choose a runtime and send the first message. Read streaming replies and tool activity, continue the conversation, cancel a running turn and reopen history. Unsupported Skill/MCP/runtime combinations are explained before creation. The Session's **Files** dialog uploads one file at a time (up to 5 MiB) through Core's public Environment Files API while idle. Each upload gets a unique path under `/workspace/inputs`; a path relative to the working directory is inserted into the message draft, not sent automatically. Unsent drafts, including uploaded file paths, survive reloads and navigation in the same browser tab and remain scoped to the Session. This keeps the API's `/workspace` alias distinct from the physical user-machine directory. Ask the Agent to save generated files under `./outputs`; published Artifacts can be paged and downloaded from the same dialog, even when the live workspace is unavailable. Downloads remain binary; errors stay in the dialog. Text-only Sessions have no file actions. Each hosted Session gets its own workspace; text-only has no workspace.
@@ -32,7 +32,7 @@ The loopback Node server has two small responsibilities: a fixed allowlist proxy
 
 SQLite files live in `~/.oac/data/parsar-example/`. Set the absolute `OAC_EXAMPLE_DATA_DIR` to relocate them. A hash of the Core origin and Project key selects the file; changing either selects a different local catalog. Back up the SQLite file with the server stopped. The Core Project key is not stored in it. Provider keys are stored there. Builds and caches use `${OAC_DEV_HOME:-$HOME/.oac}`.
 
-Use one server process and a dedicated Project for this local single-user example. The server rejects cross-origin writes and keeps the Project key out of browser responses. Session creation freezes a pending request in SQLite before calling Core, and uses the local Session ID as its idempotency key. An uncertain response can be recovered from the Agent's Session list, including after a server restart. Successful creation leaves only the Core Session reference and local title/Agent/runtime relationship; Core owns messages, turns and execution status. The browser consumes public SSE text deltas through a non-buffering proxy, reconnects after interruption, and reconciles with durable history to avoid duplicate final replies. Each send records request-return latency and first nonempty text-delta latency from browser request start. These independent observations remain in sessionStorage across reloads; missing observations are shown as a dash rather than inferred from history. Definite validation rejection removes the pending request so it can be corrected. Use one server process. Deleting a local resource is blocked while another local record references it; Session deletion/archival is outside this example. Skill deletion is a separate explicit Core operation. Earlier templates and instances become Agent configs on startup; they are never presented as actual Sessions.
+Use one server process and a dedicated Project for this local single-user example. The server rejects cross-origin writes and keeps the Project key out of browser responses. Session creation freezes a pending request in SQLite before calling Core, and uses the local Session ID as its idempotency key. An uncertain response can be recovered from the Agent's Session list, including after a server restart. Successful creation leaves only the Core Session reference and local title/Agent/runtime relationship; Core owns messages, turns and execution status. The browser consumes public SSE text deltas through a non-buffering proxy, reconnects after interruption, and reconciles with durable history to avoid duplicate final replies. Each send records request-return latency and first nonempty text-delta latency from browser request start. These independent observations remain in sessionStorage across reloads; missing observations are shown as a dash rather than inferred from history. Definite validation rejection removes the pending request so it can be corrected. Use one server process. Deleting a local resource is blocked while another local record references it; Session deletion/archival is outside this example. Skill deletion is a separate explicit Core operation.
 
 A few more implementation details:
 
@@ -64,8 +64,8 @@ It leaves sample resources for inspection and executes the configured model. It
 
 Create a user-machine runtime and start a Session with an Agent using Codex or Claude Code. No initial Turn is sent. Open **Connect user machine** and run the Core-provided command on the target host. The installer downloads the matching native distribution, installs the selected harness and starts the connection. Windows Claude Code also requires Git Bash. The page reads Core's public Environment status and enables sending after it reports connected. The example backend does not need or accept the administrator Core key. Commands carry temporary Environment-scoped authorization; do not share them. Session refresh renews them.
 
-The selected model Provider needs an HTTPS Base URL and API key. Its protocol is Responses for Codex and Anthropic for Claude Code. Core freezes and delivers the configuration to the enrolled executor. Local pending creation requests contain that configuration but browser Session responses omit the entire pending request.
+The selected model Provider needs an HTTPS Base URL and API key. Its protocol is Responses for Codex and Anthropic for Claude Code and MiniMax Code. Core freezes and delivers the configuration to the enrolled executor. Local pending creation requests contain that configuration but browser Session responses omit the entire pending request.
 
-Self-hosted capability sources are local directories under the current Core API. Managed Skill bindings fail explicitly; configure local Skills/Plugins in the runtime's capability directory before connecting. Bound HTTP MCP services also fail explicitly for self-hosted Sessions; configure them in local Plugins instead. MiniMax Code self-hosted configuration is not included in this example because its required token limits are not exposed.
+Self-hosted capability sources are local directories under the current Core API. Managed Skill bindings fail explicitly; configure local Skills/Plugins in the runtime's capability directory before connecting. Bound HTTP MCP services also fail explicitly for self-hosted Sessions; configure them in local Plugins instead.
 
 The daemon runs with the starting user's permissions and adds no sandbox. Runtime home is separate per Session; stopping it preserves local files. Credential rotation and revocation remain Core console operations. Reuse the original installation directory when reconnecting.
diff --git a/example/parsar/server/product.mjs b/example/parsar/server/product.mjs
index 1b3df5f29..f3a9a6d3c 100644
--- a/example/parsar/server/product.mjs
+++ b/example/parsar/server/product.mjs
@@ -12,34 +12,6 @@ const kinds = new Set([
   "sessions",
 ]);
 export function productAPI(store, core, fetchImpl = fetch) {
-  // Preserve earlier example configurations without fabricating execution records.
-  for (const kind of ["templates", "instances"]) {
-    for (const row of store.list(kind)) {
-      if (!store.get("agents", row.id)) {
-        const {
-          id,
-          name,
-          revision,
-          model_id,
-          harness,
-          instructions,
-          skill_ids,
-          mcp_ids,
-        } = row;
-        store.put("agents", {
-          id,
-          name,
-          revision,
-          model_id,
-          harness,
-          instructions,
-          skill_ids,
-          mcp_ids,
-        });
-      }
-      store.remove(kind, row.id);
-    }
-  }
   const sessions = sessionAPI(store, core);
   const publicRow = (kind, row) => {
     if (kind === "providers") return publicProvider(row);
diff --git a/example/parsar/server/sessions.mjs b/example/parsar/server/sessions.mjs
index 2cfdd72e6..46e4d5053 100644
--- a/example/parsar/server/sessions.mjs
+++ b/example/parsar/server/sessions.mjs
@@ -18,7 +18,7 @@ function requestFor(store, id, body) {
   const restriction = sessionRestriction(agent, runtime);
   if (restriction) throw new AppError(400, restriction);
   let modelProvider;
-  if (environment.type !== "none" && agent.harness !== "mcode") {
+  if (environment.type !== "none") {
     const provider = store.get("providers", model.provider_id);
     if (!provider?.base_url?.startsWith("https://") || !provider.api_key)
       throw new AppError(
diff --git a/example/parsar/shared/session-profile.mjs b/example/parsar/shared/session-profile.mjs
index 96ea469fd..b99a279f3 100644
--- a/example/parsar/shared/session-profile.mjs
+++ b/example/parsar/shared/session-profile.mjs
@@ -6,11 +6,7 @@ export function sessionRestriction(agent, runtime) {
       return "用户机器使用本地能力目录，不能绑定托管 Skill。请先编辑 Agent，移除托管 Skill。";
     if (agent.mcp_ids.length)
       return "用户机器的 MCP 需通过本地 Plugin 配置。请先编辑 Agent，移除 MCP 绑定。";
-    if (agent.harness === "mcode")
-      return "当前示例的用户机器支持 Codex 和 Claude Code，请先编辑 Agent 的执行引擎。";
   }
   if (runtime.environment === "none" && agent.skill_ids.length)
     return "Skills 需要托管运行环境，请选择托管沙箱或移除 Skill 绑定。";
-  if (agent.harness === "mcode" && agent.mcp_ids.length)
-    return "MiniMax Code 暂不支持此处的 HTTP MCP，请选择 Claude Code 或 Codex。";
 }
diff --git a/example/parsar/src/Agents.tsx b/example/parsar/src/Agents.tsx
index acb8b7d5c..b8f285d87 100644
--- a/example/parsar/src/Agents.tsx
+++ b/example/parsar/src/Agents.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react";
 import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { randomUuid } from "@oac/agents-client";
 import { Plus, Copy, Trash2, Layers } from "lucide-react";
 import {
   product,
@@ -43,7 +44,7 @@ export function Agents() {
           onClick={() =>
             setEditing({
               ...emptyConfiguration,
-              id: crypto.randomUUID(),
+              id: randomUuid(),
               name: "",
               revision: 0,
             })
@@ -84,7 +85,7 @@ export function Agents() {
                     onClick={() =>
                       setEditing({
                         ...agent,
-                        id: crypto.randomUUID(),
+                        id: randomUuid(),
                         name: `${agent.name} 副本`,
                         revision: 0,
                       })
diff --git a/example/parsar/src/Composer.tsx b/example/parsar/src/Composer.tsx
index 9f80c9ea5..275b4d90b 100644
--- a/example/parsar/src/Composer.tsx
+++ b/example/parsar/src/Composer.tsx
@@ -2,7 +2,7 @@ import { useEffect, useState } from "react";
 import { useMutation, useQueryClient } from "@tanstack/react-query";
 import {
   AgentCoreError,
-  createIdempotencyKey,
+  randomUuid,
   type AgentSession,
 } from "@oac/agents-client";
 import { ArrowUp, Square } from "lucide-react";
@@ -52,10 +52,10 @@ export function Composer({
           `${previous}${previous ? "\n" : ""}请处理文件：${attachment}`,
       );
   }, [attachment]);
-  const [cancelKey, setCancelKey] = useState(createIdempotencyKey);
+  const [cancelKey, setCancelKey] = useState(randomUuid);
   const [cancelRequested, setCancelRequested] = useState(false);
   useEffect(() => {
-    setCancelKey(createIdempotencyKey());
+    setCancelKey(randomUuid());
     setCancelRequested(false);
   }, [turnId]);
   const running =
@@ -66,7 +66,7 @@ export function Composer({
   };
   const send = useMutation({
     mutationFn: async () => {
-      const operation = pending || { key: createIdempotencyKey(), text };
+      const operation = pending || { key: randomUuid(), text };
       sessionStorage.setItem(storageKey, JSON.stringify(operation));
       setPending(operation);
       beginTiming(session.id, operation.key, turnId);
diff --git a/example/parsar/src/Models.tsx b/example/parsar/src/Models.tsx
index 358313d11..a12486363 100644
--- a/example/parsar/src/Models.tsx
+++ b/example/parsar/src/Models.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react";
 import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { randomUuid } from "@oac/agents-client";
 import { Plus, Pencil, Trash2 } from "lucide-react";
 import {
   product,
@@ -35,7 +36,7 @@ export function Models() {
         </Help>
         <Button
           onClick={() =>
-            setProvider({ id: crypto.randomUUID(), name: "", revision: 0 })
+            setProvider({ id: randomUuid(), name: "", revision: 0 })
           }
         >
           <Plus />
diff --git a/example/parsar/src/NewSession.tsx b/example/parsar/src/NewSession.tsx
index eefef33ff..d9492454b 100644
--- a/example/parsar/src/NewSession.tsx
+++ b/example/parsar/src/NewSession.tsx
@@ -1,6 +1,7 @@
 import { sessionRestriction } from "../shared/session-profile.mjs";
 import { useRef, useState } from "react";
 import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { randomUuid } from "@oac/agents-client";
 import {
   product,
   ProductError,
@@ -31,7 +32,7 @@ export function NewSession({
   const cache = useQueryClient();
   const runtimes = useRuntimes();
   const [form, setForm] = useState(() => ({
-    id: crypto.randomUUID(),
+    id: randomUuid(),
     name: "",
     input: "",
     agent_id: agent.id,
@@ -140,14 +141,12 @@ export function NewSession({
               {restriction}
             </p>
           )}
-          {!restriction &&
-            runtime &&
-            (runtime.environment === "none" || agent.harness === "mcode") && (
-              <p className="text-base">
-                此组合使用 Core 部署的模型连接；这里选择的 Provider
-                仅用于模型分组。
-              </p>
-            )}
+          {!restriction && runtime && runtime.environment === "none" && (
+            <p className="text-base">
+              此组合使用 Core 部署的模型连接；这里选择的 Provider
+              仅用于模型分组。
+            </p>
+          )}
           <ErrorNotice error={save.error || runtimes.error} />
           {uncertain && (
             <p>如请求结果未确定，可关闭弹窗，在会话列表中恢复同一次创建。</p>
diff --git a/example/parsar/src/Resources.tsx b/example/parsar/src/Resources.tsx
index c371fa688..34357afde 100644
--- a/example/parsar/src/Resources.tsx
+++ b/example/parsar/src/Resources.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react";
 import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { randomUuid } from "@oac/agents-client";
 import { Plus, Pencil, Trash2, Plug, Server } from "lucide-react";
 import {
   product,
@@ -75,14 +76,14 @@ function ResourceList({
             setEditing(
               kind === "mcps"
                 ? {
-                    id: crypto.randomUUID(),
+                    id: randomUuid(),
                     name: "",
                     label: "",
                     url: "",
                     revision: 0,
                   }
                 : {
-                    id: crypto.randomUUID(),
+                    id: randomUuid(),
                     name: "",
                     environment: "openai_hosted",
                     revision: 0,
diff --git a/example/parsar/src/SessionFiles.tsx b/example/parsar/src/SessionFiles.tsx
index af7da853b..56ad81c0e 100644
--- a/example/parsar/src/SessionFiles.tsx
+++ b/example/parsar/src/SessionFiles.tsx
@@ -1,7 +1,7 @@
 import { useRef } from "react";
 import { useInfiniteQuery, useMutation } from "@tanstack/react-query";
 import { Upload, Download } from "lucide-react";
-import type { ListPage, SessionArtifact } from "@oac/agents-client";
+import { randomUuid, type ListPage, type SessionArtifact } from "@oac/agents-client";
 import { api, dateTime } from "./lib/api";
 import { Button } from "./components/ui/button";
 import {
@@ -26,7 +26,7 @@ async function upload(environmentId: string, file: File) {
     name += character;
   }
   name ||= "file";
-  const path = `/workspace/inputs/${crypto.randomUUID()}-${name}`;
+  const path = `/workspace/inputs/${randomUuid()}-${name}`;
   const data = await new Promise<string>((resolve, reject) => {
     const reader = new FileReader();
     reader.onload = () => resolve(String(reader.result).split(",")[1] || "");
diff --git a/example/parsar/tests/product.test.mjs b/example/parsar/tests/product.test.mjs
index 7ff07a72d..a891f24be 100644
--- a/example/parsar/tests/product.test.mjs
+++ b/example/parsar/tests/product.test.mjs
@@ -299,10 +299,10 @@ test("one Agent creates independent Sessions; edits do not mutate prior executio
   assert.equal(store.get("sessions", pending).request, undefined);
   assert.equal(receipts.size, 3);
 });
-test("compatibility validation precedes execution, and old configurations migrate without fake Sessions", async (t) => {
+test("compatibility validation precedes execution", async (t) => {
   const store = openStore(":memory:");
   t.after(() => store.close());
-  const { api, put, agent, input } = await setup(store, () => {
+  const { api, put, input } = await setup(store, () => {
     throw new Error("must not execute");
   });
   const runtime = await put("runtimes", { name: "Text", environment: "none" });
@@ -318,13 +318,6 @@ test("compatibility validation precedes execution, and old configurations migrat
     }),
     /不含凭据/,
   );
-  const legacy = { ...agent, id: randomUUID(), runtime_id: runtime.id };
-  store.put("instances", legacy);
-  productAPI(store, () => {});
-  assert.equal(store.get("agents", legacy.id).name, agent.name);
-  assert.equal(store.get("agents", legacy.id).runtime_id, undefined);
-  assert.equal(store.list("sessions").length, 0);
-  assert.equal(store.list("instances").length, 0);
   assert.notEqual(
     dataPath({ target: "https://core.example", key: "a" }),
     dataPath({ target: "https://core.example", key: "b" }),
@@ -439,17 +432,3 @@ test("model editing and moving retain unique IDs within each Provider", async (t
   });
   assert.equal(renamed.model, "three");
 });
-
-
-test("MiniMax MCP bindings reject before Core for text-only and hosted placements", async (t) => {
-  const store = openStore(":memory:");
-  t.after(() => store.close());
-  let calls = 0;
-  const { put, agent } = await setup(store, async () => { calls++; return { id: randomUUID() }; });
-  const config = await put("agents", { ...agent, harness: "mcode", skill_ids: [] }, agent.id);
-  for (const environment of ["none", "openai_hosted"]) {
-    const runtime = await put("runtimes", { name: environment, environment });
-    await assert.rejects(put("sessions", { name: "Rejected", input: "hello", agent_id: config.id, runtime_id: runtime.id }), /MiniMax Code.*MCP/);
-  }
-  assert.equal(calls, 0);
-});
diff --git a/internal/agentcapabilities/install.go b/internal/agentcapabilities/install.go
index 785de407f..ac9585e44 100644
--- a/internal/agentcapabilities/install.go
+++ b/internal/agentcapabilities/install.go
@@ -104,6 +104,21 @@ func Finalize(installed *os.Root, input Input, identity Identity, resolve Direct
 			return ErrInvalid
 		}
 	}
+	return writeManifest(installed, manifest)
+}
+
+// Rebind gives an installation restored from an earlier preparation the identity
+// of this Session. The earlier preparation must have had the identical selection.
+func Rebind(installed *os.Root, manifest *Manifest, input Input, identity Identity) error {
+	digest, err := selectionHash(input)
+	if err != nil || validateIdentity(identity) != nil || manifest.Version != 1 || manifest.SelectionSHA256 != digest {
+		return ErrInvalid
+	}
+	manifest.Identity = identity
+	return writeManifest(installed, *manifest)
+}
+
+func writeManifest(installed *os.Root, manifest Manifest) error {
 	body, err := json.Marshal(manifest)
 	if err != nil || len(body) > 256<<10 || writeFile(installed, ManifestName+".tmp", body, 0400) != nil || installed.Rename(ManifestName+".tmp", ManifestName) != nil {
 		return ErrInvalid
diff --git a/internal/agentdaemon/proto/capabilities.go b/internal/agentdaemon/proto/capabilities.go
index 22d79c8fc..1749d5147 100644
--- a/internal/agentdaemon/proto/capabilities.go
+++ b/internal/agentdaemon/proto/capabilities.go
@@ -28,6 +28,16 @@ func CapabilityFromBool(supported bool) CapabilitySupport {
 	return CapabilityUnsupported
 }
 
+// UnsupportedCapabilities declares every capability explicitly unsupported.
+func UnsupportedCapabilities() AgentKindCapabilities {
+	var capabilities AgentKindCapabilities
+	fields := reflect.ValueOf(&capabilities).Elem()
+	for i := 0; i < fields.NumField(); i++ {
+		fields.Field(i).Set(reflect.ValueOf(CapabilityUnsupported))
+	}
+	return capabilities
+}
+
 func (s CapabilitySupport) MarshalJSON() ([]byte, error) {
 	switch s {
 	case CapabilitySupported:
diff --git a/internal/agentdaemon/proto/environment.go b/internal/agentdaemon/proto/environment.go
index b013d9ae9..c2a917310 100644
--- a/internal/agentdaemon/proto/environment.go
+++ b/internal/agentdaemon/proto/environment.go
@@ -24,9 +24,6 @@ type LocalEnvironment struct {
 	MCP []EnvironmentMCP `json:"-"`
 	// ToolEnvironment consumes Core-completed confidential initialization.
 	ToolEnvironment bool `json:"tool_environment,omitempty"`
-	// NetworkAccess must match the immutable Runtime policy for execution.
-	NetworkAccess  string   `json:"network_access,omitempty"`
-	AllowedDomains []string `json:"allowed_domains,omitempty"`
 }
 
 // EnvironmentMCP is transient Runtime configuration. Do not log it: HTTP headers
diff --git a/internal/agentdaemon/proto/event_flow.go b/internal/agentdaemon/proto/event_flow.go
index 1085d6150..f828f326f 100644
--- a/internal/agentdaemon/proto/event_flow.go
+++ b/internal/agentdaemon/proto/event_flow.go
@@ -23,8 +23,8 @@ type ExecutionEventsAckPayload struct {
 
 func IsExecutionEvent(kind string) bool {
 	switch kind {
-	case TypeDelta, TypeOutputMessage, TypeThinking, TypeToolCall, TypeCommandOutput,
-		TypeUsage, TypeError, TypeDone, TypePromptSteerAck, TypeFunctionCall,
+	case TypeDelta, TypeOutputMessage, TypeReasoning, TypeToolCall, TypeCommandOutput,
+		TypeUsage, TypeError, TypeDone, TypePromptSteerAck, TypeFunctionCall, TypeFunctionCallWithdrawn,
 		TypeSubagentIdentity, TypeSubagentLifecycle, TypeSubagentTurn, TypeSubagentItem, TypeSubagentCoordination:
 		return true
 	}
diff --git a/internal/agentdaemon/proto/execution_controls.go b/internal/agentdaemon/proto/execution_controls.go
deleted file mode 100644
index 5ccd11220..000000000
--- a/internal/agentdaemon/proto/execution_controls.go
+++ /dev/null
@@ -1,12 +0,0 @@
-package proto
-
-import "errors"
-
-// ValidateProgrammaticToolCallingDisable applies only to explicit tool disabling.
-// Omission preserves the adapter's ordinary native behavior.
-func (r PromptRequestPayload) ValidateProgrammaticToolCallingDisable(supported bool) error {
-	if r.ExecutionControls != nil && r.ExecutionControls.DisableProgrammaticToolCalling && !supported {
-		return errors.New("engine does not support disabling programmatic tool calling")
-	}
-	return nil
-}
diff --git a/internal/agentdaemon/proto/functions.go b/internal/agentdaemon/proto/functions.go
index b678c135c..0ec33b5d0 100644
--- a/internal/agentdaemon/proto/functions.go
+++ b/internal/agentdaemon/proto/functions.go
@@ -6,8 +6,9 @@ import (
 )
 
 const (
-	TypeFunctionCall   = "function_call"
-	TypeFunctionResult = "function_result"
+	TypeFunctionCall          = "function_call"
+	TypeFunctionCallWithdrawn = "function_call_withdrawn"
+	TypeFunctionResult        = "function_result"
 )
 
 type FunctionTool struct {
@@ -36,13 +37,27 @@ func (r PromptRequestPayload) ValidateToolSearch(supported bool) error {
 	return nil
 }
 
-// FunctionCallPayload belongs to the Run identified by Envelope.ID.
+// FunctionCallPayload belongs to the Run identified by Envelope.ID. NativeID
+// and TurnID name the native child and its Turn when a Subagent made the call,
+// with the meaning they have in SubagentTurnPayload; both are empty for a call
+// of the Run itself.
 type FunctionCallPayload struct {
 	CallID    string          `json:"call_id"`
+	NativeID  string          `json:"native_id,omitempty"`
+	TurnID    string          `json:"turn_id,omitempty"`
 	Name      string          `json:"name"`
 	Arguments json.RawMessage `json:"arguments"`
 }
 
+// FunctionCallWithdrawnPayload tells that the native Harness will never apply a
+// result for the call, which CallID, NativeID and TurnID identify as in
+// FunctionCallPayload.
+type FunctionCallWithdrawnPayload struct {
+	CallID   string `json:"call_id"`
+	NativeID string `json:"native_id,omitempty"`
+	TurnID   string `json:"turn_id,omitempty"`
+}
+
 type FunctionResultPayload struct {
 	DeliveryID string         `json:"delivery_id"`
 	CallID     string         `json:"call_id"`
diff --git a/internal/agentdaemon/proto/inbound.go b/internal/agentdaemon/proto/inbound.go
index 989e00d60..5ea1fdddf 100644
--- a/internal/agentdaemon/proto/inbound.go
+++ b/internal/agentdaemon/proto/inbound.go
@@ -19,10 +19,9 @@ const (
 	// TypeOutputMessage carries opt-in native message boundaries and completion snapshots.
 	TypeOutputMessage = "output_message"
 
-	// TypeThinking carries an internal-thinking fragment. Gateway
-	// forwards as a plain EventDelta so existing renderers keep
-	// working.
-	TypeThinking = "thinking"
+	// TypeReasoning carries one native reasoning item: its text fragments while
+	// in progress and its terminal status.
+	TypeReasoning = "reasoning"
 
 	// TypeToolCall carries a tool invocation. Stage=="before" runs
 	// before the call, "after" runs after.
@@ -65,10 +64,19 @@ type OutputMessagePayload struct {
 	Text   *string `json:"text,omitempty"`
 }
 
-// ThinkingPayload carries an internal-thinking fragment.
-type ThinkingPayload struct {
-	Text     string `json:"text"`
-	Sequence uint64 `json:"sequence,omitempty"`
+// ReasoningPayload reports one native reasoning item. An in_progress frame
+// carries the next text fragment of native part Index, which is the current
+// part or the next one; the completed frame carries no text.
+type ReasoningPayload struct {
+	ID     string `json:"id"`
+	Status string `json:"status"`
+	Index  int    `json:"index,omitempty"`
+	Delta  string `json:"delta,omitempty"`
+}
+
+// Valid reports whether p is a well-formed reasoning frame.
+func (p ReasoningPayload) Valid() bool {
+	return p.ID != "" && p.Index >= 0 && (p.Status == "in_progress" || (p.Status == "completed" && p.Delta == ""))
 }
 
 // ToolCallPayload carries a tool invocation event. Stage is "before"
@@ -163,20 +171,16 @@ type AgentKindCapabilities struct {
 	// process shutdown using its retained private state, without replaying input.
 	// It does not promise process memory or external connection restoration.
 	RetainedNativeHistory CapabilitySupport `json:"retained_native_history"`
-	Steering              CapabilitySupport `json:"steering"`
 	MessageItems          CapabilitySupport `json:"message_items"`
 
-	ToolObservations               CapabilitySupport `json:"tool_observations"`
-	EnvironmentNone                CapabilitySupport `json:"environment_none"`
-	LocalEnvironment               CapabilitySupport `json:"local_environment"`
-	Preparation                    CapabilitySupport `json:"preparation"`
-	WorkspaceReadPreparation       CapabilitySupport `json:"workspace_read_preparation"`
-	WorkspaceOutputExport          CapabilitySupport `json:"workspace_output_export"`
-	ProgrammaticToolCallingDisable CapabilitySupport `json:"programmatic_tool_calling_disable"`
-	WebSearchControl               CapabilitySupport `json:"web_search_control"`
-	// ExecutionControls supports typed search and verbosity controls.
+	ToolObservations         CapabilitySupport `json:"tool_observations"`
+	EnvironmentNone          CapabilitySupport `json:"environment_none"`
+	LocalEnvironment         CapabilitySupport `json:"local_environment"`
+	Preparation              CapabilitySupport `json:"preparation"`
+	WorkspaceReadPreparation CapabilitySupport `json:"workspace_read_preparation"`
+	WorkspaceOutputExport    CapabilitySupport `json:"workspace_output_export"`
+	// ExecutionControls accepts the typed execution controls.
 	ExecutionControls    CapabilitySupport `json:"execution_controls"`
-	TextVerbosity        CapabilitySupport `json:"text_verbosity"`
 	StructuredOutput     CapabilitySupport `json:"structured_output"`
 	ToolSearch           CapabilitySupport `json:"tool_search"`
 	MessageImages        CapabilitySupport `json:"message_images"`
diff --git a/internal/agentdaemon/proto/mcp.go b/internal/agentdaemon/proto/mcp.go
index 79af7876e..4bbf4f9a5 100644
--- a/internal/agentdaemon/proto/mcp.go
+++ b/internal/agentdaemon/proto/mcp.go
@@ -1,9 +1,16 @@
 package proto
 
-import "errors"
+import (
+	"errors"
+	"regexp"
+	"strings"
 
-// MCPHTTPServer declares HTTP tools with an explicit outbound connection origin. Send only to a
-// peer advertising mcp_http_tools; a transient BearerToken additionally requires
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentcapabilities"
+)
+
+// MCPHTTPServer declares public MCP tools with an explicit outbound connection origin. It is an HTTP
+// server by ServerURL, or a process in the Environment when Stdio is set (origin "environment",
+// ServerURL empty, no headers or bearer). Send only to a peer advertising mcp_http_tools; a transient BearerToken additionally requires
 // mcp_http_bearer_auth. Required initialization requires mcp_http_required.
 // Never persist or log this private request as configuration.
 type MCPHTTPServer struct {
@@ -13,18 +20,50 @@ type MCPHTTPServer struct {
 	AllowedTools     *[]string `json:"allowed_tools"`
 	Required         bool      `json:"required,omitempty"`
 	BearerToken      *string   `json:"bearer_token,omitempty"`
+	// Headers are non-secret; credentials travel only in BearerToken.
+	Headers map[string]string `json:"headers,omitempty"`
+	Stdio   *MCPStdio         `json:"stdio,omitempty"`
+}
+
+// MCPStdio starts an MCP server as a process of the Runtime's Environment. EnvVars
+// name variables the process inherits from that Environment; values never cross the wire.
+type MCPStdio struct {
+	Command string   `json:"command"`
+	Args    []string `json:"args"`
+	Cwd     string   `json:"cwd"`
+	EnvVars []string `json:"env_vars"`
+}
+
+var mcpEnvironmentVariable = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
+
+// Valid reports a startable declaration: a nonempty command, an absolute cwd,
+// variable names in EnvVars and no NUL in the command or its arguments.
+func (s MCPStdio) Valid() bool {
+	if strings.TrimSpace(s.Command) == "" || strings.ContainsRune(s.Command+strings.Join(s.Args, ""), 0) ||
+		agentcapabilities.ValidateSourceDirectories([]string{s.Cwd}) != nil {
+		return false
+	}
+	for _, name := range s.EnvVars {
+		if !mcpEnvironmentVariable.MatchString(name) {
+			return false
+		}
+	}
+	return true
 }
 
 // ValidateConnectionOrigin rejects relocation before dispatch and adapter setup.
 func (server MCPHTTPServer) ValidateConnectionOrigin(req PromptRequestPayload) error {
 	switch server.ConnectionOrigin {
 	case "service":
+		if server.Stdio != nil {
+			return errors.New("MCP stdio requires an execution environment")
+		}
 		if !req.DisableExecutionEnvironment || req.LocalEnvironment != nil {
 			return errors.New("service-origin MCP requires a service execution host")
 		}
 	case "environment":
-		if req.DisableExecutionEnvironment || req.LocalEnvironment == nil || req.LocalEnvironment.NetworkAccess != "enabled" {
-			return errors.New("environment MCP requires an enabled workspace network")
+		if req.DisableExecutionEnvironment || req.LocalEnvironment == nil {
+			return errors.New("environment MCP requires an execution environment")
 		}
 	default:
 		return errors.New("MCP requires an explicit connection origin")
diff --git a/internal/agentdaemon/proto/message_images.go b/internal/agentdaemon/proto/message_images.go
deleted file mode 100644
index 233c472de..000000000
--- a/internal/agentdaemon/proto/message_images.go
+++ /dev/null
@@ -1,39 +0,0 @@
-package proto
-
-import (
-	"bytes"
-	"encoding/base64"
-	"errors"
-	"image"
-	_ "image/jpeg"
-	_ "image/png"
-	"strings"
-)
-
-// ValidateInlineImages checks inline PNG/JPEG content without downloading or
-// rewriting it. Callers separately qualify message/function-result support.
-func (m MessageInput) ValidateInlineImages() error {
-	for _, message := range m {
-		for _, part := range message.Content {
-			if part.Type != "input_image" {
-				continue
-			}
-			if part.ImageURL == nil {
-				return errors.New("image input requires a reference")
-			}
-			header, encoded, ok := strings.Cut(*part.ImageURL, ",")
-			if !ok || (header != "data:image/png;base64" && header != "data:image/jpeg;base64") {
-				return errors.New("image requires inline PNG or JPEG")
-			}
-			data, err := base64.StdEncoding.Strict().DecodeString(encoded)
-			if err != nil || base64.StdEncoding.EncodeToString(data) != encoded {
-				return errors.New("image requires valid base64")
-			}
-			_, format, err := image.DecodeConfig(bytes.NewReader(data))
-			if err != nil || header != "data:image/"+format+";base64" {
-				return errors.New("image format does not match its media type")
-			}
-		}
-	}
-	return nil
-}
diff --git a/internal/agentdaemon/proto/message_images_test.go b/internal/agentdaemon/proto/message_images_test.go
deleted file mode 100644
index 4da4eb9a3..000000000
--- a/internal/agentdaemon/proto/message_images_test.go
+++ /dev/null
@@ -1,45 +0,0 @@
-package proto
-
-import (
-	"bytes"
-	"encoding/base64"
-	"image"
-	"image/jpeg"
-	"image/png"
-	"testing"
-)
-
-func TestInlineMessageImages(t *testing.T) {
-	for _, format := range []string{"png", "jpeg"} {
-		var encoded bytes.Buffer
-		picture := image.NewRGBA(image.Rect(0, 0, 2, 2))
-		if format == "png" {
-			_ = png.Encode(&encoded, picture)
-		} else {
-			_ = jpeg.Encode(&encoded, picture, nil)
-		}
-		url := "data:image/" + format + ";base64," + base64.StdEncoding.EncodeToString(encoded.Bytes())
-		input := MessageInput{{Content: []InputContent{{Type: "input_image", ImageURL: &url}}}}
-		if err := input.ValidateInlineImages(); err != nil {
-			t.Fatal(format, err)
-		}
-		wrongType := "data:image/gif;base64," + base64.StdEncoding.EncodeToString(encoded.Bytes())
-		input[0].Content[0].ImageURL = &wrongType
-		if input.ValidateInlineImages() == nil {
-			t.Fatal("accepted unsupported image type")
-		}
-	}
-	for _, url := range []string{"https://example.test/image.png", "file:///private/image.png", "data:image/png;base64,AA==", "data:image/png;base64,!", "data:image/png;base64,"} {
-		input := MessageInput{{Content: []InputContent{{Type: "input_image", ImageURL: &url}}}}
-		if input.ValidateInlineImages() == nil {
-			t.Fatalf("accepted %q", url)
-		}
-		// User-message qualification must not narrow the function-output union.
-		if input.Validate() != nil {
-			t.Fatalf("inline profile leaked into the shared content union: %q", url)
-		}
-	}
-	if err := TextInput("ordinary text").ValidateInlineImages(); err != nil {
-		t.Fatal(err)
-	}
-}
diff --git a/internal/agentdaemon/proto/outbound.go b/internal/agentdaemon/proto/outbound.go
index f5f2062a9..106fe054a 100644
--- a/internal/agentdaemon/proto/outbound.go
+++ b/internal/agentdaemon/proto/outbound.go
@@ -48,7 +48,6 @@ type PromptRequestPayload struct {
 	WorkspaceReadOnly            bool           `json:"workspace_read_only,omitempty"`
 	AgentStateKey                string         `json:"agent_state_key,omitempty"`
 	RequireExistingNativeSession bool           `json:"require_existing_native_session,omitempty"`
-	ObserveMessages              bool           `json:"observe_messages,omitempty"`
 	ObserveSubagentIdentities    bool           `json:"observe_subagent_identities,omitempty"`
 	FunctionTools                []FunctionTool `json:"function_tools,omitempty"`
 	ToolSearch                   bool           `json:"tool_search,omitempty"`
@@ -61,13 +60,37 @@ type PromptCancelPayload struct {
 	DeliveryID string `json:"delivery_id,omitempty"`
 }
 
-// ExecutionControls requires both values when supplied; omitting the block preserves agent options.
-// Send only to a peer advertising execution_controls, independently of older option capabilities.
+// ExecutionControls carries the official execution options the Session sets or
+// whose official default applies. An absent member means the Harness's native
+// default: Core never sends a value the official configuration does not define.
+// Send only to a peer advertising execution_controls.
 type ExecutionControls struct {
-	DisableProgrammaticToolCalling bool          `json:"disable_programmatic_tool_calling,omitempty"`
-	WebSearch                      string        `json:"web_search"`
-	TextVerbosity                  string        `json:"text_verbosity"`
-	OutputFormat                   *OutputFormat `json:"output_format,omitempty"`
+	WebSearch *WebSearchControl `json:"web_search,omitempty"`
+	// ProgrammaticToolCalling is the official programmatic_tool_calling.enabled value.
+	ProgrammaticToolCalling *bool  `json:"programmatic_tool_calling,omitempty"`
+	ReasoningEffort         string `json:"reasoning_effort,omitempty"`
+	ReasoningSummary        string `json:"reasoning_summary,omitempty"`
+	// ServiceTier is never "auto": auto means unset.
+	ServiceTier   string        `json:"service_tier,omitempty"`
+	TextVerbosity string        `json:"text_verbosity,omitempty"`
+	OutputFormat  *OutputFormat `json:"output_format,omitempty"`
+}
+
+// WebSearchControl is the resolved official web_search tool. A nil
+// AllowedDomains is the official null; an empty list is kept distinct.
+type WebSearchControl struct {
+	Mode           string          `json:"mode"`
+	ContextSize    string          `json:"context_size"`
+	AllowedDomains []string        `json:"allowed_domains"`
+	Location       *SearchLocation `json:"location,omitempty"`
+}
+
+// SearchLocation carries only the keys the Session set.
+type SearchLocation struct {
+	City     *string `json:"city,omitempty"`
+	Country  *string `json:"country,omitempty"`
+	Region   *string `json:"region,omitempty"`
+	Timezone *string `json:"timezone,omitempty"`
 }
 
 // OutputFormat passes the public schema unchanged to a qualified native adapter.
diff --git a/internal/agentdaemon/proto/prototest/capabilities.go b/internal/agentdaemon/proto/prototest/capabilities.go
index 69cabdaf0..76ecd8d7e 100644
--- a/internal/agentdaemon/proto/prototest/capabilities.go
+++ b/internal/agentdaemon/proto/prototest/capabilities.go
@@ -12,35 +12,31 @@ import (
 // fixture is deliberately updated, so declaration validation fails on omission.
 func Capabilities(overrides proto.AgentKindCapabilities) proto.AgentKindCapabilities {
 	c := proto.AgentKindCapabilities{
-		SubagentObservations:           proto.CapabilityUnsupported,
-		Streaming:                      proto.CapabilityUnsupported,
-		Usage:                          proto.CapabilityUnsupported,
-		Resume:                         proto.CapabilityUnsupported,
-		NativeSessionRecovery:          proto.CapabilityUnsupported,
-		RetainedNativeHistory:          proto.CapabilityUnsupported,
-		Steering:                       proto.CapabilityUnsupported,
-		MessageItems:                   proto.CapabilityUnsupported,
-		ToolObservations:               proto.CapabilityUnsupported,
-		EnvironmentNone:                proto.CapabilityUnsupported,
-		LocalEnvironment:               proto.CapabilityUnsupported,
-		Preparation:                    proto.CapabilityUnsupported,
-		WorkspaceReadPreparation:       proto.CapabilityUnsupported,
-		WorkspaceOutputExport:          proto.CapabilityUnsupported,
-		ProgrammaticToolCallingDisable: proto.CapabilityUnsupported,
-		WebSearchControl:               proto.CapabilityUnsupported,
-		ExecutionControls:              proto.CapabilityUnsupported,
-		TextVerbosity:                  proto.CapabilityUnsupported,
-		StructuredOutput:               proto.CapabilityUnsupported,
-		ToolSearch:                     proto.CapabilityUnsupported,
-		MessageImages:                  proto.CapabilityUnsupported,
-		FunctionResultImages:           proto.CapabilityUnsupported,
-		SubagentControl:                proto.CapabilityUnsupported,
-		DurableInputReceipts:           proto.CapabilityUnsupported,
-		DurableTurns:                   proto.CapabilityUnsupported,
-		FunctionTools:                  proto.CapabilityUnsupported,
-		MCPHTTPTools:                   proto.CapabilityUnsupported,
-		MCPHTTPRequired:                proto.CapabilityUnsupported,
-		MCPHTTPBearerAuth:              proto.CapabilityUnsupported,
+		SubagentObservations:     proto.CapabilityUnsupported,
+		Streaming:                proto.CapabilityUnsupported,
+		Usage:                    proto.CapabilityUnsupported,
+		Resume:                   proto.CapabilityUnsupported,
+		NativeSessionRecovery:    proto.CapabilityUnsupported,
+		RetainedNativeHistory:    proto.CapabilityUnsupported,
+		MessageItems:             proto.CapabilityUnsupported,
+		ToolObservations:         proto.CapabilityUnsupported,
+		EnvironmentNone:          proto.CapabilityUnsupported,
+		LocalEnvironment:         proto.CapabilityUnsupported,
+		Preparation:              proto.CapabilityUnsupported,
+		WorkspaceReadPreparation: proto.CapabilityUnsupported,
+		WorkspaceOutputExport:    proto.CapabilityUnsupported,
+		ExecutionControls:        proto.CapabilityUnsupported,
+		StructuredOutput:         proto.CapabilityUnsupported,
+		ToolSearch:               proto.CapabilityUnsupported,
+		MessageImages:            proto.CapabilityUnsupported,
+		FunctionResultImages:     proto.CapabilityUnsupported,
+		SubagentControl:          proto.CapabilityUnsupported,
+		DurableInputReceipts:     proto.CapabilityUnsupported,
+		DurableTurns:             proto.CapabilityUnsupported,
+		FunctionTools:            proto.CapabilityUnsupported,
+		MCPHTTPTools:             proto.CapabilityUnsupported,
+		MCPHTTPRequired:          proto.CapabilityUnsupported,
+		MCPHTTPBearerAuth:        proto.CapabilityUnsupported,
 	}
 	dst, src := reflect.ValueOf(&c).Elem(), reflect.ValueOf(overrides)
 	for i := 0; i < src.NumField(); i++ {
diff --git a/internal/agentdaemon/proto/prototest/wire.go b/internal/agentdaemon/proto/prototest/wire.go
index 7833863c9..82142f3b2 100644
--- a/internal/agentdaemon/proto/prototest/wire.go
+++ b/internal/agentdaemon/proto/prototest/wire.go
@@ -27,7 +27,7 @@ const (
 // Correlation values the scenarios use.
 const (
 	SessionID        = "session"
-	StateKey         = "agents-api-session"
+	StateKey         = "session"
 	PreparationID    = "prepare"
 	RunID            = "run"
 	CancelDeliveryID = "cancel"
diff --git a/internal/agentdaemon/proto/steering.go b/internal/agentdaemon/proto/steering.go
index 6658752cb..13e5b944b 100644
--- a/internal/agentdaemon/proto/steering.go
+++ b/internal/agentdaemon/proto/steering.go
@@ -8,9 +8,8 @@ const TypePromptSteerAck = "prompt_steer_ack"
 
 // PromptSteerPayload identifies one input batch within an active run.
 type PromptSteerPayload struct {
-	InputID        string       `json:"input_id"`
-	Input          MessageInput `json:"input"`
-	DurableReceipt bool         `json:"durable_receipt,omitempty"`
+	InputID string       `json:"input_id"`
+	Input   MessageInput `json:"input"`
 }
 
 // PromptSteerAckPayload distinguishes a completed write from native acceptance.
diff --git a/internal/agentdaemon/proto/version.go b/internal/agentdaemon/proto/version.go
index b051ee427..d295153f4 100644
--- a/internal/agentdaemon/proto/version.go
+++ b/internal/agentdaemon/proto/version.go
@@ -3,7 +3,7 @@ package proto
 // Version identifies the complete Core–Runtime wire contract. Change it when
 // removing or changing required semantics. Additive extensions must explicitly
 // negotiate support and retain the base contract when not selected.
-const Version = "0.16.0"
+const Version = "0.21.0"
 
 // VersionCompatible accepts only this contract. Patch drift, prerelease suffixes
 // and malformed versions do not select an implicit compatibility path.
diff --git a/internal/agentdaemon/proto/workspace_read_preparation.go b/internal/agentdaemon/proto/workspace_read_preparation.go
index 754d85011..cd8ff66a9 100644
--- a/internal/agentdaemon/proto/workspace_read_preparation.go
+++ b/internal/agentdaemon/proto/workspace_read_preparation.go
@@ -7,6 +7,6 @@ func ValidWorkspaceReadPreparation(r PromptRequestPayload) bool {
 		r.RunID == "" && len(r.Input) == 0 && r.AgentSessionID == "" &&
 		!r.RequireExistingNativeSession && !r.DisableExecutionEnvironment &&
 		len(r.AgentOptions) == 0 && r.ExecutionControls == nil && r.MCPHTTPServers == nil &&
-		len(r.FunctionTools) == 0 && !r.ToolSearch && !r.ObserveMessages &&
+		len(r.FunctionTools) == 0 && !r.ToolSearch &&
 		!r.ObserveSubagentIdentities
 }
diff --git a/internal/agentdaemon/proto/workspace_write.go b/internal/agentdaemon/proto/workspace_write.go
index 13a594e30..779a3f29a 100644
--- a/internal/agentdaemon/proto/workspace_write.go
+++ b/internal/agentdaemon/proto/workspace_write.go
@@ -34,8 +34,7 @@ type WorkspaceWriteResultPayload struct {
 	Offset    int    `json:"offset,omitempty"`
 	SizeBytes int    `json:"size_bytes,omitempty"`
 	ErrorCode string `json:"error_code,omitempty"`
-	// Reason optionally refines a write_rejected result. Older peers omit or
-	// ignore it and keep the generic rejection.
+	// Reason optionally refines a write_rejected result.
 	Reason string `json:"reason,omitempty"`
 }
 
diff --git a/internal/agentnetwork/policy.go b/internal/agentnetwork/policy.go
index fb94397bc..e266d23eb 100644
--- a/internal/agentnetwork/policy.go
+++ b/internal/agentnetwork/policy.go
@@ -1,5 +1,4 @@
-// Package agentnetwork validates the hosted execution policy without selecting
-// a harness, Provider, native proxy or initialization mechanism.
+// Package agentnetwork validates the public Environment network field.
 package agentnetwork
 
 import (
@@ -9,11 +8,11 @@ import (
 	"strings"
 )
 
-var ErrInvalid = errors.New("invalid hosted network policy")
+var errInvalid = errors.New("invalid hosted network policy")
 
 type Policy struct {
-	Access         string   `json:"access"`
-	AllowedDomains []string `json:"allowed_domains"`
+	Access         string
+	AllowedDomains []string
 }
 
 // Validate accepts the qualified exact ASCII hostname form. It does not rewrite
@@ -26,16 +25,16 @@ func (p Policy) Validate() error {
 		}
 	case "restricted":
 		if len(p.AllowedDomains) < 1 || len(p.AllowedDomains) > 100 {
-			return ErrInvalid
+			return errInvalid
 		}
 		for _, domain := range p.AllowedDomains {
 			if !hostname(domain) {
-				return ErrInvalid
+				return errInvalid
 			}
 		}
 		return nil
 	}
-	return ErrInvalid
+	return errInvalid
 }
 
 func hostname(value string) bool {
@@ -58,9 +57,8 @@ func hostname(value string) bool {
 	return true
 }
 
-// Hosts is the deterministic native allowlist. The caller must validate first.
-// DNS host identity is case-insensitive; public metadata remains untouched.
-func (p Policy) Hosts() []string {
+// hosts is the case-folded, sorted allowlist. The caller must validate first.
+func (p Policy) hosts() []string {
 	hosts := make([]string, len(p.AllowedDomains))
 	for i, host := range p.AllowedDomains {
 		hosts[i] = strings.ToLower(host)
@@ -80,16 +78,11 @@ func (p Policy) Narrows(template Policy) bool {
 	if template.Access != "restricted" || p.Access != "restricted" {
 		return false
 	}
-	hosts := template.Hosts()
-	for _, host := range p.Hosts() {
+	hosts := template.hosts()
+	for _, host := range p.hosts() {
 		if _, ok := slices.BinarySearch(hosts, host); !ok {
 			return false
 		}
 	}
 	return true
 }
-
-// Equal compares validated effective authority, independent of public list order.
-func (p Policy) Equal(other Policy) bool {
-	return p.Access == other.Access && p.Validate() == nil && other.Validate() == nil && slices.Equal(p.Hosts(), other.Hosts())
-}
diff --git a/internal/agentnetwork/policy_test.go b/internal/agentnetwork/policy_test.go
index 581d34e2c..fa6d26cf7 100644
--- a/internal/agentnetwork/policy_test.go
+++ b/internal/agentnetwork/policy_test.go
@@ -1,7 +1,6 @@
 package agentnetwork
 
 import (
-	"reflect"
 	"strings"
 	"testing"
 )
@@ -45,16 +44,3 @@ func TestTemplateNetworkOverrideCannotBroaden(t *testing.T) {
 		t.Fatal("invalid policy cannot gain authority through an override")
 	}
 }
-
-func TestPolicyIdentityPreservesPublicInput(t *testing.T) {
-	input := []string{"B.example.com", "a.example.com", "B.example.com"}
-	before := append([]string(nil), input...)
-	policy := Policy{Access: "restricted", AllowedDomains: input}
-	other := Policy{Access: "restricted", AllowedDomains: []string{"a.example.com", "b.example.com"}}
-	if !policy.Equal(other) || !reflect.DeepEqual(input, before) {
-		t.Fatal("effective comparison changed caller input or list order affected authority")
-	}
-	if policy.Equal(Policy{Access: "restricted", AllowedDomains: []string{"example.com"}}) {
-		t.Fatal("parent hostname must not grant subdomain authority")
-	}
-}
diff --git a/internal/agentplugin/mcp.go b/internal/agentplugin/mcp.go
index b85119ae6..a9bfdfe6f 100644
--- a/internal/agentplugin/mcp.go
+++ b/internal/agentplugin/mcp.go
@@ -82,14 +82,13 @@ func (s *MCPServer) validate() error {
 			(s.BearerTokenEnvVar != "" && !environmentVariable.MatchString(s.BearerTokenEnvVar)) {
 			return ErrInvalid
 		}
-		seen := map[string]bool{}
-		for name, value := range s.HTTPHeaders {
-			lower := strings.ToLower(name)
-			if !httpguts.ValidHeaderFieldName(name) || !httpguts.ValidHeaderFieldValue(value) || seen[lower] ||
-				(lower == "authorization" && s.BearerTokenEnvVar != "") {
+		if !ValidHTTPHeaders(s.HTTPHeaders) {
+			return ErrInvalid
+		}
+		for name := range s.HTTPHeaders {
+			if strings.EqualFold(name, "Authorization") && s.BearerTokenEnvVar != "" {
 				return ErrInvalid
 			}
-			seen[lower] = true
 		}
 	case "stdio":
 		if strings.TrimSpace(s.Command) == "" || strings.ContainsRune(s.Command, 0) || s.URL != "" || s.BearerTokenEnvVar != "" || s.HTTPHeaders != nil {
@@ -120,3 +119,17 @@ func (s *MCPServer) validate() error {
 	}
 	return nil
 }
+
+// ValidHTTPHeaders reports whether every MCP header has a valid HTTP name and
+// value, with names unique ignoring case.
+func ValidHTTPHeaders(headers map[string]string) bool {
+	seen := map[string]bool{}
+	for name, value := range headers {
+		lower := strings.ToLower(name)
+		if !httpguts.ValidHeaderFieldName(name) || !httpguts.ValidHeaderFieldValue(value) || seen[lower] {
+			return false
+		}
+		seen[lower] = true
+	}
+	return true
+}
diff --git a/internal/harnessconfig/builtin/admission_test.go b/internal/harnessconfig/builtin/admission_test.go
new file mode 100644
index 000000000..4e9a5eddb
--- /dev/null
+++ b/internal/harnessconfig/builtin/admission_test.go
@@ -0,0 +1,69 @@
+package builtin
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+)
+
+func TestMCPOriginSupport(t *testing.T) {
+	for _, kind := range []string{"claude_sdk", "codex", "mcode"} {
+		declaration, _ := Registry().Lookup(kind)
+		for _, placement := range []string{"none", "self_hosted", "openai_hosted"} {
+			for _, origin := range []string{"service", "environment", "", "unknown"} {
+				servers := []proto.MCPHTTPServer{{ConnectionOrigin: origin, ServerLabel: "proof", ServerURL: "https://example.test/mcp"}}
+				allowed := origin == "environment" && placement != "none" || origin == "service" && placement == "none"
+				if err := declaration.ValidateMCPOrigins(placement, servers); (err == nil) != allowed {
+					t.Fatalf("%s/%s/%s: %v", kind, placement, origin, err)
+				}
+			}
+		}
+	}
+}
+
+func TestMiniMaxMCPPoliciesRejectInsteadOfDropping(t *testing.T) {
+	declaration, _ := Registry().Lookup("mcode")
+	empty := []string{}
+	named := []string{"proof"}
+	for _, allowed := range []*[]string{nil, &empty, &named} {
+		for _, required := range []bool{false, true} {
+			server := proto.MCPHTTPServer{ConnectionOrigin: "environment", ServerLabel: "proof", ServerURL: "https://example.test", AllowedTools: allowed, Required: required}
+			err := declaration.ValidateTools(nil, []proto.MCPHTTPServer{server})
+			if (err == nil) != (allowed == nil && !required) {
+				t.Fatal("unsupported MCP policy accepted", err)
+			}
+		}
+	}
+}
+
+func TestSubagentDeclarationsPreserveSupportedBoundaries(t *testing.T) {
+	for _, kind := range []string{"claude_sdk", "codex"} {
+		t.Run(kind, func(t *testing.T) {
+			declaration, _ := Registry().Lookup(kind)
+			admission := harnessconfig.Admission{MultiAgent: true}
+			if err := declaration.ValidateConfiguration(admission); err != nil {
+				t.Fatal(err)
+			}
+			// Subagents use the Agent's function and MCP tools.
+			for _, tool := range []string{`{"type":"function","name":"f"}`, `{"type":"mcp","server_label":"s"}`} {
+				admission.Tools = []json.RawMessage{json.RawMessage(tool)}
+				if err := declaration.ValidateConfiguration(admission); err != nil {
+					t.Fatal(kind, tool, err)
+				}
+			}
+		})
+	}
+}
+
+func TestCodexRejectsCodeModeWithSubagents(t *testing.T) {
+	declaration, _ := Registry().Lookup("codex")
+	tools := []json.RawMessage{json.RawMessage(`{"type":"programmatic_tool_calling","enabled":true}`)}
+	for _, multiAgent := range []bool{false, true} {
+		err := declaration.ValidateConfiguration(harnessconfig.Admission{MultiAgent: multiAgent, Tools: tools})
+		if (err == nil) == multiAgent {
+			t.Fatalf("multi_agent=%v: %v", multiAgent, err)
+		}
+	}
+}
diff --git a/internal/harnessconfig/builtin/builtin.go b/internal/harnessconfig/builtin/builtin.go
new file mode 100644
index 000000000..8dc50c136
--- /dev/null
+++ b/internal/harnessconfig/builtin/builtin.go
@@ -0,0 +1,16 @@
+// Package builtin is the set of Harnesses in this build. The registry itself is
+// generated from the packages under internal/harnessconfig that hold a
+// declaration.go.
+package builtin
+
+import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+
+func Registry() harnessconfig.Registry { return registry }
+
+// Kinds returns the public identifiers in this build, not Runtime availability.
+func Kinds() []string { return registry.Kinds() }
+
+func Contains(kind string) bool {
+	_, ok := registry.Lookup(kind)
+	return ok
+}
diff --git a/internal/harnessconfig/builtin/catalog.json b/internal/harnessconfig/builtin/catalog.json
deleted file mode 100644
index 9328ac7d7..000000000
--- a/internal/harnessconfig/builtin/catalog.json
+++ /dev/null
@@ -1,5 +0,0 @@
-[
-  {"kind": "claude_sdk", "label": "Claude Code", "configuration": "claudesdk", "profile": "claudeProfile"},
-  {"kind": "codex", "label": "Codex", "configuration": "codex", "profile": "codexProfile"},
-  {"kind": "mcode", "label": "MiniMax Code", "configuration": "mcode", "profile": "mcodeProfile"}
-]
diff --git a/internal/harnessconfig/builtin/native_test.go b/internal/harnessconfig/builtin/native_test.go
index b17070962..8869462a6 100644
--- a/internal/harnessconfig/builtin/native_test.go
+++ b/internal/harnessconfig/builtin/native_test.go
@@ -13,13 +13,14 @@ func TestNativeModelParameters(t *testing.T) {
 		kind, raw string
 		valid     bool
 	}{
-		{"codex", `{"model_reasoning_effort":"high"}`, true},
+		{"codex", `{"model_reasoning_effort":"high"}`, false},
 		{"codex", `{"model_reasoning_effort":"private-sentinel","model_reasoning_effort":"high"}`, false},
 		{"claude_sdk", `{"thinking":{"type":"private-sentinel","type":"enabled"}}`, false},
 		{"codex", `{"model_reasoning_effort":{}}`, false},
 		{"codex", `{"model_reasoning_effort":"max"}`, false},
 		{"codex", `{"effort":"high"}`, false},
-		{"claude_sdk", `{"effort":"max","thinking":{"type":"adaptive","display":"summarized"}}`, true},
+		{"claude_sdk", `{"thinking":{"type":"adaptive","display":"summarized"}}`, true},
+		{"claude_sdk", `{"effort":"max"}`, false},
 		{"claude_sdk", `{"thinking":{"type":"enabled","budgetTokens":1024}}`, true},
 		{"claude_sdk", `{"thinking":{"type":"disabled"}}`, true},
 		{"claude_sdk", `{"thinking":{"type":"enabled"}}`, true},
@@ -32,8 +33,9 @@ func TestNativeModelParameters(t *testing.T) {
 		{"claude_sdk", `{"maxThinkingTokens":1024}`, false},
 		{"mcode", `{}`, true},
 		{"mcode", `{"effort":"high"}`, false},
-		{"", `{"effort":"high"}`, true},
-		{"", `{"model_reasoning_effort":"high"}`, true},
+		{"", `{"thinking":{"type":"adaptive"}}`, true},
+		{"", `{"effort":"high"}`, false},
+		{"", `{"model_reasoning_effort":"high"}`, false},
 		{"", `{"secret":"private-value"}`, false},
 		{"unknown", `{}`, true},
 		{"unknown", `{"effort":"high"}`, false},
diff --git a/internal/harnessconfig/builtin/registry.go b/internal/harnessconfig/builtin/registry.go
index 6f714b39d..f2a462dde 100644
--- a/internal/harnessconfig/builtin/registry.go
+++ b/internal/harnessconfig/builtin/registry.go
@@ -8,27 +8,4 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/mcode"
 )
 
-var registry = harnessconfig.NewRegistry(map[string]harnessconfig.Configuration{
-	"claude_sdk": claudesdk.Configuration(),
-	"codex":      codex.Configuration(),
-	"mcode":      mcode.Configuration(),
-})
-
-func Registry() harnessconfig.Registry { return registry }
-
-// Configuration binds a registered public Harness to its authored declaration.
-func Configuration(kind string) harnessconfig.Configuration {
-	configuration, ok := registry.Lookup(kind)
-	if !ok {
-		panic("unregistered public Harness configuration")
-	}
-	return configuration
-}
-
-// Kinds returns the public identifiers in this build, not Runtime availability.
-func Kinds() []string { return []string{"claude_sdk", "codex", "mcode"} }
-
-func Contains(kind string) bool {
-	_, ok := registry.Lookup(kind)
-	return ok
-}
+var registry = harnessconfig.NewRegistry(claudesdk.Declaration, codex.Declaration, mcode.Declaration)
diff --git a/internal/harnessconfig/builtin/route_test.go b/internal/harnessconfig/builtin/route_test.go
index cc8620627..8ea329bae 100644
--- a/internal/harnessconfig/builtin/route_test.go
+++ b/internal/harnessconfig/builtin/route_test.go
@@ -21,11 +21,11 @@ func TestNativeProviderDeclarationIsSharedWithRuntime(t *testing.T) {
 			if !reflect.DeepEqual(protocols, declared) {
 				t.Fatalf("protocols: %v", declared)
 			}
-			if config.AcceptsHarnessConfig() != (kind != "mcode") {
+			if config.AcceptsHarnessConfig() != (kind == "claude_sdk") {
 				t.Fatal("native configuration support drift")
 			}
 			for _, protocol := range []string{"anthropic", "responses", "chat_completions"} {
-				raw := map[string]any{"protocol": protocol, "base_url": "https://model.example/v1", "api_key": "key-canary", "context_window": 64000, "max_output_tokens": 4096}
+				raw := map[string]any{"protocol": protocol, "base_url": "https://model.example/v1", "api_key": "key-canary", "context_window": 64000}
 				p, err := config.ParseProvider(raw)
 				accepted := kind == "mcode" || (kind == "codex" && protocol == "responses") || (kind == "claude_sdk" && protocol == "anthropic")
 				if (err == nil) != accepted || (config.ValidateProtocol(protocol) == nil) != accepted {
diff --git a/internal/harnessconfig/claudesdk/configuration.go b/internal/harnessconfig/claudesdk/configuration.go
deleted file mode 100644
index dd9d091d9..000000000
--- a/internal/harnessconfig/claudesdk/configuration.go
+++ /dev/null
@@ -1,10 +0,0 @@
-// Package claudesdk owns the qualified Claude SDK provider declaration.
-package claudesdk
-
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
-func Configuration() harnessconfig.Configuration {
-	return harnessconfig.Configuration{AcceptsProviderHeaders: true, ValidateNativeConfig: validateNativeConfig, Providers: []harnessconfig.Provider{
-		{Protocol: "anthropic"},
-	}}
-}
diff --git a/internal/harnessconfig/claudesdk/declaration.go b/internal/harnessconfig/claudesdk/declaration.go
new file mode 100644
index 000000000..bd164167d
--- /dev/null
+++ b/internal/harnessconfig/claudesdk/declaration.go
@@ -0,0 +1,212 @@
+// Package claudesdk declares the Claude Code Harness.
+package claudesdk
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"math"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+)
+
+// Declaration is the only authored description of the Claude Code Harness. The
+// Runtime may narrow Capabilities to the installed bundle, never widen them.
+var Declaration = harnessconfig.Declaration{
+	Kind:  "claude_sdk",
+	Label: "Claude Code",
+	Configuration: harnessconfig.Configuration{AcceptsProviderHeaders: true,
+		ValidateNativeConfig: validateNativeConfig,
+		Providers:            []harnessconfig.Provider{{Protocol: "anthropic"}},
+		// CLAUDE_CODE_MAX_OUTPUT_TOKENS, which native caps at the model's limit.
+		MaxOutputTokens: true,
+	},
+	Capabilities: proto.AgentKindCapabilities{
+		SubagentObservations:     proto.CapabilitySupported,
+		Streaming:                proto.CapabilitySupported,
+		Usage:                    proto.CapabilitySupported,
+		Resume:                   proto.CapabilitySupported,
+		RetainedNativeHistory:    proto.CapabilitySupported,
+		NativeSessionRecovery:    proto.CapabilitySupported,
+		MessageItems:             proto.CapabilitySupported,
+		ToolObservations:         proto.CapabilitySupported,
+		EnvironmentNone:          proto.CapabilitySupported,
+		LocalEnvironment:         proto.CapabilitySupported,
+		Preparation:              proto.CapabilitySupported,
+		WorkspaceReadPreparation: proto.CapabilitySupported,
+		WorkspaceOutputExport:    proto.CapabilitySupported,
+		ExecutionControls:        proto.CapabilitySupported,
+		StructuredOutput:         proto.CapabilitySupported,
+		ToolSearch:               proto.CapabilitySupported,
+		MessageImages:            proto.CapabilitySupported,
+		FunctionResultImages:     proto.CapabilitySupported,
+		SubagentControl:          proto.CapabilitySupported,
+		DurableInputReceipts:     proto.CapabilitySupported,
+		DurableTurns:             proto.CapabilitySupported,
+		FunctionTools:            proto.CapabilitySupported,
+		MCPHTTPTools:             proto.CapabilitySupported,
+		MCPHTTPRequired:          proto.CapabilitySupported,
+		MCPHTTPBearerAuth:        proto.CapabilitySupported,
+	},
+	// The SDK takes effort low to max. Its thinking blocks are the reasoning
+	// text, so a summary request takes only auto; there is no concise or
+	// detailed setting. It has no verbosity or service tier. Native REPL runs
+	// tool calls inside model-written code, outside the root tool_use and
+	// tool_result records that function receipts and tool observations
+	// read, so enabling programmatic tool calling is rejected. Native WebSearch and
+	// WebFetch are live and have no cached mode or settings: disabled removes them,
+	// and live and an absent control keep them on workspace placements. On none,
+	// live adds only WebSearch. Medium is the official default verbosity and needs
+	// no setting.
+	Execution: harnessconfig.ExecutionOptions{
+		WebSearchModes:          []string{"disabled", "live"},
+		ReasoningEfforts:        []string{"low", "medium", "high", "xhigh", "max"},
+		ReasoningSummaries:      []string{"auto"},
+		ProgrammaticToolCalling: []bool{false},
+		TextVerbosities:         []string{"medium"},
+	},
+	Placements:             []string{"none", "openai_hosted", "self_hosted"},
+	MCPOrigins:             []string{"service", "environment"},
+	WhitespaceOnlyText:     proto.CapabilitySupported,
+	ValidateConfiguration:  validateConfiguration,
+	ValidateTools:          validateTools,
+	ValidateMessageInput:   validateMessageInput,
+	ValidateFunctionResult: validateFunctionResult,
+}
+
+var mcpLabel = regexp.MustCompile(`^[a-zA-Z0-9_-]+$`)
+
+// validateConfiguration holds the packaged adapter's execution limits on a saved
+// Agent and Environment, not saved-Agent schema rules.
+func validateConfiguration(admission harnessconfig.Admission) error {
+	if admission.TextFormat == "json_schema" {
+		if err := proto.ValidateBinary64Schema(admission.TextSchema); err != nil {
+			return err
+		}
+	}
+	for _, raw := range admission.Tools {
+		var tool struct {
+			Type      string `json:"type"`
+			Transport struct {
+				Type string `json:"type"`
+				Cwd  string `json:"cwd"`
+			} `json:"transport"`
+		}
+		// Native starts stdio servers in the workspace and has no cwd setting.
+		if json.Unmarshal(raw, &tool) == nil && tool.Type == "mcp" && tool.Transport.Type == "stdio" && admission.WorkspaceDirectory != "" &&
+			filepath.Clean(tool.Transport.Cwd) != filepath.Clean(admission.WorkspaceDirectory) {
+			return errors.New("The configured engine starts MCP stdio servers in the workspace directory; set cwd to it.")
+		}
+	}
+	return nil
+}
+
+// validateTools applies execution limits of the packaged adapter. Shared
+// resolution still owns URL, transport and credential-binding validation.
+func validateTools(tools []proto.FunctionTool, servers []proto.MCPHTTPServer) error {
+	for _, server := range servers {
+		if !mcpLabel.MatchString(server.ServerLabel) || server.ServerLabel == "functions" || strings.Contains(server.ServerURL, "#") {
+			return errors.New("The configured engine does not support this HTTP MCP declaration.")
+		}
+		// Native hides unselected tools only for HTTP servers, which the adapter lists itself.
+		if server.Stdio != nil && server.AllowedTools != nil {
+			return errors.New("The configured engine requires allowed_tools=null for MCP stdio servers.")
+		}
+		if ExpandsEnvironment(server) {
+			return errors.New("The configured engine does not support ${ in MCP URLs or header values.")
+		}
+	}
+	return harnessconfig.RequireObjectSchemas(tools)
+}
+
+func validateFunctionResult(result proto.FunctionResultPayload) error {
+	for _, part := range result.Content {
+		if part.Type == "input_image" && (!result.Success || !inlineImage(*part.ImageURL)) {
+			return harnessconfig.ErrInvalidInput
+		}
+	}
+	return nil
+}
+
+// A user message image that is not a data URL becomes a native URL source.
+func validateMessageInput(input proto.MessageInput) error {
+	for _, message := range input {
+		for _, part := range message.Content {
+			if part.Type == "input_image" && strings.HasPrefix(*part.ImageURL, "data:") && !inlineImage(*part.ImageURL) {
+				return harnessconfig.ErrInvalidInput
+			}
+		}
+	}
+	return nil
+}
+
+// inlineImage reports canonical base64 in a media type the pinned SDK declares.
+func inlineImage(url string) bool {
+	header, encoded, _ := strings.Cut(url, ",")
+	data, err := base64.StdEncoding.DecodeString(encoded)
+	switch header {
+	case "data:image/png;base64", "data:image/jpeg;base64", "data:image/gif;base64", "data:image/webp;base64":
+		return err == nil && encoded != "" && base64.StdEncoding.EncodeToString(data) == encoded
+	}
+	return false
+}
+
+func validateNativeConfig(config proto.HarnessConfig) bool {
+	for key, value := range config {
+		switch key {
+		case "thinking":
+			thinking, ok := value.(map[string]any)
+			if !ok || !validThinking(thinking) {
+				return false
+			}
+		default:
+			return false
+		}
+	}
+	return true
+}
+
+// The pinned SDK's native ThinkingConfig union; deprecated maxThinkingTokens
+// is intentionally absent so a thinking budget has exactly one owner.
+func validThinking(thinking map[string]any) bool {
+	kind, ok := thinking["type"].(string)
+	if !ok || (kind != "adaptive" && kind != "enabled" && kind != "disabled") {
+		return false
+	}
+	for key, value := range thinking {
+		switch key {
+		case "type":
+		case "budgetTokens":
+			n, ok := value.(float64)
+			if kind != "enabled" || !ok || n < 1 || n > 9007199254740991 || math.Trunc(n) != n {
+				return false
+			}
+		case "display":
+			text, ok := value.(string)
+			if kind == "disabled" || !ok || (text != "summarized" && text != "omitted") {
+				return false
+			}
+		default:
+			return false
+		}
+	}
+	return true
+}
+
+// ExpandsEnvironment reports a URL or header value the native client would
+// expand from its own environment, which holds Core-held credentials.
+func ExpandsEnvironment(server proto.MCPHTTPServer) bool {
+	if strings.Contains(server.ServerURL, "${") {
+		return true
+	}
+	for _, value := range server.Headers {
+		if strings.Contains(value, "${") {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/harnessconfig/claudesdk/declaration_test.go b/internal/harnessconfig/claudesdk/declaration_test.go
new file mode 100644
index 000000000..62f8b1a86
--- /dev/null
+++ b/internal/harnessconfig/claudesdk/declaration_test.go
@@ -0,0 +1,65 @@
+package claudesdk
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+)
+
+func TestDeclarationAdmitsNativeToolCombinations(t *testing.T) {
+	tools := func(types ...string) []json.RawMessage {
+		var raw []json.RawMessage
+		for _, kind := range types {
+			raw = append(raw, json.RawMessage(`{"type":"`+kind+`"}`))
+		}
+		return raw
+	}
+	for name, admission := range map[string]harnessconfig.Admission{
+		"structured output with multi_agent": {MultiAgent: true, TextFormat: "json_schema"},
+		"structured output with mcp":         {TextFormat: "json_schema", Tools: tools("mcp")},
+		"structured output with tool_search": {TextFormat: "json_schema", Tools: tools("function", "tool_search")},
+		"tool_search with mcp":               {Tools: tools("function", "tool_search", "mcp")},
+	} {
+		admission.TextSchema = json.RawMessage(`{"type":"object"}`)
+		if err := Declaration.ValidateConfiguration(admission); err != nil {
+			t.Errorf("%s: %v", name, err)
+		}
+	}
+}
+
+func TestDeclarationAdmitsAnyMCPToolName(t *testing.T) {
+	allowed := []string{"a/b", "tool name"}
+	err := Declaration.ValidateTools(nil, []proto.MCPHTTPServer{{ServerLabel: "docs", ServerURL: "https://example.test/mcp", AllowedTools: &allowed}})
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestDeclarationRejectsMCPEnvironmentExpansion(t *testing.T) {
+	servers := []proto.MCPHTTPServer{{ServerLabel: "docs", ServerURL: "https://example.test/mcp", Headers: map[string]string{"X-Tenant": "a"}}}
+	if err := Declaration.ValidateTools(nil, servers); err != nil {
+		t.Fatal(err)
+	}
+	servers[0].Headers["X-Tenant"] = "${ANTHROPIC_API_KEY}"
+	if err := Declaration.ValidateTools(nil, servers); err == nil {
+		t.Fatal("header value with ${ admitted")
+	}
+	servers[0].Headers["X-Tenant"], servers[0].ServerURL = "a", "https://example.test/${ANTHROPIC_API_KEY}"
+	if err := Declaration.ValidateTools(nil, servers); err == nil {
+		t.Fatal("URL with ${ admitted")
+	}
+}
+
+func TestDeclarationRequiresWorkspaceStdioCwd(t *testing.T) {
+	stdio := func(cwd string) []json.RawMessage {
+		return []json.RawMessage{json.RawMessage(`{"type":"mcp","transport":{"type":"stdio","command":"x","cwd":"` + cwd + `"}}`)}
+	}
+	if err := Declaration.ValidateConfiguration(harnessconfig.Admission{WorkspaceDirectory: "/workspace", Tools: stdio("/workspace/")}); err != nil {
+		t.Fatal(err)
+	}
+	if err := Declaration.ValidateConfiguration(harnessconfig.Admission{WorkspaceDirectory: "/workspace", Tools: stdio("/srv")}); err == nil {
+		t.Fatal("stdio cwd outside the workspace admitted")
+	}
+}
diff --git a/internal/harnessconfig/claudesdk/native.go b/internal/harnessconfig/claudesdk/native.go
deleted file mode 100644
index 9606efd5d..000000000
--- a/internal/harnessconfig/claudesdk/native.go
+++ /dev/null
@@ -1,58 +0,0 @@
-package claudesdk
-
-import (
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"math"
-)
-
-func validateNativeConfig(config proto.HarnessConfig) bool {
-	for key, value := range config {
-		switch key {
-		case "effort":
-			text, ok := value.(string)
-			if !ok {
-				return false
-			}
-			switch text {
-			case "low", "medium", "high", "xhigh", "max":
-			default:
-				return false
-			}
-		case "thinking":
-			thinking, ok := value.(map[string]any)
-			if !ok || !validThinking(thinking) {
-				return false
-			}
-		default:
-			return false
-		}
-	}
-	return true
-}
-
-// The pinned SDK's native ThinkingConfig union; deprecated maxThinkingTokens
-// is intentionally absent so a thinking budget has exactly one owner.
-func validThinking(thinking map[string]any) bool {
-	kind, ok := thinking["type"].(string)
-	if !ok || (kind != "adaptive" && kind != "enabled" && kind != "disabled") {
-		return false
-	}
-	for key, value := range thinking {
-		switch key {
-		case "type":
-		case "budgetTokens":
-			n, ok := value.(float64)
-			if kind != "enabled" || !ok || n < 1 || n > 9007199254740991 || math.Trunc(n) != n {
-				return false
-			}
-		case "display":
-			text, ok := value.(string)
-			if kind == "disabled" || !ok || (text != "summarized" && text != "omitted") {
-				return false
-			}
-		default:
-			return false
-		}
-	}
-	return true
-}
diff --git a/internal/harnessconfig/codex/configuration.go b/internal/harnessconfig/codex/configuration.go
deleted file mode 100644
index f2588ddda..000000000
--- a/internal/harnessconfig/codex/configuration.go
+++ /dev/null
@@ -1,10 +0,0 @@
-// Package codex owns the qualified Codex provider configuration declaration.
-package codex
-
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
-func Configuration() harnessconfig.Configuration {
-	return harnessconfig.Configuration{AcceptsProviderHeaders: true, ValidateNativeConfig: validateNativeConfig, Providers: []harnessconfig.Provider{
-		{Protocol: "responses"},
-	}}
-}
diff --git a/internal/harnessconfig/codex/declaration.go b/internal/harnessconfig/codex/declaration.go
new file mode 100644
index 000000000..66095c8c2
--- /dev/null
+++ b/internal/harnessconfig/codex/declaration.go
@@ -0,0 +1,107 @@
+// Package codex declares the Codex Harness.
+package codex
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+)
+
+// Declaration is the only authored description of the Codex Harness. The
+// Runtime may narrow Capabilities for the installed host, never widen them.
+var Declaration = harnessconfig.Declaration{
+	Kind:  "codex",
+	Label: "Codex",
+	Configuration: harnessconfig.Configuration{AcceptsProviderHeaders: true,
+		// context_window maps to model_context_window; Codex has no native
+		// max_output_tokens setting.
+		Providers: []harnessconfig.Provider{{Protocol: "responses"}},
+	},
+	Capabilities: proto.AgentKindCapabilities{
+		SubagentObservations:     proto.CapabilitySupported,
+		Streaming:                proto.CapabilitySupported,
+		Usage:                    proto.CapabilitySupported,
+		Resume:                   proto.CapabilitySupported,
+		RetainedNativeHistory:    proto.CapabilitySupported,
+		NativeSessionRecovery:    proto.CapabilitySupported,
+		MessageItems:             proto.CapabilitySupported,
+		ToolObservations:         proto.CapabilitySupported,
+		EnvironmentNone:          proto.CapabilitySupported,
+		LocalEnvironment:         proto.CapabilitySupported,
+		Preparation:              proto.CapabilitySupported,
+		WorkspaceReadPreparation: proto.CapabilitySupported,
+		WorkspaceOutputExport:    proto.CapabilitySupported,
+		ExecutionControls:        proto.CapabilitySupported,
+		StructuredOutput:         proto.CapabilitySupported,
+		ToolSearch:               proto.CapabilityUnsupported,
+		MessageImages:            proto.CapabilitySupported,
+		FunctionResultImages:     proto.CapabilitySupported,
+		SubagentControl:          proto.CapabilitySupported,
+		DurableInputReceipts:     proto.CapabilitySupported,
+		DurableTurns:             proto.CapabilitySupported,
+		FunctionTools:            proto.CapabilitySupported,
+		MCPHTTPTools:             proto.CapabilitySupported,
+		MCPHTTPRequired:          proto.CapabilitySupported,
+		MCPHTTPBearerAuth:        proto.CapabilitySupported,
+	},
+	// Codex maps every official value natively: web_search, tools.web_search.*,
+	// model_reasoning_effort, model_reasoning_summary, service_tier,
+	// model_verbosity and features.code_mode. Native indexed search has no
+	// official value. Official auto service tier means unset, and fast is Codex's
+	// native alias of priority. Codex ignores a value the selected model does not
+	// support.
+	Execution: harnessconfig.ExecutionOptions{
+		WebSearchModes:          []string{"disabled", "cached", "live"},
+		WebSearchSettings:       true,
+		ReasoningEfforts:        []string{"none", "minimal", "low", "medium", "high", "xhigh", "max"},
+		ReasoningSummaries:      []string{"concise", "detailed", "auto"},
+		ServiceTiers:            []string{"default", "flex", "priority", "fast"},
+		ProgrammaticToolCalling: []bool{true, false},
+		TextVerbosities:         []string{"low", "medium", "high"},
+	},
+	Placements:           []string{"none", "self_hosted", "openai_hosted"},
+	MCPOrigins:           []string{"service", "environment"},
+	WhitespaceOnlyText:   proto.CapabilitySupported,
+	ValidateMessageInput: rejectRemoteImages,
+	ValidateFunctionResult: func(result proto.FunctionResultPayload) error {
+		return rejectRemoteImages(proto.MessageInput{{Content: result.Content}})
+	},
+	ValidateConfiguration: func(admission harnessconfig.Admission) error {
+		// Subagent observation turns native code_mode off.
+		if admission.MultiAgent && enablesProgrammaticToolCalling(admission.Tools) {
+			return errors.New("programmatic_tool_calling.enabled=true is not supported with multi_agent by this Harness.")
+		}
+		return nil
+	},
+}
+
+// Native Codex rejects http and https image URLs in turns and tool results.
+func rejectRemoteImages(input proto.MessageInput) error {
+	for _, message := range input {
+		for _, part := range message.Content {
+			if part.ImageURL == nil {
+				continue
+			}
+			if scheme, _, ok := strings.Cut(*part.ImageURL, ":"); ok && (strings.EqualFold(scheme, "http") || strings.EqualFold(scheme, "https")) {
+				return harnessconfig.ErrInvalidInput
+			}
+		}
+	}
+	return nil
+}
+
+func enablesProgrammaticToolCalling(tools []json.RawMessage) bool {
+	for _, raw := range tools {
+		var tool struct {
+			Type    string `json:"type"`
+			Enabled *bool  `json:"enabled"`
+		}
+		if json.Unmarshal(raw, &tool) == nil && tool.Type == "programmatic_tool_calling" && tool.Enabled != nil && *tool.Enabled {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/harnessconfig/codex/declaration_test.go b/internal/harnessconfig/codex/declaration_test.go
new file mode 100644
index 000000000..ee8130f8f
--- /dev/null
+++ b/internal/harnessconfig/codex/declaration_test.go
@@ -0,0 +1,17 @@
+package codex
+
+import (
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+)
+
+func TestDeclarationAdmitsStructuredOutput(t *testing.T) {
+	if !Declaration.Capabilities.StructuredOutput.IsSupported() {
+		t.Fatal("structured output is not declared")
+	}
+	err := Declaration.ValidateConfiguration(harnessconfig.Admission{TextFormat: "json_schema", TextSchema: []byte(`{"type":"object"}`)})
+	if err != nil {
+		t.Fatalf("json_schema rejected: %v", err)
+	}
+}
diff --git a/internal/harnessconfig/codex/native.go b/internal/harnessconfig/codex/native.go
deleted file mode 100644
index 2f87051a3..000000000
--- a/internal/harnessconfig/codex/native.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package codex
-
-import "github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-
-func validateNativeConfig(config proto.HarnessConfig) bool {
-	for key, value := range config {
-		if key != "model_reasoning_effort" {
-			return false
-		}
-		text, ok := value.(string)
-		if !ok {
-			return false
-		}
-		switch text {
-		case "none", "minimal", "low", "medium", "high", "xhigh":
-		default:
-			return false
-		}
-	}
-	return true
-}
diff --git a/internal/harnessconfig/configuration_test.go b/internal/harnessconfig/configuration_test.go
index e2155ea45..95affb60d 100644
--- a/internal/harnessconfig/configuration_test.go
+++ b/internal/harnessconfig/configuration_test.go
@@ -1,18 +1,27 @@
 package harnessconfig
 
-import "testing"
+import (
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+)
+
+func testDeclaration(kind string, configuration Configuration) Declaration {
+	return Declaration{Kind: kind, Label: kind, Configuration: configuration, Capabilities: proto.UnsupportedCapabilities(),
+		Placements: []string{"none"}, MCPOrigins: []string{}, WhitespaceOnlyText: proto.CapabilityUnsupported, Execution: ExecutionOptions{TextVerbosities: []string{"medium"}}}
+}
 
 func TestRegistryOwnsDeclarations(t *testing.T) {
-	declaration := Configuration{Providers: []Provider{{Protocol: "responses", RequiresTokenLimits: true}}}
-	registry := NewRegistry(map[string]Configuration{"additional-adapter": declaration})
+	declaration := testDeclaration("additional-adapter", Configuration{Providers: []Provider{{Protocol: "responses"}}})
+	registry := NewRegistry(declaration)
 	declaration.Providers[0].Protocol = "changed"
 	got, ok := registry.Lookup("additional-adapter")
-	if !ok || got.Validate("responses", 100, 20) != nil || got.Validate("responses", 0, 0) == nil || got.ValidateProtocol("unknown") == nil {
+	if !ok || got.ValidateProtocol("responses") != nil || got.ValidateProtocol("unknown") == nil {
 		t.Fatal("registry did not preserve adapter rules")
 	}
-	got.Providers[0].RequiresTokenLimits = false
+	got.Providers[0].Protocol = "mutated"
 	again, _ := registry.Lookup("additional-adapter")
-	if again.Validate("responses", 0, 0) == nil {
+	if again.ValidateProtocol("responses") != nil {
 		t.Fatal("lookup mutated the registered declaration")
 	}
 	if _, ok := registry.Lookup("unknown"); ok || registry.SupportsProtocol("changed") || !registry.SupportsProtocol("responses") {
@@ -21,7 +30,7 @@ func TestRegistryOwnsDeclarations(t *testing.T) {
 }
 
 func TestUndeclaredHarnessHasNoNativeParameters(t *testing.T) {
-	registry := NewRegistry(nil)
+	registry := NewRegistry()
 	for _, raw := range []string{"", "{}", "{ \n }"} {
 		if err := registry.ValidateHarnessConfig("additional-adapter", []byte(raw)); err != nil {
 			t.Fatalf("empty parameters rejected: %v", err)
@@ -36,3 +45,27 @@ func TestUndeclaredHarnessHasNoNativeParameters(t *testing.T) {
 		t.Fatal("empty parameters inferred provider support")
 	}
 }
+
+func TestDeclarationRequiresExplicitSupport(t *testing.T) {
+	valid := testDeclaration("example", Configuration{})
+	if err := valid.ValidateDeclaration(); err != nil {
+		t.Fatal(err)
+	}
+	for name, change := range map[string]func(*Declaration){
+		"capability":   func(d *Declaration) { d.Capabilities.Streaming = proto.CapabilityUnspecified },
+		"whitespace":   func(d *Declaration) { d.WhitespaceOnlyText = proto.CapabilityUnspecified },
+		"placements":   func(d *Declaration) { d.Placements = nil },
+		"origins":      func(d *Declaration) { d.MCPOrigins = nil },
+		"service MCP":  func(d *Declaration) { d.Placements, d.MCPOrigins = []string{"self_hosted"}, []string{"service"} },
+		"bearer":       func(d *Declaration) { d.Capabilities.MCPHTTPBearerAuth = proto.CapabilitySupported },
+		"label":        func(d *Declaration) { d.Label = " " },
+		"unknown kind": func(d *Declaration) { d.Kind = " example" },
+		"verbosity":    func(d *Declaration) { d.Execution.TextVerbosities = []string{"high"} },
+	} {
+		declaration := valid.Clone()
+		change(&declaration)
+		if declaration.ValidateDeclaration() == nil {
+			t.Errorf("%s: ambiguous declaration accepted", name)
+		}
+	}
+}
diff --git a/internal/harnessconfig/harness.go b/internal/harnessconfig/harness.go
index 7511ea3ff..70f513573 100644
--- a/internal/harnessconfig/harness.go
+++ b/internal/harnessconfig/harness.go
@@ -1,10 +1,11 @@
-// Package harnessconfig defines the shared model configuration contract.
-// This file is the authoring entry point for Harness configuration: declare
-// native provider support and parameter validation once, then bind that same
-// Configuration when registering the Runtime Harness. Core admission, support
-// descriptions and every Runtime execution/preparation entry consume it.
+// Package harnessconfig defines the shared Harness declaration. This file is
+// the authoring entry point for a Harness: one Declaration states its kind,
+// display name, model providers, native parameter validation, capabilities,
+// placements and the public admission rules it adds. Core admission, support
+// descriptions and every Runtime execution/preparation entry consume that same
+// value, so nothing about a Harness is declared a second time elsewhere.
 // Adapter-specific validation and native rendering remain private implementations.
-// Execution lifecycle and operation qualification are separate contracts.
+// Execution lifecycle is a separate contract.
 //
 // The current HarnessConfig wire object is defined by proto.HarnessConfig.
 // Omission and {} mean no native parameters. Explicit null, arrays, repeated
@@ -25,12 +26,15 @@
 // continuations and recovery. A Runtime that cannot preserve a frozen snapshot
 // rejects it without rewriting, migration or aliases. Native connection setup is
 // direct: no model API proxy, passthrough gateway or protocol conversion, including
-// inside an adapter. Protocol acceptance does not qualify model capabilities;
+// inside an adapter. Protocol acceptance does not declare model capabilities;
 // operation and input requirements must still be checked before native submission.
 package harnessconfig
 
 import (
+	"encoding/json"
 	"errors"
+	"fmt"
+	"maps"
 	"slices"
 	"strings"
 
@@ -41,8 +45,7 @@ import (
 // Provider is deliberately limited to configuration compatibility. Core owns
 // credential admission and endpoint security; native launch options stay private.
 type Provider struct {
-	Protocol            string
-	RequiresTokenLimits bool
+	Protocol string
 }
 
 // Configuration is an adapter-owned declaration, not live provider readiness.
@@ -53,10 +56,114 @@ type Configuration struct {
 	Providers []Provider
 	// AcceptsProviderHeaders declares native delivery of non-sensitive model request metadata.
 	AcceptsProviderHeaders bool
+	// MaxOutputTokens reports that the adapter maps a provider's
+	// max_output_tokens to a native setting. Every adapter maps context_window.
+	MaxOutputTokens bool
 	// ValidateNativeConfig belongs to the selected adapter, never Core.
 	ValidateNativeConfig func(proto.HarnessConfig) bool
 }
 
+// Declaration is everything a Harness states about itself, authored once in
+// internal/harnessconfig/<package>/declaration.go. The Runtime adapter binds it
+// to native execution, and Core admission validates every Session against it:
+// Core keeps no parallel per-Harness description.
+//
+// Every capability is Supported or Unsupported; the zero value is invalid.
+// Runtime discovery may narrow Capabilities for the installed host (a missing
+// binary, an unsupported platform) and never widens them. A nil validator means
+// only the common validation applies.
+type Declaration struct {
+	// Kind is the public identifier; Label is its display name.
+	Kind, Label string
+	// Configuration declares model providers and native parameter validation.
+	Configuration
+	// Capabilities is the maximum the adapter supports on a capable host and the
+	// operations Core may rely on once a connected Runtime advertises them.
+	Capabilities proto.AgentKindCapabilities
+	// Placements lists the Environment types the Harness executes in.
+	Placements []string
+	// MCPOrigins lists where HTTP MCP connections originate: "service" for the
+	// service-side environment:none profile, "environment" for the Environment.
+	MCPOrigins []string
+	// Execution declares which official execution option values the Harness
+	// maps to a native setting. Admission rejects any other user-set value.
+	Execution ExecutionOptions
+	// WhitespaceOnlyText declares messages without an image or non-whitespace
+	// text. Unsupported Harnesses reject them at admission; Core never trims or
+	// pads model input to fit a Harness.
+	WhitespaceOnlyText proto.CapabilitySupport
+	// ValidateConfiguration adds pure restrictions on a saved Agent and
+	// Environment.
+	ValidateConfiguration func(Admission) error
+	// ValidateTools adds restrictions on resolved function and MCP tools.
+	ValidateTools func([]proto.FunctionTool, []proto.MCPHTTPServer) error
+	// ValidateMessageInput adds restrictions on messages that carry images.
+	ValidateMessageInput func(proto.MessageInput) error
+	// ValidateFunctionResult adds restrictions on submitted function results.
+	ValidateFunctionResult func(proto.FunctionResultPayload) error
+}
+
+// Info is the Runtime descriptor before discovery has checked the host.
+func (d Declaration) Info() proto.SupportedAgentKind {
+	return proto.SupportedAgentKind{Kind: d.Kind, Capabilities: d.Capabilities}
+}
+
+// Accepts reports whether the Harness executes in the Environment type.
+func (d Declaration) Accepts(placement string) bool {
+	return slices.Contains(d.Placements, placement)
+}
+
+func (d Declaration) Clone() Declaration {
+	d.Configuration = d.Configuration.Clone()
+	d.Execution = d.Execution.Clone()
+	d.Placements = slices.Clone(d.Placements)
+	d.MCPOrigins = slices.Clone(d.MCPOrigins)
+	return d
+}
+
+// ValidateDeclaration rejects ambiguous support before registration. Nothing is
+// inferred: every capability, placement and origin is stated.
+func (d Declaration) ValidateDeclaration() error {
+	// The label is rendered into the generated Markdown catalog.
+	if d.Kind == "" || d.Kind != strings.TrimSpace(d.Kind) || strings.TrimSpace(d.Label) == "" || strings.ContainsAny(d.Label, "\n\t|") {
+		return errors.New("harnessconfig: invalid kind or label")
+	}
+	if err := d.Configuration.ValidateDeclaration(); err != nil {
+		return err
+	}
+	if err := d.Capabilities.ValidateDeclaration(); err != nil {
+		return err
+	}
+	if d.WhitespaceOnlyText != proto.CapabilitySupported && d.WhitespaceOnlyText != proto.CapabilityUnsupported {
+		return errors.New("harnessconfig: whitespace-only text support must be declared")
+	}
+	if len(d.Placements) == 0 || !validChoices(d.Placements, "none", "openai_hosted", "self_hosted") {
+		return errors.New("harnessconfig: invalid placements")
+	}
+	if d.MCPOrigins == nil || !validChoices(d.MCPOrigins, "service", "environment") ||
+		(slices.Contains(d.MCPOrigins, "service") && !d.Accepts("none")) ||
+		(slices.Contains(d.MCPOrigins, "environment") && !d.Accepts("openai_hosted") && !d.Accepts("self_hosted")) ||
+		(d.Capabilities.MCPHTTPBearerAuth.IsSupported() && len(d.MCPOrigins) == 0) {
+		return errors.New("harnessconfig: invalid MCP origins")
+	}
+	// Core always sends the official default text verbosity.
+	if !slices.Contains(d.Execution.TextVerbosities, "medium") {
+		return errors.New("harnessconfig: execution must declare text verbosity medium")
+	}
+	return nil
+}
+
+func validChoices(values []string, allowed ...string) bool {
+	seen := make(map[string]bool, len(values))
+	for _, value := range values {
+		if !slices.Contains(allowed, value) || seen[value] {
+			return false
+		}
+		seen[value] = true
+	}
+	return true
+}
+
 // PreparedConfiguration owns a validated snapshot without native side effects.
 // Model and Provider may be absent only for the existing native-owned connection
 // path. A supplied model must be a nonempty string; an explicit provider requires
@@ -141,54 +248,174 @@ func (c Configuration) ValidateProtocol(protocol string) error {
 	return nil
 }
 
-func (c Configuration) Validate(protocol string, contextWindow, maxOutputTokens int32) error {
-	if err := c.ValidateProtocol(protocol); err != nil {
-		return err
-	}
-	provider, _ := c.Provider(protocol)
-	if provider.RequiresTokenLimits && (contextWindow <= 0 || maxOutputTokens <= 0) {
-		return errors.New("selected harness requires positive model context_window and max_output_tokens")
-	}
-	return nil
-}
-
 // Registry is an immutable snapshot. Missing declarations remain unknown rather
-// than inheriting another harness's configuration rules.
+// than inheriting another harness's rules.
 type Registry struct {
-	configurations map[string]Configuration
+	declarations map[string]Declaration
 }
 
-func NewRegistry(configurations map[string]Configuration) Registry {
-	registry := Registry{configurations: make(map[string]Configuration, len(configurations))}
-	for kind, configuration := range configurations {
-		if kind == "" || configuration.ValidateDeclaration() != nil {
-			panic("harnessconfig: invalid declaration")
+// NewRegistry panics on an invalid or duplicate declaration. Static
+// registrations are programmer errors, never runtime input.
+func NewRegistry(declarations ...Declaration) Registry {
+	registry := Registry{declarations: make(map[string]Declaration, len(declarations))}
+	for _, declaration := range declarations {
+		if _, duplicate := registry.declarations[declaration.Kind]; duplicate {
+			panic("harnessconfig: duplicate declaration")
+		}
+		if err := declaration.ValidateDeclaration(); err != nil {
+			panic(err)
 		}
-		registry.configurations[kind] = configuration.Clone()
+		registry.declarations[declaration.Kind] = declaration.Clone()
 	}
 	return registry
 }
 
-func (r Registry) Lookup(kind string) (Configuration, bool) {
-	configuration, ok := r.configurations[kind]
-	return configuration.Clone(), ok
+// IsZero reports a Registry that was never built by NewRegistry.
+func (r Registry) IsZero() bool { return r.declarations == nil }
+
+func (r Registry) Lookup(kind string) (Declaration, bool) {
+	declaration, ok := r.declarations[kind]
+	return declaration.Clone(), ok
 }
 
-func (r Registry) ValidateProtocol(kind, protocol string) error {
-	configuration, _ := r.Lookup(kind)
-	return configuration.ValidateProtocol(protocol)
+// Kinds returns a stable snapshot of the declared Harness identifiers.
+func (r Registry) Kinds() []string {
+	kinds := slices.Collect(maps.Keys(r.declarations))
+	slices.Sort(kinds)
+	return kinds
 }
 
-func (r Registry) Validate(kind, protocol string, contextWindow, maxOutputTokens int32) error {
-	configuration, _ := r.Lookup(kind)
-	return configuration.Validate(protocol, contextWindow, maxOutputTokens)
+func (r Registry) ValidateProtocol(kind, protocol string) error {
+	declaration, _ := r.Lookup(kind)
+	return declaration.ValidateProtocol(protocol)
 }
 
 func (r Registry) SupportsProtocol(protocol string) bool {
-	for _, configuration := range r.configurations {
-		if _, ok := configuration.Provider(protocol); ok {
+	for _, declaration := range r.declarations {
+		if _, ok := declaration.Provider(protocol); ok {
 			return true
 		}
 	}
 	return false
 }
+
+// ErrInvalidInput marks a configuration a Harness declaration rejects. Core
+// reports it as an invalid request, without echoing submitted values.
+var ErrInvalidInput = errors.New("invalid harness configuration")
+
+// Admission is the saved Agent and Environment a Harness declaration validates.
+// Core projects its public types into it, so declarations stay independent of
+// the public API package.
+type Admission struct {
+	TextFormat string
+	TextSchema json.RawMessage
+	MultiAgent bool
+	Tools      []json.RawMessage
+	// WorkspaceDirectory is the Environment's workspace, empty without one.
+	WorkspaceDirectory string
+}
+
+// ValidateMCPOrigins preserves outbound authority independently of Harness names.
+// Workspace connections never stand in for service-network connections.
+func (d Declaration) ValidateMCPOrigins(placement string, servers []proto.MCPHTTPServer) error {
+	for _, server := range servers {
+		switch server.ConnectionOrigin {
+		case "service":
+			if placement != "none" {
+				return errors.New("Service-origin MCP requires the service-side environment:none profile.")
+			}
+		case "environment":
+			if placement != "openai_hosted" && placement != "self_hosted" {
+				return errors.New("Environment-origin MCP requires a managed or self-hosted execution Environment.")
+			}
+		default:
+			return errors.New("MCP requires an explicit connection origin.")
+		}
+		if !slices.Contains(d.MCPOrigins, server.ConnectionOrigin) {
+			return errors.New("The configured engine does not support this MCP connection origin.")
+		}
+	}
+	return nil
+}
+
+// RequireObjectSchemas rejects a function whose parameter schema has no root type object.
+func RequireObjectSchemas(functions []proto.FunctionTool) error {
+	for _, tool := range functions {
+		var schema struct {
+			Type string `json:"type"`
+		}
+		if json.Unmarshal(tool.Parameters, &schema) != nil || schema.Type != "object" {
+			return errors.New("The configured engine requires function schemas with root type object.")
+		}
+	}
+	return nil
+}
+
+// ExecutionOptions lists the official execution option values a Harness maps to
+// a native setting. An empty set declares the option unsupported. Absent
+// options need no declaration: they follow the Harness's native default. Auto
+// service tier means unset, so it is always accepted.
+type ExecutionOptions struct {
+	// WebSearchModes are the supported web_search modes: disabled, cached, live.
+	WebSearchModes []string
+	// WebSearchSettings reports native homes for context_size, allowed_domains
+	// and location.
+	WebSearchSettings bool
+	// ReasoningEfforts and ReasoningSummaries are the supported reasoning values.
+	ReasoningEfforts, ReasoningSummaries []string
+	// ServiceTiers are the supported tiers other than auto.
+	ServiceTiers []string
+	// ProgrammaticToolCalling lists the supported enabled values.
+	ProgrammaticToolCalling []bool
+	// TextVerbosities are the supported text verbosity levels.
+	TextVerbosities []string
+}
+
+func (o ExecutionOptions) Clone() ExecutionOptions {
+	o.WebSearchModes = slices.Clone(o.WebSearchModes)
+	o.ReasoningEfforts = slices.Clone(o.ReasoningEfforts)
+	o.ReasoningSummaries = slices.Clone(o.ReasoningSummaries)
+	o.ServiceTiers = slices.Clone(o.ServiceTiers)
+	o.ProgrammaticToolCalling = slices.Clone(o.ProgrammaticToolCalling)
+	o.TextVerbosities = slices.Clone(o.TextVerbosities)
+	return o
+}
+
+// ValidateExecutionControls rejects a user-set or default value the Harness
+// does not declare. Core admission and the Runtime call it with the same
+// controls, so neither keeps a second list. Messages name the field and never
+// echo configuration other than the rejected value.
+func (d Declaration) ValidateExecutionControls(controls *proto.ExecutionControls) error {
+	if controls == nil {
+		return nil
+	}
+	o := d.Execution
+	reject := func(field, value string) error {
+		return fmt.Errorf("%s %q is not supported by this Harness.", field, value)
+	}
+	if search := controls.WebSearch; search != nil {
+		if !slices.Contains(o.WebSearchModes, search.Mode) {
+			return reject("web_search.mode", search.Mode)
+		}
+		// Settings of disabled search configure nothing.
+		if search.Mode != "disabled" && !o.WebSearchSettings && (search.ContextSize != "medium" || search.AllowedDomains != nil || search.Location != nil) {
+			return errors.New("web_search context_size, allowed_domains and location are not supported by this Harness.")
+		}
+	}
+	if enabled := controls.ProgrammaticToolCalling; enabled != nil && !slices.Contains(o.ProgrammaticToolCalling, *enabled) {
+		return fmt.Errorf("programmatic_tool_calling.enabled=%t is not supported by this Harness.", *enabled)
+	}
+	if v := controls.ReasoningEffort; v != "" && !slices.Contains(o.ReasoningEfforts, v) {
+		return reject("reasoning.effort", v)
+	}
+	if v := controls.ReasoningSummary; v != "" && !slices.Contains(o.ReasoningSummaries, v) {
+		return reject("reasoning.summary", v)
+	}
+	if v := controls.ServiceTier; v != "" && !slices.Contains(o.ServiceTiers, v) {
+		return reject("service_tier", v)
+	}
+	if v := controls.TextVerbosity; v != "" && !slices.Contains(o.TextVerbosities, v) {
+		return reject("text.verbosity", v)
+	}
+	return nil
+}
diff --git a/internal/harnessconfig/harnesstest/fixture.go b/internal/harnessconfig/harnesstest/fixture.go
new file mode 100644
index 000000000..9c5ff5020
--- /dev/null
+++ b/internal/harnessconfig/harnesstest/fixture.go
@@ -0,0 +1,26 @@
+// Package harnesstest supplies explicit Harness declarations for admission fixtures.
+package harnesstest
+
+import (
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+)
+
+// Declaration supports only common text admission in the "none" placement by
+// default: every capability is unsupported, with the official default medium
+// verbosity that Core always sends. change adjusts the result.
+func Declaration(kind string, change func(*harnessconfig.Declaration)) harnessconfig.Declaration {
+	d := harnessconfig.Declaration{
+		Kind:               kind,
+		Label:              kind,
+		Capabilities:       proto.UnsupportedCapabilities(),
+		Execution:          harnessconfig.ExecutionOptions{TextVerbosities: []string{"medium"}},
+		Placements:         []string{"none"},
+		MCPOrigins:         []string{},
+		WhitespaceOnlyText: proto.CapabilityUnsupported,
+	}
+	if change != nil {
+		change(&d)
+	}
+	return d
+}
diff --git a/internal/harnessconfig/mcode/configuration.go b/internal/harnessconfig/mcode/configuration.go
deleted file mode 100644
index ef62f60f0..000000000
--- a/internal/harnessconfig/mcode/configuration.go
+++ /dev/null
@@ -1,12 +0,0 @@
-// Package mcode owns the qualified MiniMax Code provider declaration.
-package mcode
-
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
-func Configuration() harnessconfig.Configuration {
-	return harnessconfig.Configuration{AcceptsProviderHeaders: true, Providers: []harnessconfig.Provider{
-		{Protocol: "anthropic", RequiresTokenLimits: true},
-		{Protocol: "responses", RequiresTokenLimits: true},
-		{Protocol: "chat_completions", RequiresTokenLimits: true},
-	}}
-}
diff --git a/internal/harnessconfig/mcode/declaration.go b/internal/harnessconfig/mcode/declaration.go
new file mode 100644
index 000000000..349bb0bb6
--- /dev/null
+++ b/internal/harnessconfig/mcode/declaration.go
@@ -0,0 +1,121 @@
+// Package mcode declares the MiniMax Code Harness.
+package mcode
+
+import (
+	"encoding/json"
+	"errors"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+)
+
+// FunctionServerLabel is the native MCP server that carries public functions.
+const FunctionServerLabel = "functions"
+
+// Declaration is the only authored description of the MiniMax Code Harness. The
+// Runtime may narrow Capabilities for the installed host, never widen them.
+// Whitespace-only text is unsupported because the native runtime refuses such
+// prompts with "Local message content or attachments are required.".
+var Declaration = harnessconfig.Declaration{
+	Kind:  "mcode",
+	Label: "MiniMax Code",
+	Configuration: harnessconfig.Configuration{AcceptsProviderHeaders: true, Providers: []harnessconfig.Provider{
+		{Protocol: "anthropic"},
+		{Protocol: "responses"},
+		{Protocol: "chat_completions"},
+	}, MaxOutputTokens: true},
+	Capabilities: proto.AgentKindCapabilities{
+		SubagentObservations:     proto.CapabilitySupported,
+		Streaming:                proto.CapabilitySupported,
+		Usage:                    proto.CapabilityUnsupported,
+		Resume:                   proto.CapabilitySupported,
+		RetainedNativeHistory:    proto.CapabilityUnsupported,
+		NativeSessionRecovery:    proto.CapabilityUnsupported,
+		MessageItems:             proto.CapabilityUnsupported,
+		ToolObservations:         proto.CapabilitySupported,
+		EnvironmentNone:          proto.CapabilitySupported,
+		LocalEnvironment:         proto.CapabilitySupported,
+		Preparation:              proto.CapabilitySupported,
+		WorkspaceReadPreparation: proto.CapabilitySupported,
+		WorkspaceOutputExport:    proto.CapabilitySupported,
+		ExecutionControls:        proto.CapabilitySupported,
+		StructuredOutput:         proto.CapabilityUnsupported,
+		ToolSearch:               proto.CapabilityUnsupported,
+		MessageImages:            proto.CapabilityUnsupported,
+		FunctionResultImages:     proto.CapabilityUnsupported,
+		SubagentControl:          proto.CapabilitySupported,
+		DurableInputReceipts:     proto.CapabilitySupported,
+		DurableTurns:             proto.CapabilitySupported,
+		FunctionTools:            proto.CapabilitySupported,
+		MCPHTTPTools:             proto.CapabilitySupported,
+		MCPHTTPRequired:          proto.CapabilityUnsupported,
+		MCPHTTPBearerAuth:        proto.CapabilitySupported,
+	},
+	// Native search needs a MiniMax account credential that Core does not hold, so
+	// features.webSearch stays false and disabled is the only mode. Effort becomes the
+	// custom model's only thinking option, and none disables native thinking.
+	// MiniMax Code has no native home for summary, service tier or programmatic
+	// tool calling.
+	// Medium is the official default verbosity and needs no setting.
+	Execution: harnessconfig.ExecutionOptions{
+		WebSearchModes:          []string{"disabled"},
+		ReasoningEfforts:        []string{"none", "minimal", "low", "medium", "high", "xhigh", "max"},
+		ProgrammaticToolCalling: []bool{false},
+		TextVerbosities:         []string{"medium"},
+	},
+	Placements:         []string{"none", "openai_hosted", "self_hosted"},
+	MCPOrigins:         []string{"service", "environment"},
+	WhitespaceOnlyText: proto.CapabilityUnsupported,
+	ValidateTools: func(functions []proto.FunctionTool, mcp []proto.MCPHTTPServer) error {
+		if err := harnessconfig.RequireObjectSchemas(functions); err != nil {
+			return err
+		}
+		for _, tool := range functions {
+			// The adapter's MCP server library gives x-mcp-header transport meaning.
+			if hasKey(tool.Parameters, "x-mcp-header") {
+				return errors.New("The configured engine does not support the x-mcp-header keyword in function schemas.")
+			}
+		}
+		for _, server := range mcp {
+			// Native starts session stdio servers in its home directory, which is private state, never the cwd a declaration names.
+			if server.Stdio != nil {
+				return errors.New("The configured engine cannot start MCP stdio servers in the declared cwd.")
+			}
+			if server.AllowedTools != nil || server.Required {
+				return errors.New("The configured engine requires allowed_tools=null and required=false.")
+			}
+			// The adapter serves public functions under this label.
+			if len(functions) > 0 && server.ServerLabel == FunctionServerLabel {
+				return errors.New("The configured engine reserves the HTTP MCP label functions.")
+			}
+		}
+		return nil
+	},
+}
+
+// hasKey reports whether the JSON document has an object member with this name at any depth.
+func hasKey(raw json.RawMessage, key string) bool {
+	var found func(any) bool
+	found = func(v any) bool {
+		switch v := v.(type) {
+		case map[string]any:
+			if _, ok := v[key]; ok {
+				return true
+			}
+			for _, child := range v {
+				if found(child) {
+					return true
+				}
+			}
+		case []any:
+			for _, child := range v {
+				if found(child) {
+					return true
+				}
+			}
+		}
+		return false
+	}
+	var doc any
+	return json.Unmarshal(raw, &doc) == nil && found(doc)
+}
diff --git a/internal/harnessconfig/mcode/declaration_test.go b/internal/harnessconfig/mcode/declaration_test.go
new file mode 100644
index 000000000..d74a5b773
--- /dev/null
+++ b/internal/harnessconfig/mcode/declaration_test.go
@@ -0,0 +1,20 @@
+package mcode
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+)
+
+func TestFunctionSchemaRejectsMCPHeaderKeyword(t *testing.T) {
+	for schema, ok := range map[string]bool{
+		`{"type":"object","properties":{"q":{"type":"string"}}}`:                         true,
+		`{"type":"object","properties":{"q":{"type":"string","x-mcp-header":"Region"}}}`: false,
+	} {
+		err := Declaration.ValidateTools([]proto.FunctionTool{{Name: "f", Parameters: json.RawMessage(schema)}}, nil)
+		if (err == nil) != ok {
+			t.Errorf("%s: %v", schema, err)
+		}
+	}
+}
diff --git a/internal/harnessconfig/native.go b/internal/harnessconfig/native.go
index fa9162823..dd35ad8e3 100644
--- a/internal/harnessconfig/native.go
+++ b/internal/harnessconfig/native.go
@@ -77,7 +77,7 @@ func (r Registry) ValidateHarnessConfig(kind string, raw json.RawMessage) error
 		_, err := c.ParseHarnessConfig(raw)
 		return err
 	}
-	for _, c := range r.configurations {
+	for _, c := range r.declarations {
 		if _, err := c.ParseHarnessConfig(raw); err == nil {
 			return nil
 		}
diff --git a/internal/harnessconfig/provider.go b/internal/harnessconfig/provider.go
index 3fdb6d250..8df935a85 100644
--- a/internal/harnessconfig/provider.go
+++ b/internal/harnessconfig/provider.go
@@ -23,7 +23,10 @@ func (c Configuration) ParseProvider(raw any) (modelprovider.Provider, error) {
 	if err != nil {
 		return modelprovider.Provider{}, err
 	}
-	if err := c.Validate(string(provider.Protocol), provider.ContextWindow, provider.MaxOutputTokens); err != nil {
+	if err := c.ValidateProtocol(string(provider.Protocol)); err != nil {
+		return modelprovider.Provider{}, err
+	}
+	if err := c.ValidateMaxOutputTokens(provider.MaxOutputTokens); err != nil {
 		return modelprovider.Provider{}, err
 	}
 	if err := c.ValidateProviderHeaders(provider.Headers); err != nil {
@@ -31,3 +34,11 @@ func (c Configuration) ParseProvider(raw any) (modelprovider.Provider, error) {
 	}
 	return provider, nil
 }
+
+// ValidateMaxOutputTokens rejects a set limit the Harness has no native home for.
+func (c Configuration) ValidateMaxOutputTokens(value int32) error {
+	if value > 0 && !c.MaxOutputTokens {
+		return errors.New("The selected harness has no native max_output_tokens setting.")
+	}
+	return nil
+}
diff --git a/internal/modelprovider/config.go b/internal/modelprovider/config.go
index 434b19f85..49efd0797 100644
--- a/internal/modelprovider/config.go
+++ b/internal/modelprovider/config.go
@@ -71,7 +71,7 @@ func (p Provider) Validate() error {
 	if strings.TrimSpace(p.APIKey) == "" || len(p.APIKey) > 16384 || strings.ContainsAny(p.APIKey, "\x00\r\n") {
 		return ErrConfiguration
 	}
-	if p.ContextWindow < 0 || p.MaxOutputTokens < 0 || p.MaxOutputTokens > p.ContextWindow {
+	if !TokenLimitsValid(p.ContextWindow, p.MaxOutputTokens) {
 		return ErrConfiguration
 	}
 	return ValidateHeaders(p.Headers)
@@ -158,3 +158,9 @@ func (h *Headers) UnmarshalJSON(data []byte) error {
 	*h = result
 	return nil
 }
+
+// TokenLimitsValid holds the token-limit rule: unset is zero, and an output
+// limit never exceeds a set context window.
+func TokenLimitsValid(contextWindow, maxOutputTokens int32) bool {
+	return contextWindow >= 0 && maxOutputTokens >= 0 && (contextWindow == 0 || maxOutputTokens <= contextWindow)
+}
diff --git a/internal/runtimefs/runtimefs.go b/internal/runtimefs/runtimefs.go
index 093369431..f1ee01867 100644
--- a/internal/runtimefs/runtimefs.go
+++ b/internal/runtimefs/runtimefs.go
@@ -13,6 +13,9 @@ import (
 
 var ErrUnsafe = errors.New("Runtime state path unavailable or invalid")
 
+// ErrLocked reports that another process holds the directory lock.
+var ErrLocked = errors.New("directory is locked by another process")
+
 func validName(name string) bool {
 	return name != "" && name != "." && name != ".." && !strings.ContainsAny(name, "/\\\x00")
 }
diff --git a/internal/runtimefs/runtimefs_test.go b/internal/runtimefs/runtimefs_test.go
index 8a25f4ac5..646f8c61c 100644
--- a/internal/runtimefs/runtimefs_test.go
+++ b/internal/runtimefs/runtimefs_test.go
@@ -96,6 +96,9 @@ func TestPrivateLockChild(t *testing.T) {
 			unlock()
 			t.Fatal("concurrent lock admitted")
 		}
+		if !errors.Is(err, ErrLocked) {
+			t.Fatalf("a held lock must report ErrLocked, got %v", err)
+		}
 	} else {
 		if err != nil {
 			t.Fatal(err)
diff --git a/internal/runtimefs/runtimefs_unix.go b/internal/runtimefs/runtimefs_unix.go
index 91448d0f0..eeb0a49da 100644
--- a/internal/runtimefs/runtimefs_unix.go
+++ b/internal/runtimefs/runtimefs_unix.go
@@ -3,6 +3,8 @@
 package runtimefs
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -23,6 +25,9 @@ func LockDirectory(root *os.Root) (func(), error) {
 	}
 	if err = syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
 		f.Close()
+		if errors.Is(err, syscall.EWOULDBLOCK) {
+			return nil, fmt.Errorf("%w: %w", ErrLocked, err)
+		}
 		return nil, err
 	}
 	return func() { _ = syscall.Flock(int(f.Fd()), syscall.LOCK_UN); _ = f.Close() }, nil
diff --git a/internal/runtimefs/runtimefs_windows.go b/internal/runtimefs/runtimefs_windows.go
index 6d79718b0..20b08761a 100644
--- a/internal/runtimefs/runtimefs_windows.go
+++ b/internal/runtimefs/runtimefs_windows.go
@@ -1,6 +1,8 @@
 package runtimefs
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -38,6 +40,9 @@ func LockDirectory(root *os.Root) (func(), error) {
 	overlapped := new(windows.Overlapped)
 	if err = windows.LockFileEx(windows.Handle(f.Fd()), windows.LOCKFILE_EXCLUSIVE_LOCK|windows.LOCKFILE_FAIL_IMMEDIATELY, 0, 1, 0, overlapped); err != nil {
 		f.Close()
+		if errors.Is(err, windows.ERROR_LOCK_VIOLATION) {
+			return nil, fmt.Errorf("%w: %w", ErrLocked, err)
+		}
 		return nil, err
 	}
 	return func() { _ = windows.UnlockFileEx(windows.Handle(f.Fd()), 0, 1, 0, overlapped); _ = f.Close() }, nil
diff --git a/packages/agents-client/README.md b/packages/agents-client/README.md
index 0e471313f..e35675888 100644
--- a/packages/agents-client/README.md
+++ b/packages/agents-client/README.md
@@ -24,7 +24,7 @@ Behavior shared by the clients:
 - **Strict responses.** Session, history, event, Environment and Core API responses are checked against their pinned shapes before they are returned. A malformed one throws `AgentCoreError` with status 502 and a code such as `invalid_session_resource` or `invalid_admin_response` (`CoreMetricsClient`: status 0, `invalid_response`) instead of passing on a guessed value. Agent responses are typed but not checked at run time.
 - **Errors.** A non-2xx response throws `AgentCoreError` with `status`, `code`, `param`, `errorType` and, from the Core API, the optional `details` of the [Core error envelope](../../contracts/agents-api/core-errors.md). Input the client cannot send, such as a malformed resource ID, throws `TypeError` before any request; Core enforces size, count and range limits.
 - **No retries or timeouts.** No client retries a request. Pass `signal` to cancel one.
-- **Idempotency.** `createSession` takes an idempotency key and generates one when omitted; pass your own to retry a creation safely. `sendMessage`, `submitEvents`, `cancelTurn` and `submitFunctionResult` require one. `createIdempotencyKey()` makes one.
+- **Idempotency.** `createSession` takes an idempotency key and generates one when omitted; pass your own to retry a creation safely. `sendMessage`, `submitEvents`, `cancelTurn` and `submitFunctionResult` require one. `randomUuid()` makes one.
 - **Streams.** `streamEvents` and `createSessionStream` decode the live event stream with `createSSEDecoder` and validate each event. Recover missed events with ordinary reads; the decoder does not resume with `Last-Event-ID`.
 
 ### Saved Agent and deployment defaults
@@ -38,9 +38,9 @@ import { OpenAIAgentsClient } from "@oac/agents-client";
 const client = new OpenAIAgentsClient({ baseUrl: apiBaseURL, token: projectAPIKey });
 const agent = await client.createAgent({
   model: "requested-model",
+  reasoning: { effort: "high" },
   x_agents_core: {
     harness: "codex",
-    harness_config: { model_reasoning_effort: "high" },
     model_provider: {
       protocol: "responses",
       base_url: modelBaseURL,
@@ -82,7 +82,6 @@ if (frozen.model_provider.status === "available") {
 await admin.setHarnessModelConfiguration("codex", {
   model_provider: { protocol: "responses", base_url: modelBaseURL, api_key: modelAPIKey },
   model: "requested-model",
-  harness_config: { model_reasoning_effort: "high" },
 });
 const defaults = await admin.retrieveHarnessModelConfiguration("codex");
 console.log(defaults.model, defaults.harness_config, defaults.model_provider.api_key_configured);
diff --git a/packages/agents-client/src/admin-client.test.ts b/packages/agents-client/src/admin-client.test.ts
index b240b71f4..b1205cbd6 100644
--- a/packages/agents-client/src/admin-client.test.ts
+++ b/packages/agents-client/src/admin-client.test.ts
@@ -154,15 +154,15 @@ describe("AdminClient transport boundary", () => {
   });
 
   it("manages deployment default model providers without ever reading a key", async () => {
-    const provider = { last_used_at: null, last_error_code: null, last_error_at: null, object: "core.model_configuration", harness: "codex", model: "test-model", harness_config: { model_reasoning_effort: "high" }, model_provider: { protocol: "responses", base_url: "https://model.example/v1", api_key_configured: true }, updated_at: "2026-09-26T08:00:00Z" };
+    const provider = { last_used_at: null, last_error_code: null, last_error_at: null, object: "core.model_configuration", harness: "codex", model: "test-model", harness_config: {}, model_provider: { protocol: "responses", base_url: "https://model.example/v1", api_key_configured: true }, updated_at: "2026-09-26T08:00:00Z" };
     const harnesses = { object: "list", data: [
-      { object: "core.harness", id: "claude_sdk", enabled: false, default: false, model_configuration: null, model_configuration_support: { protocols: ["anthropic"], accepts_harness_config: true, token_limits_required: false } },
-      { object: "core.harness", id: "codex", enabled: true, default: true, model_configuration: provider, model_configuration_support: { protocols: ["responses"], accepts_harness_config: true, token_limits_required: false } },
+      { object: "core.harness", id: "claude_sdk", enabled: false, default: false, model_configuration: null, model_configuration_support: { protocols: ["anthropic"], accepts_harness_config: true, accepts_max_output_tokens: true } },
+      { object: "core.harness", id: "codex", enabled: true, default: true, model_configuration: provider, model_configuration_support: { protocols: ["responses"], accepts_harness_config: true, accepts_max_output_tokens: false } },
     ] };
     expect(await clientWith(harnesses).client.listHarnesses()).toEqual(harnesses);
     expect(await clientWith(provider).client.retrieveHarnessModelConfiguration("codex")).toEqual(provider);
     const { client, fetch } = clientWith(provider);
-    const input = { model: "test-model", harness_config: { model_reasoning_effort: "high" }, model_provider: { protocol: "responses", base_url: "https://model.example/v1", api_key: "write-only", context_window: 200000, max_output_tokens: 8000 } } as const;
+    const input = { model: "test-model", harness_config: {}, model_provider: { protocol: "responses", base_url: "https://model.example/v1", api_key: "write-only", context_window: 200000, max_output_tokens: 8000 } } as const;
     expect(await client.setHarnessModelConfiguration("codex", input)).toEqual(provider);
     expect(JSON.parse(fetch.mock.calls[0]![1]!.body as string)).toEqual(input);
     for (const unsafe of [{ ...provider, api_key: "leak" }, { ...provider, harness: "mcode" }, { ...provider, model_provider: { ...provider.model_provider, api_key_configured: false } }, { ...provider, model_provider: { ...provider.model_provider, base_url: "http://model.example/v1" } }, { ...provider, model_provider: { ...provider.model_provider, api_key: "leak" } }, { ...provider, model: "" }, { ...provider, harness_config: [] }, { ...provider, extra: 1 }]) {
diff --git a/packages/agents-client/src/admin-projection.ts b/packages/agents-client/src/admin-projection.ts
index 321107239..714bd6fac 100644
--- a/packages/agents-client/src/admin-projection.ts
+++ b/packages/agents-client/src/admin-projection.ts
@@ -226,10 +226,11 @@ function projectModelConfigurationSupport(value: unknown): CoreHarness["model_co
   const protocols = support.protocols;
   if (!Array.isArray(protocols) || protocols.length === 0 || !protocols.every((protocol) => isOneOf(modelProviderProtocols, protocol)) ||
     new Set(protocols).size !== protocols.length ||
-    typeof support.accepts_harness_config !== "boolean" || typeof support.token_limits_required !== "boolean") return invalidAdminResponse();
+    typeof support.accepts_harness_config !== "boolean" || typeof support.accepts_max_output_tokens !== "boolean") return invalidAdminResponse();
   return {
     protocols: [...protocols],
-    accepts_harness_config: support.accepts_harness_config, token_limits_required: support.token_limits_required,
+    accepts_harness_config: support.accepts_harness_config,
+    accepts_max_output_tokens: support.accepts_max_output_tokens,
   };
 }
 export function projectCoreHarnessList(value: unknown): { object: "list"; data: CoreHarness[] } {
diff --git a/packages/agents-client/src/client.test.ts b/packages/agents-client/src/client.test.ts
index 99c737350..621ce525a 100644
--- a/packages/agents-client/src/client.test.ts
+++ b/packages/agents-client/src/client.test.ts
@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { AdminClient } from "./admin-client";
-import { AgentCoreError, projectAgentSession, CreationStreamRetryError, createIdempotencyKey, isSessionDeletionConflict, OpenAIAgentsClient } from "./client";
+import { AgentCoreError, projectAgentSession, CreationStreamRetryError, isSessionDeletionConflict, OpenAIAgentsClient, randomUuid } from "./client";
 import hostedDadf64 from "./fixtures/parsar-dadf64a7/openai-hosted.json";
 import eventBatchDadf64 from "./fixtures/parsar-dadf64a7/session-event-batch.json";
 import type {
@@ -2249,7 +2249,7 @@ describe("OpenAIAgentsClient", () => {
 
   it("lets the caller hold and reuse one event-write idempotency key before an uncertain retry", async () => {
     const calls: FetchCall[] = [];
-    const key = createIdempotencyKey();
+    const key = randomUuid();
     const client = new OpenAIAgentsClient({
       fetch: (async (input: RequestInfo | URL, init?: RequestInit) => {
         calls.push({ input, init });
@@ -2258,8 +2258,7 @@ describe("OpenAIAgentsClient", () => {
     });
     const events: SessionInputEvent[] = [{ type: "agent.session.input.cancel" }];
 
-    expect(key.trim()).not.toBe("");
-    expect(new TextEncoder().encode(key).length).toBeLessThanOrEqual(128);
+    expect(key).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
     await expect(client.submitEvents("session", events, key)).rejects.toMatchObject({ status: 500 });
     await expect(client.submitEvents("session", events, key)).rejects.toMatchObject({ status: 500 });
     expect(calls).toHaveLength(2);
@@ -2286,7 +2285,7 @@ describe("OpenAIAgentsClient", () => {
     }
   });
 
-  it("keeps the three legacy single-event helpers on the public batch wire", async () => {
+  it("maps the single-event helpers on the public batch wire", async () => {
     const calls: FetchCall[] = [];
     const client = new OpenAIAgentsClient({ fetch: recordingFetch(new Response(null, { status: 202 }), calls) });
 
diff --git a/packages/agents-client/src/client.ts b/packages/agents-client/src/client.ts
index 5beb09c3a..a25b4743c 100644
--- a/packages/agents-client/src/client.ts
+++ b/packages/agents-client/src/client.ts
@@ -207,11 +207,13 @@ function isHarnessKind(value: unknown): value is CoreHarnessKind {
   return typeof value === "string" && harnessKinds.has(value as CoreHarnessKind);
 }
 
-export function createIdempotencyKey(): string {
-  if (typeof crypto !== "undefined" && "randomUUID" in crypto) {
-    return crypto.randomUUID();
-  }
-  return `web-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+/** A random v4 UUID. `crypto.randomUUID` needs a secure context, which a plain-HTTP console lacks. */
+export function randomUuid(): string {
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  bytes[6] = (bytes[6]! & 0x0f) | 0x40;
+  bytes[8] = (bytes[8]! & 0x3f) | 0x80;
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 
 function addPageOptions(params: URLSearchParams, options?: PageOptions): void {
@@ -1856,7 +1858,7 @@ export class OpenAIAgentsClient implements AgentCore {
     return { ...page, data: page.data.map((session) => projectAgentSession(session)) };
   }
 
-  async createSession(input: CreateSessionInput, idempotencyKey = createIdempotencyKey()): Promise<AgentSession> {
+  async createSession(input: CreateSessionInput, idempotencyKey = randomUuid()): Promise<AgentSession> {
     if ((input as { stream?: boolean }).stream === true) {
       throw new TypeError("createSession only supports the JSON response; connect streamEvents after creation.");
     }
@@ -1893,7 +1895,7 @@ export class OpenAIAgentsClient implements AgentCore {
     const headers = this.headers({
       Accept: "text/event-stream",
       "Content-Type": "application/json",
-      "Idempotency-Key": idempotencyKey ?? createIdempotencyKey(),
+      "Idempotency-Key": idempotencyKey ?? randomUuid(),
     });
     const response = await this.fetchImpl(`${this.baseUrl}/agents/sessions`, {
       method: "POST",
diff --git a/packages/agents-client/src/deployment-contract.ts b/packages/agents-client/src/deployment-contract.ts
index 66f8bd5db..4b04cab05 100644
--- a/packages/agents-client/src/deployment-contract.ts
+++ b/packages/agents-client/src/deployment-contract.ts
@@ -1,3 +1,3 @@
 // Code generated by services/core/cmd/specification-contract from sandbox/deployment_contract.go; DO NOT EDIT.
 
-export const deploymentContract = {"workspace_fields":["attachment","user_xattr","capacity_quota"],"resources":[{"name":"cpus","min":1,"max":255,"omit_zero":false},{"name":"memory_mib","min":512,"max":1048576,"omit_zero":false},{"name":"root_disk_mib","min":0,"max":4294967295,"omit_zero":true},{"name":"environment_disk_mib","min":0,"max":4294967295,"omit_zero":true}],"runtime":[{"name":"source_commit","pattern":"[0-9a-f]{40}"},{"name":"image_id","pattern":"sha256:[0-9a-f]{64}"},{"name":"image_manifest_digest","pattern":"sha256:[0-9a-f]{64}"},{"name":"microsandbox_ref","pattern":"oac-runtime@sha256:[0-9a-f]{64}"},{"name":"runtime_sha256","pattern":"[0-9a-f]{64}"},{"name":"firmware_sha256","pattern":"[0-9a-f]{64}"}],"providers":{"docker":{"mode":"nodes","disk":false,"runtime":true,"default_resources":{"cpus":2,"memory_mib":2048}},"e2b":{"mode":"direct","disk":false,"runtime":false,"default_resources":null},"microsandbox":{"mode":"nodes","workspace":{"attachment":"host_directory","user_xattr":true},"disk":true,"runtime":true,"default_resources":{"cpus":2,"memory_mib":4096,"root_disk_mib":8192,"environment_disk_mib":8192}}},"minimum_disk":1024} as const;
+export const deploymentContract = {"workspace_fields":["attachment","user_xattr","capacity_quota"],"resources":[{"name":"cpus","min":1,"max":255,"omit_zero":false},{"name":"memory_mib","min":512,"max":1048576,"omit_zero":false},{"name":"root_disk_mib","min":0,"max":4294967295,"omit_zero":true},{"name":"environment_disk_mib","min":0,"max":4294967295,"omit_zero":true}],"providers":{"docker":{"mode":"nodes","disk":false,"default_resources":{"cpus":2,"memory_mib":2048}},"e2b":{"mode":"direct","disk":false,"default_resources":null},"microsandbox":{"mode":"nodes","workspace":{"attachment":"host_directory","user_xattr":true},"disk":true,"default_resources":{"cpus":2,"memory_mib":4096,"root_disk_mib":8192}}},"minimum_disk":1024} as const;
diff --git a/packages/agents-client/src/execution-configuration-projection.ts b/packages/agents-client/src/execution-configuration-projection.ts
index e0a1506cc..b78e69a3b 100644
--- a/packages/agents-client/src/execution-configuration-projection.ts
+++ b/packages/agents-client/src/execution-configuration-projection.ts
@@ -33,6 +33,11 @@ function safeBaseURL(value: string): boolean {
   return !authority.includes("@") && host !== "" && query === "" && fragment === "";
 }
 
+/** Core's token-limit rule: an output limit never exceeds a set context window. */
+export function tokenLimitsFit(contextWindow?: number, maxOutputTokens?: number): boolean {
+  return !contextWindow || (maxOutputTokens ?? 0) <= contextWindow;
+}
+
 /** The safe provider view shared by frozen Session configuration and saved Agent reads. */
 export function safeProvider(value: unknown, invalid: Invalid): ModelProviderView {
   if (!isRecord(value) || !onlyFields(value, modelProviderViewFields) ||
@@ -40,7 +45,7 @@ export function safeProvider(value: unknown, invalid: Invalid): ModelProviderVie
     typeof value.base_url !== "string" || typeof value.api_key_configured !== "boolean" ||
     (value.context_window !== undefined && !isNonnegativeInteger(value.context_window)) ||
     (value.max_output_tokens !== undefined && !isNonnegativeInteger(value.max_output_tokens)) ||
-    Number(value.max_output_tokens ?? 0) > Number(value.context_window ?? 0)) return invalid();
+    !tokenLimitsFit(value.context_window as number | undefined, value.max_output_tokens as number | undefined)) return invalid();
   if (!safeBaseURL(value.base_url)) return invalid();
   return {
     protocol: value.protocol as ModelProviderView["protocol"], base_url: value.base_url, api_key_configured: value.api_key_configured,
diff --git a/packages/agents-client/src/execution-configuration.test.ts b/packages/agents-client/src/execution-configuration.test.ts
index c3938f2f9..89db539ed 100644
--- a/packages/agents-client/src/execution-configuration.test.ts
+++ b/packages/agents-client/src/execution-configuration.test.ts
@@ -6,8 +6,8 @@ const projectId = "11111111-1111-4111-8111-111111111111";
 const id = "013773a9-44b9-4f84-baca-b51c04a01201";
 const snapshot: SessionExecutionConfiguration = {
   object: "agent.session.execution_configuration", schema_version: 1, session_id: id,
-  model: { value: "frozen-model", source: "session" }, harness: { value: "codex", source: "agent" },
-  harness_config: { value: { model_reasoning_effort: "high" }, source: "agent" },
+  model: { value: "frozen-model", source: "session" }, harness: { value: "claude_sdk", source: "agent" },
+  harness_config: { value: { thinking: { type: "adaptive" } }, source: "agent" },
   model_provider: { status: "available", source: "agent", configuration: { protocol: "responses", base_url: "https://model.example/v1", api_key_configured: true } },
 };
 function clientReturning(value: unknown, seen?: (url: string, init?: RequestInit) => void) {
@@ -35,6 +35,8 @@ describe("frozen execution configuration", () => {
       value.model_provider.configuration!.context_window = 200000;
       value.model_provider.configuration!.max_output_tokens = 8000;
       expect(await clientReturning(value).retrieveSessionExecutionConfiguration(projectId, id)).toEqual(value);
+      delete value.model_provider.configuration!.context_window;
+      expect(await clientReturning(value).retrieveSessionExecutionConfiguration(projectId, id)).toEqual(value);
     }
   });
   it.each([
diff --git a/packages/agents-client/src/generated/core-api.ts b/packages/agents-client/src/generated/core-api.ts
index 61d951c63..8c0362eb2 100644
--- a/packages/agents-client/src/generated/core-api.ts
+++ b/packages/agents-client/src/generated/core-api.ts
@@ -116,6 +116,19 @@ export interface AdminauditPage {
 export const adminauditPageFields = ["data", "has_more", "next_cursor"] as const;
 export const attachmentKindValues = ["host_directory"] as const;
 export type AttachmentKind = (typeof attachmentKindValues)[number];
+export interface Capacity {
+  max_active: number;
+  max_retained: number;
+}
+export const capacityFields = ["max_active", "max_retained"] as const;
+export interface ComputeProfileRecord {
+  configuration?: Record<string, unknown>;
+  generation?: number;
+  metadata?: Record<string, unknown>;
+  specification?: DeploymentSpec;
+}
+export const computeProfileRecordFields = ["configuration", "generation", "metadata", "specification"] as const;
+export const computeProfileRecordRequired = [] as const;
 export interface ConfigurationDiscoveryInput {
   configuration?: Record<string, unknown>;
   credential?: Record<string, unknown>;
@@ -190,12 +203,12 @@ export interface DeploymentResources {
 export const deploymentResourcesFields = ["allocations", "pending"] as const;
 export interface DeploymentSpec {
   resources: SandboxResources;
-  runtime?: RuntimeRelease;
   workspace?: Declaration;
 }
-export const deploymentSpecFields = ["resources", "runtime", "workspace"] as const;
+export const deploymentSpecFields = ["resources", "workspace"] as const;
 export const deploymentSpecRequired = ["resources"] as const;
 export interface DeploymentView {
+  compute_profiles?: Record<string, ComputeProfileRecord>;
   configuration?: Record<string, unknown>;
   core_url: string;
   credential_configured: boolean;
@@ -212,7 +225,7 @@ export interface DeploymentView {
   specification_digest?: string;
   suspension: Suspension | null;
 }
-export const deploymentViewFields = ["configuration", "core_url", "credential_configured", "generation", "installation_id", "metadata", "mode", "owner_epoch", "provider", "reset", "resources", "rollout", "specification", "specification_digest", "suspension"] as const;
+export const deploymentViewFields = ["compute_profiles", "configuration", "core_url", "credential_configured", "generation", "installation_id", "metadata", "mode", "owner_epoch", "provider", "reset", "resources", "rollout", "specification", "specification_digest", "suspension"] as const;
 export const deploymentViewRequired = ["core_url", "credential_configured", "generation", "installation_id", "mode", "owner_epoch", "provider", "reset", "resources", "rollout", "suspension"] as const;
 export interface DiagnosticFailure {
   code: DiagnosticFailureCode;
@@ -413,10 +426,10 @@ export const modelConfigurationInputFields = ["harness_config", "model", "model_
 export const modelConfigurationInputRequired = ["model", "model_provider"] as const;
 export interface ModelConfigurationSupport {
   accepts_harness_config: boolean;
+  accepts_max_output_tokens: boolean;
   protocols: string[];
-  token_limits_required: boolean;
 }
-export const modelConfigurationSupportFields = ["accepts_harness_config", "protocols", "token_limits_required"] as const;
+export const modelConfigurationSupportFields = ["accepts_harness_config", "accepts_max_output_tokens", "protocols"] as const;
 export interface Node {
   active: number;
   available_disk_bytes: number | null;
@@ -425,7 +438,6 @@ export interface Node {
   core_url: string;
   cpu_count: number | null;
   created_at: string;
-  diagnostic?: NodeDiagnosticCode;
   enrollment_id: string | null;
   id: string;
   last_seen_at: string | null;
@@ -435,14 +447,14 @@ export interface Node {
   online: boolean;
   provider: string;
   provider_ready: boolean;
+  recommended_capacity: Capacity | null;
   reserved: number;
   retained: number;
   rollout: NodeRollout;
   running: number;
   snapshots: number;
 }
-export const nodeFields = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "diagnostic", "enrollment_id", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "reserved", "retained", "rollout", "running", "snapshots"] as const;
-export const nodeRequired = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "enrollment_id", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "reserved", "retained", "rollout", "running", "snapshots"] as const;
+export const nodeFields = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "enrollment_id", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "recommended_capacity", "reserved", "retained", "rollout", "running", "snapshots"] as const;
 export interface NodeAllocation {
   compute_phase: string;
   compute_phase_changed_at: string | null;
@@ -468,7 +480,6 @@ export interface NodeDetail {
   core_url: string;
   cpu_count: number | null;
   created_at: string;
-  diagnostic?: NodeDiagnosticCode;
   enrollment_id: string | null;
   history: HostHistory;
   host: NodeHost;
@@ -480,15 +491,15 @@ export interface NodeDetail {
   online: boolean;
   provider: string;
   provider_ready: boolean;
+  recommended_capacity: Capacity | null;
   reserved: number;
   retained: number;
   rollout: NodeRollout;
   running: number;
   snapshots: number;
 }
-export const nodeDetailFields = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "diagnostic", "enrollment_id", "history", "host", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "reserved", "retained", "rollout", "running", "snapshots"] as const;
-export const nodeDetailRequired = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "enrollment_id", "history", "host", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "reserved", "retained", "rollout", "running", "snapshots"] as const;
-export const nodeDiagnosticCodeValues = ["provider_unavailable", "host_unsupported", "artifacts_unavailable", "runtime_download_failed", "runtime_image_unavailable", "capacity_insufficient"] as const;
+export const nodeDetailFields = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "enrollment_id", "history", "host", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "recommended_capacity", "reserved", "retained", "rollout", "running", "snapshots"] as const;
+export const nodeDiagnosticCodeValues = ["provider_unavailable", "host_unsupported", "artifacts_unavailable", "runtime_image_unavailable", "capacity_insufficient"] as const;
 export type NodeDiagnosticCode = (typeof nodeDiagnosticCodeValues)[number];
 export interface NodeHost {
   available_disk_bytes: number | null;
@@ -506,7 +517,7 @@ export interface NodeRollout {
 }
 export const nodeRolloutFields = ["diagnostic", "ready_generation", "state"] as const;
 export const nodeRolloutRequired = ["ready_generation", "state"] as const;
-export const nodeRolloutStateValues = ["ready", "preparing", "failed", "update_required", "unknown"] as const;
+export const nodeRolloutStateValues = ["ready", "preparing", "failed", "unknown"] as const;
 export type NodeRolloutState = (typeof nodeRolloutStateValues)[number];
 export interface NodeUpdate {
   max_active: number;
@@ -657,9 +668,8 @@ export interface RolloutNodes {
   preparing: number;
   ready: number;
   unknown: number;
-  update_required: number;
 }
-export const rolloutNodesFields = ["failed", "preparing", "ready", "unknown", "update_required"] as const;
+export const rolloutNodesFields = ["failed", "preparing", "ready", "unknown"] as const;
 export const rolloutStateValues = ["settled", "preparing"] as const;
 export type RolloutState = (typeof rolloutStateValues)[number];
 export interface RuntimeCPUObservation {
@@ -796,38 +806,35 @@ export const runtimeObservationReasonValues = ["runtime_mode_not_observable", "a
 export type RuntimeObservationReason = (typeof runtimeObservationReasonValues)[number];
 export const runtimeObservationStatusValues = ["observed", "unsupported", "unavailable"] as const;
 export type RuntimeObservationStatus = (typeof runtimeObservationStatusValues)[number];
-export interface RuntimeRelease {
-  firmware_sha256: string;
-  image_id: string;
-  image_manifest_digest: string;
-  microsandbox_ref: string;
-  runtime_sha256: string;
-  source_commit: string;
-}
-export const runtimeReleaseFields = ["firmware_sha256", "image_id", "image_manifest_digest", "microsandbox_ref", "runtime_sha256", "source_commit"] as const;
 export interface SandboxAllocationList {
   data: NodeAllocation[];
 }
 export const sandboxAllocationListFields = ["data"] as const;
+export interface SandboxComputeProfileInput {
+  configuration?: Record<string, unknown>;
+  resources?: SandboxResources;
+}
+export const sandboxComputeProfileInputFields = ["configuration", "resources"] as const;
+export const sandboxComputeProfileInputRequired = [] as const;
 export interface SandboxDeploymentChangeInput {
+  compute_profiles?: Record<string, SandboxComputeProfileInput>;
   configuration?: Record<string, unknown>;
   credential?: Record<string, unknown>;
   expected_generation: number;
   provider?: string;
   resources?: SandboxResources;
-  runtime?: RuntimeRelease;
 }
-export const sandboxDeploymentChangeInputFields = ["configuration", "credential", "expected_generation", "provider", "resources", "runtime"] as const;
+export const sandboxDeploymentChangeInputFields = ["compute_profiles", "configuration", "credential", "expected_generation", "provider", "resources"] as const;
 export const sandboxDeploymentChangeInputRequired = ["expected_generation"] as const;
 export interface SandboxDeploymentInput {
+  compute_profiles?: Record<string, SandboxComputeProfileInput>;
   configuration?: Record<string, unknown>;
   credential?: Record<string, unknown>;
   expected_generation: number;
   provider?: string;
   resources?: SandboxResources;
-  runtime?: RuntimeRelease;
 }
-export const sandboxDeploymentInputFields = ["configuration", "credential", "expected_generation", "provider", "resources", "runtime"] as const;
+export const sandboxDeploymentInputFields = ["compute_profiles", "configuration", "credential", "expected_generation", "provider", "resources"] as const;
 export const sandboxDeploymentInputRequired = ["expected_generation"] as const;
 export interface SandboxEnrollmentToken {
   enrollment_id: string;
diff --git a/packages/agents-client/src/index.ts b/packages/agents-client/src/index.ts
index c2ca28622..1c75802ac 100644
--- a/packages/agents-client/src/index.ts
+++ b/packages/agents-client/src/index.ts
@@ -1,6 +1,6 @@
 export { coreHarnessKinds, coreHarnessNames, modelProviderProtocols } from "./harness-catalog";
 export { deploymentContract } from "./deployment-contract";
-export { AgentCoreError, CreationStreamRetryError, createIdempotencyKey, isSessionDeletionConflict, OpenAIAgentsClient } from "./client";
+export { AgentCoreError, CreationStreamRetryError, isSessionDeletionConflict, OpenAIAgentsClient, randomUuid } from "./client";
 export type { OpenAIAgentsClientOptions, CoreErrorDetail, CoreErrorDetails } from "./client";
 export { createSSEDecoder } from "./sse";
 export type { SSEDecoder, SSEMessage } from "./sse";
@@ -10,6 +10,7 @@ export * from "./core-metrics";
 export type { CoreClientOptions } from "./core-request";
 export { isEnvironmentTemplateName, isRecognizedEnvironmentTemplate } from "./environment-template-projection";
 export { isOpenAIHostedSessionEnvironment } from "./session-environment-projection";
+export { tokenLimitsFit } from "./execution-configuration-projection";
 export { compareSkillVersionNumbers, isSkillId, isSkillUploadPath, isSkillVersionId, isSkillVersionNumber } from "./skill-projection";
 export { AdminClient } from "./admin-client";
 // Skill, SkillVersion and SessionArtifact come from ./types; the admin projections use the same shapes.
diff --git a/packages/agents-client/src/protocol-types.test.ts b/packages/agents-client/src/protocol-types.test.ts
index 39cc30384..a720a95bd 100644
--- a/packages/agents-client/src/protocol-types.test.ts
+++ b/packages/agents-client/src/protocol-types.test.ts
@@ -12,7 +12,7 @@ import turnResources from "./fixtures/parsar-0438880a/turn-resources.json";
 import toolProfiles from "./fixtures/parsar-2b34ea46/tool-profiles.json";
 import type {
   AnonymousHttpMcpToolInput,
-  ServiceHttpMcpToolInput,
+  McpToolInput,
   AgentsCoreSelection,
   SavedAgentCoreInput,
   SavedAgentCore,
@@ -159,8 +159,8 @@ describe("Parsar 2b34ea46 bounded tool profiles", () => {
   });
 
   it("accepts the minimal pinned MCP tool whose omitted origin Core saves as service", () => {
-    expectTypeOf<ServiceHttpMcpToolInput["connection_origin"]>().toEqualTypeOf<"service" | null | undefined>();
-    const minimal: ServiceHttpMcpToolInput = {
+    expectTypeOf<McpToolInput["connection_origin"]>().toEqualTypeOf<"service" | "environment" | null | undefined>();
+    const minimal: McpToolInput = {
       type: "mcp",
       server_label: "docs",
       transport: { type: "http", server_url: "https://mcp.example/tools" },
diff --git a/packages/agents-client/src/provider-observations.test.ts b/packages/agents-client/src/provider-observations.test.ts
index 15d6d444b..f0adafd2b 100644
--- a/packages/agents-client/src/provider-observations.test.ts
+++ b/packages/agents-client/src/provider-observations.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it } from "vitest";
 import { projectCoreHarnessList, projectHarnessModelConfiguration } from "./admin-projection";
 
-const provider = { object: "core.model_configuration", harness: "codex", model: "test-model", harness_config: { model_reasoning_effort: "high" }, model_provider: { protocol: "responses", base_url: "https://model.example/v1", api_key_configured: true }, updated_at: "2026-09-26T08:00:00Z", last_used_at: null, last_error_code: null, last_error_at: null };
+const provider = { object: "core.model_configuration", harness: "codex", model: "test-model", harness_config: {}, model_provider: { protocol: "responses", base_url: "https://model.example/v1", api_key_configured: true }, updated_at: "2026-09-26T08:00:00Z", last_used_at: null, last_error_code: null, last_error_at: null };
 describe("deployment default observations", () => {
   it("preserves null and safe observations", () => {
     expect(projectHarnessModelConfiguration(provider)).toEqual(provider);
@@ -16,11 +16,11 @@ describe("deployment default observations", () => {
 });
 
 describe("adapter model configuration support", () => {
-  const support = { protocols: ["responses"], accepts_harness_config: true, token_limits_required: false };
+  const support = { protocols: ["responses"], accepts_harness_config: true, accepts_max_output_tokens: false };
   const harness = { object: "core.harness", id: "codex", enabled: false, default: false, model_configuration: null, model_configuration_support: support };
   it("preserves build declarations and native default order without inferring readiness", () => {
     const claude = { ...harness, id: "claude_sdk", model_configuration_support: { ...support, protocols: ["anthropic"] } };
-    const minimax = { ...harness, id: "mcode", model_configuration_support: { protocols: ["anthropic", "responses", "chat_completions"], accepts_harness_config: false, token_limits_required: true } };
+    const minimax = { ...harness, id: "mcode", model_configuration_support: { protocols: ["anthropic", "responses", "chat_completions"], accepts_harness_config: false, accepts_max_output_tokens: true } };
     const value = { object: "list", data: [harness, claude, minimax] };
     expect(projectCoreHarnessList(value)).toEqual(value);
     const projected = projectCoreHarnessList(value).data[2]!.model_configuration_support.protocols;
@@ -32,8 +32,7 @@ describe("adapter model configuration support", () => {
       { ...support, protocols: "responses" }, { ...support, protocols: [] }, { ...support, protocols: ["unknown"] },
       { ...support, protocols: [null] }, { ...support, protocols: ["responses", "responses"] },
       { ...support, native_protocols: ["responses"] }, { ...support, accepts_harness_config: "true" },
-      { ...support, accepts_harness_config: undefined }, { ...support, token_limits_required: undefined },
-      { ...support, token_limits_required: null }, { ...support, ready: true }]) {
+      { ...support, accepts_harness_config: undefined }, { ...support, ready: true }]) {
       expect(() => projectCoreHarnessList({ object: "list", data: [{ ...harness, model_configuration_support: value }] })).toThrow();
     }
   });
diff --git a/packages/agents-client/src/sandbox-client.test.ts b/packages/agents-client/src/sandbox-client.test.ts
index 8d53d2cfd..731667484 100644
--- a/packages/agents-client/src/sandbox-client.test.ts
+++ b/packages/agents-client/src/sandbox-client.test.ts
@@ -9,18 +9,19 @@ function response(value: unknown, status = 200) { return new Response(JSON.strin
 
 // Shapes as Core serializes them (deployment.Node, deployment.NodeDetail, deployment.NodeAllocation, deployment.View).
 const created = "2026-09-25T08:00:00.123456789Z";
-/** A ready node: Core omits `diagnostic`. */
+/** A ready node. */
 const node = {
   rollout: { state: "ready", ready_generation: 1 },
   id: "3b0c1f4e-8a2d-4c6b-9e7f-1a2b3c4d5e6f", name: "core-01", provider: "docker", online: true, provider_ready: true,
   cpu_count: 16, available_memory_bytes: 8589934592, available_disk_bytes: 107374182400, running: 1, snapshots: 0,
   last_seen_at: "2026-09-25T09:00:00Z", max_active: 2, max_retained: 2, active: 1, reserved: 0, retained: 1, cleanup_pending: 0,
   created_at: created, core_url: "https://core.example", enrollment_id: "9d2e6b1a-4c3f-4e8d-a7b6-5c4d3e2f1a0b",
+  recommended_capacity: { max_active: 8, max_retained: 8 },
 };
-/** Never heard from, enrolled before Core recorded enrollment IDs, with a fixed readiness code. */
+/** Never heard from and enrolled before Core recorded enrollment IDs. */
 const unready = {
-  ...node, rollout: { state: "unknown", ready_generation: 1 }, id: "7f6e5d4c-3b2a-4190-8f7e-6d5c4b3a2918", online: false, provider_ready: false, diagnostic: "host_unsupported",
-  cpu_count: null, available_memory_bytes: null, available_disk_bytes: null, running: 0, last_seen_at: null, active: 0, retained: 0, enrollment_id: null,
+  ...node, rollout: { state: "unknown", ready_generation: 1 }, id: "7f6e5d4c-3b2a-4190-8f7e-6d5c4b3a2918", online: false, provider_ready: false,
+  cpu_count: null, available_memory_bytes: null, available_disk_bytes: null, running: 0, last_seen_at: null, active: 0, retained: 0, enrollment_id: null, recommended_capacity: null,
 };
 const detail = {
   ...node,
@@ -41,21 +42,19 @@ const allocation = {
   session_id: "2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f", environment_id: "3d4e5f6a-7b8c-4d9e-8f1a-2b3c4d5e6f7a",
   state: "running", compute_phase: "running", compute_phase_changed_at: null, diagnostic: "", initialization: "ready", created_at: created,
 };
-const runtime = { source_commit: "a".repeat(40), image_id: "sha256:" + "b".repeat(64), image_manifest_digest: "sha256:" + "c".repeat(64), microsandbox_ref: "oac-runtime@sha256:" + "d".repeat(64), runtime_sha256: "e".repeat(64), firmware_sha256: "f".repeat(64) };
 const unconfigured = {
   credential_configured: false, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: null }, installation_id: "", provider: "", core_url: "https://core.example", reset: null, owner_epoch: 0, generation: 0, mode: "", resources: { allocations: 0, pending: 0 }, suspension: null };
 const docker = {
   configuration: {}, metadata: {},
-  ...unconfigured, installation_id: "94be54a1-138c-4f30-bc87-b13686272dbe", provider: "docker", rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 0 } }, owner_epoch: 1, generation: 1, mode: "nodes",
-  resources: { allocations: 2, pending: 1 }, specification: { resources: { cpus: 2, memory_mib: 2048 }, runtime }, specification_digest: "0".repeat(64),
+  ...unconfigured, installation_id: "94be54a1-138c-4f30-bc87-b13686272dbe", provider: "docker", rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, unknown: 0 } }, owner_epoch: 1, generation: 1, mode: "nodes",
+  resources: { allocations: 2, pending: 1 }, specification: { resources: { cpus: 2, memory_mib: 2048 } }, specification_digest: "0".repeat(64),
 };
 const microsandbox = {
-  ...docker, provider: "microsandbox", specification: { resources: { cpus: 2, memory_mib: 2048, root_disk_mib: 8192, environment_disk_mib: 8192 }, runtime },
+  ...docker, provider: "microsandbox", specification: { resources: { cpus: 2, memory_mib: 2048, root_disk_mib: 8192 } },
   suspension: { idle_seconds: 300, retention_seconds: 86400 },
 };
 const externalWorkspace = { ...deploymentContract.providers.microsandbox.workspace, capacity_quota: false };
-const externalDeployment = { ...microsandbox, specification: { ...microsandbox.specification,
-  resources: { ...microsandbox.specification.resources, environment_disk_mib: 0 }, workspace: externalWorkspace } };
+const externalDeployment = { ...microsandbox, specification: { ...microsandbox.specification, workspace: externalWorkspace } };
 /** An E2B selection saved before Core recorded its template build. */
 const e2bDeployment = {
   ...docker, provider: "e2b", rollout: unconfigured.rollout, mode: "direct", specification: { resources: { cpus: 2, memory_mib: 2048 } },
@@ -93,7 +92,7 @@ describe("strict sandbox administration projections", () => {
   it.each([
     ["nodes", "an unknown member", { data: [{ ...node, credential: "node-secret" }] }],
     ["nodes", "a missing enrollment_id", { data: [unenrolled] }],
-    ["nodes", "an empty diagnostic", { data: [{ ...node, diagnostic: "" }] }],
+    ["nodes", "a node diagnostic", { data: [{ ...node, diagnostic: "host_unsupported" }] }],
     ["nodes", "a string count", { data: [{ ...node, cpu_count: "16" }] }],
     ["nodes", "a numeric timestamp", { data: [{ ...node, last_seen_at: 0 }] }],
     ["nodes", "a null list", { data: null }],
@@ -161,12 +160,6 @@ describe("Core sandbox credential boundaries", () => {
     expect(new Headers(fetch.mock.calls[0]?.[1]?.headers).has("Authorization")).toBe(false);
     expect(fetch.mock.calls[0]?.[1]?.signal).toBe(controller.signal);
   });
-  it("returns the node's fixed readiness diagnostic unchanged and reads an unknown code as provider_unavailable", async () => {
-    const fetch = vi.fn<typeof globalThis.fetch>().mockResolvedValue(response({ data: [unready, { ...unready, diagnostic: "future_code" }, node] }));
-    const { data } = await new SandboxAdminClient({ baseUrl: "/core/v1/sandbox", fetch }).listNodes();
-    expect(data.map((entry) => entry.diagnostic)).toEqual(["host_unsupported", "provider_unavailable", undefined]);
-    expectTypeOf<SandboxNode["diagnostic"]>().toEqualTypeOf<undefined | "provider_unavailable" | "host_unsupported" | "artifacts_unavailable" | "runtime_download_failed" | "runtime_image_unavailable" | "capacity_insufficient">();
-  });
   it("requires each node's enrollment ID: a string, or null for nodes enrolled before Core recorded it", async () => {
     const fetch = vi.fn<typeof globalThis.fetch>().mockResolvedValue(response({ data: [node, unready] }));
     const { data } = await new SandboxAdminClient({ fetch }).listNodes();
@@ -214,7 +207,7 @@ describe("Core sandbox credential boundaries", () => {
   it("forwards one specification with generation and preserves backend conflict details", async () => {
     const fetch = vi.fn<typeof globalThis.fetch>().mockResolvedValue(response({ error: { code: "sandbox_specification_mismatch", message: "Node specification differs" } }, 409));
     const admin = new SandboxAdminClient({ token: "admin-only", fetch });
-    const input = { provider: "docker" as const, resources: { cpus: 2, memory_mib: 2048 }, runtime: { source_commit: "a".repeat(40), image_id: "sha256:" + "b".repeat(64), image_manifest_digest: "sha256:" + "c".repeat(64), microsandbox_ref: "oac-runtime@sha256:" + "d".repeat(64), runtime_sha256: "e".repeat(64), firmware_sha256: "f".repeat(64) }, expected_generation: 3 };
+    const input = { provider: "docker" as const, resources: { cpus: 2, memory_mib: 2048 }, expected_generation: 3 };
     await expect(admin.updateDeployment(input)).rejects.toMatchObject({ status: 409, code: "sandbox_specification_mismatch" });
     expect(fetch).toHaveBeenCalledTimes(1);
     expect(JSON.parse(String(fetch.mock.calls[0]?.[1]?.body))).toEqual(input);
@@ -301,7 +294,7 @@ describe("hosted provider configuration", () => {
     expect((shown as AgentCoreError).errorType).toBeUndefined();
     await expect(client.initializeDeployment({ expected_generation: 0, provider: "e2b", configuration: { template: e2b.template }, credential: { api_key: e2b.api_key } })).rejects.toMatchObject({ status: 409, code: "sandbox_configuration_error", message: rejection.message, param: null });
   });
-  it("keeps legacy E2B ownership reset actionable without reflecting either key", async () => {
+  it("keeps E2B ownership reset actionable without reflecting either key", async () => {
     const fetch = vi.fn<typeof globalThis.fetch>().mockResolvedValue(response({ error: {
       code: "sandbox_reset_required", message: "revoked-old-key " + e2b.api_key,
       param: "revoked-old-key", details: { current_provider: "e2b", requested_provider: "e2b", secret: e2b.api_key },
@@ -410,14 +403,14 @@ it("keeps omitted-key public-URL errors actionable without reflecting a stored k
   expect(fetch).toHaveBeenCalledTimes(1);
 });
 
-it.each(["unknown", "preparing", "failed", "update_required"])("does not erase old serving readiness for target %s", async (state) => {
-  const value = { ...node, rollout: { state, ready_generation: 1, ...(state === "failed" ? { diagnostic: "runtime_download_failed" } : {}) } };
+it.each(["unknown", "preparing", "failed"])("does not erase old serving readiness for target %s", async (state) => {
+  const value = { ...node, rollout: { state, ready_generation: 1, ...(state === "failed" ? { diagnostic: "capacity_insufficient" } : {}) } };
   const client = new SandboxAdminClient({ fetch: async () => response({ data: [value] }) });
   expect((await client.listNodes()).data[0]).toEqual(value);
 });
 
- it("preserves artifact transfer diagnostics on node and target without exposing transport details", async () => {
- const value = { ...unready, online: true, diagnostic: "runtime_download_failed", rollout: { state: "failed", ready_generation: 1, diagnostic: "runtime_download_failed" } };
+ it("preserves the target diagnostic without exposing transport details", async () => {
+ const value = { ...unready, online: true, rollout: { state: "failed", ready_generation: 1, diagnostic: "capacity_insufficient" } };
  const client = new SandboxAdminClient({ fetch: async () => response({ data: [value] }) });
  expect((await client.listNodes()).data[0]).toEqual(value);
  });
@@ -427,11 +420,10 @@ describe("shared node diagnostic contract", () => {
     expect([...sandboxNodeDiagnostics].sort()).toEqual([...nodeDiagnosticFixture].sort());
     expect(normalizeSandboxNodeDiagnostic("future_code")).toBe("provider_unavailable");
   });
-  it.each(nodeDiagnosticFixture)("preserves %s through node and rollout projections", async (diagnostic) => {
-    const value = { ...node, provider_ready: false, diagnostic, rollout: { state: "failed", ready_generation: 1, diagnostic } };
+  it.each(nodeDiagnosticFixture)("preserves %s through the rollout projection", async (diagnostic) => {
+    const value = { ...node, provider_ready: false, rollout: { state: "failed", ready_generation: 1, diagnostic } };
     const client = new SandboxAdminClient({ baseUrl: "https://core.example", token: "test", fetch: async () => response({ data: [value] }) });
     const result = await client.listNodes();
-    expect(result.data[0]?.diagnostic).toBe(diagnostic);
     expect(result.data[0]?.rollout.diagnostic).toBe(diagnostic);
   });
 });
diff --git a/packages/agents-client/src/sandbox-client.ts b/packages/agents-client/src/sandbox-client.ts
index 9b8a9bca3..d5030a1e8 100644
--- a/packages/agents-client/src/sandbox-client.ts
+++ b/packages/agents-client/src/sandbox-client.ts
@@ -5,12 +5,12 @@ import { hasOwn, isNonnegativeInteger, isOneOf, isRecord, onlyFields, sameResour
 import {
   attachmentKindValues,
   deploymentResourcesFields, deploymentSpecFields, deploymentSpecRequired, deploymentViewFields, deploymentModeValues, deploymentViewRequired,
-  hostHistoryFields, hostHistoryPointFields, nodeAllocationDiagnosticValues, nodeAllocationFields, nodeDetailFields, nodeDetailRequired,
-  nodeDiagnosticCodeValues, nodeFields, nodeHostFields, nodeRequired, nodeRolloutFields, nodeRolloutRequired, nodeRolloutStateValues, resetModeValues,
-  resetFields, resetOfflineNodeFields, resetRemainingFields, rolloutFields, rolloutNodesFields, rolloutStateValues, runtimeReleaseFields,
+  hostHistoryFields, hostHistoryPointFields, nodeAllocationDiagnosticValues, nodeAllocationFields, nodeDetailFields,
+  capacityFields, nodeDiagnosticCodeValues, nodeFields, nodeHostFields, nodeRolloutFields, nodeRolloutRequired, nodeRolloutStateValues, resetModeValues,
+  resetFields, resetOfflineNodeFields, resetRemainingFields, rolloutFields, rolloutNodesFields, rolloutStateValues,
   sandboxAllocationListFields, sandboxNodeListFields, sandboxResourcesFields, sandboxResourcesRequired, suspensionFields,
   type DeploymentSpec, type DeploymentView, type HostHistoryPoint, type Node, type NodeAllocation, type NodeDetail, type NodeDiagnosticCode,
-  type NodeHost, type NodeRollout, type NodeUpdate, type Reset, type ResetOfflineNode, type ResetRequest, type Rollout, type RuntimeRelease,
+  type NodeHost, type NodeRollout, type NodeUpdate, type Reset, type ResetOfflineNode, type ResetRequest, type Rollout,
   type SandboxIdlePolicyInput, type SandboxDeploymentInput, type SandboxEnrollmentToken, type SandboxResources as SandboxResourcesResource,
 } from "./generated/core-api";
 import type { ReadOptions } from "./types";
@@ -29,19 +29,18 @@ export function normalizeSandboxNodeDiagnostic(value: string): SandboxNodeDiagno
 export type SandboxProvider = keyof typeof deploymentContract.providers;
 /** Client-generated, never a Core code: a deployment write whose rejection could echo the key and is withheld. */
 export const sandboxConfigurationUnconfirmed = "sandbox_configuration_unconfirmed";
-const sandboxConfigurationParams = new Set<unknown>(["runtime", ...deploymentContract.resources.map(({ name }) => `resources.${name}`)]);
+const sandboxConfigurationParams = new Set<unknown>([...deploymentContract.resources.map(({ name }) => `resources.${name}`)]);
 
 // Generated types keep their schema names in ./generated/core-api; these are the client's names for them.
 /** CPU and MiB limits for each sandbox, not node concurrency. */
 export type SandboxResources = SandboxResourcesResource;
-export type SandboxRuntimeRelease = RuntimeRelease;
 export type SandboxSpecification = DeploymentSpec;
 export type SandboxRollout = Rollout;
 /** `state` is target preparation, which never invalidates a qualified older serving pin; `ready_generation` is that durable pin and alone does not imply connection readiness. */
 export type SandboxNodeRollout = NodeRollout;
 export type StartSandboxReset = ResetRequest;
 export type SandboxReset = Reset;
-/** `provider_ready` is the last provider report, so combine it with `online`; `diagnostic` is absent while the provider is ready. A `core_url` other than the installation public URL means the node receives no new sandboxes and must be re-added. */
+/** `provider_ready` is true while the node is online and its serving generation is ready. A `core_url` other than the installation public URL means the node receives no new sandboxes and must be re-added. */
 export type SandboxNode = Node;
 /** A one-time node enrollment command; `enrollment_id` is its public handle, never a credential. */
 export type SandboxEnrollment = SandboxEnrollmentToken;
@@ -54,7 +53,7 @@ export type SandboxAllocation = NodeAllocation;
 // The schema types each Provider's configuration, credential and metadata as free-form objects; the client names E2B's.
 /**
  * Core derives the deployment's address from the installation public URL; a `core_url` member is rejected.
- * `expected_generation` is required, zero for first setup. Docker and microsandbox require `resources` and `runtime`;
+ * `expected_generation` is required, zero for first setup. Docker and microsandbox require `resources`;
  * E2B may omit `resources` to adopt its template build's CPU and memory, and always runs that build.
  */
 export type InitializeSandboxDeployment = Omit<SandboxDeploymentInput, "provider" | "configuration" | "credential"> & {
@@ -107,11 +106,6 @@ function projectSpecification(value: unknown): SandboxSpecification {
     if (!isOneOf(attachmentKindValues, workspace.attachment) || typeof workspace.user_xattr !== "boolean" || typeof workspace.capacity_quota !== "boolean") return invalidSandboxResponse();
     result.workspace = { attachment: workspace.attachment, user_xattr: workspace.user_xattr, capacity_quota: workspace.capacity_quota };
   }
-  if (hasOwn(specification, "runtime")) {
-    const runtime = members(specification.runtime, runtimeReleaseFields);
-    valid(strings(runtime, runtimeReleaseFields));
-    result.runtime = { ...runtime } as unknown as SandboxRuntimeRelease;
-  }
   return result;
 }
 /** The adapter's public projection has no credential member. */
@@ -181,26 +175,24 @@ function projectDeployment(value: unknown): SandboxDeployment {
   } as unknown as SandboxDeployment;
 }
 
-/** Core omits an empty `diagnostic`, so a present one is a code; an unknown code reads as provider_unavailable. */
 function projectNode(node: Record<string, unknown>): SandboxNode {
-  const { diagnostic, rollout, ...rest } = node;
+  const { rollout, ...rest } = node;
   const fields = { ...rest, rollout: projectNodeRollout(rollout, node.online) };
   valid(strings(node, ["id", "name", "provider", "core_url"]) && typeof node.online === "boolean" && typeof node.provider_ready === "boolean" &&
     [node.cpu_count, node.available_memory_bytes, node.available_disk_bytes].every(nullable(isNonnegativeInteger)) &&
     [node.running, node.snapshots, node.max_active, node.max_retained, node.active, node.reserved, node.retained, node.cleanup_pending].every(isNonnegativeInteger) &&
-    nullable(timestamp)(node.last_seen_at) && timestamp(node.created_at) && (node.enrollment_id === null || typeof node.enrollment_id === "string") &&
-    (diagnostic === undefined || (typeof diagnostic === "string" && diagnostic !== "")));
-  if (diagnostic === undefined) return { ...fields } as unknown as SandboxNode;
-  return { ...fields, diagnostic: normalizeSandboxNodeDiagnostic(diagnostic as string) } as unknown as SandboxNode;
+    nullable((capacity) => { const c = members(capacity, capacityFields); return [c.max_active, c.max_retained].every(isNonnegativeInteger); })(node.recommended_capacity) &&
+    nullable(timestamp)(node.last_seen_at) && timestamp(node.created_at) && (node.enrollment_id === null || typeof node.enrollment_id === "string"));
+  return fields as unknown as SandboxNode;
 }
 function projectNodeList(value: unknown): { data: SandboxNode[] } {
   const list = members(value, sandboxNodeListFields);
   valid(Array.isArray(list.data));
-  return { data: (list.data as unknown[]).map((entry) => projectNode(members(entry, nodeFields, nodeRequired))) };
+  return { data: (list.data as unknown[]).map((entry) => projectNode(members(entry, nodeFields))) };
 }
 /** A never-observed host is all null; the history lists every bucket of the range. */
 function projectNodeDetail(value: unknown, nodeId: string): SandboxNodeDetail {
-  const { host, history, ...fields } = members(value, nodeDetailFields, nodeDetailRequired);
+  const { host, history, ...fields } = members(value, nodeDetailFields);
   const node = projectNode(fields);
   const observed = members(host, nodeHostFields);
   const buckets = members(history, hostHistoryFields);
diff --git a/packages/agents-client/src/saved-agent-defaults.test.ts b/packages/agents-client/src/saved-agent-defaults.test.ts
index 573b822ef..6f8c2cbdc 100644
--- a/packages/agents-client/src/saved-agent-defaults.test.ts
+++ b/packages/agents-client/src/saved-agent-defaults.test.ts
@@ -8,7 +8,7 @@ describe("saved Agent execution defaults", () => {
     const calls: unknown[] = [];
     const safe: SavedAgentCore = {
       harness: "codex",
-      harness_config: { model_reasoning_effort: "high" },
+      harness_config: {},
       model_provider: {
         protocol, base_url: "https://model.example/v1", api_key_configured: true,
       },
@@ -25,7 +25,7 @@ describe("saved Agent execution defaults", () => {
     const provider: ModelProviderInput = {
       protocol, base_url: "https://model.example/v1", api_key: "write-only-fixture",
     };
-    const agent = await client.createAgent({ model: "example-model", x_agents_core: { harness: "codex", harness_config: { model_reasoning_effort: "high" }, model_provider: provider } });
+    const agent = await client.createAgent({ model: "example-model", x_agents_core: { harness: "codex", harness_config: {}, model_provider: provider } });
     expect(agent.x_agents_core).toEqual(safe);
     expect(JSON.stringify(agent)).not.toContain("write-only-fixture");
     await client.updateAgent(agent.id, { model: "new-model" });
@@ -35,7 +35,7 @@ describe("saved Agent execution defaults", () => {
     await client.updateAgent(agent.id, { x_agents_core: { harness_config: {} } });
     await client.updateAgent(agent.id, { x_agents_core: null });
     expect(calls).toEqual([
-      { model: "example-model", x_agents_core: { harness: "codex", harness_config: { model_reasoning_effort: "high" }, model_provider: provider } },
+      { model: "example-model", x_agents_core: { harness: "codex", harness_config: {}, model_provider: provider } },
       { model: "new-model" },
       { x_agents_core: { harness: "codex" } },
       { x_agents_core: { model_provider: provider } },
@@ -76,7 +76,7 @@ describe("native model configuration projections", () => {
       id: "test-agent", model: "test-model", name: null, instructions: null, multi_agent: { enabled: false, max_concurrent_subagents: null },
       reasoning: { effort: null, summary: null }, service_tier: "auto", text: { format: { type: "text" }, verbosity: "medium" }, tools: [],
     };
-    for (const harness_config of [{}, { effort: "high", thinking: { type: "adaptive" } }]) {
+    for (const harness_config of [{}, { thinking: { type: "adaptive" } }]) {
       const value = { ...agent, x_agents_core: { harness_config } };
       expect(projectAgentSnapshot(value).x_agents_core).toEqual({ harness_config });
       expect(projectSavedAgentConfiguration(value).x_agents_core).toEqual({ harness_config });
diff --git a/packages/agents-client/src/types.ts b/packages/agents-client/src/types.ts
index 7a2c37b41..93f06d8e0 100644
--- a/packages/agents-client/src/types.ts
+++ b/packages/agents-client/src/types.ts
@@ -7,7 +7,7 @@ import type {
   EnvironmentParamSelfHosted, EnvironmentResourceSelfHosted, EnvironmentStatusResource, FunctionCallStatusResource,
   HostedEnvironmentFileParam, InputContentParam, InputContentParamInputText, InputMessageParam, ListOrderParam,
   McpOauthRefreshResource, MultiAgentConfigCurrentParam, MultiAgentConfigResource, NetworkAccessResource,
-  NetworkPolicyResource, PersistedAgentToolConfigParamFunction, PersistedAgentToolConfigParamProgrammaticToolCalling,
+  NetworkPolicyResource, PersistedAgentToolConfigParamFunction, PersistedAgentToolConfigParamMcp, PersistedAgentToolConfigParamProgrammaticToolCalling,
   PersistedAgentToolConfigParamToolSearch, PersistedAgentToolConfigParamWebSearch, ReasoningEffortResource,
   ReasoningParam, ReasoningResource, ReasoningSummaryResource, RotateVaultCredentialAuthParamStaticBearer,
   RotateVaultCredentialParams, ServiceTierResource, SessionEnvironmentStateResource, SessionEnvironmentStatusResource,
@@ -58,25 +58,14 @@ export type MultiAgentInput = MultiAgentConfigCurrentParam;
 
 export type FunctionToolInput = PersistedAgentToolConfigParamFunction;
 
-/** The service-origin HTTP MCP profile accepted by current Core. */
-export interface ServiceHttpMcpToolInput {
-  type: "mcp";
-  server_label: string;
-  transport: {
-    type: "http";
-    server_url: string;
-  };
-  /** null or omitted permits every advertised tool; [] permits none. */
-  allowed_tools?: string[] | null;
-  /** null or omitted is saved as "service", as the official service does. */
-  connection_origin?: "service" | null;
-  /** Saving a reference does not authorize it; Session vault_ids must attach its owner. */
-  credential_id?: string | null;
-  required?: boolean;
-}
+/**
+ * The persisted MCP profile, without inline secrets. Omitted `connection_origin` is saved
+ * as "service"; a `credential_id` reference is authorized only by a Session vault that owns it.
+ */
+export type McpToolInput = PersistedAgentToolConfigParamMcp;
 
 /** Anonymous is an explicit subset that cannot name a stored Credential. */
-export type AnonymousHttpMcpToolInput = Omit<ServiceHttpMcpToolInput, "credential_id"> & {
+export type AnonymousHttpMcpToolInput = Omit<McpToolInput, "credential_id"> & {
   credential_id?: null;
 };
 
@@ -96,13 +85,13 @@ export type WebSearchToolInput = PersistedAgentToolConfigParamWebSearch;
 // The tool profiles Core saves, narrowed from the schema's tool params.
 export type SavedAgentToolInput =
   | FunctionToolInput
-  | ServiceHttpMcpToolInput
+  | McpToolInput
   | ToolSearchInput
   | ProgrammaticToolCallingInput
   | WebSearchToolInput;
 // Session function tools load eagerly.
 export type SessionFunctionToolInput = Omit<FunctionToolInput, "defer_loading"> & { defer_loading?: false };
-export type ConfigurableAgentToolInput = SessionFunctionToolInput | ServiceHttpMcpToolInput;
+export type ConfigurableAgentToolInput = SessionFunctionToolInput | McpToolInput;
 
 export type VaultStatus = VaultStatusParam;
 
diff --git a/packages/claude-sdk-adapter/README.md b/packages/claude-sdk-adapter/README.md
index ad803ff49..ce6fa2535 100644
--- a/packages/claude-sdk-adapter/README.md
+++ b/packages/claude-sdk-adapter/README.md
@@ -2,7 +2,7 @@
 
 This package translates the pinned native Claude Agent SDK into OpenAgentCore's common Executor and Turn lifecycle. It owns the private TypeScript bridge and the native SDK configuration. The [Go adapter](../../apps/daemon/internal/agent/claudesdk) owns the bridge subprocess and translates bridge frames into the shared Runtime protocol.
 
-[Harness onboarding](../../contracts/agents-api/harness-onboarding.md) defines the shared interfaces, registration and acceptance. Public qualification belongs to [Harness capabilities](../../contracts/agents-api/harness-capabilities.md) and its linked operation contracts; local readiness cannot expand it.
+[Harness protocol](../../contracts/agents-api/harness-onboarding.md) defines the shared interfaces, registration and acceptance. Public qualification belongs to [Harness capabilities](../../contracts/agents-api/harness-capabilities.md) and its linked operation contracts; local readiness cannot expand it.
 
 ## Develop and verify
 
@@ -22,17 +22,17 @@ The package test compiles TypeScript before running its tests. The Make target a
 
 `packages/claude-sdk-adapter` privately owns the pinned official TypeScript SDK and native message translation. The Go `claudesdk.NewExecutorFactory` uses the shared owned process runner and emits the daemon's delta, error and Done frames. The SDK owns the model loop. Its narrow stdio protocol carries Executor preparation and identified Turn starts, text deltas, function calls/results/receipts, active input/receipts, usage snapshots and terminal result/error plus settlement; native translation stays inside the adapter. The private `native_model_options` input contains only the native options compiled by Go after shared Harness validation. The bridge checks object/field structure and maps those fields explicitly to SDK options; enum membership, budget ranges and thinking combinations belong solely to the Go adapter declaration. The public `harness_config` object does not cross this private boundary.
 
-With `observe_messages`, it also emits the neutral `output_message` start/completion snapshots and tags deltas with the native Messages API message ID, not the SDK event UUID. Text blocks in one native message share that identity. The SDK's per-block assistant snapshots replace draft block text; only native `message_stop` completes the message, without replaying its text as another delta. Thinking/tool-only messages produce no text Items; interrupted messages retain their streamed partial text. No phase is inferred from the final result. Turn-owned native work and output draining precede reuse. Executor close releases the SDK Query and native process. The private `turn_settled` frame requires `confirmed` independently of `reusable`: confirmed native Turn/cancellation settlement, confirmed resource cleanup, and reuse eligibility are separate facts. Unknown or nonempty interrupt receipts and unsettled input/function/tool work remain unconfirmed even after successful teardown. Go rejects cancellation and AwaitSettlement when native confirmation is missing or false, or its own receipt ledger remains unsettled. A confirmed Turn may be non-reusable after cleanup; that state alone does not turn a verified cancellation into an error. Confirmed native cancellation may settle unanswered function calls after result admission closes and callbacks drain. A submitted function result still requires its native application receipt, including when the MCP request aborts.
+It also emits the neutral `output_message` start/completion snapshots and tags deltas with the native Messages API message ID, not the SDK event UUID. Text blocks in one native message share that identity. The SDK's per-block assistant snapshots replace draft block text; only native `message_stop` completes the message, without replaying its text as another delta. Thinking/tool-only messages produce no text Items; interrupted messages retain their streamed partial text. No phase is inferred from the final result. Turn-owned native work and output draining precede reuse. Executor close releases the SDK Query and native process. The private `turn_settled` frame requires `confirmed` independently of `reusable`: confirmed native Turn/cancellation settlement, confirmed resource cleanup, and reuse eligibility are separate facts. Unknown or nonempty interrupt receipts and unsettled input/function/tool work remain unconfirmed even after successful teardown. Go rejects cancellation and AwaitSettlement when native confirmation is missing or false, or its own receipt ledger remains unsettled. A confirmed Turn may be non-reusable after cleanup; that state alone does not turn a verified cancellation into an error. Confirmed native cancellation may settle unanswered function calls after result admission closes and callbacks drain. A submitted function result still requires its native application receipt, including when the MCP request aborts.
 
 ### Workspace execution
 
-`claudesdk.Config.Workspace` is an operator binding for the selected workspace and native state. It enables native Bash/Read/Edit and admitted host functions in the SDK loop. Native tools run with the launching user's permissions on all platforms; the adapter adds no inner sandbox, protected-root deny policy or managed shell wrapper. Isolation belongs to the outer Environment ([Runtime and outer isolation](../../docs/concepts.md#runtime-and-outer-isolation)), which must exclude other tenants' and broader application credentials; an ordinary native install provides no such boundary, and directory selection is not tenant authorization. The adapter's tool callback authorizes unattended execution in native `default` permission mode. It does not use the CLI permission-bypass flag, which Claude rejects for root accounts.
+`claudesdk.Config.Workspace` is an operator binding for the selected workspace and native state. It runs the native `claude_code` tool preset and system prompt, with the request's instructions appended, plus admitted host functions in the SDK loop. Ask-user, scheduling, workflow and background tools are removed because no one answers or waits, `ListAgents` is removed because it reaches other Sessions' native processes on the host, and `WebSearch` and `WebFetch` are removed when the web search control is `disabled`. The native setting sources and MCP discovery apply unchanged, so a workspace's project settings and hooks run with the Session's provider key ([model execution](../../contracts/agents-api/model-execution.md#session-override)), and native telemetry stays on; the adapter keeps private `CLAUDE_CONFIG_DIR`, `HOME` and `TMPDIR`. On every placement `DISABLE_AUTOUPDATER` and `CLAUDE_CODE_DISABLE_BACKGROUND_TASKS` are flag settings, which outrank user and project settings, and the bridge runs with Node's `--use-env-proxy`, which native tools do not inherit, so that its own fetch honours the operator's proxy. Native tools run with the launching user's permissions on all platforms; the adapter adds no inner sandbox, protected-root deny policy or managed shell wrapper. Isolation belongs to the outer Environment ([Runtime and outer isolation](../../docs/concepts.md#runtime-and-outer-isolation)), which must exclude other tenants' and broader application credentials; an ordinary native install provides no such boundary, and directory selection is not tenant authorization. The adapter's tool callback approves every tool for unattended execution. It does not use the CLI permission-bypass flag, which Claude rejects for root accounts. Environment Skills install as symlinks under `<state>/skills`, as a local `~/.claude/skills` does, so native lists their bare names and runs inline shell under that callback.
 
-`Config.Env` selects readiness and native process variables. Explicit tool env is applied to tool execution, but same-user tools can still read credentials or history from local files. Workspace hooks keep their event, identity and lifecycle responsibilities; they are not security enforcement. Process groups and Windows Jobs provide cancellation and descendant cleanup, not isolation. Supported MCP and subagent combinations require their own qualification. The `none` profile keeps its tool inventory. Packaged `workspace_tools` establishes bridge support, not outer host isolation or public API admission. The dedicated Runtime composes public preparation, placement quotas, command Items and Files ownership. Real-provider acceptance verifies effects, cancellation and same-history continuation for the actual platform and outer deployment.
+`Config.Env` selects readiness and native process variables. Explicit tool env is applied to tool execution, but same-user tools can still read credentials or history from local files. Workspace hooks keep their event, identity and lifecycle responsibilities; they are not security enforcement. Process groups and Windows Jobs provide cancellation and descendant cleanup, not isolation. Supported MCP and subagent combinations require their own qualification. The `none` profile keeps its tool inventory. The bridge emits neutral `search_observation` events for root `WebSearch` (action `search`) and `WebFetch` (action `open_page`) calls. Packaged `workspace_tools` establishes bridge support, not outer host isolation or public API admission. The dedicated Runtime composes public preparation, placement quotas, command Items and Files ownership. Real-provider acceptance verifies effects, cancellation and same-history continuation for the actual platform and outer deployment.
 
 ### Executor preparation and Turns
 
-The private bridge accepts `executor_prepare` without model input. It freezes validated configuration and resume identity, checks required history, and retains one native process and SDK Query across Turns. Preparation requires initialization and acknowledgement of required hooks while the input iterator remains empty. An `executor_ready` receipt permits later `turn_start` messages containing only Turn identity and ordered input; configuration replacement and concurrent starts are rejected. Every Turn event carries its originating `turn_id`. Native Session identity and actual tool inventory are checked before `input_ready`.
+The private bridge accepts `executor_prepare` without model input. It freezes validated configuration and resume identity, checks required history, and retains one native process and SDK Query across Turns. Preparation requires initialization and acknowledgement of required hooks while the input iterator remains empty. An `executor_ready` receipt permits later `turn_start` messages containing only Turn identity and ordered input; configuration replacement and concurrent starts are rejected. Every Turn event carries its originating `turn_id`. Native Session identity and the tool inventory the profile requires are checked before `input_ready`.
 
 Each Turn ends with a result/error and `turn_settled`, independently of process exit. The outer input iterator remains open for later Turns. `turn_cancel` invokes the native interrupt control for that exact Turn. Unconfirmed input, native child work or queue state invalidates the Executor and requires close before replacement. EOF, owner signals and invalid control input close owned resources. Preparation may write native metadata and perform startup traffic; readiness does not prove provider authentication, complete sandbox health or placement authorization.
 
@@ -42,7 +42,7 @@ Each Turn ends with a result/error and `turn_settled`, independently of process
 
 The optional private `agent.WorkspaceReader` on this Executor and its delegated wrappers requires the packaged `workspace_read` feature. It sends bounded relative paths to that same SDK Query's native `readFile` control. Only the adapter combines the path with the frozen workspace root; callers cannot replace the placement. The pinned native read handler awaits file-handle close before its successful base64 response. The adapter validates bytes and truncation, bounds each result to 1 MiB and each request to 8 KiB, and admits one read at a time. Its continuous bridge output consumer retains read receipts during preparation and across Turns. Caller cancellation detaches observation without cancelling the Run or discarding an admitted waiter; its original deadline still applies. Owner closure stops admission. Native null, malformed receipts, timeout and interrupted delivery remain uncertain and stop the owner; local reap is not a successful read settlement. The SDK's nullable result catches all native/control errors, so it cannot distinguish missing files from denial or transport failure. The reader provides no public Files endpoint, snapshot consistency, placement registration or idle owner policy. The qualified live workspace fixture also checks binary, empty and bounded reads before input and during real execution, plus effects before cancellation and reads on fresh-process history continuation.
 
-The optional private `agent.WorkspaceDirectoryLister` uses the portable `workspace_directory` bridge feature. Node reads directory metadata under the selected workspace; there is no Linux `/proc/self/fd` dependency. Public daemon Files operations share the Go Binding implementation on all platforms. Their relative path and result bounds define the Files API, not Harness permissions.
+The optional private `agent.WorkspaceDirectoryLister` uses the portable `workspace_directory` bridge feature. Node reads directory metadata under the selected workspace and never follows a link ([list files](../../contracts/agents-api/environment-files.md#list-files)); there is no Linux `/proc/self/fd` dependency. Public daemon Files operations share the Go Binding implementation on all platforms. Their relative path and result bounds define the Files API, not Harness permissions.
 
 Directory requests are bounded to 8 KiB and 1,000 immediate entries, with explicit truncation, literal names, kinds, and sizes only for regular files. They do not promise ordering, snapshots, recursion, or public pagination. Missing and permission errors are returned only from distinguishable filesystem outcomes; unknown results stop the owner. Each operation closes its directory before a successful receipt. Caller cancellation, Turn transitions and owner shutdown follow the workspace read settlement rules. The lister alone does not enable public Claude Files; the dedicated Runtime integration supplies public placement and ownership.
 
@@ -54,13 +54,13 @@ Private workspace execution requires the packaged `workspace_command_observation
 
 The private adapter accepts typed anonymous HTTP and static-bearer HTTPS MCP declarations on the trusted `environment:none` harness host. The packaged readiness report must include `mcp_http_tools`; discovery advertises that feature only when present, and execution rechecks the installed bundle before dispatching an MCP request. An unchanged SDK version alone cannot qualify an older bridge. Authenticated private requests also require the packaged `mcp_http_bearer_auth` feature at discovery and dispatch. The daemon generates a separate environment reference for each server and launch; only those references enter the bridge request and native SDK configuration. The native HTTP client expands them from its owned process environment. Literal bearers must never enter SDK MCP headers because that configuration enters argv. Readiness probes receive no per-request bearer environment. Token validation is shared with the Codex adapter; credential storage remains an opaque-string contract. Public MCP admission, Vault credential selection and their failure rules belong to [public MCP connection origin](../../contracts/agents-api/environments.md#public-mcp-connection-origin) and [credential selection](../../contracts/agents-api/vaults.md#credential-selection-in-a-session).
 
-MCP queries use the SDK's main-thread Agent definition to restrict model-visible tools, in addition to empty built-ins, strict MCP configuration, empty setting sources and default-deny permissions. Permission allowlists alone do not restrict the native model inventory. Null selects all tools from a declared server; an empty list selects none. Host functions compose with those selections. Native server status supplies original tool identities; map their normalized native aliases while preserving the original names in observations. Native status deduplicates aliases, so it does not prove a complete original server inventory. A native PreToolUse hook waits for inventory verification before admitting root calls and denies unverified, mismatched or cancelled calls. The native Agent restriction controls model-visible tools; inventory verification is not a barrier before the model request. Anonymous HTTP declarations explicitly set an empty Authorization header to disable native OAuth and automatic credential injection. Preserve that header; do not erase native history or credentials to enforce this boundary. Servers that reject a blank Authorization header, normalized name collisions and inventory changes during a query require separate validation; this profile covers static inventories. Private SDK status/control objects can contain expanded authentication headers. Read only connection and tool identity fields; never retain, log or publish raw status/configuration or control responses. Diagnostic projections must whitelist safe fields; filtering actual model or tool output does not fix a leak. The adapter profile requires connected servers, reserves the `functions` label, accepts alphanumeric/underscore/hyphen server labels and alphanumeric/underscore/hyphen/dot selected tool names, and excludes remote environments. Required startup is separately qualified by `mcp_http_required`. All HTTP MCP queries use native SDK startup and an empty input iterator to confirm initialization hooks. Required declarations additionally check connected server status before the initial prompt is released exactly once. Pending, failed, missing or ambiguous required status rejects before input; native startup timeouts are retained without an adapter retry loop. Normal system/init still verifies Session identity and the complete inventory before input readiness/tool authority. Optional servers keep their inventory checks without a pre-input connection requirement. A Runtime must advertise the concrete required-initialization capability; there is no fallback to another execution path.
+Before the native query starts, the adapter lists each server with a nonempty `allowed_tools` subset over Streamable HTTP with the native configuration's URL and bearer header, and passes the native names of the unselected tools in `disallowedTools`; a listing failure fails the query without retry. The PreToolUse hook denies any unselected call as a backstop. Null selects all tools from a declared server; an empty list selects none. Host functions compose with those selections. Native server status supplies original tool identities; map their normalized native aliases while preserving the original names in observations. Native status deduplicates aliases, so it does not prove a complete original server inventory. A native PreToolUse hook waits for inventory verification before admitting root calls and denies unverified, mismatched or cancelled calls. Inventory verification is not a barrier before the model request. Anonymous HTTP declarations explicitly set an empty Authorization header to disable native OAuth and automatic credential injection. Preserve that header; do not erase native history or credentials to enforce this boundary. Servers that reject a blank Authorization header, normalized name collisions and inventory changes during a query require separate validation; this profile covers static inventories. Private SDK status/control objects can contain expanded authentication headers. Read only connection and tool identity fields; never retain, log or publish raw status/configuration or control responses. Diagnostic projections must whitelist safe fields; filtering actual model or tool output does not fix a leak. The adapter profile requires connected servers, reserves the `functions` label, accepts alphanumeric/underscore/hyphen server labels and any selected tool name, which the native client normalizes, and excludes remote environments. Required startup is separately qualified by `mcp_http_required`. All HTTP MCP queries use native SDK startup and an empty input iterator to confirm initialization hooks. Required declarations additionally check connected server status before the initial prompt is released exactly once. Pending, failed, missing or ambiguous required status rejects before input; native startup timeouts are retained without an adapter retry loop. Normal system/init still verifies Session identity before input readiness/tool authority, with the complete inventory on `none` and the presence of every tool Core declared on a workspace. Optional servers without a subset keep their inventory checks without a pre-input connection requirement. A Runtime must advertise the concrete required-initialization capability; there is no fallback to another execution path.
 
 Root assistant tool calls and live root user results produce the neutral MCP observations. Correlate actual Session/call identities; exclude replay, synthetic and subagent work and keep host function receipts separate. Preserve the exact native `tool_use_result` when one result is unambiguous, otherwise the per-call result content. Native errors remain observed native errors. The SDK can replace annotated MCP content with rendered structuredContent and flatten MCP errors; these observations do not claim original MCP envelope fidelity or hosted output parity. Do not reconstruct lost fields or infer output from model prose. Unfinished observed calls become incomplete on shutdown, without claiming that remote tool effects were cancelled. Rich content, native truncation and asynchronous MCP task results remain unverified.
 
 ### Deferred function discovery
 
-Workspace deferred-function discovery uses native ToolSearch alongside the normal workspace tool profile. Its readiness feature is `workspace_tool_search`, in addition to `tool_search` and the workspace/function features. Qualification, combination limits and model-policy limitations are owned by [Deferred function discovery](../../contracts/agents-api/execution-tools.md#deferred-function-discovery).
+Workspace deferred-function discovery uses native ToolSearch alongside the normal workspace tool profile. Its readiness feature is `workspace_tool_search`, in addition to `tool_search` and the workspace/function features. Combinations are described under [Deferred function discovery](../../contracts/agents-api/execution-tools.md#deferred-function-discovery).
 
 ### Registration and state
 
@@ -70,17 +70,17 @@ SDK state lives under `paths.ProfileDir(profile)/runtime/claude-sdk`, independen
 
 ### Descriptor and execution profile
 
-The SDK descriptor advertises the validated daemon subset, including durable Turns/input receipts, text observations, function tools, raw usage and restrictive execution controls. It does not advertise permissions, raw tool Items, general web-search control or text-verbosity levels. Router admission for `environment:none` uses the available engine capability, not an engine name.
+The SDK descriptor advertises the validated daemon subset, including durable Turns/input receipts, text observations, function tools, raw usage and restrictive execution controls. It does not advertise permissions, raw tool Items, enabled web-search modes or text-verbosity levels. Router admission for `environment:none` uses the available engine capability, not an engine name.
 
-Core owns public admission for Claude: [harness selection](../../contracts/agents-api/model-execution.md#harness-selection) chooses the engine for each Session; one [engine policy](../../contracts/agents-api/harness-onboarding.md#add-the-engine-to-core) serves API admission, device selection and the final claim; the [qualified operations](../../contracts/agents-api/harness-capabilities.md) table records Claude's medium-only verbosity and object-root function schemas; [function result images](../../contracts/agents-api/message-content.md#function-results) defines which placements accept image results; and [deployment defaults](../../contracts/agents-api/model-execution.md#deployment-defaults) define the model provider Core freezes for a Session. The adapter receives that provider as the adapter-owned `model_provider`, never in public Session configuration. Without one, a `none` host uses the daemon's own provider environment. The adapter alone selects the provider environment and removes credentials from native tool environments.
+Core owns public admission for Claude: [harness selection](../../contracts/agents-api/model-execution.md#harness-selection) chooses the engine for each Session; one [engine policy](../../contracts/agents-api/harness-onboarding.md#declare-the-harness) serves API admission, device selection and the final claim; the [supported operations](../../contracts/agents-api/harness-capabilities.md) table records Claude's medium-only verbosity and object-root function schemas; [function result images](../../contracts/agents-api/message-content.md#function-results) defines which placements accept image results; and [deployment defaults](../../contracts/agents-api/model-execution.md#deployment-defaults) define the model provider Core freezes for a Session. The adapter receives that provider as the adapter-owned `model_provider`, never in public Session configuration. Without one, a `none` host uses the daemon's own provider environment. The adapter alone selects the provider environment and removes credentials from native tool environments.
 
-The `none` profile accepts only text, explicit model/system instructions, managed state, exact native resume and declared functions with ordered text or successful inline PNG/JPEG results, and the HTTP MCP subset described above. It rejects unsupported request options and disables built-in tools and undeclared MCP discovery. `DisableExecutionEnvironment` and `DisableSubagents` are accepted assertions about the single-Agent restrictive profile. Omission does not enable built-in tools. Explicit Subagent observation enables only the native delegation tools described under [Subagents](#subagents). Single-Agent new and resumed queries use the SDK's empty built-in tool set, explicit function MCP configuration and allowlist, strict MCP configuration and empty user/project/local setting sources. Without HTTP MCP declarations, native initialization and real provider request inventories must contain only the declared host functions. Managed operator policy may further restrict execution; it must not widen the profile. The profile limits model tool access; it does not isolate native state files or filesystem access by an explicitly supplied host function. The private factory accepts typed execution controls only for disabled search and medium text verbosity. Search remains excluded by the native tool inventory; medium retains the SDK's default text generation, without adding instructions or changing caller input. The pinned SDK has no native verbosity-level option, so low and high verbosity and enabled search are unsupported. Missing/invalid fields in a supplied control block fail before native setup; omitting the block keeps the same restrictive profile. Use the SDK's history lookup before explicit resume; never fall back to a new Session. Native files remain device-affine under a caller-selected managed runtime directory. The launch configuration supplies trusted provider environment; request options cannot supply environment variables or business write authority. Omitted, null and empty `system_prompt` map to empty SDK instructions only at this adapter boundary; null model values and unsupported options remain rejected.
+The `none` profile accepts only text, explicit model/system instructions, managed state, exact native resume and declared functions with ordered text or successful inline PNG, JPEG, GIF or WebP results, and the HTTP MCP subset described above. It rejects unsupported request options and disables built-in tools and undeclared MCP discovery. `DisableExecutionEnvironment` and `DisableSubagents` are accepted assertions about the single-Agent restrictive profile. Omission does not enable built-in tools. Explicit Subagent observation enables only the native delegation tools described under [Subagents](#subagents). Single-Agent new and resumed queries use the SDK's empty built-in tool set, explicit function MCP configuration and allowlist, strict MCP configuration and empty user/project/local setting sources. Without HTTP MCP declarations, native initialization and real provider request inventories must contain only the declared host functions; native decides whether ToolSearch, StructuredOutput and, with live search, WebSearch join them. Managed operator policy may further restrict execution; it must not widen the profile. The profile limits model tool access; it does not isolate native state files or filesystem access by an explicitly supplied host function. The private factory accepts the execution controls in the [Claude declaration](../../internal/harnessconfig/claudesdk/declaration.go): disabled or live search, medium text verbosity and reasoning effort, which maps to the SDK's `effort` option. Live search adds only the provider-side WebSearch tool, never WebFetch, which would fetch from the Runtime host; medium retains the SDK's default text generation, without adding instructions or changing caller input. The pinned SDK has no verbosity, summary or service-tier option. An undeclared value fails before native setup; omitting the block keeps the same restrictive profile. Use the SDK's history lookup before explicit resume; never fall back to a new Session. Native files remain device-affine under a caller-selected managed runtime directory. The launch configuration supplies trusted provider environment; request options cannot supply environment variables or business write authority. Omitted, null and empty `system_prompt` map to empty SDK instructions only at this adapter boundary; null model values and unsupported options remain rejected.
 
 ### Function server and results
 
 The internal SDK function-server helper uses the maintained MCP server's public request handlers and standard Tool/CallToolResult types. It snapshots definitions and forwards JSON Schema without a JSON Schema-to-Zod conversion; supplied tools are always loaded. Native call identity comes from the pinned harness's `claudecode/toolUseId` MCP metadata, independently of request IDs, names or arrival order. Missing identities and undeclared tools fail before invoking the host. Return content/error fields unchanged over MCP and forward its per-request abort signal. The private Go factory connects declared functions through this helper and reuses the daemon function-call/result interface and neutral observations. The native function-server registry must contain exactly those functions. SDK allowlisting admits only these host callbacks; the host still owns result decisions and any business permission checks. It grants no runtime-token business authority.
 
-Function results remain pending after stdin/MCP delivery. A matching live, root native user tool_result confirms application only when its Session/call identity, error flag and ordered content match the submission. Text matches exactly; each submitted image position must remain a valid native base64 image. Native resizing or re-encoding may change image bytes. This acknowledges incorporation into native history, not byte/pixel fidelity or completed provider consumption. Public Items retain the original caller content; real image-dependent model responses separately qualify usability. Ignore replayed, synthetic and subagent messages. Native error text joins the submitted text parts with newlines; neutral observations retain their original order and separate failure status. Missing/mismatched receipts fail the execution; do not replay unknown delivery. Result submission waits at most ten seconds for a receipt and cancels uncertain execution on timeout. Invalid or unsupported image results fail before consuming a pending call. Function state belongs to one live Run and ends with it; the router owns receipt retry/conflict handling. This does not establish crash recovery or exactly-once effects.
+Function results remain pending after stdin/MCP delivery. A matching live native user tool_result of the calling agent confirms application only when its Session/call identity, error flag and ordered content match the submission. Text matches exactly; each submitted image position must hold a native image, or the text note native substitutes for an image it cannot process. Native resizing or re-encoding may change image bytes. This acknowledges incorporation into native history, not byte/pixel fidelity or completed provider consumption. Public Items of a root call retain the original caller content, and a child's Items come from its native history; real image-dependent model responses separately qualify usability. Ignore replayed and synthetic messages. Native error text joins the submitted text parts with newlines; neutral observations retain their original order and separate failure status. Missing/mismatched receipts fail the execution; do not replay unknown delivery. Result submission waits at most ten seconds for a receipt and cancels uncertain execution on timeout. Invalid or unsupported image results fail before consuming a pending call. Function state belongs to one live Run and ends with it; the router owns receipt retry/conflict handling. This does not establish crash recovery or exactly-once effects.
 
 ### Usage
 
@@ -94,24 +94,24 @@ Active text uses the SDK's `AsyncIterable<SDKUserMessage>` input, with a fresh n
 
 ## Subagents
 
-The adapter uses the pinned Claude Agent SDK's native Agent and SendMessage execution; it implements no model loop. An explicit Runtime request enables the `oac_worker` agent; ordinary requests keep their tools. The packaged `subagent_resources` readiness feature gates this request.
+The adapter uses the pinned Claude Agent SDK's native Agent and SendMessage execution; it implements no model loop. An explicit Runtime request enables the native Agent and SendMessage tools with Claude Code's own agent types and prompts; ordinary requests keep their tools. The packaged `subagent_resources` readiness feature gates this request.
 
 A child identity comes from native task admission and persisted child metadata. The metadata's `toolUseId` must identify the parent's original Agent call; `parentAgentId` identifies a nested parent, and root children require native `spawnDepth: 1`. The child history must belong to the same root Session and child ID. The SDK resolves its persisted conversation chain; the adapter reads the corresponding private original records for ownership and timestamps that the SDK's public TypeScript message shape omits.
 
 The first own native user record has a null `parentUuid`. Its timestamp supplies `opened_at`, in seconds, and the first Turn's creation and start time, in milliseconds: the original input time, not discovery time or a copied parent record. The fixed native metadata has no separate creation timestamp. Reopening the Runtime preserves these values. Each later own input starts a child Turn; native end-turn assistant records supply completion time. Own messages, reasoning and native Bash receipts keep their native IDs and ordering. Completion leaves the Subagent active and idle: the adapter emits no closed state because this native profile has no qualified close operation.
 
-The native query owns child execution and cleanup. PreToolUse admission reserves each native Agent or idle-child SendMessage call before execution. Native `task_started` associates the call and child ID; completion releases that reservation. The frozen limit applies across the child tree, excludes the root, and defaults to six. Unknown call associations fail closed. SendMessage to a running child is rejected; only idle continuation is qualified. Native background execution, alternate agent types, worktree isolation and per-call model overrides are rejected.
+The native query owns child execution and cleanup. PreToolUse admission reserves each native Agent or idle-child SendMessage call before execution. Native `task_started` associates the call and child ID; completion releases that reservation. The frozen limit applies across the child tree, excludes the root, and defaults to six. Unknown call associations fail closed. SendMessage to a running child is rejected; only idle continuation is qualified. A SendMessage `to` is a child ID or the `name` given at spawn. Remote isolation, which needs an account credential Core does not hold, is rejected; native background execution is removed by `CLAUDE_CODE_DISABLE_BACKGROUND_TASKS`. Agent types, per-call `model` and worktree isolation follow the native defaults, and the coordination fact reports the requested `model`.
 
-Workspace children use native Bash with the same launching-user permissions as the parent, and the daemon and adapter add no filesystem, permission or network sandbox. A child's workspace tool calls are denied until native task admission has verified its identity. Workspace hooks keep their execution and event responsibilities but are not a private-file boundary: tools can access Runtime state that the host user can access. Isolation belongs to the outer Environment. Functions and MCP combined with Subagents are not qualified and are rejected explicitly ([subagents contract](../../contracts/agents-api/subagents.md)); functions and MCP without Subagents are unaffected. Claude on Windows requires Git Bash.
+Workspace children use native Bash with the same launching-user permissions as the parent, and the daemon and adapter add no filesystem, permission or network sandbox. A child's Agent and SendMessage calls are denied until native task admission has verified its identity. Workspace hooks keep their execution and event responsibilities but are not a private-file boundary: tools can access Runtime state that the host user can access. Isolation belongs to the outer Environment. A child calls the Agent's functions and MCP tools like the root. The PreToolUse hook admits a child only after native started it and records which agent made each function call, because the MCP request does not name it. Before the call the bridge sends the child's `subagent_identity` and open `subagent_turn` from its live record and then `function_call` with `native_id` and `turn_id`. The child's own live tool result, forwarded with the root session, confirms the result; an aborted child call is sent as `function_withdrawn`. Claude on Windows requires Git Bash.
 
 Cancellation uses an adapter-owned effect receipt only after the query owner confirms native process exit, because the fixed native history can end at a tool call without a cancellation result or timestamp. Each receipt is linked into the native history directory atomically, without overwriting an earlier receipt, and records the child, own Turn, spawn call and confirmed effect time. Native records stay unchanged. Replay uses that same timestamp; it never takes a new cancellation time from an unfinished history. Child Items and the cancelled Turn precede the root cancellation event. Missing native exit confirmation or a missing receipt does not imply a terminal child state.
 
 ## Runtime artifact
 
-`make build-claude-sdk-runtime` exports the compiled bridge and pinned production SDK/MCP dependencies, including the native package for the build host, into a platform/architecture/libc-specific `.tar.gz` and SHA256 file under `${OAC_DEV_HOME:-$HOME/.oac}/build/claude-sdk-runtime`. `CLAUDE_SDK_BUILD_DIR` may select another absolute output directory. The production dependency closure requires Node20 or newer; Node22 is the tested version. This standalone archive requires operator-supplied Node and is independent of product sources, services and databases. It does not add Node or SDK assets to the Agents API binaries/image.
+`make build-claude-sdk-runtime` exports the compiled bridge and pinned production SDK/MCP dependencies, including the native package for the build host, into a platform/architecture/libc-specific `.tar.gz` and SHA256 file under `${OAC_DEV_HOME:-$HOME/.oac}/build/claude-sdk-runtime`. `CLAUDE_SDK_BUILD_DIR` may select another absolute output directory. The bridge requires Node 22.21 or newer, or 24.5 or newer on Node 24, which accept `--use-env-proxy`; Node 22 is the tested version. This standalone archive requires operator-supplied Node and is independent of product sources, services and databases. It does not add Node or SDK assets to the Agents API binaries/image.
 
 The build validates source manifests with the repository-pinned pnpm frozen install and compiles into fresh managed staging, never exporting incremental checkout output. It then uses `pnpm deploy` from the adapter workspace with its dedicated frozen lock. The adapter has no workspace dependencies; keep that boundary explicit. Workspace injection is configured only in this adapter project for its frozen export; do not enable it in the Web/client workspace or replace export with a custom dependency copier. Export only compiled `dist` and production dependencies; retain their package metadata, lockfile and licenses. Check dependency links stay inside the export, pinned SDK/MCP/native versions, native `--version`, and bridge startup before publishing the archive. Startup with stdin EOF is an import check, not model execution acceptance. `make check-claude-sdk` includes this artifact check.
 
 Extract the archive into a fresh managed runtime directory on a matching host and use its absolute `dist/main.js` as the private factory entrypoint. Validate relocation and real provider cancellation/continuation before accepting an artifact. Linux x64/glibc with Node22 is the currently exercised platform; other hosts require their own native acceptance. Do not reuse a bundle across platforms or libc variants. The native installer bundles Node and owns user-managed activation; release publication remains separate. Operator-configured discovery and registration remain available for unmanaged bootstrap as specified above.
 
-The exported `dist/runtime_check.js` companion is the local readiness contract. It checks Node20+, installed SDK/MCP/native versions against the package manifest, contained dependency resolution, native startup, and the exact `dist/main.js` bridge with stdin EOF. It emits one versioned JSON report without calling a model or creating Session state. The artifact check reuses this companion and separately checks all exported links, the lockfile and source pins. `claudesdk.CheckRuntime` uses the same Node, entrypoint and environment as execution, with shared process-group ownership, bounded output and a 15-second deadline plus bounded cleanup. Both native and bridge probes have five-second limits. Return unavailable on failed or malformed probes; never forward native diagnostics or treat local readiness as provider authentication, public capability acceptance or filesystem isolation. The native installer reuses this readiness check after copying its release components.
+The exported `dist/runtime_check.js` companion is the local readiness contract. It checks the Node version, installed SDK/MCP/native versions against the package manifest, contained dependency resolution, native startup, and the exact `dist/main.js` bridge with stdin EOF. It emits one versioned JSON report without calling a model or creating Session state. The artifact check reuses this companion and separately checks all exported links, the lockfile and source pins. `claudesdk.CheckRuntime` uses the same Node, entrypoint and environment as execution, with shared process-group ownership, bounded output and a 15-second deadline plus bounded cleanup. Both native and bridge probes have five-second limits. Return unavailable on failed or malformed probes; never forward native diagnostics or treat local readiness as provider authentication, public capability acceptance or filesystem isolation. The native installer reuses this readiness check after copying its release components.
diff --git a/packages/claude-sdk-adapter/src/adapter.ts b/packages/claude-sdk-adapter/src/adapter.ts
index e0375740f..d96dc02b1 100644
--- a/packages/claude-sdk-adapter/src/adapter.ts
+++ b/packages/claude-sdk-adapter/src/adapter.ts
@@ -1,21 +1,21 @@
 import { NativeFailure } from "./native_failure.js";
 import { ExecutorTurns, type ExecutorEvent } from "./executor_protocol.js";
 import { StructuredOutput } from "./structured_output.js";
-import { toolSearchEnvironment } from "./tool_search.js";
 import { Subagents } from "./subagents.js";
 import type { Fact } from "./subagent_history.js";
 import { WorkspaceDirectories, type WorkspaceDirectoryEvent } from "./workspace_directories.js";
-import { getSessionInfo, query, startup, type McpServerConfig, type Options, type WarmQuery } from "@anthropic-ai/claude-agent-sdk";
+import { getSessionInfo, query, startup, type HookCallback, type McpServerConfig, type Options, type WarmQuery } from "@anthropic-ai/claude-agent-sdk";
 import { WorkspaceReads, type WorkspaceReadEvent } from "./workspace_reads.js";
 import { Inputs, type InputEvent } from "./inputs.js";
 import { executorResultUsage, resultUsage, type NativeUsage } from "./usage.js";
 import { spawnNative } from "./native.js";
 import { MessageObserver, type MessageEvent } from "./messages.js";
-import { createFunctionServer } from "./functions.js";
+import { createFunctionServer, type FunctionCall } from "./functions.js";
 import { FunctionBridge, type FunctionEvent } from "./function_bridge.js";
 import { MCPProfile } from "./mcp.js";
 import { MCPObserver, type MCPEvent } from "./mcp_observer.js";
 import { CommandObserver, type CommandEvent } from "./command_observer.js";
+import { SearchObserver, type SearchEvent } from "./search_observer.js";
 import { WorkspaceProfile } from "./workspace.js";
 import { immediateInput, type Prepare, type Start, type ExecutorPrepare } from "./request.js";
 import { recoverSession } from "./recovery.js";
@@ -31,6 +31,7 @@ export type Event =
   | FunctionEvent
   | MCPEvent
   | CommandEvent
+  | SearchEvent
   | { type: "prepared" }
   | { type: "usage"; session_id: string; result_id: string; usage: NativeUsage }
   | { type: "delta"; delta: string }
@@ -45,29 +46,41 @@ export async function execute(request: Start | Prepare | ExecutorPrepare, emit:
   let classifiedFailure: { engine_error_code: string; session_id: string; result_id: string } | undefined;
   const definitions = (request.functions ?? []).map(tool => ({ name: tool.name, description: tool.description, inputSchema: tool.parameters, deferLoading: tool.defer_loading }));
   const names = definitions.map(tool => `mcp__functions__${tool.name}`);
-  const allowed = [...names, ...(request.tool_search ? ["ToolSearch"] : [])];
+  // Environment none runs only the tools Core selects. WebSearch is a provider-side tool; WebFetch would fetch from the Runtime host.
+  const selected = [...(request.tool_search ? ["ToolSearch"] : []), ...(request.web_search === "live" ? ["WebSearch"] : [])];
   const declarations = request.workspace?.mcp ?? request.mcp_http_servers;
-  const profile = declarations === undefined ? undefined : new MCPProfile(declarations, names);
-  const subagents = request.subagents ? new Subagents(request.cwd, request.subagents.max_concurrent, request.resume) : undefined;
-  const workspace = request.workspace === undefined ? undefined : new WorkspaceProfile(request.cwd, request.workspace, names, profile, subagents, !!request.output_format, !!request.tool_search);
+  const profile: MCPProfile | undefined = declarations === undefined ? undefined : new MCPProfile(declarations, names, id => subagents?.permitsActor(id) ?? id === undefined);
+  const subagents = request.subagents ? new Subagents(request.cwd, request.subagents.max_concurrent, request.resume, profile?.identities, request.reasoning_summary) : undefined;
+  const workspace = request.workspace === undefined ? undefined : new WorkspaceProfile(request.cwd, request.workspace, profile, subagents, request.web_search === "disabled");
   let commands = workspace ? new CommandObserver() : undefined;
+  const observeSearch = workspace !== undefined || request.web_search === "live";
+  let searches = observeSearch ? new SearchObserver() : undefined;
   if (request.type === "prepare" && !workspace) throw new Error("invalid_request");
   if (workspace && "mcp_http_servers" in request) throw new Error("invalid_request");
   if (request.require_history && !request.resume) {
     const recovered = await recoverSession(request.cwd);
     if (!recovered) {
-      await emit({ type: "error", code: "history_unavailable" });
+      // No Turn is bound yet, so the Executor owner reports missing history.
+      await ownerEmit({ type: "error", code: "history_unavailable" });
       return;
     }
     request = { ...request, resume: recovered };
   }
   if (request.resume && !await getSessionInfo(request.resume, { dir: request.cwd })) {
-    await emit({ type: "error", code: "history_unavailable" });
+    await ownerEmit({ type: "error", code: "history_unavailable" });
     return;
   }
   subagents?.expectSession(request.resume);
   const mcpServers: Record<string, McpServerConfig> = Object.create(null);
-  if (definitions.length) mcpServers.functions = createFunctionServer(definitions, (call,signal) => { const target=functions; return turns ? turns.track(()=>target.invoke(call,signal)) : target.invoke(call,signal); });
+  // Core resolves a Subagent's call through the child's identity and open Turn, so those facts precede it.
+  const invoke = async (target: FunctionBridge, call: FunctionCall, signal: AbortSignal) => {
+    let child: Awaited<ReturnType<Subagents["child"]>>;
+    // A call Core cannot attribute fails the execution instead of reaching the model as a tool error.
+    try { child = await subagents?.child(call.id); } catch (error) { failed = true; stream?.close(); throw error; }
+    for (const fact of child?.facts ?? []) await emit(fact);
+    return target.invoke(child ? { ...call, child: { native_id: child.native_id, turn_id: child.turn_id } } : call, signal);
+  };
+  if (definitions.length) mcpServers.functions = createFunctionServer(definitions, (call,signal) => { const target=functions; return turns ? turns.track(()=>invoke(target,call,signal)) : invoke(target,call,signal); });
   let mcp = profile ? new MCPObserver(profile.identities) : undefined;
   if (profile) Object.assign(mcpServers, profile.servers);
   const children: Promise<number | null>[] = [];
@@ -77,7 +90,7 @@ export async function execute(request: Start | Prepare | ExecutorPrepare, emit:
   let failed = false;
   let cancellationFactsFailed = false;
   let structured = request.output_format ? new StructuredOutput() : undefined;
-  let messages = request.observe_messages ? new MessageObserver() : undefined;
+  let messages = new MessageObserver(request.reasoning_summary);
   let stream: ReturnType<typeof query> | undefined;
   let warm: WarmQuery | undefined;
   let nativeAlive = false;
@@ -85,34 +98,44 @@ export async function execute(request: Start | Prepare | ExecutorPrepare, emit:
   abort.signal.addEventListener("abort", closeInputs, { once: true });
   try {
     if (abort.signal.aborted) throw new Error("cancelled");
+    // The model sees only the selected tools of a subset server; the hook below remains the backstop.
+    const unselected = profile ? await profile.unselectedTools(abort.signal) : [];
+    const beforeTool: HookCallback = async (input, id, context) => {
+      if (input.hook_event_name !== "PreToolUse") return {};
+      if (subagents?.isCoordination(input.tool_name)) return subagents.beforeTool(input, id, context);
+      await subagents?.noteTool(input, id, context);
+      return profile ? profile.beforeTool(input, id, context) : {};
+    };
     const options: Options = {
         ...(request.native_model_options?.effort !== undefined ? { effort: request.native_model_options.effort } : {}),
         ...(request.native_model_options?.thinking !== undefined ? { thinking: request.native_model_options.thinking } : {}),
         cwd: request.cwd,
-        env: workspace?.options.env ?? { ...process.env, ...(subagents ? { CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" } : {}) },
+        env: workspace?.options.env ?? { ...process.env },
+        // Flag settings outrank user and project settings, so no settings file brings back detached work after a
+        // Turn or updates of the pinned binary.
+        settings: { env: { CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1", DISABLE_AUTOUPDATER: "1" } },
         model: request.model,
         ...(request.output_format ? { outputFormat: request.output_format } : {}),
-        systemPrompt: request.system_prompt,
+        // On a workspace Claude Code keeps its own prompt and the Agent's instructions are appended; that prompt
+        // describes tools environment none does not have.
+        systemPrompt: workspace ? { type: "preset", preset: "claude_code", ...(request.system_prompt ? { append: request.system_prompt } : {}) } : request.system_prompt,
         ...(request.resume ? { resume: request.resume } : {}),
-        tools: subagents ? ["Agent", "SendMessage"] : request.tool_search ? ["ToolSearch"] : [], allowedTools: profile?.allowed ?? allowed, strictMcpConfig: true, settingSources: [],
-        ...(profile ? {
-          agent: "oac_root", disallowedTools: profile.denied,
-          hooks: { PreToolUse: [{ hooks: [profile.beforeTool] }] },
-          agents: { oac_root: { description: "Execution root.", prompt: request.system_prompt,
-            model: request.model, tools: [...(Array.isArray(workspace?.options.tools) ? workspace.options.tools : []), ...profile.allowed] } },
-        } : {}),
-        persistSession: true, includePartialMessages: true, abortController: abort,
-        canUseTool: async () => ({ behavior: "deny", message: "Tools are unavailable in this execution profile." }),
+        includePartialMessages: true, abortController: abort,
+        // Environment none keeps no workspace tools and approves only Core's function and MCP tools. The host's
+        // settings, memory files and MCP servers belong to no Session.
+        ...(workspace ? {} : {
+          tools: [...(subagents ? ["Agent", "SendMessage"] : []), ...selected],
+          allowedTools: [...(profile?.allowed ?? names), ...selected],
+          settingSources: [], strictMcpConfig: true,
+          canUseTool: async () => ({ behavior: "deny" as const, message: "Tools are unavailable in this execution profile." }),
+        }),
         ...(workspace?.options ?? {}),
+        disallowedTools: [...(workspace?.options.disallowedTools ?? []), ...(profile?.denied ?? []), ...unselected],
         mcpServers,
-        ...(subagents ? { ...subagents.options(!!workspace), hooks: {
+        ...(subagents ? { forwardSubagentText: true, hooks: {
           Stop: [{ hooks: [subagents.stopped] }], SubagentStart: [{ hooks: [subagents.childStart] }],
-          PostToolUseFailure: [{ hooks: [subagents.failedTool] }],
-          PreToolUse: [{ hooks: [async (input, id, context) => {
-            if (input.hook_event_name === "PreToolUse" && subagents.isCoordination(input.tool_name)) return subagents.beforeTool(input, id, context);
-            return workspace ? workspace.beforeTool(input, id, context) : {};
-          }] }],
-        } } : {}),
+          PostToolUseFailure: [{ hooks: [subagents.failedTool] }], PreToolUse: [{ hooks: [beforeTool] }],
+        } } : profile ? { hooks: { PreToolUse: [{ hooks: [beforeTool] }] } } : {}),
         spawnClaudeCodeProcess: options => {
           const child = spawnNative(options);
           nativeAlive = true;
@@ -121,7 +144,8 @@ export async function execute(request: Start | Prepare | ExecutorPrepare, emit:
           return child;
         },
     };
-    if (request.tool_search) options.env = toolSearchEnvironment(options.env ?? process.env, request.model);
+    // ENABLE_TOOL_SEARCH=true is the official mapping of tool_search; native owns discovery and provider policy.
+    if (request.tool_search) options.env = { ...(options.env ?? process.env), ENABLE_TOOL_SEARCH: "true" };
     if(turns) {
       for(const matchers of Object.values(options.hooks ?? {})) for(const matcher of matchers ?? []) {
         matcher.hooks=matcher.hooks.map(hook=>(...args)=>turns.track(()=>hook(...args)));
@@ -146,9 +170,10 @@ export async function execute(request: Start | Prepare | ExecutorPrepare, emit:
         turns.configure(stream,(input,output)=>{
           inputs=new Inputs(input);
           functions=new FunctionBridge(output);
-          messages=request.observe_messages ? new MessageObserver() : undefined;
+          messages=new MessageObserver(request.reasoning_summary);
           structured=request.output_format ? new StructuredOutput() : undefined;
           commands=workspace ? new CommandObserver() : undefined;
+          searches=observeSearch ? new SearchObserver() : undefined;
           mcp=profile ? new MCPObserver(profile.identities) : undefined;
           subagents?.beginTurn();
           return inputs;
@@ -179,22 +204,26 @@ export async function execute(request: Start | Prepare | ExecutorPrepare, emit:
       await functions.consume(message, nativeID, turns?.cancelled);
       if (mcp) for (const event of mcp.consume(message, nativeID)) await emit(event);
       if (commands) for (const event of commands.consume(message, nativeID, inputs.hasInput)) await emit(event);
-      if (messages) for (const event of messages.consume(message)) await emit(event);
+      if (searches) for (const event of searches.consume(message, nativeID)) await emit(event);
+      for (const event of messages.consume(message)) await emit(event);
       if (message.type === "system" && message.subtype === "init") {
         nativeID = message.session_id;
         if (!nativeID || (request.resume && nativeID !== request.resume)) throw new Error("unexpected native session");
-        if (workspace) workspace.verify(message.tools, profile ? await stream.mcpServerStatus() : message.mcp_servers, nativeID);
-        else if (profile) profile.verify(message.tools, await stream.mcpServerStatus(), nativeID);
-        else if (message.tools.length !== allowed.length + (subagents ? 2 : 0) + (structured ? 1 : 0) || message.tools.some(name => ![...allowed, ...(subagents ? ["Task", "SendMessage"] : []), ...(structured ? ["StructuredOutput"] : [])].includes(name)) ||
+        // Native decides whether the selected tools and StructuredOutput join the inventory; a missing structured call fails the result.
+        const tools = message.tools.filter(name => name !== "StructuredOutput" && !selected.includes(name));
+        if (profile) profile.verify(tools, await stream.mcpServerStatus(), nativeID, !workspace, subagents ? ["Task", "SendMessage"] : []);
+        if (workspace) {
+          // Native tools and settings may add servers and tools, but every tool and Skill Core declared must still be present.
+          const declared = [...names, ...(workspace.skillNames.length ? ["Skill"] : []), ...(subagents ? ["Task", "SendMessage"] : [])];
+          if (declared.some(name => !message.tools.includes(name)) || workspace.skillNames.some(name => !message.skills?.includes(name)) ||
+              definitions.length && !message.mcp_servers.some(server => server.name === "functions" && server.status === "connected")) throw new Error("unexpected native configuration");
+        } else if (!profile && (tools.length !== names.length + (subagents ? 2 : 0) || tools.some(name => ![...names, ...(subagents ? ["Task", "SendMessage"] : [])].includes(name)) ||
             message.mcp_servers.length !== (definitions.length ? 1 : 0) ||
-            message.mcp_servers.some(server => server.name !== "functions" || server.status !== "connected")) {
+            message.mcp_servers.some(server => server.name !== "functions" || server.status !== "connected"))) {
           throw new Error("unexpected native configuration");
         }
         turns?.identify(nativeID);
         if(!turns || turns.id) for (const event of inputs.start(nativeID)) await emit(event);
-      } else if (!messages && message.type === "stream_event" && message.parent_tool_use_id === null &&
-                 message.event.type === "content_block_delta" && message.event.delta.type === "text_delta") {
-        await emit({ type: "delta", delta: message.event.delta.text });
       } else if (message.type === "result") {
         if (!message.uuid || resultIDs.has(message.uuid) || !nativeID || message.session_id !== nativeID) throw new Error("invalid native result identity");
         resultIDs.add(message.uuid);
@@ -212,7 +241,7 @@ export async function execute(request: Start | Prepare | ExecutorPrepare, emit:
       if(turns && result && inputs.complete && (!subagents || subagents.complete)) {
         if (turns.cancelled) functions.cancelUnanswered();
         if(!await turns.quiescent() || abort.signal.aborted) throw new Error("unconfirmed interrupt");
-        functions.assertComplete(); mcp?.assertComplete(); commands?.assertComplete();
+        functions.assertComplete(); mcp?.assertComplete(); commands?.assertComplete(); searches?.assertComplete();
         if(subagents) for(const event of await subagents.facts()) await emit(event);
         await emit(turns.cancelled ? {type:"error",code:"cancelled"} : result);
         functions.close();
@@ -224,6 +253,7 @@ export async function execute(request: Start | Prepare | ExecutorPrepare, emit:
     functions.assertComplete();
     mcp?.assertComplete();
     commands?.assertComplete();
+    searches?.assertComplete();
   } catch (error) {
     if (error !== nativeResultFailure) classifiedFailure = undefined;
     failed = true;
@@ -247,6 +277,7 @@ export async function execute(request: Start | Prepare | ExecutorPrepare, emit:
     }
     if (mcp) for (const event of mcp.close()) await emit(event);
     if (commands) for (const event of commands.close()) await emit(event);
+    if (searches) for (const event of searches.close(nativeID)) await emit(event);
   }
   if(turns) {
     if(turns.id) {
diff --git a/packages/claude-sdk-adapter/src/function_bridge.ts b/packages/claude-sdk-adapter/src/function_bridge.ts
index 777d9ea15..354f455ea 100644
--- a/packages/claude-sdk-adapter/src/function_bridge.ts
+++ b/packages/claude-sdk-adapter/src/function_bridge.ts
@@ -12,7 +12,8 @@ export type FunctionResult = {
   content: InputContent[];
 };
 export type FunctionEvent =
-  | { type: "function_call"; call: { call_id: string; name: string; arguments: Record<string, unknown> } }
+  | { type: "function_call"; call: { call_id: string; name: string; arguments: Record<string, unknown>; native_id?: string; turn_id?: string } }
+  | { type: "function_withdrawn"; withdrawn: { call_id: string; native_id: string; turn_id: string } }
   | { type: "function_applied"; call_id: string; delivery_id: string };
 type Pending = {
   resolve: (result: CallToolResult) => void;
@@ -20,11 +21,15 @@ type Pending = {
   cleanup: () => void;
   result?: FunctionResult;
   aborted?: boolean;
+  child?: FunctionCall["child"];
 };
+// Native stopped waiting for the call, so no result can be applied.
+class Abandoned extends Error {}
 
 export class FunctionBridge {
   private readonly pending = new Map<string, Pending>();
   private readonly seen = new Set<string>();
+  private readonly withdrawn = new Set<string>();
   constructor(private readonly emit: (event: FunctionEvent) => Promise<void>) {}
 
   readonly invoke: FunctionHandler = async (call: FunctionCall, signal: AbortSignal) => {
@@ -36,16 +41,24 @@ export class FunctionBridge {
         const pending = this.pending.get(call.id);
         if (pending?.result) pending.aborted = true;
         else this.pending.delete(call.id);
-        reject(new Error("Native function call aborted."));
+        reject(new Abandoned("Native function call aborted."));
       };
       signal.addEventListener("abort", stop, { once: true });
-      this.pending.set(call.id, { resolve, reject, cleanup: () => signal.removeEventListener("abort", stop) });
+      this.pending.set(call.id, { resolve, reject, cleanup: () => signal.removeEventListener("abort", stop), child: call.child });
     });
-    const [, result] = await Promise.all([
-      this.emit({ type: "function_call", call: { call_id: call.id, name: call.name, arguments: call.arguments } }),
-      waiting,
-    ]);
-    return result;
+    try {
+      const [, result] = await Promise.all([
+        this.emit({ type: "function_call", call: { call_id: call.id, name: call.name, arguments: call.arguments, ...call.child } }),
+        waiting,
+      ]);
+      return result;
+    } catch (error) {
+      if (call.child && error instanceof Abandoned) {
+        this.withdrawn.add(call.id);
+        await this.emit({ type: "function_withdrawn", withdrawn: { call_id: call.id, ...call.child } });
+      }
+      throw error;
+    }
   };
 
   submit(line: string): void {
@@ -63,6 +76,8 @@ export class FunctionBridge {
       throw new Error("Native error results cannot retain images.");
     }
     const pending = this.pending.get(result.call_id);
+    // The host may send a result before it reads the withdrawal; native no longer waits for it.
+    if (!pending && this.withdrawn.has(result.call_id)) return;
     if (!pending || pending.result) throw new Error("Function result is not pending.");
     pending.result = result;
     pending.resolve({ content: result.content.map(part => {
@@ -73,12 +88,12 @@ export class FunctionBridge {
   }
 
   async consume(message: SDKMessage, sessionID: string, cancelled = false): Promise<void> {
-    if (message.type !== "user" || message.parent_tool_use_id !== null || message.session_id !== sessionID ||
+    if (message.type !== "user" || message.session_id !== sessionID ||
         message.isSynthetic || ("isReplay" in message && message.isReplay) || !Array.isArray(message.message.content)) return;
     for (const block of message.message.content) {
       if (block.type !== "tool_result") continue;
       const pending = this.pending.get(block.tool_use_id);
-      if (!pending || pending.aborted) continue;
+      if (!pending || pending.aborted || (message.parent_tool_use_id !== null) !== !!pending.child) continue;
       const result = pending.result;
       if (!result) {
         if (!cancelled || !block.is_error) throw new Error("Native response preceded host result.");
@@ -104,7 +119,7 @@ export class FunctionBridge {
       if (pending.result || (callID !== undefined && id !== callID)) continue;
       pending.cleanup();
       this.pending.delete(id);
-      pending.reject(new Error("Native function call cancelled."));
+      pending.reject(new Abandoned("Native function call cancelled."));
     }
   }
 
@@ -122,18 +137,12 @@ export class FunctionBridge {
 }
 
 // A matching root call confirms incorporation into native history. Native image
-// decoding/resizing may change bytes; preserve text and ordered image positions.
+// processing may change bytes or replace an unprocessable image with a text note;
+// preserve text and ordered image positions.
 function matchesNativeContent(content: InputContent[], actual: unknown): boolean {
   const expected = nativeContent({ content });
   if (!Array.isArray(expected) || !Array.isArray(actual) || actual.length !== expected.length) return false;
-  return expected.every((part, index) => {
-    const received = actual[index];
-    if (part.type !== "image") return isDeepStrictEqual(part, received);
-    if (!received || received.type !== "image" || received.source?.type !== "base64" ||
-        typeof received.source.media_type !== "string" || typeof received.source.data !== "string") return false;
-    try {
-      imageSource(`data:${received.source.media_type};base64,${received.source.data}`);
-      return true;
-    } catch { return false; }
-  });
+  return expected.every((part, index) => part.type === "image"
+    ? actual[index]?.type === "image" || actual[index]?.type === "text"
+    : isDeepStrictEqual(part, actual[index]));
 }
diff --git a/packages/claude-sdk-adapter/src/functions.ts b/packages/claude-sdk-adapter/src/functions.ts
index 791274dff..a0f430f3d 100644
--- a/packages/claude-sdk-adapter/src/functions.ts
+++ b/packages/claude-sdk-adapter/src/functions.ts
@@ -5,7 +5,8 @@ import {
   type Tool, type CallToolResult,
 } from "@modelcontextprotocol/sdk/types.js";
 
-export type FunctionCall = { id: string; name: string; arguments: Record<string, unknown> };
+// A call of a Subagent names the native child and its Turn.
+export type FunctionCall = { id: string; name: string; arguments: Record<string, unknown>; child?: { native_id: string; turn_id: string } };
 export type FunctionHandler = (call: FunctionCall, signal: AbortSignal) => Promise<CallToolResult>;
 
 export function createFunctionServer(definitions: (Tool & { deferLoading?: boolean })[], invoke: FunctionHandler): McpSdkServerConfigWithInstance {
diff --git a/packages/claude-sdk-adapter/src/inputs.ts b/packages/claude-sdk-adapter/src/inputs.ts
index f2effbffe..fa5957fbf 100644
--- a/packages/claude-sdk-adapter/src/inputs.ts
+++ b/packages/claude-sdk-adapter/src/inputs.ts
@@ -1,4 +1,4 @@
-import { EmptyUserMessageError, parseMessageInput, nativeContent, type MessageInput } from "./message_input.js";
+import { parseMessageInput, nativeContent, type MessageInput } from "./message_input.js";
 import type { SDKMessage, SDKUserMessage } from "@anthropic-ai/claude-agent-sdk";
 import { randomUUID } from "node:crypto";
 
@@ -37,15 +37,7 @@ export class Inputs implements AsyncIterable<SDKUserMessage> {
     const input = value as Record<string, unknown>;
     if (input.type !== "steer" || Object.keys(input).some(key => !["type", "input_id", "input"].includes(key)) ||
         typeof input.input_id !== "string" || !input.input_id.trim() || input.input_id.length > 256) throw new Error("Invalid input.");
-    let messages: MessageInput;
-    try {
-      messages = parseMessageInput(input.input);
-    } catch (error) {
-      // Core admission rejects blank text for this harness, so this is
-      // unreachable. A rejected steering input still ends the Turn in Core.
-      if (error instanceof EmptyUserMessageError) return [{ type: "input_rejected", input_id: input.input_id }];
-      throw error;
-    }
+    const messages = parseMessageInput(input.input);
     // The native consumed-UUID list has 64 slots, including the opening prompt.
     if (this.ended || !this.sessionID || this.submitted.size + messages.length > 64 || this.ids.has(input.input_id)) {
       return [{ type: "input_rejected", input_id: input.input_id }];
@@ -57,7 +49,7 @@ export class Inputs implements AsyncIterable<SDKUserMessage> {
 
   private enqueue(messages: MessageInput, id?: string): void {
     // Convert the entire batch before admitting any native input.
-    const contents = messages.map(nativeContent);
+    const contents = messages.map(message => nativeContent(message, true));
     const batch: Batch = { id, unapplied: contents.length };
     for (const content of contents) {
       const uuid = randomUUID();
diff --git a/packages/claude-sdk-adapter/src/mcp.ts b/packages/claude-sdk-adapter/src/mcp.ts
index 453122181..3567190c0 100644
--- a/packages/claude-sdk-adapter/src/mcp.ts
+++ b/packages/claude-sdk-adapter/src/mcp.ts
@@ -1,4 +1,6 @@
 import type { StdioServer } from "./mcp_environment.js";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import type { HookCallback, McpServerConfig, McpServerStatus } from "@anthropic-ai/claude-agent-sdk";
 
 export type HTTPServer = {
@@ -7,6 +9,7 @@ export type HTTPServer = {
   allowed_tools: string[] | null;
   required?: boolean;
   bearer_token_env_var?: string;
+  headers?: Record<string, string>;
 };
 export type ToolIdentity = { server: string; name: string };
 
@@ -23,18 +26,20 @@ export function parseHTTPServers(value: unknown): HTTPServer[] | undefined {
   const references = new Set<string>();
   for (const server of value) {
     if (!server || typeof server !== "object" ||
-        Object.keys(server).some(key => !["server_label", "server_url", "allowed_tools", "bearer_token_env_var", "required"].includes(key)) ||
+        Object.keys(server).some(key => !["server_label", "server_url", "allowed_tools", "bearer_token_env_var", "required", "headers"].includes(key)) ||
         (server.required !== undefined && typeof server.required !== "boolean") ||
+        (server.headers !== undefined && (!server.headers || typeof server.headers !== "object" ||
+          Object.values(server.headers).some(value => typeof value !== "string"))) ||
         typeof server.server_label !== "string" || !/^[a-zA-Z0-9_-]+$/.test(server.server_label) ||
         server.server_label === "functions" || labels.has(server.server_label) ||
         typeof server.server_url !== "string" ||
         (server.allowed_tools !== null && (!Array.isArray(server.allowed_tools) ||
-          server.allowed_tools.some((name: unknown) => typeof name !== "string" || !/^[a-zA-Z0-9_.-]+$/.test(name))))) {
+          server.allowed_tools.some((name: unknown) => typeof name !== "string")))) {
       throw new Error("invalid_request");
     }
     const url = new URL(server.server_url);
     if (!["http:", "https:"].includes(url.protocol) || !url.hostname || url.username || url.password ||
-        server.server_url.includes("?") || server.server_url.includes("#")) throw new Error("invalid_request");
+        server.server_url.includes("#")) throw new Error("invalid_request");
     if (server.bearer_token_env_var !== undefined) {
       const reference = server.bearer_token_env_var;
       if (url.protocol !== "https:" || typeof reference !== "string" ||
@@ -52,11 +57,15 @@ export class MCPProfile {
   readonly denied: string[] = [];
   readonly identities = new Map<string, ToolIdentity>();
   private sessionID = "";
-  private localTools = new Set<string>();
   private admitted = false;
   private release!: (ready: boolean) => void;
   private readonly ready = new Promise<boolean>(resolve => { this.release = resolve; });
 
+  // Declared servers expose only their selected tools. Other native tools are not Core's to restrict.
+  private unselected(name: string): boolean {
+    return !this.identities.has(name) && this.declarations.some(server => name.startsWith(`mcp__${server.server_label}__`));
+  }
+
   readonly beforeTool: HookCallback = async (input, id, { signal }) => {
     let stopped!: () => void;
     const interrupted = new Promise<boolean>(resolve => {
@@ -65,9 +74,8 @@ export class MCPProfile {
     });
     try {
       if (!signal.aborted && await Promise.race([this.ready, interrupted]) && !signal.aborted && this.admitted &&
-          input.hook_event_name === "PreToolUse" && input.agent_id === undefined && input.session_id === this.sessionID &&
-          (id === undefined || id === input.tool_use_id) &&
-          (this.identities.has(input.tool_name) || this.functions.includes(input.tool_name) || this.localTools.has(input.tool_name))) return {};
+          input.hook_event_name === "PreToolUse" && this.permitsActor(input.agent_id) && input.session_id === this.sessionID &&
+          (id === undefined || id === input.tool_use_id) && !this.unselected(input.tool_name)) return {};
       return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny",
         permissionDecisionReason: "Tool is outside the verified execution profile." } };
     } finally {
@@ -75,7 +83,8 @@ export class MCPProfile {
     }
   };
 
-  constructor(private readonly declarations: (HTTPServer | StdioServer)[], private readonly functions: string[]) {
+  // permitsActor tells whether an agent may call tools: the root always, a Subagent once native has started it.
+  constructor(private readonly declarations: (HTTPServer | StdioServer)[], private readonly functions: string[], private readonly permitsActor: (id?: string) => boolean = id => id === undefined) {
     this.allowed = [...functions];
     for (const server of declarations) {
       const prefix = `mcp__${server.server_label}__`;
@@ -84,10 +93,11 @@ export class MCPProfile {
       } else {
         const reference = server.bearer_token_env_var;
         if (reference && !process.env[reference]) throw new Error("missing MCP credential environment");
-        // An explicit empty Authorization suppresses native OAuth and automatic auth.
+        // An explicit Authorization, empty unless declared, suppresses native OAuth and automatic auth.
         // Keep bearer references literal: SDK server configuration enters native argv.
+        const declared = Object.keys(server.headers ?? {}).some(name => name.toLowerCase() === "authorization");
         this.servers[server.server_label] = { type: "http", url: server.server_url, alwaysLoad: true,
-          headers: { Authorization: reference ? `Bearer \${${reference}}` : "" } };
+          headers: { ...server.headers, ...(!declared && { Authorization: reference ? `Bearer \${${reference}}` : "" }) } };
       }
       if (server.allowed_tools === null) this.allowed.push(prefix + "*");
       else if (!server.allowed_tools.length) this.denied.push(prefix + "*");
@@ -95,24 +105,67 @@ export class MCPProfile {
     }
   }
 
-  verify(inventory: string[], statuses: McpServerStatus[], sessionID: string, localTools: readonly string[] = []): void {
+  // Lists each subset server with the credentials of its native configuration and returns the native names of the tools it did not select.
+  // A server that cannot be listed fails the query, as a native connection failure does at initialization.
+  async unselectedTools(signal: AbortSignal): Promise<string[]> {
+    const hidden: string[] = [];
+    for (const server of this.declarations) {
+      if ("command" in server || !server.allowed_tools?.length) continue;
+      const selected = new Set(server.allowed_tools.map(name => nativeToolName(server.server_label, name)));
+      const reference = server.bearer_token_env_var;
+      const client = new Client({ name: "oac-claude-sdk-adapter", version: "0.0.0" });
+      try {
+        await client.connect(new StreamableHTTPClientTransport(new URL(server.server_url),
+          { requestInit: { headers: { ...server.headers, ...(reference && { Authorization: `Bearer ${process.env[reference]}` }) } } }), { signal });
+        let cursor: string | undefined;
+        const cursors = new Set<string>();
+        do {
+          const page = await client.listTools({ cursor }, { signal });
+          for (const tool of page.tools) {
+            const native = nativeToolName(server.server_label, tool.name);
+            if (!selected.has(native)) hidden.push(native);
+          }
+          cursor = page.nextCursor;
+          // A repeated cursor would page forever.
+          if (cursor !== undefined && cursors.has(cursor)) throw new Error("MCP tool listing repeated a cursor");
+          if (cursor !== undefined) cursors.add(cursor);
+        } while (cursor);
+      } finally {
+        await client.close();
+      }
+    }
+    return hidden;
+  }
+
+  // With exact inventory the text profile accepts nothing but the declared servers and tools.
+  verify(inventory: string[], statuses: McpServerStatus[], sessionID: string, exact = true, extra: string[] = []): void {
     // Native status.config can contain expanded headers. Retain only identities;
     // never publish or persist the private SDK control response.
     this.admitted = false;
     const expected = new Map<string, ToolIdentity>();
     const declared = new Map(this.declarations.map(server => [server.server_label, server]));
     const seen = new Set<string>();
-    const baseline = [...this.functions, ...localTools];
-    const nativeNames = new Set(baseline);
+    let matched = 0;
+    const nativeNames = new Set(this.functions);
     for (const status of statuses) {
       if (seen.has(status.name)) throw new Error("duplicate native MCP server");
       seen.add(status.name);
       if (status.name === "functions" && this.functions.length) {
         if (status.status !== "connected") throw new Error("native function server unavailable");
+        matched++;
         continue;
       }
       const server = declared.get(status.name);
-      if (!server || status.status !== "connected") throw new Error("native MCP server unavailable or undeclared");
+      if (!server) {
+        if (exact) throw new Error("native MCP server unavailable or undeclared");
+        continue;
+      }
+      matched++;
+      // Native runs on without an optional server that did not connect.
+      if (status.status !== "connected") {
+        if ("required" in server && server.required) throw new Error("required native MCP server unavailable");
+        continue;
+      }
       for (const tool of status.tools ?? []) {
         const native = nativeToolName(server.server_label, tool.name);
         if (nativeNames.has(native)) throw new Error("ambiguous native MCP identity");
@@ -121,14 +174,14 @@ export class MCPProfile {
         expected.set(native, { server: server.server_label, name: tool.name });
       }
     }
-    if (seen.size !== declared.size + (this.functions.length ? 1 : 0) ||
-        inventory.length !== expected.size + baseline.length || new Set(inventory).size !== inventory.length ||
-        inventory.some(name => !expected.has(name) && !baseline.includes(name))) {
+    if (matched !== declared.size + (this.functions.length ? 1 : 0) ||
+        !exact && [...expected.keys()].some(name => !inventory.includes(name)) ||
+        exact && (inventory.length !== expected.size + this.functions.length + extra.length || new Set(inventory).size !== inventory.length ||
+          inventory.some(name => !expected.has(name) && !this.functions.includes(name) && !extra.includes(name)))) {
       throw new Error("unexpected native MCP inventory");
     }
     this.identities.clear();
     for (const [name, identity] of expected) this.identities.set(name, identity);
-    this.localTools = new Set(localTools);
     this.sessionID = sessionID;
     this.admitted = true;
     this.release(true);
@@ -143,8 +196,6 @@ export class MCPProfile {
     }
   }
 
-  permits(name: string): boolean { return this.admitted && this.identities.has(name); }
-
   credentialReferences(): string[] {
     return this.declarations.flatMap(server => "bearer_token_env_var" in server && server.bearer_token_env_var ? [server.bearer_token_env_var] : []);
   }
diff --git a/packages/claude-sdk-adapter/src/mcp_environment.ts b/packages/claude-sdk-adapter/src/mcp_environment.ts
index b949b6e7c..8dffa8ad0 100644
--- a/packages/claude-sdk-adapter/src/mcp_environment.ts
+++ b/packages/claude-sdk-adapter/src/mcp_environment.ts
@@ -6,6 +6,9 @@ export type StdioServer = {
   command: string;
   args: string[];
   allowed_tools: null;
+  required?: boolean;
+  // A public stdio server runs the caller's command; installed servers run the Runtime launcher.
+  declared?: true;
 };
 export type EnvironmentMCPServer = HTTPServer | StdioServer;
 
@@ -17,13 +20,18 @@ export function parseEnvironmentMCP(value: unknown): EnvironmentMCPServer[] | un
   for (const server of value) {
     if (!server || typeof server !== "object" || labels.has(server.server_label)) throw new Error("invalid_request");
     if ("command" in server) {
-        if (Object.keys(server).some(key => !["server_label", "command", "args", "allowed_tools"].includes(key)) ||
+        const declared = server.declared === true;
+        if (Object.keys(server).some(key => !["server_label", "command", "args", "allowed_tools", ...(declared ? ["declared", "required"] : [])].includes(key)) ||
+            (server.declared !== undefined && !declared) || (server.required !== undefined && typeof server.required !== "boolean") ||
             typeof server.server_label !== "string" || !/^[a-zA-Z0-9_-]+$/.test(server.server_label) || server.server_label === "functions" || server.allowed_tools !== null ||
-            typeof server.command !== "string" || !isAbsolute(server.command) || normalize(server.command) !== server.command ||
-            !Array.isArray(server.args) || server.args.length !== 4 || server.args[0] !== "runtime-mcp-exec" ||
-            typeof server.args[1] !== "string" || !isAbsolute(server.args[1]) || normalize(server.args[1]) !== server.args[1] || server.args[1] === parse(server.args[1]).root ||
-            typeof server.args[2] !== "string" || !server.args[2] || /[\\]/.test(server.args[2]) || server.args[2].split("/").some((part: string) => !part || part === "." || part === "..") ||
-            server.args[3] !== server.server_label || [server.command, ...server.args].some((part: string) => /[\x00-\x1f\x7f]/.test(part))) throw new Error("invalid_request");
+            typeof server.command !== "string" || !Array.isArray(server.args) ||
+            [server.command, ...server.args].some((part: unknown) => typeof part !== "string" || (declared ? part.includes("\0") : /[\x00-\x1f\x7f]/.test(part)))) throw new Error("invalid_request");
+        if (!declared && (!isAbsolute(server.command) || normalize(server.command) !== server.command ||
+            server.args.length !== 4 || server.args[0] !== "runtime-mcp-exec" ||
+            !isAbsolute(server.args[1]) || normalize(server.args[1]) !== server.args[1] || server.args[1] === parse(server.args[1]).root ||
+            !server.args[2] || /[\\]/.test(server.args[2]) || server.args[2].split("/").some((part: string) => !part || part === "." || part === "..") ||
+            server.args[3] !== server.server_label)) throw new Error("invalid_request");
+        if (declared && !server.command.trim()) throw new Error("invalid_request");
         labels.add(server.server_label);
 
     } else {
diff --git a/packages/claude-sdk-adapter/src/message_input.ts b/packages/claude-sdk-adapter/src/message_input.ts
index fc5454b37..90ca676bd 100644
--- a/packages/claude-sdk-adapter/src/message_input.ts
+++ b/packages/claude-sdk-adapter/src/message_input.ts
@@ -3,32 +3,20 @@ import type { SDKUserMessage } from "@anthropic-ai/claude-agent-sdk";
 export type InputContent = { type: "input_text"; text: string } | { type: "input_image"; image_url: string };
 export type MessageInput = { content: InputContent[] }[];
 
-// Core admission declares whitespace-only text unqualified for this harness.
-export class EmptyUserMessageError extends Error {
-  constructor() { super("Empty user message."); }
-}
-
-// The explicit union of ECMAScript trim (WhiteSpace and LineTerminator) and Go
-// unicode.IsSpace. Core admission uses the same set for this harness.
-const blankText = /^[\t\n\v\f\r \u0085\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]*$/u;
-
-export function isBlankText(text: string): boolean { return blankText.test(text); }
-
 // This is the common Runtime representation; native image blocks stay here.
 export function parseMessageInput(value: unknown): MessageInput {
   if (!Array.isArray(value) || !value.length) throw new Error("Invalid user messages.");
   for (const message of value) {
     if (!message || typeof message !== "object" || Object.keys(message).some(key => key !== "content") ||
         !Array.isArray(message.content) || !message.content.length) throw new Error("Invalid user message.");
-    const content = parseInputContent(message.content);
-    const meaningful = content.some(part => part.type === "input_image" || !isBlankText(part.text));
-    if (!meaningful) throw new EmptyUserMessageError();
+    parseInputContent(message.content, true);
   }
   return value as MessageInput;
 }
 
 // Function results share content validation but permit empty arrays and empty text.
-export function parseInputContent(content: unknown): InputContent[] {
+// Only a user message image that is not a data URL becomes a native URL source.
+export function parseInputContent(content: unknown, remote = false): InputContent[] {
   if (!Array.isArray(content)) throw new Error("Invalid input content.");
   for (const part of content) {
     if (!part || typeof part !== "object") throw new Error("Invalid user content.");
@@ -36,22 +24,24 @@ export function parseInputContent(content: unknown): InputContent[] {
       continue;
     } else if (part.type === "input_image" && typeof part.image_url === "string" &&
         Object.keys(part).every(key => key === "type" || key === "image_url")) {
-      imageSource(part.image_url);
+      if (!remote || part.image_url.startsWith("data:")) imageSource(part.image_url);
     } else throw new Error("Invalid user content.");
   }
   return content as InputContent[];
 }
 
-export function imageSource(url: string): { type: "base64"; media_type: "image/png" | "image/jpeg"; data: string } {
-  const match = /^data:(image\/png|image\/jpeg);base64,([A-Za-z0-9+/]+={0,2})$/.exec(url);
+type MediaType = "image/png" | "image/jpeg" | "image/gif" | "image/webp";
+
+export function imageSource(url: string): { type: "base64"; media_type: MediaType; data: string } {
+  const match = /^data:(image\/(?:png|jpeg|gif|webp));base64,([A-Za-z0-9+/]+={0,2})$/.exec(url);
   if (!match || Buffer.from(match[2]!, "base64").toString("base64") !== match[2]) throw new Error("Unsupported image reference.");
-  return { type: "base64", media_type: match[1] as "image/png" | "image/jpeg", data: match[2]! };
+  return { type: "base64", media_type: match[1] as MediaType, data: match[2]! };
 }
 
-export function nativeContent(message: MessageInput[number]): SDKUserMessage["message"]["content"] {
+export function nativeContent(message: MessageInput[number], remote = false): SDKUserMessage["message"]["content"] {
   return message.content.map(part => part.type === "input_text"
     ? { type: "text" as const, text: part.text }
-    : { type: "image" as const, source: imageSource(part.image_url) });
+    : { type: "image" as const, source: remote && !part.image_url.startsWith("data:") ? { type: "url" as const, url: part.image_url } : imageSource(part.image_url) });
 }
 
 export function textInput(text: string): MessageInput { return [{ content: [{ type: "input_text", text }] }]; }
diff --git a/packages/claude-sdk-adapter/src/messages.ts b/packages/claude-sdk-adapter/src/messages.ts
index 7a47fc8bd..b9a98faa2 100644
--- a/packages/claude-sdk-adapter/src/messages.ts
+++ b/packages/claude-sdk-adapter/src/messages.ts
@@ -2,7 +2,8 @@ import type { SDKMessage } from "@anthropic-ai/claude-agent-sdk";
 
 export type MessageEvent =
   | { type: "delta"; delta: string; item_id: string }
-  | { type: "output_message"; message: { id: string; status: "in_progress" | "completed"; phase?: "final_answer"; text?: string } };
+  | { type: "output_message"; message: { id: string; status: "in_progress" | "completed"; phase?: "final_answer"; text?: string } }
+  | { type: "reasoning"; reasoning: { id: string; status: "in_progress" | "completed"; delta?: string } };
 
 type ActiveMessage = {
   id: string;
@@ -10,10 +11,14 @@ type ActiveMessage = {
   block?: number;
   observed: boolean;
   failed: boolean;
+  // Thinking blocks in progress, and whether each has reported text.
+  thinking: Map<number, boolean>;
 };
 
 export class MessageObserver {
   private active?: ActiveMessage;
+  // Native thinking blocks are reported as reasoning only when the Agent requested summaries.
+  constructor(private readonly reasoning = false) {}
 
   consume(message: SDKMessage): MessageEvent[] {
     if ((message.type !== "stream_event" && message.type !== "assistant") ||
@@ -35,13 +40,19 @@ export class MessageObserver {
     const event = message.event;
     if (event.type === "message_start") {
       if (!event.message.id) throw new Error("missing native message identity");
-      this.active = { id: event.message.id, blocks: new Map(), observed: false, failed: false };
+      this.active = { id: event.message.id, blocks: new Map(), observed: false, failed: false, thinking: new Map() };
       return [];
     }
     const active = this.active;
     if (!active) throw new Error("native message start is missing");
     if (event.type === "content_block_start") {
       active.block = event.index;
+      if (event.content_block.type === "thinking" && this.reasoning) {
+        // A block reports nothing until its first text, so one without text is not reported.
+        const delta = event.content_block.thinking;
+        active.thinking.set(event.index, !!delta);
+        return delta ? [{ type: "reasoning", reasoning: { id: `${active.id}:${event.index}`, status: "in_progress", delta } }] : [];
+      }
       if (event.content_block.type !== "text") return [];
       active.blocks.set(event.index, event.content_block.text);
       const events: MessageEvent[] = [];
@@ -58,7 +69,17 @@ export class MessageObserver {
       active.blocks.set(event.index, previous + event.delta.text);
       return event.delta.text ? [{ type: "delta", item_id: active.id, delta: event.delta.text }] : [];
     }
-    if (event.type === "content_block_stop") active.block = undefined;
+    if (event.type === "content_block_delta" && event.delta.type === "thinking_delta" && active.thinking.has(event.index)) {
+      if (!event.delta.thinking) return [];
+      active.thinking.set(event.index, true);
+      return [{ type: "reasoning", reasoning: { id: `${active.id}:${event.index}`, status: "in_progress", delta: event.delta.thinking } }];
+    }
+    if (event.type === "content_block_stop") {
+      active.block = undefined;
+      const reported = active.thinking.get(event.index);
+      active.thinking.delete(event.index);
+      if (reported) return [{ type: "reasoning", reasoning: { id: `${active.id}:${event.index}`, status: "completed" } }];
+    }
     if (event.type === "message_stop") {
       this.active = undefined;
       if (active.observed && !active.failed) {
diff --git a/packages/claude-sdk-adapter/src/request.ts b/packages/claude-sdk-adapter/src/request.ts
index 9cdd460ed..1b00a08e0 100644
--- a/packages/claude-sdk-adapter/src/request.ts
+++ b/packages/claude-sdk-adapter/src/request.ts
@@ -16,9 +16,10 @@ export type Start = {
   cwd: string;
   resume?: string;
   require_history?: boolean;
-  observe_messages?: boolean;
   subagents?: { max_concurrent: number };
   tool_search?: boolean;
+  reasoning_summary?: boolean;
+  web_search?: "disabled" | "live";
   functions?: { name: string; description: string; parameters: Tool["inputSchema"]; defer_loading?: boolean }[];
   mcp_http_servers?: HTTPServer[];
   workspace?: Workspace;
@@ -35,15 +36,16 @@ export function parseRequest(line: string): Start | Prepare | ExecutorPrepare {
   const value: unknown = JSON.parse(line);
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid_request");
   const request = value as Record<string, unknown>;
-  const allowed = new Set(["native_model_options", "type", "input", "model", "system_prompt", "cwd", "resume", "require_history", "observe_messages", "output_format", "subagents", "functions", "tool_search", "mcp_http_servers", "workspace"]);
+  const allowed = new Set(["native_model_options", "type", "input", "model", "system_prompt", "cwd", "resume", "require_history", "output_format", "subagents", "functions", "tool_search", "reasoning_summary", "web_search", "mcp_http_servers", "workspace"]);
   if (Object.keys(request).some(key => !allowed.has(key)) ||
       (request.type !== "start" && request.type !== "prepare" && request.type !== "executor_prepare") ||
       (request.type === "start" ? !Array.isArray(request.input) : "input" in request) ||
       typeof request.model !== "string" || !request.model.trim() ||
       typeof request.system_prompt !== "string" ||
       typeof request.cwd !== "string" || !isAbsolute(request.cwd) ||
-      (request.observe_messages !== undefined && typeof request.observe_messages !== "boolean") ||
+      (request.web_search !== undefined && request.web_search !== "disabled" && request.web_search !== "live") ||
       (request.require_history !== undefined && typeof request.require_history !== "boolean") ||
+      (request.reasoning_summary !== undefined && typeof request.reasoning_summary !== "boolean") ||
       (request.resume !== undefined && (typeof request.resume !== "string" || !request.resume))) throw new Error("invalid_request");
   if (request.functions !== undefined && (!Array.isArray(request.functions) || request.functions.some(tool =>
       !tool || typeof tool.name !== "string" || !tool.name || typeof tool.description !== "string" ||
@@ -51,25 +53,20 @@ export function parseRequest(line: string): Start | Prepare | ExecutorPrepare {
       !tool.parameters || tool.parameters.type !== "object"))) throw new Error("invalid_request");
   const deferred = (request.functions as Start["functions"])?.some(tool => tool.defer_loading) ?? false;
   if ((request.tool_search !== undefined && typeof request.tool_search !== "boolean") ||
-      (!!request.tool_search !== deferred) ||
-      (request.tool_search && (request.subagents || request.mcp_http_servers !== undefined || request.output_format))) throw new Error("invalid_request");
+      (!!request.tool_search !== deferred)) throw new Error("invalid_request");
   if (request.subagents !== undefined) {
     const value = request.subagents as Record<string, unknown>;
-    if (!value || typeof value !== "object" || Object.keys(value).length !== 1 || !Number.isSafeInteger(value.max_concurrent) || (value.max_concurrent as number) < 1 ||
-        (request.functions as unknown[] | undefined)?.length || request.mcp_http_servers !== undefined) throw new Error("invalid_request");
+    if (!value || typeof value !== "object" || Object.keys(value).length !== 1 || !Number.isSafeInteger(value.max_concurrent) || (value.max_concurrent as number) < 1) throw new Error("invalid_request");
   }
   if (request.output_format !== undefined) {
     const format = request.output_format as Start["output_format"];
     if (!format || format.type !== "json_schema" || Object.keys(format).some(key => !["type", "schema"].includes(key)) ||
-        !format.schema || format.schema.type !== "object" || !request.observe_messages || request.subagents ||
-        request.mcp_http_servers !== undefined) throw new Error("invalid_request");
+        !format.schema || format.schema.type !== "object") throw new Error("invalid_request");
   }
   if (request.type === "start") requestInput(request.input);
   parseNativeModelOptions(request.native_model_options);
   parseHTTPServers(request.mcp_http_servers);
   const workspace = parseWorkspace(request.workspace, request.cwd);
-  if (request.subagents && workspace?.mcp?.length) throw new Error("invalid_request");
-  if ((request.output_format || request.tool_search) && (workspace?.mcp?.length || workspace?.skills?.length)) throw new Error("invalid_request");
   if (request.require_history && !workspace) throw new Error("invalid_request");
   if ((workspace && "mcp_http_servers" in request) ||
       (request.type === "prepare" && !workspace)) throw new Error("invalid_request");
diff --git a/packages/claude-sdk-adapter/src/runtime_check.ts b/packages/claude-sdk-adapter/src/runtime_check.ts
index 730030d6d..a9f47bdac 100644
--- a/packages/claude-sdk-adapter/src/runtime_check.ts
+++ b/packages/claude-sdk-adapter/src/runtime_check.ts
@@ -8,7 +8,9 @@ import { fileURLToPath } from "node:url";
 
 // This companion checks the exact bridge used by execution, without a model query.
 try {
-  assert(Number(process.versions.node.split(".")[0]) >= 20, "unsupported_node");
+  // --use-env-proxy, which routes the bridge's own fetch through the operator's proxy, needs 22.21 or 24.5.
+  const [major, minor] = process.versions.node.split(".").map(Number);
+  assert(major === 22 ? minor >= 21 : major === 24 ? minor >= 5 : major > 24, "unsupported_node");
   const root = await realpath(fileURLToPath(new URL("..", import.meta.url)));
   const inside = async (path: string) => {
     const resolved = await realpath(path);
diff --git a/packages/claude-sdk-adapter/src/search_observer.ts b/packages/claude-sdk-adapter/src/search_observer.ts
new file mode 100644
index 000000000..d4eb60e7f
--- /dev/null
+++ b/packages/claude-sdk-adapter/src/search_observer.ts
@@ -0,0 +1,60 @@
+import type { SDKMessage } from "@anthropic-ai/claude-agent-sdk";
+
+type Action = { type: "search"; query: string } | { type: "open_page"; url: string };
+type Observation = { kind: "web_search"; status: "in_progress" | "completed" | "failed" | "incomplete"; action: Action };
+export type SearchEvent = {
+  type: "search_observation"; session_id: string; id: string;
+  stage: "before" | "after"; observation: Observation;
+};
+
+// Projects the native WebSearch and WebFetch calls of the root thread as web search Items.
+export class SearchObserver {
+  private readonly calls = new Map<string, Observation>();
+
+  *consume(message: SDKMessage, sessionID: string): Generator<SearchEvent, void> {
+    if ((message.type !== "assistant" && message.type !== "user") || message.parent_tool_use_id !== null ||
+        ("isSynthetic" in message && message.isSynthetic) || ("isReplay" in message && message.isReplay)) return;
+    const content = message.message.content;
+    if (!Array.isArray(content)) return;
+    if (message.type === "assistant") {
+      if (message.error) return;
+      for (const block of content) {
+        if (block.type !== "tool_use" || this.calls.has(block.id)) continue;
+        const input = block.input as Record<string, unknown> | null;
+        let action: Action | undefined;
+        if (block.name === "WebSearch" && typeof input?.query === "string") action = { type: "search", query: input.query };
+        else if (block.name === "WebFetch" && typeof input?.url === "string") action = { type: "open_page", url: input.url };
+        if (!action) continue;
+        const observation: Observation = { kind: "web_search", status: "in_progress", action };
+        this.calls.set(block.id, observation);
+        yield this.event(sessionID, block.id, "before", observation);
+      }
+    } else {
+      for (const block of content) {
+        if (block.type !== "tool_result") continue;
+        const call = this.calls.get(block.tool_use_id);
+        if (!call || call.status !== "in_progress") continue;
+        call.status = block.is_error ? "failed" : "completed";
+        yield this.event(sessionID, block.tool_use_id, "after", call);
+      }
+    }
+  }
+
+  assertComplete(): void {
+    if ([...this.calls.values()].some(call => call.status === "in_progress")) throw new Error("unconfirmed search result");
+  }
+
+  close(sessionID: string): SearchEvent[] {
+    const events: SearchEvent[] = [];
+    for (const [id, call] of this.calls) {
+      if (call.status !== "in_progress") continue;
+      call.status = "incomplete";
+      events.push(this.event(sessionID, id, "after", call));
+    }
+    return events;
+  }
+
+  private event(sessionID: string, id: string, stage: "before" | "after", observation: Observation): SearchEvent {
+    return { type: "search_observation", session_id: sessionID, id, stage, observation: { ...observation } };
+  }
+}
diff --git a/packages/claude-sdk-adapter/src/subagent_history.ts b/packages/claude-sdk-adapter/src/subagent_history.ts
index b7e6aa0d0..38ce8adc2 100644
--- a/packages/claude-sdk-adapter/src/subagent_history.ts
+++ b/packages/claude-sdk-adapter/src/subagent_history.ts
@@ -1,17 +1,19 @@
 import { readFile, realpath, stat, writeFile, link, unlink } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { dirname, join, relative } from "node:path";
+import type { ToolIdentity } from "./mcp.js";
 
 export type Fact = { type: "subagent_identity" | "subagent_turn" | "subagent_item" | "subagent_coordination"; fact: Record<string, unknown> };
 export type NativeRow = {
   type: string; uuid?: string; parentUuid?: string | null; sessionId?: string; agentId?: string;
-  isSidechain?: boolean; timestamp?: string; toolUseResult?: Record<string, unknown>;
+  isSidechain?: boolean; timestamp?: string; toolUseResult?: Record<string, unknown>; mcpMeta?: Record<string, unknown>;
   message?: { id?: string; role?: string; content?: unknown; stop_reason?: string | null };
 };
 type Call = { id: string; name: string; input: Record<string, unknown>; turn: string; result?: Record<string, unknown>; error?: boolean; finished?: boolean };
 export type Cancellation = { root: string; native_id: string; turn_id: string; source_item_id: string; last_item_id: string; completed_at_ms: number };
 type Entry = { id: string; metadata: Record<string, unknown>; rows: NativeRow[]; cancellations?: Cancellation[] };
 type Child = { id: string; parent: string; call: Call; rows: NativeRow[]; opened: number; cancellations: Cancellation[] };
+const functionPrefix = "mcp__functions__";
 const identity = /^[A-Za-z0-9_-]{1,160}$/;
 function fail(): never { throw new Error("invalid native child history"); }
 const blocks = (r: NativeRow): Record<string, unknown>[] => Array.isArray(r.message?.content) ? r.message.content as Record<string, unknown>[] : [];
@@ -37,7 +39,10 @@ function calls(rows: NativeRow[]): Map<string, Call> {
   return result;
 }
 
-export function projectHistory(root: string, rootRows: NativeRow[], entries: Entry[]): Fact[] {
+// With live, the children are still running: admitted names the ones native started in this Turn, and only their open Turn is projected.
+export type Projection = { live?: ReadonlyMap<string, string>; tools?: ReadonlyMap<string, ToolIdentity>; reasoning?: boolean };
+
+export function projectHistory(root: string, rootRows: NativeRow[], entries: Entry[], { live, tools = new Map(), reasoning = false }: Projection = {}): Fact[] {
   const facts: Fact[] = [], children = new Map<string, Child>();
   const byParent = new Map<string, Map<string, Call>>([[root, calls(rootRows)]]);
   for (const entry of entries) byParent.set(entry.id, calls(entry.rows));
@@ -54,7 +59,7 @@ export function projectHistory(root: string, rootRows: NativeRow[], entries: Ent
       if (!own || receipt.root !== root || receipt.native_id !== id || receipt.source_item_id !== call.id ||
           !rows.some(r => r.uuid === receipt.last_item_id) || !Number.isSafeInteger(receipt.completed_at_ms) || receipt.completed_at_ms < time(own)) fail();
     }
-    if (call.result?.agentId !== id && !cancellations.some(r => r.turn_id === first.uuid)) fail();
+    if (call.result?.agentId !== id && !(live ? live.has(id) : cancellations.some(r => r.turn_id === first.uuid))) fail();
     children.set(id, { id, parent, call, rows, opened: time(first), cancellations });
   }
   const ordered: Child[] = [], pending = new Map(children);
@@ -68,8 +73,8 @@ export function projectHistory(root: string, rootRows: NativeRow[], entries: Ent
     parent_turn_id: child.call.turn, source_item_id: child.call.id, name: typeof child.call.input.name === "string" ? child.call.input.name : null,
     instructions: null,
   } });
-  for (const child of ordered) facts.push(...projectChild(child, children));
-  for (const call of byParent.get(root)!.values()) {
+  for (const child of ordered) facts.push(...(live ? [openTurn(child)] : projectChild(child, children, tools, reasoning)));
+  if (!live) for (const call of byParent.get(root)!.values()) {
     const coordination = coordinationFact(call, "", children);
     if (coordination) facts.push({ type: "subagent_coordination", fact: coordination });
   }
@@ -79,14 +84,42 @@ export function projectHistory(root: string, rootRows: NativeRow[], entries: Ent
 function coordinationFact(call: Call, actor: string, children: Map<string, Child>): Record<string, unknown> | undefined {
   const spawn = ["Agent", "Task"].includes(call.name), send = call.name === "SendMessage";
   if (!spawn && !send) return;
-  const recipient = spawn ? call.result?.agentId ?? [...children.values()].find(c => c.call.id === call.id)?.id : call.input.to;
+  // Native records the resolved child in a successful send result.
+  const recipient = spawn ? call.result?.agentId ?? [...children.values()].find(c => c.call.id === call.id)?.id
+    : (call.result?.pin as { id?: string } | undefined)?.id ?? (children.has(call.input.to as string) ? call.input.to : undefined);
   if (!call.error && (typeof recipient !== "string" || !children.has(recipient))) fail();
   return { id: call.id, kind: spawn ? "create_subagent_call" : "send_subagent_input_call", status: call.error || !call.finished ? "failed" : "completed",
     actor_id: actor, recipients: typeof recipient === "string" ? [recipient] : [], text: typeof (spawn ? call.input.prompt : call.input.message) === "string" ? (spawn ? call.input.prompt : call.input.message) : null,
-    model: null, reasoning_effort: null };
+    model: spawn && typeof call.input.model === "string" ? call.input.model : null, reasoning_effort: null };
+}
+
+// Core resolves a running child's call through its identity and open Turn.
+function openTurn(child: Child): Fact {
+  const first = child.rows.filter(input).at(-1)!, created = time(first);
+  return { type: "subagent_turn", fact: { native_id: child.id, turn_id: first.uuid!, created_at_ms: created, started_at_ms: created, status: "in_progress" } };
 }
 
-function projectChild(child: Child, children: Map<string, Child>): Fact[] {
+// Maps a child's native tool call to its neutral observation; other native tools are not projected.
+function observation(call: Call, tools: ReadonlyMap<string, ToolIdentity>): Record<string, unknown> | undefined {
+  if (call.name === "Bash") {
+    if (typeof call.input.command !== "string") fail();
+    return { kind: "command", command: call.input.command };
+  }
+  if (call.name.startsWith(functionPrefix)) return { kind: "function", name: call.name.slice(functionPrefix.length), arguments: call.input };
+  const mcp = tools.get(call.name);
+  return mcp && { kind: "mcp", server: mcp.server, name: mcp.name, arguments: call.input };
+}
+
+// A native function result holds a string or text and base64 image blocks.
+function functionContent(content: unknown): Record<string, unknown>[] {
+  if (typeof content === "string") return [{ type: "input_text", text: content }];
+  if (!Array.isArray(content)) fail();
+  return content.map(b => b.type === "text" && typeof b.text === "string" ? { type: "input_text", text: b.text }
+    : b.type === "image" && b.source?.type === "base64" ? { type: "input_image", image_url: `data:${b.source.media_type};base64,${b.source.data}` } : fail());
+}
+
+// Thinking blocks project as reasoning only when the Agent requested summaries.
+function projectChild(child: Child, children: Map<string, Child>, tools: ReadonlyMap<string, ToolIdentity>, reasoning: boolean): Fact[] {
   const facts: Fact[] = [], turns: NativeRow[][] = [];
   for (const row of child.rows) {
     if (input(row)) turns.push([]);
@@ -120,7 +153,7 @@ function projectChild(child: Child, children: Map<string, Child>): Fact[] {
       for (const block of blocks(row)) {
         if (block.type === "text" && typeof block.text === "string") message.text += block.text;
         else if (block.type === "thinking" && typeof block.thinking === "string") message.thinking += block.thinking;
-        const kind = block.type === "text" ? "text" : block.type === "thinking" ? "thinking" : block.type === "tool_use" ? "tool" : undefined;
+        const kind = block.type === "text" ? "text" : block.type === "thinking" && reasoning ? "thinking" : block.type === "tool_use" ? "tool" : undefined;
         if (kind) {
           const key = kind === "tool" ? block.id as string : id;
           if (!seen.has(kind + ":" + key)) { seen.add(kind + ":" + key); order.push({ id: key, kind }); }
@@ -138,17 +171,21 @@ function projectChild(child: Child, children: Map<string, Child>): Fact[] {
       const call = toolCalls.get(entry.id)!;
       const coordination = coordinationFact(call, child.id, children);
       if (coordination) { item(call.id, "subagent_coordination", coordination); continue; }
-      if (call.name !== "Bash") continue;
-      if (typeof call.input.command !== "string") fail();
-      const results = rows.flatMap(row => blocks(row)).filter(b => b.type === "tool_result" && b.tool_use_id === call.id);
+      const native = observation(call, tools);
+      if (!native) continue;
+      const owners = rows.filter(row => blocks(row).some(b => b.type === "tool_result" && b.tool_use_id === call.id));
+      const results = owners.flatMap(row => blocks(row)).filter(b => b.type === "tool_result" && b.tool_use_id === call.id);
       if (results.length > 1 || (!results.length && !cancellation)) fail();
-      if (!results.length) {
-        item(call.id, "tool_call", { id: call.id, stage: "after", observation: { kind: "command", status: "failed", command: call.input.command, output: "Native execution was cancelled." } });
-        continue;
-      }
-      const result = results[0], content = result.content;
+      const result = results[0], content = result?.content, owner = owners[0];
+      // The SDK sends a row that answers one call with its native result and MCP metadata, as the root's MCP Items keep it.
+      const mcpResult = owner?.toolUseResult !== undefined && blocks(owner).filter(b => b.type === "tool_result").length === 1
+        ? owner.mcpMeta ? { content: owner.toolUseResult, ...owner.mcpMeta } : owner.toolUseResult : content ?? null;
       const output = typeof content === "string" ? content : Array.isArray(content) ? content.filter(b => b.type === "text").map(b => b.text).join("\n") : "";
-      item(call.id, "tool_call", { id: call.id, stage: "after", observation: { kind: "command", status: result.is_error ? "failed" : "completed", command: call.input.command, output } });
+      const status = !result ? native.kind === "command" ? "failed" : "incomplete" : result.is_error ? "failed" : "completed";
+      const outcome = native.kind === "command" ? { output: result ? output : "Native execution was cancelled." }
+        : native.kind === "mcp" && result ? { [result.is_error ? "error" : "output"]: mcpResult }
+        : result ? { content: functionContent(content) } : {};
+      item(call.id, "tool_call", { id: call.id, stage: "after", observation: { ...native, status, ...outcome } });
     }
     if (completed !== undefined && cancellation) fail();
     const ended = completed ?? cancellation?.completed_at_ms;
@@ -158,7 +195,10 @@ function projectChild(child: Child, children: Map<string, Child>): Fact[] {
   return facts;
 }
 
-export async function readHistory(root: string, transcript: string, cwd: string, cancelled?: { at: number; admitted: ReadonlyMap<string, string> }): Promise<{ facts: Fact[]; ids: string[] }> {
+// With live, only that running child and its ancestors are read.
+export type Read = Projection & { cancelled?: { at: number; admitted: ReadonlyMap<string, string> }; child?: string };
+
+export async function readHistory(root: string, transcript: string, cwd: string, { cancelled, child, ...projection }: Read = {}): Promise<{ facts: Fact[]; ids: string[] }> {
   if (!identity.test(root) || !process.env.CLAUDE_CONFIG_DIR) fail();
   const state = await realpath(process.env.CLAUDE_CONFIG_DIR!);
   const path = await realpath(transcript);
@@ -176,21 +216,24 @@ export async function readHistory(root: string, transcript: string, cwd: string,
     return lines.map(line => JSON.parse(line) as NativeRow);
   }
   const { getSubagentMessages, listSubagents } = await import("@anthropic-ai/claude-agent-sdk");
-  const ids = await listSubagents(root, { dir: cwd });
+  const location = (id: string) => join(dirname(path), root, "subagents", "agent-" + (identity.test(id) ? id : fail()));
+  let ids: string[], at: string;
+  if (child === undefined) ids = await listSubagents(root, { dir: cwd });
+  else for (ids = [], at = child; at !== root && ids.length <= 64; at = JSON.parse(await read(location(at) + ".meta.json")).parentAgentId ?? root) ids.push(at);
   if (ids.length > 64 || new Set(ids).size !== ids.length) fail();
   const entries: Entry[] = [];
   for (const id of ids) {
-    if (!identity.test(id)) fail();
-    const base = join(dirname(path), root, "subagents", "agent-" + id);
-    const raw = await rows(base + ".jsonl"), metadata = JSON.parse(await read(base + ".meta.json"));
+    const base = location(id);
     // The SDK resolves the persisted conversation chain; raw records retain the
-    // native ownership and timestamps omitted by its public TypeScript shape.
+    // native ownership and timestamps omitted by its public TypeScript shape. A
+    // running child keeps appending, so the raw read follows the SDK read.
     const messages = await getSubagentMessages(root, id, { dir: cwd });
+    const raw = await rows(base + ".jsonl"), metadata = JSON.parse(await read(base + ".meta.json"));
     const own = new Map(raw.filter(r => r.uuid).map(r => [r.uuid, r]));
     if (!messages.length || messages.some(m => !own.has(m.uuid))) fail();
     const selected = messages.map(m => own.get(m.uuid)!);
     const cancellations: Cancellation[] = [];
-    const inputs = selected.filter(input);
+    const inputs = projection.live ? [] : selected.filter(input);
     for (let index = 0; index < inputs.length; index++) {
       const own = inputs[index];
       if (!own.uuid || !identity.test(own.uuid)) fail();
@@ -208,7 +251,7 @@ export async function readHistory(root: string, transcript: string, cwd: string,
     }
     entries.push({ id, metadata, rows: selected, cancellations });
   }
-  return { ids, facts: projectHistory(root, await rows(path), entries) };
+  return { ids, facts: projectHistory(root, await rows(path), entries, projection) };
 }
 
 // Link publishes a complete receipt without replacing an earlier effect. Native
diff --git a/packages/claude-sdk-adapter/src/subagents.ts b/packages/claude-sdk-adapter/src/subagents.ts
index add5e689d..5a2b1e06e 100644
--- a/packages/claude-sdk-adapter/src/subagents.ts
+++ b/packages/claude-sdk-adapter/src/subagents.ts
@@ -1,23 +1,27 @@
-import type { HookCallback, Options, SDKMessage } from "@anthropic-ai/claude-agent-sdk";
+import type { HookCallback, SDKMessage } from "@anthropic-ai/claude-agent-sdk";
 import { readHistory, type Fact } from "./subagent_history.js";
+import type { ToolIdentity } from "./mcp.js";
 
 const deny = (reason: string) => ({ hookSpecificOutput: { hookEventName: "PreToolUse" as const, permissionDecision: "deny" as const, permissionDecisionReason: reason } });
 export class Subagents {
   readonly known = new Set<string>();
   private readonly observedCalls = new Set<string>();
   private readonly pending = new Map<string, string>();
+  private readonly names = new Map<string, string>();
+  private readonly pendingNames = new Map<string, string>();
   private readonly running = new Map<string, string>();
   private readonly admitted = new Map<string, string>();
+  private readonly actors = new Map<string, string>();
   private session = "";
   private transcript = "";
   private hydrated = false;
-  constructor(private readonly cwd: string, private readonly limit: number, private resume: string | undefined) {
+  constructor(private readonly cwd: string, private readonly limit: number, private resume: string | undefined, private readonly tools: ReadonlyMap<string, ToolIdentity> = new Map(), private readonly reasoning = false) {
     if (!Number.isSafeInteger(limit) || limit < 1) throw new Error("invalid_request");
   }
   get complete(): boolean { return this.pending.size === 0 && this.running.size === 0; }
   beginTurn(): void {
     if (!this.complete) throw new Error("native child work is unsettled");
-    this.observedCalls.clear(); this.admitted.clear();
+    this.observedCalls.clear(); this.admitted.clear(); this.actors.clear();
   }
   expectSession(id: string | undefined): void { this.resume = id; }
   permitsActor(id?: string): boolean { return id === undefined || this.known.has(id); }
@@ -35,37 +39,46 @@ export class Subagents {
     const value = input.tool_input as Record<string, unknown>;
     if (!value || typeof value !== "object") return deny("Invalid subagent call.");
     const spawn = input.tool_name !== "SendMessage";
-    if (spawn ? value.subagent_type !== "oac_worker" || typeof value.prompt !== "string" || !value.prompt.trim() ||
-        value.isolation !== undefined || value.run_in_background === true || value.model !== undefined || value.mode !== undefined
-      : typeof value.to !== "string" || !this.known.has(value.to) || (value.type !== undefined && value.type !== "message") ||
+    // Native decides which agent types, models and modes exist; only a remote run, which needs an account Core does not hold, is refused.
+    const to = spawn ? "" : typeof value.to === "string" ? this.recipient(value.to) : "";
+    if (spawn ? typeof value.prompt !== "string" || !value.prompt.trim() || value.isolation === "remote"
+      : !this.known.has(to) || (value.type !== undefined && value.type !== "message") ||
         typeof value.message !== "string" || !value.message.trim()) return deny("Unsupported subagent operation.");
     if (this.pending.has(input.tool_use_id)) return {};
-    if (!spawn && (this.running.has(value.to as string) || [...this.pending.values()].includes(value.to as string))) return deny("The subagent is still running.");
+    if (!spawn && (this.running.has(to) || [...this.pending.values()].includes(to))) return deny("The subagent is still running.");
     {
       if (this.pending.size + this.running.size >= this.limit) return deny("The concurrent subagent limit has been reached.");
-      this.pending.set(input.tool_use_id, spawn ? "" : value.to as string);
+      this.pending.set(input.tool_use_id, to);
+      if (spawn && typeof value.name === "string") this.pendingNames.set(input.tool_use_id, value.name);
     }
     return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow" } };
   };
+  // A native MCP request names its tool call but not the agent that made it.
+  readonly noteTool: HookCallback = async input => {
+    if (input.hook_event_name === "PreToolUse" && input.agent_id !== undefined) this.actors.set(input.tool_use_id, input.agent_id);
+    return {};
+  };
+  // The child of a call, with the facts Core needs before it can resolve the call: the child's identity and its open Turn.
+  async child(call: string): Promise<{ native_id: string; turn_id: string; facts: Fact[] } | undefined> {
+    const id = this.actors.get(call);
+    if (id === undefined) return;
+    if (!this.transcript || !this.known.has(id)) throw new Error("native child history is missing");
+    const { facts } = await readHistory(this.session, this.transcript, this.cwd, { child: id, live: this.admitted, tools: this.tools, reasoning: this.reasoning });
+    return { native_id: id, turn_id: facts[facts.length - 1].fact.turn_id as string, facts };
+  }
   readonly stopped: HookCallback = async input => {
     if (input.hook_event_name === "Stop" && input.session_id === this.session && input.agent_id === undefined) this.transcript = input.transcript_path;
     return {};
   };
   readonly childStart: HookCallback = async input => {
-    if (input.hook_event_name !== "SubagentStart" || input.session_id !== this.session || input.agent_type !== "oac_worker" || !this.running.has(input.agent_id)) throw new Error("invalid native child start");
+    if (input.hook_event_name !== "SubagentStart" || input.session_id !== this.session || !this.running.has(input.agent_id)) throw new Error("invalid native child start");
     this.known.add(input.agent_id);
     return {};
   };
   readonly failedTool: HookCallback = async input => {
-    if (input.hook_event_name === "PostToolUseFailure") this.pending.delete(input.tool_use_id);
+    if (input.hook_event_name === "PostToolUseFailure") { this.pending.delete(input.tool_use_id); this.pendingNames.delete(input.tool_use_id); }
     return {};
   };
-  options(workspace: boolean): Pick<Options, "agents" | "forwardSubagentText"> {
-    return { forwardSubagentText: true, agents: { oac_worker: {
-      description: "A subagent for delegated work in this Session.", prompt: "Complete the delegated task using the available tools.", model: "inherit",
-      tools: [...(workspace ? ["Bash"] : []), "Agent", "SendMessage"],
-    } } };
-  }
   consume(message: SDKMessage): void {
     if (message.type === "assistant" && message.parent_tool_use_id === null) {
       for (const block of message.message.content) if (block.type === "tool_use") this.observedCalls.add(block.id);
@@ -79,6 +92,8 @@ export class Subagents {
       const recipient = this.pending.get(message.tool_use_id);
       if (recipient && recipient !== message.task_id) throw new Error("mismatched native continuation target");
       if (!this.pending.delete(message.tool_use_id) && !this.running.has(message.task_id)) throw new Error("unadmitted native child task");
+      const name = this.pendingNames.get(message.tool_use_id);
+      if (name !== undefined) { this.pendingNames.delete(message.tool_use_id); this.names.set(name, message.task_id); }
       this.known.add(message.task_id);
       this.running.set(message.task_id, message.tool_use_id);
       this.admitted.set(message.task_id, message.tool_use_id);
@@ -86,14 +101,25 @@ export class Subagents {
       if (this.running.get(message.task_id) !== message.tool_use_id) throw new Error("unmatched native child completion");
       this.running.delete(message.task_id);
     } else if (message.type === "user" && Array.isArray(message.message.content)) {
-      for (const block of message.message.content) if (block.type === "tool_result") this.pending.delete(block.tool_use_id);
+      for (const block of message.message.content) if (block.type === "tool_result") { this.pending.delete(block.tool_use_id); this.pendingNames.delete(block.tool_use_id); }
     }
   }
   async facts(cancelledAt?: number): Promise<Fact[]> {
     if (!this.session || !this.transcript) { if (!this.known.size) return []; throw new Error("native child history is missing"); }
     if (cancelledAt === undefined && (this.pending.size || this.running.size)) throw new Error("native child work is unsettled");
-    const history = await readHistory(this.session, this.transcript, this.cwd, cancelledAt === undefined ? undefined : { at: cancelledAt, admitted: this.admitted });
+    const history = await readHistory(this.session, this.transcript, this.cwd, { tools: this.tools, reasoning: this.reasoning, ...(cancelledAt === undefined ? {} : { cancelled: { at: cancelledAt, admitted: this.admitted } }) });
     if ([...this.known].some(id => !history.ids.includes(id))) throw new Error("native child history is missing");
     return history.facts.filter(event => event.type !== "subagent_coordination" || this.observedCalls.has(event.fact.id as string));
   }
+
+  // Native resolves an exact name first, then the name in its normalized form.
+  private recipient(to: string): string {
+    const exact = this.names.get(to);
+    if (exact !== undefined) return exact;
+    const name = nativeName(to);
+    for (const [key, id] of this.names) if (nativeName(key) === name) return id;
+    return to;
+  }
 }
+
+const nativeName = (name: string) => name.normalize("NFKC").replace(/[\p{Cc}\p{Cf}]/gu, c => /\s/.test(c) ? c : "").trim().toLowerCase().replace(/\s+/g, "-");
diff --git a/packages/claude-sdk-adapter/src/tool_search.ts b/packages/claude-sdk-adapter/src/tool_search.ts
deleted file mode 100644
index d95d4f6ff..000000000
--- a/packages/claude-sdk-adapter/src/tool_search.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-// The native harness owns discovery, schema loading and its model/provider policy.
-// Reject known conflicting modes, without copying its dynamic policy evaluator.
-export function toolSearchEnvironment(env: NodeJS.ProcessEnv, model: string): NodeJS.ProcessEnv {
-  const enabled = (value: string | undefined) => !!value && !["0", "false"].includes(value.toLowerCase());
-  if (["CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_USE_FOUNDRY",
-       "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS"].some(key => enabled(env[key])) ||
-      (env.ENABLE_TOOL_SEARCH && env.ENABLE_TOOL_SEARCH !== "true") ||
-      ["claude-3-haiku", "claude-3-5-haiku"].some(name => model.toLowerCase().includes(name))) {
-    throw new Error("unqualified native tool search configuration");
-  }
-  return { ...env, ENABLE_TOOL_SEARCH: "true" };
-}
diff --git a/packages/claude-sdk-adapter/src/workspace.ts b/packages/claude-sdk-adapter/src/workspace.ts
index 2f2b7148d..00909a5ee 100644
--- a/packages/claude-sdk-adapter/src/workspace.ts
+++ b/packages/claude-sdk-adapter/src/workspace.ts
@@ -1,10 +1,10 @@
 import type { Subagents } from "./subagents.js";
-import { parseEnvironmentMCP, type EnvironmentMCPServer } from "./mcp_environment.js";
 import type { MCPProfile } from "./mcp.js";
-import { parseSkills, workspaceSkills, type WorkspaceSkill } from "./workspace_skills.js";
-import type { CanUseTool, HookCallback, Options } from "@anthropic-ai/claude-agent-sdk";
+import { parseEnvironmentMCP, type EnvironmentMCPServer } from "./mcp_environment.js";
+import { installSkills, parseSkills, type WorkspaceSkill } from "./workspace_skills.js";
+import type { Options } from "@anthropic-ai/claude-agent-sdk";
 import { realpathSync, statSync } from "node:fs";
-import { isAbsolute, parse, resolve } from "node:path";
+import { isAbsolute, parse } from "node:path";
 
 export type Workspace = {
   tool_env?: Record<string, string>;
@@ -15,17 +15,14 @@ export type Workspace = {
   skills?: WorkspaceSkill[];
   capability_root?: string;
   mcp?: EnvironmentMCPServer[];
-  network_access?: "enabled" | "disabled" | "restricted";
-  allowed_domains?: string[];
 };
 
 const environmentNames = new Set([
   "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL", "ANTHROPIC_CUSTOM_HEADERS",
   "ANTHROPIC_DEFAULT_SONNET_MODEL", "ANTHROPIC_DEFAULT_OPUS_MODEL", "ANTHROPIC_DEFAULT_HAIKU_MODEL",
-  "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS", "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY",
+  "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS", "CLAUDE_CODE_MAX_CONTEXT_TOKENS", "CLAUDE_CODE_MAX_OUTPUT_TOKENS",
+  "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY",
 ]);
-const nativeTools = ["Bash", "Read", "Edit"];
-const denial = "Tool is outside the workspace execution profile.";
 const invalidPath = /[\x00-\x1f\x7f]/;
 
 
@@ -44,19 +41,14 @@ export function parseWorkspace(value: unknown, cwd: string): Workspace | undefin
   if (value === undefined) return undefined;
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid_request");
   const config = value as Record<string, unknown>;
-  if (Object.keys(config).some(key => !["tool_env", "home", "state", "scratch", "env_names", "network_access", "allowed_domains", "skills", "mcp", "capability_root"].includes(key)) ||
-      (config.network_access !== undefined && config.network_access !== "enabled" && config.network_access !== "disabled" && config.network_access !== "restricted") ||
+  if (Object.keys(config).some(key => !["tool_env", "home", "state", "scratch", "env_names", "skills", "mcp", "capability_root"].includes(key)) ||
       !Array.isArray(config.env_names) ||
       config.env_names.some(name => typeof name !== "string" || !environmentNames.has(name)) ||
       new Set(config.env_names).size !== config.env_names.length) throw new Error("invalid_request");
-  if (config.network_access !== undefined && config.network_access !== "enabled") throw new Error("invalid_request");
   if (config.tool_env !== undefined && (!config.tool_env || typeof config.tool_env !== "object" || Array.isArray(config.tool_env) || Object.values(config.tool_env).some(value => typeof value !== "string"))) throw new Error("invalid_request");
   const mcp = parseEnvironmentMCP(config.mcp);
   if (config.capability_root !== undefined) directory(config.capability_root, false);
   if ((Array.isArray(config.skills) && config.skills.length || mcp?.length) && !config.capability_root) throw new Error("invalid_request");
-  if (mcp?.length && config.network_access !== "enabled") throw new Error("invalid_request");
-  const domains = config.allowed_domains ?? [];
-  if (!Array.isArray(domains) || domains.length !== 0) throw new Error("invalid_request");
   for(const root of [cwd,config.home,config.state,config.scratch]) directory(root,false);
   return { ...config, ...(config.skills === undefined ? {} : { skills: parseSkills(config.skills) }) } as Workspace;
 
@@ -64,18 +56,17 @@ export function parseWorkspace(value: unknown, cwd: string): Workspace | undefin
 
 export class WorkspaceProfile {
   readonly options: Options;
-  private readonly skillNames: readonly string[];
+  readonly skillNames: readonly string[];
 
-  constructor(private readonly cwd: string, private readonly config: Workspace, private readonly functions: readonly string[] = [], private readonly mcp?: MCPProfile, private readonly subagents?: Subagents, private readonly structuredOutput = false, private readonly toolSearch = false) {
+  constructor(cwd: string, config: Workspace, mcp?: MCPProfile, subagents?: Subagents, disableWebSearch = false) {
     config = parseWorkspace(config, cwd)!;
     // SDK history lookup reads the bridge environment, independently of query.env.
     if (process.env.HOME !== config.home || process.env.CLAUDE_CONFIG_DIR !== config.state ||
         process.env.CLAUDE_CODE_PROJECT_DIR_NAME !== undefined) throw new Error("invalid_request");
     const env: Record<string, string> = {
       ...Object.fromEntries(Object.entries(process.env).filter((entry): entry is [string,string] => entry[1] !== undefined)),
+      // Private state paths.
       HOME: config.home, TMPDIR: config.scratch, CLAUDE_CONFIG_DIR: config.state,
-      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1", DISABLE_TELEMETRY: "1", DISABLE_ERROR_REPORTING: "1",
-      DISABLE_AUTOUPDATER: "1", CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1",
     };
     for (const [name, value] of Object.entries(config.tool_env ?? {})) {
       // Initialization cannot redirect the native Session history lookup.
@@ -90,78 +81,15 @@ export class WorkspaceProfile {
       if (!process.env[reference]) throw new Error("invalid_request");
       env[reference] = process.env[reference]!;
     }
-    const skills = workspaceSkills(config.skills ?? [], config.capability_root ?? "");
-    this.skillNames = skills?.names ?? [];
-    const skillTools = skills ? ["Skill"] : [];
+    this.skillNames = installSkills(config.skills ?? [], config.capability_root ?? "", config.state);
     this.options = {
-      env, tools: [...nativeTools, ...(toolSearch ? ["ToolSearch"] : []), ...skillTools, ...(subagents ? ["Agent", "SendMessage"] : [])],
-      ...(skills ? { plugins: skills.paths.map(path => ({ type: "local" as const, path, skipMcpDiscovery: true })) } : {}), allowedTools: mcp?.allowed ?? [...functions, ...(toolSearch ? ["ToolSearch"] : [])], mcpServers: {}, strictMcpConfig: true,
-      // The existing callback authorizes tools without CLI permission bypass,
-      // which the native CLI refuses for root accounts.
-      settingSources: [], permissionMode: "default", persistSession: true,
-      settings: {},
-      sandbox: { enabled: false },
-      canUseTool: this.canUseTool,
-      hooks: { PreToolUse: [{ hooks: [this.beforeTool] }] },
+      env, tools: { type: "preset", preset: "claude_code" },
+      // Nobody answers a question, no Turn leaves scheduled, monitoring or workflow work behind, ListAgents
+      // would reach other Sessions' processes on the host, and Core declares subagents and search.
+      disallowedTools: ["AskUserQuestion", "CronCreate", "CronDelete", "CronList", "ScheduleWakeup", "Monitor", "Workflow", "ListAgents",
+        ...(subagents ? [] : ["Agent", "SendMessage"]), ...(disableWebSearch ? ["WebSearch", "WebFetch"] : [])],
+      // The native CLI refuses permission bypass for root accounts, so the callback approves every tool.
+      canUseTool: async (_name, input) => ({ behavior: "allow", updatedInput: input }),
     };
   }
-
-  verify(tools: string[], servers: { name: string; status: string; tools?: { name: string }[] }[], sessionID = ""): void {
-    if (this.mcp) {
-      this.mcp.verify(tools, servers as Parameters<MCPProfile["verify"]>[1], sessionID, [...nativeTools, ...(this.skillNames.length ? ["Skill"] : []), ...(this.subagents ? ["Task", "SendMessage"] : [])]);
-      return;
-    }
-    const expected = [...nativeTools, ...(this.toolSearch ? ["ToolSearch"] : []), ...(this.structuredOutput ? ["StructuredOutput"] : []), ...this.functions, ...(this.skillNames.length ? ["Skill"] : []), ...(this.subagents ? ["Task", "SendMessage"] : [])];
-    if (servers.length !== (this.functions.length ? 1 : 0) ||
-        servers.some(server => server.name !== "functions" || server.status !== "connected") ||
-        tools.length !== expected.length || new Set(tools).size !== tools.length ||
-        tools.some(name => !expected.includes(name))) throw new Error("unexpected native workspace inventory");
-  }
-
-  readonly canUseTool: CanUseTool = async (name, input, { signal, agentID }) => {
-    if (!signal.aborted && (agentID === undefined || this.subagents?.permitsActor(agentID)) && this.permits(name, input)) {
-      return { behavior: "allow", updatedInput: this.nativeInput(name, input) };
-    }
-    return { behavior: "deny", message: denial };
-  };
-
-  readonly beforeTool: HookCallback = async (input, id, { signal }) => {
-    if (this.mcp) {
-      const admission = await this.mcp.beforeTool(input, id, { signal });
-      if ("hookSpecificOutput" in admission && admission.hookSpecificOutput?.hookEventName === "PreToolUse" &&
-          admission.hookSpecificOutput.permissionDecision === "deny") return admission;
-      if (input.hook_event_name === "PreToolUse" && this.mcp.permits(input.tool_name)) return admission;
-    }
-    if (!signal.aborted && input.hook_event_name === "PreToolUse" && (input.agent_id === undefined || this.subagents?.permitsActor(input.agent_id)) &&
-        (id === undefined || id === input.tool_use_id) && this.permits(input.tool_name, input.tool_input)) {
-      return !["Read", "Edit", "Skill"].includes(input.tool_name) ? {} : { hookSpecificOutput: { hookEventName: "PreToolUse",
-        updatedInput: this.nativeInput(input.tool_name, input.tool_input as Record<string, unknown>) } };
-    }
-    return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: denial } };
-  };
-
-  private nativeInput(name: string, input: Record<string, unknown>): Record<string, unknown> {
-    if (name === "Skill") return { ...input, skill: this.skillName(input.skill) };
-    return name !== "Read" && name !== "Edit" ? input : { ...input, file_path: resolve(this.cwd, input.file_path as string) };
-  }
-
-  private skillName(value: unknown): string | undefined {
-    if (typeof value !== "string") return undefined;
-    // Public names are unique in the installed snapshot; native plugins add a namespace.
-    return this.skillNames.find(name => name === value || name.endsWith(":" + value));
-  }
-
-  private permits(name: string, value: unknown): boolean {
-    if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-    const input = value as Record<string, unknown>;
-    if (this.structuredOutput && name === "StructuredOutput") return true;
-    if (this.toolSearch && name === "ToolSearch") return true;
-    if (this.functions.includes(name) || this.mcp?.permits(name)) return true;
-    if (name === "Skill") return this.skillName(input.skill) !== undefined;
-    if (name === "Bash") return typeof input.command === "string" && !!input.command.trim() &&
-      (input.run_in_background === undefined || input.run_in_background === false);
-    if ((name !== "Read" && name !== "Edit") || typeof input.file_path !== "string" || !input.file_path ||
-        /[\x00-\x1f]/.test(input.file_path)) return false;
-    return true;
-  }
 }
diff --git a/packages/claude-sdk-adapter/src/workspace_directories.ts b/packages/claude-sdk-adapter/src/workspace_directories.ts
index 355bf0c0a..a55c12486 100644
--- a/packages/claude-sdk-adapter/src/workspace_directories.ts
+++ b/packages/claude-sdk-adapter/src/workspace_directories.ts
@@ -46,7 +46,12 @@ export class WorkspaceDirectories {
   }
 
   private async enumerate(directory: string, maxEntries: number): Promise<{ entries: WorkspaceDirectoryEntry[]; truncated: boolean }> {
-    const path = join(this.root!, ...directory.split("/"));
+    let path = this.root!;
+    // Listings never follow a link: one anywhere in the path is rejected like a regular file.
+    for (const part of directory ? directory.split("/") : []) {
+      path = join(path, part);
+      if (!(await lstat(path)).isDirectory()) throw Object.assign(new Error("not a directory"), { code: "ENOTDIR" });
+    }
     const dir = await opendir(path, { encoding: "buffer" as BufferEncoding });
       try {
         const entries: WorkspaceDirectoryEntry[] = [];
diff --git a/packages/claude-sdk-adapter/src/workspace_skills.ts b/packages/claude-sdk-adapter/src/workspace_skills.ts
index e15f69909..7851b8783 100644
--- a/packages/claude-sdk-adapter/src/workspace_skills.ts
+++ b/packages/claude-sdk-adapter/src/workspace_skills.ts
@@ -1,4 +1,4 @@
-import { linkSync, lstatSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readlinkSync, symlinkSync } from "node:fs";
 import { join, posix } from "node:path";
 
 export type WorkspaceSkill = {
@@ -29,56 +29,19 @@ export function parseSkills(value: unknown): WorkspaceSkill[] {
   return value as WorkspaceSkill[];
 }
 
-// The common Runtime has already validated these immutable packages. Native
-// explicit component paths must remain within the plugin root after realpath,
-// so preserve the tree with hardlinks rather than outward directory symlinks.
-function projectPackage(source: string, destination: string): void {
-  mkdirSync(destination, { recursive: true, mode: 0o700 });
-  if (!lstatSync(destination).isDirectory()) throw new Error("invalid native Skill root");
-  for (const entry of readdirSync(source, { withFileTypes: true })) {
-    const from = join(source, entry.name), to = join(destination, entry.name);
-    if (entry.isDirectory()) {
-      projectPackage(from, to);
-    } else if (entry.isFile()) {
-      try { linkSync(from, to); }
-      catch (error) {
-        if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
-        const sourceInfo = lstatSync(from), installed = lstatSync(to);
-        if (!installed.isFile() || installed.dev !== sourceInfo.dev || installed.ino !== sourceInfo.ino) throw new Error("invalid native Skill root");
-      }
-    } else { throw new Error("invalid native Skill root"); }
-  }
-}
-
-// Only the generated envelope is activated. Original plugin control files stay
-// beneath content; exact Skill roots, not public plugin manifests, drive loading.
-export function workspaceSkills(skills: readonly WorkspaceSkill[], capabilityRoot: string): { paths: string[]; names: string[] } | undefined {
-  if (!skills.length) return undefined;
-  const packages = new Map<string, WorkspaceSkill[]>();
+// Skills install as user Skills under the private state path, as a local ~/.claude/skills does, so
+// native lists their bare names. The common Runtime has already validated the immutable packages.
+export function installSkills(skills: readonly WorkspaceSkill[], capabilityRoot: string, state: string): string[] {
+  if (!skills.length) return [];
+  const directory = join(state, "skills");
+  mkdirSync(directory, { recursive: true, mode: 0o700 });
   for (const skill of skills) {
-    const body = readFileSync(join(capabilityRoot, skill.relative_root, "SKILL.md"), "utf8");
-    if (/(?<=^|\s)!`[^`]+`/m.test(body) || /```!\s*\n?[\s\S]*?\n?```/.test(body)) {
-      throw new Error("unsupported native Skill activation");
-    }
-    const selected = packages.get(skill.package_root) ?? [];
-    selected.push(skill);
-    packages.set(skill.package_root, selected);
-  }
-  const result = { paths: [] as string[], names: [] as string[] };
-  for (const [root, selected] of packages) {
-    const name = `environment-skills-${result.paths.length}`;
-    const path = join(capabilityRoot, "native", "claude", name);
-    projectPackage(join(capabilityRoot, root), join(path, "content"));
-    mkdirSync(join(path, ".claude-plugin"), { recursive: true, mode: 0o700 });
-    const manifest = JSON.stringify({ name, description: "Environment Skills", skills: selected.map(skill =>
-      "./" + posix.join("content", posix.relative(root, skill.relative_root))) });
-    const target = join(path, ".claude-plugin", "plugin.json");
-    try { writeFileSync(target, manifest, { flag: "wx", mode: 0o400 }); }
-    catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "EEXIST" || !lstatSync(target).isFile() || readFileSync(target, "utf8") !== manifest) throw error;
-    }
-    result.paths.push(path);
-    result.names.push(...selected.map(skill => `${name}:${skill.metadata.name}`));
+    const link = join(directory, skill.metadata.name), target = join(capabilityRoot, skill.relative_root);
+    // Native loads a user Skill with a plugin manifest as a plugin, with its hooks and MCP servers.
+    if (existsSync(join(target, ".claude-plugin"))) throw new Error("invalid_request");
+    // A junction needs no Windows symlink privilege; POSIX ignores the type.
+    try { symlinkSync(target, link, "junction"); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code !== "EEXIST" || readlinkSync(link) !== target) throw error; }
   }
-  return result;
+  return skills.map(skill => skill.metadata.name);
 }
diff --git a/packages/claude-sdk-adapter/tests/blank-text.json b/packages/claude-sdk-adapter/tests/blank-text.json
deleted file mode 100644
index 8cf8c1d2e..000000000
--- a/packages/claude-sdk-adapter/tests/blank-text.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "description": "Characters treated as whitespace when deciding whether Claude SDK user text is blank: the union of Go unicode.IsSpace and ECMAScript String.prototype.trim. Core admission and the Claude bridge must both match this list.",
-  "members": [
-    "U+0009",
-    "U+000A",
-    "U+000B",
-    "U+000C",
-    "U+000D",
-    "U+0020",
-    "U+0085",
-    "U+00A0",
-    "U+1680",
-    "U+2000",
-    "U+2001",
-    "U+2002",
-    "U+2003",
-    "U+2004",
-    "U+2005",
-    "U+2006",
-    "U+2007",
-    "U+2008",
-    "U+2009",
-    "U+200A",
-    "U+2028",
-    "U+2029",
-    "U+202F",
-    "U+205F",
-    "U+3000",
-    "U+FEFF"
-  ],
-  "non_members": [
-    "U+0000",
-    "U+0041",
-    "U+180E",
-    "U+200B",
-    "U+200C",
-    "U+200D",
-    "U+2060",
-    "U+FFFE",
-    "U+1F600"
-  ]
-}
diff --git a/packages/claude-sdk-adapter/tests/blank_text.test.mjs b/packages/claude-sdk-adapter/tests/blank_text.test.mjs
deleted file mode 100644
index 036808785..000000000
--- a/packages/claude-sdk-adapter/tests/blank_text.test.mjs
+++ /dev/null
@@ -1,28 +0,0 @@
-import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import test from "node:test";
-import { isBlankText, parseMessageInput } from "../dist/message_input.js";
-
-// Core's Claude admission test reads the same table, so both sides must agree.
-const table = JSON.parse(readFileSync(new URL("./blank-text.json", import.meta.url), "utf8"));
-const codes = values => new Set(values.map(value => Number.parseInt(value.replace("U+", ""), 16)));
-const members = codes(table.members);
-const nonMembers = codes(table.non_members);
-
-test("blank text uses exactly the shared union of ECMAScript trim and Go whitespace", () => {
-  assert.equal(members.size, 26);
-  for (const code of [0xfeff, 0x0085]) assert.ok(members.has(code));
-  for (const code of [0x200b, 0x180e]) assert.ok(nonMembers.has(code));
-  for (let code = 0; code <= 0x10ffff; code++) {
-    if (code >= 0xd800 && code <= 0xdfff) continue;
-    const text = String.fromCodePoint(code);
-    assert.equal(isBlankText(text), members.has(code), `U+${code.toString(16)}`);
-    if (text.trim() === "") assert.ok(members.has(code), `ECMAScript whitespace U+${code.toString(16)} missing`);
-  }
-  const all = String.fromCodePoint(...members);
-  assert.throws(() => parseMessageInput([{ content: [{ type: "input_text", text: all }] }]), /Empty user message/);
-  for (const code of nonMembers) {
-    const text = " " + String.fromCodePoint(code) + "\ufeff";
-    assert.equal(parseMessageInput([{ content: [{ type: "input_text", text }] }])[0].content[0].text, text);
-  }
-});
diff --git a/packages/claude-sdk-adapter/tests/execution.test.mjs b/packages/claude-sdk-adapter/tests/execution.test.mjs
index d0625c842..6ed59a70f 100644
--- a/packages/claude-sdk-adapter/tests/execution.test.mjs
+++ b/packages/claude-sdk-adapter/tests/execution.test.mjs
@@ -40,6 +40,8 @@ globalThis.queryFixture = ({prompt,options}) => {
   assert.equal(options.effort, "high");
   assert.deepEqual(options.thinking, {type:"enabled",budgetTokens:1024});
   assert.equal(options.model, "fixture");
+  assert.equal(options.systemPrompt, "Translate.");
+  assert.deepEqual(options.settings, {env:{CLAUDE_CODE_DISABLE_BACKGROUND_TASKS:"1",DISABLE_AUTOUPDATER:"1"}});
   const child = options.spawnClaudeCodeProcess({command:process.execPath,args:["-e","process.stdin.resume();process.stdin.on('end',()=>process.exit(0));"],env:process.env,signal:abort.signal});
   return {
     close(){child.stdin.end();},
@@ -59,7 +61,7 @@ globalThis.queryFixture = ({prompt,options}) => {
     },
   };
 };
-await execute({type:"start",input: [{ content: [{ type: "input_text", text: "opening text" }] }],model:"fixture",system_prompt:"",cwd:process.cwd(),native_model_options:{effort:"high",thinking:{type:"enabled",budgetTokens:1024}},
+await execute({type:"start",input: [{ content: [{ type: "input_text", text: "opening text" }] }],model:"fixture",system_prompt:"Translate.",cwd:process.cwd(),native_model_options:{effort:"high",thinking:{type:"enabled",budgetTokens:1024}},
   ...(mode === "later-function" ? {functions:[{name:"lookup",description:"fixture",parameters:{type:"object",properties:{}}}]} : {})},emit,abort,functions,inputs);
 assert.equal(inputs.complete,true);
 assert.equal(events.filter(e=>e.type === "input_applied" && e.input_id === "extra").length,1);
diff --git a/packages/claude-sdk-adapter/tests/executor.test.mjs b/packages/claude-sdk-adapter/tests/executor.test.mjs
index d30b7505d..3e6083e44 100644
--- a/packages/claude-sdk-adapter/tests/executor.test.mjs
+++ b/packages/claude-sdk-adapter/tests/executor.test.mjs
@@ -7,7 +7,7 @@ import assert from "node:assert/strict";
 import { registerHooks } from "node:module";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
-const sdk = "export async function startup(args){return globalThis.startupFixture(args)} export function query(){throw new Error('one warm query required')} export async function getSessionInfo(){return {sessionId:'native'}}";
+const sdk = "export async function startup(args){return globalThis.startupFixture(args)} export function query(){throw new Error('one warm query required')} export async function getSessionInfo(){return process.argv[1]==='missing-history' ? undefined : {sessionId:'native'}}";
 registerHooks({resolve(specifier,context,next){if(specifier==='@anthropic-ai/claude-agent-sdk') return {url:'data:text/javascript,'+encodeURIComponent(sdk),shortCircuit:true};return next(specifier,context)}});
 globalThis.startupFixture=async({options})=>{
  const child=options.spawnClaudeCodeProcess({command:process.execPath,args:['-e',"process.stdin.resume();process.stdin.on('end',()=>process.exit(0))"],env:options.env,signal:options.abortController.signal});
@@ -78,7 +78,7 @@ async function launch(t,mode="normal") {
  const send=value=>child.stdin.write(JSON.stringify(value)+"\n");
  const start=(id,text)=>send({type:"turn_start",turn_id:id,input:[{content:[{type:"input_text",text}]}]});
  send({type:"executor_prepare",cwd:"/tmp",model:"fixture",system_prompt:"",
- ...(mode==="features" || mode.startsWith("pending-function") ? {observe_messages:true,functions:[{name:"lookup",description:"lookup",parameters:{type:"object",properties:{text:{type:"string"}}}}]} : {})});
+ ...(mode==="features" || mode.startsWith("pending-function") ? {functions:[{name:"lookup",description:"lookup",parameters:{type:"object",properties:{text:{type:"string"}}}}]} : {})});
  await wait(()=>events.some(event=>event.type==="executor_ready"));
  assert.equal(observations.filter(event=>event.type==="input").length,0);
  return {child,events,observations,closed,wait,send,start};
@@ -193,3 +193,12 @@ for (const mode of ["pending-function-result", "pending-function-terminal", "pen
  }
  assert.deepEqual(await closed,{code:0,signal:null});
 });
+
+test("executor preparation reports missing native history before readiness",{timeout:10000},async()=>{
+ const child=spawn(process.execPath,["--input-type=module","-e",fixture,"missing-history"],{stdio:["pipe","pipe","pipe","ipc"]});
+ let stdout="";child.stdout.setEncoding("utf8");child.stdout.on("data",data=>{stdout+=data});
+ const closed=new Promise(resolve=>child.once("close",code=>resolve(code)));
+ child.stdin.end(JSON.stringify({type:"executor_prepare",cwd:"/tmp",model:"fixture",system_prompt:"",resume:"native"})+"\n");
+ assert.equal(await closed,0);
+ assert.deepEqual(stdout.trim().split("\n").map(line=>JSON.parse(line)),[{type:"error",code:"history_unavailable"}]);
+});
diff --git a/packages/claude-sdk-adapter/tests/function_bridge.test.mjs b/packages/claude-sdk-adapter/tests/function_bridge.test.mjs
index bd78b0e27..a45c10c80 100644
--- a/packages/claude-sdk-adapter/tests/function_bridge.test.mjs
+++ b/packages/claude-sdk-adapter/tests/function_bridge.test.mjs
@@ -89,10 +89,7 @@ test("successful image results confirm native preprocessing with unchanged ident
     { type: "image", source: { type: "base64", media_type: "image/jpeg", data: "BAUG" } },
     { type: "text", text: "after" },
   ];
-  for (const bad of [converted.slice(1), [...converted, converted[0]],
-    [converted[0], { type: "text", text: "Image could not be processed" }, converted[2]],
-    [converted[2], converted[1], converted[0]],
-    [converted[0], { type: "image", source: { type: "base64", media_type: "image/jpeg", data: "!!" } }, converted[2]]]) {
+  for (const bad of [converted.slice(1), [...converted, converted[0]], [converted[2], converted[1], converted[0]]]) {
     await assert.rejects(bridge.consume(native(value, bad), "native"), /differs/);
   }
   await bridge.consume({ ...native(value, converted), isSynthetic: true }, "native");
@@ -140,3 +137,30 @@ test("native cancellation preserves a submitted result's missing receipt", async
   assert.throws(() => bridge.assertComplete(), /unconfirmed/);
   bridge.close();
 });
+
+test("a Subagent call carries its child, is confirmed by the child's own result and is withdrawn when native abandons it unanswered", { timeout: 5000 }, async () => {
+  const events = [], child = { native_id: "child", turn_id: "child-turn" };
+  const bridge = new FunctionBridge(async event => { events.push(event); });
+  const abort = new AbortController();
+  const kept = bridge.invoke({ ...call("a"), child }, new AbortController().signal);
+  const dropped = bridge.invoke({ ...call("b"), child }, abort.signal);
+  const droppedCheck = assert.rejects(dropped, /aborted/);
+  assert.deepEqual(events[0], { type: "function_call", call: { call_id: "a", name: "lookup", arguments: { ids: ["same"] }, ...child } });
+  bridge.submit(JSON.stringify(result("a")));
+  await bridge.consume(native(result("a")), "native");
+  assert.equal(events.length, 2);
+  await bridge.consume({ ...native(result("a")), parent_tool_use_id: "spawn" }, "native");
+  assert.equal(events.length, 3);
+  assert.deepEqual(events[2], { type: "function_applied", call_id: "a", delivery_id: "delivery-a" });
+  await kept;
+  abort.abort();
+  await droppedCheck;
+  assert.deepEqual(events[3], { type: "function_withdrawn", withdrawn: { call_id: "b", ...child } });
+  bridge.submit(JSON.stringify(result("b")));
+  bridge.assertComplete();
+  const late = new AbortController(), delivered = bridge.invoke({ ...call("c"), child }, late.signal);
+  bridge.submit(JSON.stringify(result("c")));
+  await delivered;
+  late.abort();
+  assert.throws(() => bridge.assertComplete(), /unconfirmed/);
+});
diff --git a/packages/claude-sdk-adapter/tests/inputs.test.mjs b/packages/claude-sdk-adapter/tests/inputs.test.mjs
index ce664b6b9..9d197645a 100644
--- a/packages/claude-sdk-adapter/tests/inputs.test.mjs
+++ b/packages/claude-sdk-adapter/tests/inputs.test.mjs
@@ -113,11 +113,27 @@ test("native UUID capacity rejects a whole batch and partial consumption does no
   assert.equal(partial.complete, false);
 });
 
-test("report whitespace-only steering as a rejected input", () => {
+test("whitespace-only steering reaches native content unchanged", async () => {
   const inputs = new Inputs([{ content: [{ type: "input_text", text: "first" }] }]);
-  inputs.start("native");
-  assert.deepEqual(inputs.submit(steer("blank", " \n\t")), [{ type: "input_rejected", input_id: "blank" }]);
-  assert.deepEqual(inputs.submit(steer("after")), []);
+  const stream = inputs[Symbol.asyncIterator]();
+  await stream.next(); inputs.start("native");
+  assert.deepEqual(inputs.submit(steer("blank", " \n\t")), []);
+  assert.deepEqual((await stream.next()).value.message.content, [{ type: "text", text: " \n\t" }]);
   assert.throws(() => inputs.submit({ type: "steer", input_id: "no-content", input: [{ content: [] }] }), /Invalid/);
   inputs.close();
 });
+
+test("a user message maps a remote URL and any native base64 type; a tool result takes base64 only", async () => {
+  const { nativeContent, parseInputContent } = await import("../dist/message_input.js");
+  const content = [
+    { type: "input_image", image_url: "https://example.com/a.webp" },
+    { type: "input_image", image_url: "data:image/gif;base64,AQID" },
+  ];
+  assert.deepEqual(nativeContent({ content }, true), [
+    { type: "image", source: { type: "url", url: "https://example.com/a.webp" } },
+    { type: "image", source: { type: "base64", media_type: "image/gif", data: "AQID" } },
+  ]);
+  assert.throws(() => parseInputContent([content[0]]), /Unsupported image/);
+  assert.throws(() => parseInputContent([{ type: "input_image", image_url: "data:image/bmp;base64,AQID" }], true), /Unsupported image/);
+  assert.equal(parseInputContent([content[1]]).length, 1);
+});
diff --git a/packages/claude-sdk-adapter/tests/mcp.test.mjs b/packages/claude-sdk-adapter/tests/mcp.test.mjs
index 70bc102e2..75fcffe27 100644
--- a/packages/claude-sdk-adapter/tests/mcp.test.mjs
+++ b/packages/claude-sdk-adapter/tests/mcp.test.mjs
@@ -27,14 +27,20 @@ test("native selection composes unrestricted, selected and empty servers with ho
 
 test("invalid remote declarations and wildcard injection fail at the bridge boundary", () => {
   const start = { type: "start", input: [{ content: [{ type: "input_text", text: "hello" }] }], model: "model", system_prompt: "", cwd: "/tmp" };
-  for (const value of [null, {}, [declaration(["*"])], [{ ...declaration(null), server_label: "functions" }],
+  for (const value of [null, {}, [{ ...declaration(null), server_label: "functions" }],
     [{ ...declaration(null), server_url: "https://user:secret@example.invalid/mcp" }],
-    [{ ...declaration(null), server_url: "https://example.invalid/mcp?" }],
+    [{ ...declaration(null), server_url: "https://example.invalid/mcp#fragment" }],
     [{ ...declaration(null), required: "true" }], [{ ...declaration(null), required: null }], [declaration(null), declaration([])]]) {
     assert.throws(() => parseStart(JSON.stringify({ ...start, mcp_http_servers: value })));
   }
   assert.deepEqual(parseStart(JSON.stringify({ ...start, mcp_http_servers: [declaration(null), { ...declaration([]), server_label: "empty" }] })).mcp_http_servers,
     [declaration(null), { ...declaration([]), server_label: "empty" }]);
+  const withQuery = { ...declaration(null), server_url: "https://example.invalid/mcp?tenant=a" };
+  assert.deepEqual(parseStart(JSON.stringify({ ...start, mcp_http_servers: [withQuery] })).mcp_http_servers, [withQuery]);
+  // Native normalization turns any tool name into a literal identity, so a wildcard cannot widen the allowlist.
+  const wildcard = declaration(["*", "a/b"]);
+  assert.deepEqual(parseStart(JSON.stringify({ ...start, mcp_http_servers: [wildcard] })).mcp_http_servers, [wildcard]);
+  assert.deepEqual(new MCPProfile([wildcard], []).allowed, [native("_"), native("a_b")]);
 });
 
 test("native tool spelling preserves original identity and rejects ambiguous aliases", () => {
diff --git a/packages/claude-sdk-adapter/tests/mcp_bearer.test.mjs b/packages/claude-sdk-adapter/tests/mcp_bearer.test.mjs
index 1426b1913..531c9de70 100644
--- a/packages/claude-sdk-adapter/tests/mcp_bearer.test.mjs
+++ b/packages/claude-sdk-adapter/tests/mcp_bearer.test.mjs
@@ -1,5 +1,8 @@
 import assert from "node:assert/strict";
+import { createServer } from "node:http";
 import test from "node:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { parseStart } from "../dist/adapter.js";
 import { MCPProfile } from "../dist/mcp.js";
 
@@ -29,15 +32,50 @@ test("bearer references remain literal in native configuration and private statu
 test("untrusted header expressions, raw tokens and non-HTTPS authenticated declarations are rejected", () => {
   for (const invalid of [
     { ...server, bearer_token: "fixture-secret" },
-    { ...server, headers: { Authorization: "Bearer fixture-secret" } },
+    { ...server, headers: { "X-Tenant": 1 } },
     { ...server, server_url: "http://example.invalid/mcp" },
     ...[null, "", "ANTHROPIC_AUTH_TOKEN", "OAC_RUNTIME_MCP_BEARER_", "${OPERATOR_TOKEN}", reference + ":-fallback"].map(bearer_token_env_var => ({ ...server, bearer_token_env_var })),
   ]) assert.throws(() => parseStart(JSON.stringify(start([invalid]))));
   assert.throws(() => parseStart(JSON.stringify(start([server, { ...server, server_label: "other" }]))));
 });
 
+test("custom headers reach the native configuration beside the bearer", t => {
+  process.env[reference] = "fixture-private-bearer";
+  t.after(() => { delete process.env[reference]; });
+  const profile = new MCPProfile([{ ...server, headers: { "X-Tenant": "a" } }], []);
+  assert.deepEqual(profile.servers.private.headers, { "X-Tenant": "a", Authorization: "Bearer ${" + reference + "}" });
+  const literal = new MCPProfile([{ ...server, bearer_token_env_var: undefined, headers: { authorization: "Bearer literal" } }], []);
+  assert.deepEqual(literal.servers.private.headers, { authorization: "Bearer literal" });
+});
+
 test("missing credential environment fails before the native query", () => {
   const missing = "OAC_RUNTIME_MCP_BEARER_" + "B".repeat(26);
   delete process.env[missing];
   assert.throws(() => new MCPProfile([{ ...server, bearer_token_env_var: missing }], []), /missing MCP credential environment/);
 });
+
+test("subset listing sends each server only its own bearer", async t => {
+  const seen = { a: new Set(), b: new Set() };
+  const listeners = await Promise.all(["a", "b"].map(async label => {
+    const http = createServer(async (req, res) => {
+      seen[label].add(req.headers.authorization);
+      const mcp = new McpServer({ name: label, version: "0" });
+      for (const name of ["echo", "extra"]) mcp.registerTool(name, {}, async () => ({ content: [] }));
+      const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
+      await mcp.connect(transport);
+      let body = "";
+      for await (const chunk of req) body += chunk;
+      await transport.handleRequest(req, res, body ? JSON.parse(body) : undefined);
+    });
+    await new Promise(resolve => http.listen(0, "127.0.0.1", resolve));
+    return http;
+  }));
+  const references = ["A", "B"].map(letter => "OAC_RUNTIME_MCP_BEARER_" + letter.repeat(26));
+  references.forEach((name, i) => { process.env[name] = "token-" + i; });
+  t.after(() => { references.forEach(name => delete process.env[name]); listeners.forEach(http => http.close()); });
+  const profile = new MCPProfile(["a", "b"].map((label, i) => ({ server_label: label,
+    server_url: `http://127.0.0.1:${listeners[i].address().port}/mcp`, allowed_tools: ["echo"], bearer_token_env_var: references[i] })), []);
+  assert.deepEqual(await profile.unselectedTools(new AbortController().signal), ["mcp__a__extra", "mcp__b__extra"]);
+  assert.deepEqual([...seen.a], ["Bearer token-0"]);
+  assert.deepEqual([...seen.b], ["Bearer token-1"]);
+});
diff --git a/packages/claude-sdk-adapter/tests/mcp_required.test.mjs b/packages/claude-sdk-adapter/tests/mcp_required.test.mjs
index 40dcb9b4c..0783044a8 100644
--- a/packages/claude-sdk-adapter/tests/mcp_required.test.mjs
+++ b/packages/claude-sdk-adapter/tests/mcp_required.test.mjs
@@ -2,8 +2,27 @@ import assert from "node:assert/strict";
 import { spawn } from "node:child_process";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
+import { createServer } from "node:http";
 import { join } from "node:path";
 import test from "node:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+
+// Stateless MCP server with a selected and an unselected tool.
+async function listen() {
+  const server = createServer(async (req, res) => {
+    if (req.method !== "POST") return void res.writeHead(405).end();
+    const mcp = new McpServer({ name: "fixture", version: "0" });
+    for (const name of ["echo", "extra"]) mcp.registerTool(name, {}, async () => ({ content: [] }));
+    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
+    await mcp.connect(transport);
+    let body = "";
+    for await (const chunk of req) body += chunk;
+    await transport.handleRequest(req, res, JSON.parse(body));
+  });
+  await new Promise(resolve => server.listen(0, "127.0.0.1", resolve));
+  return { url: `http://127.0.0.1:${server.address().port}/mcp`, close: () => server.close() };
+}
 
 // Run the production entrypoint: its explicitly supplied Inputs must also be held.
 const fixture = `
@@ -15,10 +34,11 @@ const baseline=workspace?["Bash","Read","Edit"]:[];
 const sdk='export function startup(args){return globalThis.startup(args);} export function query(args){return globalThis.direct(args);} export async function getSessionInfo(){return process.argv[1]==="missing-history"?undefined:{sessionId:"native"};}';
 registerHooks({resolve(s,c,next){return s==="@anthropic-ai/claude-agent-sdk"?{url:"data:text/javascript,"+encodeURIComponent(sdk),shortCircuit:true}:next(s,c);}});
 function create(options){
- assert.deepEqual(options.tools,baseline);
- assert.equal(options.agent,"oac_root");
- assert.deepEqual(options.agents.oac_root.tools,[...baseline,...(mode==="workspace-empty"?[]:["mcp__fixture__echo"])]);
- assert.deepEqual(options.disallowedTools,mode==="workspace-empty"?["mcp__fixture__*","mcp__optional__*"]:["mcp__optional__*"]);assert.equal(options.strictMcpConfig,true);assert.equal(options.hooks.PreToolUse.length,1);
+ assert.deepEqual(options.tools,workspace?{type:"preset",preset:"claude_code"}:[]);
+ assert.equal(options.agent,undefined);assert.equal(options.agents,undefined);
+ assert.deepEqual(options.disallowedTools.filter(name=>name.startsWith("mcp__")),mode==="workspace-empty"?["mcp__fixture__*","mcp__optional__*"]:["mcp__optional__*","mcp__fixture__extra"]);
+ assert.equal(options.disallowedTools.includes("AskUserQuestion"),workspace);
+ assert.equal(options.strictMcpConfig,workspace?undefined:true);assert.deepEqual(options.settingSources,workspace?undefined:[]);assert.equal(options.hooks.PreToolUse.length,1);
  assert.equal(options.mcpServers.fixture.alwaysLoad,true);
  const child=options.spawnClaudeCodeProcess({command:process.execPath,args:["-e","process.stdin.resume();process.stdin.on('end',()=>process.exit(0));"],env:options.env,signal:options.abortController.signal});
  process.send({kind:"spawn"});
@@ -54,9 +74,10 @@ await import(${JSON.stringify(new URL("../dist/main.js", import.meta.url).href)}
 process.disconnect();
 `;
 
-for (const mode of ["connected", "pending", "failed", "missing", "duplicate", "missing-hooks", "cancelled", "resume", "wrong-history", "missing-history", "optional", "workspace-connected", "workspace-empty"]) {
+for (const mode of ["connected", "pending", "failed", "missing", "duplicate", "missing-hooks", "cancelled", "resume", "wrong-history", "missing-history", "optional", "workspace-connected", "workspace-empty", "unlistable"]) {
   test(`required MCP entrypoint holds input through readiness: ${mode}`, async () => {
     const cwd = mkdtempSync(join(tmpdir(), "oac-required-"));
+    const remote = await listen();
     const child = spawn(process.execPath, ["--input-type=module", "-e", fixture, mode], { stdio: ["pipe", "pipe", "pipe", "ipc"], env: {...process.env,HOME:cwd,CLAUDE_CONFIG_DIR:cwd} });
     const observations = [];
     let stdout = "", stderr = "";
@@ -66,11 +87,11 @@ for (const mode of ["connected", "pending", "failed", "missing", "duplicate", "m
     const closed = new Promise(resolve => child.once("close", (code, signal) => resolve({ code, signal })));
     const timer = setTimeout(() => child.kill("SIGKILL"), 8000);
     try {
-      const servers = [{ server_label: "fixture", server_url: "https://example.invalid/mcp", allowed_tools: mode === "workspace-empty" ? [] : ["echo"], required: mode !== "optional" },
+      const servers = [{ server_label: "fixture", server_url: mode === "unlistable" ? "http://127.0.0.1:1/mcp" : remote.url, allowed_tools: mode === "workspace-empty" ? [] : ["echo"], required: mode !== "optional" },
         { server_label: "optional", server_url: "https://optional.invalid/mcp", allowed_tools: [], required: false }];
       child.stdin.write(JSON.stringify({ type: "start", model: "fixed", input: [{ content: [{ type: "input_text", text: "one input" }] }], system_prompt: "", cwd,
         ...(mode.includes("history") || mode === "resume" ? { resume: "native" } : {}),
-        ...(mode.startsWith("workspace-") ? {workspace:{home:cwd,state:cwd,scratch:cwd,capability_root:cwd,env_names:[],network_access:"enabled",mcp:servers}} : {mcp_http_servers:servers}) }) + "\n");
+        ...(mode.startsWith("workspace-") ? {workspace:{home:cwd,state:cwd,scratch:cwd,capability_root:cwd,env_names:[],mcp:servers}} : {mcp_http_servers:servers}) }) + "\n");
       const exit = await closed;
       assert.equal(exit.signal, null, stderr);
       assert.equal(exit.code, 0, stderr);
@@ -83,7 +104,7 @@ for (const mode of ["connected", "pending", "failed", "missing", "duplicate", "m
       if (mode === "missing-history") assert.equal(observations.length, 0);
       if (mode === "cancelled") assert.equal(events.at(-1).code, "cancelled");
     } finally {
-      clearTimeout(timer);child.kill("SIGKILL");await closed;rmSync(cwd, { recursive: true, force: true });
+      remote.close();clearTimeout(timer);child.kill("SIGKILL");await closed;rmSync(cwd, { recursive: true, force: true });
     }
   });
 }
diff --git a/packages/claude-sdk-adapter/tests/mcp_workspace.test.mjs b/packages/claude-sdk-adapter/tests/mcp_workspace.test.mjs
index 49bc7e805..b564306f0 100644
--- a/packages/claude-sdk-adapter/tests/mcp_workspace.test.mjs
+++ b/packages/claude-sdk-adapter/tests/mcp_workspace.test.mjs
@@ -12,7 +12,7 @@ const stdio = { server_label: "installed", command: process.execPath, allowed_to
   args: ["runtime-mcp-exec", join(process.cwd(), "capabilities"), "plugins/installed", "installed"] };
 const native = "mcp__installed__echo_v1";
 const statuses = [{ name: "installed", status: "connected", tools: [{ name: "echo.v1" }] }];
-const baseline = ["Bash", "Read", "Edit"];
+const nativePreset = ["Bash", "Read", "Edit", "Write"];
 
 function fixture(t, declarations = [stdio]) {
   const root = realpathSync(mkdtempSync(join(tmpdir(), "oac-mcp-workspace-")));
@@ -20,7 +20,7 @@ function fixture(t, declarations = [stdio]) {
     const path = join(root, name); mkdirSync(path); return [name, path];
   }));
   const config = { home: dirs.home, state: dirs.state, scratch: dirs.scratch,
-    capability_root: dirs.capabilities,  env_names: ["ANTHROPIC_AUTH_TOKEN"], network_access: "enabled", mcp: declarations };
+    capability_root: dirs.capabilities,  env_names: ["ANTHROPIC_AUTH_TOKEN"], mcp: declarations };
   const previous = process.env;
   process.env = { HOME: dirs.home, CLAUDE_CONFIG_DIR: dirs.state, ANTHROPIC_AUTH_TOKEN: "model-secret" };
   t.after(() => { process.env = previous; rmSync(root, { recursive: true, force: true }); });
@@ -31,8 +31,8 @@ function fixture(t, declarations = [stdio]) {
 test("installed MCP projection uses the common Runtime launcher", t => {
   const { request } = fixture(t);
   assert.deepEqual(parseStart(JSON.stringify(request)), request);
-  assert.throws(() => parseStart(JSON.stringify({ ...request, observe_messages: true,
-    output_format: { type: "json_schema", schema: { type: "object" } } })), /invalid_request/);
+  const structured = { ...request, output_format: { type: "json_schema", schema: { type: "object" } } };
+  assert.deepEqual(parseStart(JSON.stringify(structured)), structured);
   assert.equal(immediateInput(request), undefined);
   assert.deepEqual(parseEnvironmentMCP([stdio]), [stdio]);
   for (const value of [[stdio, stdio], [{ ...stdio, command: "relative" }], [{ ...stdio, env: { TOKEN: "secret" } }],
@@ -46,50 +46,54 @@ test("installed MCP projection uses the common Runtime launcher", t => {
       assert.throws(() => parseEnvironmentMCP([{ ...stdio, args }]), /invalid_request/);
     }
   }
-  assert.throws(() => parseStart(JSON.stringify({ ...request, workspace: { ...request.workspace, network_access: "disabled" } })), /invalid_request/);
 });
 
-test("combined inventory admits exact MCP identities with host file authority", async t => {
+test("workspace admits declared MCP identities and leaves other native tools alone", async t => {
   const { dirs, config } = fixture(t);
   const mcp = new MCPProfile([stdio], []);
-  const workspace = new WorkspaceProfile(dirs.work, config, [], mcp);
+  const workspace = new WorkspaceProfile(dirs.work, config, mcp);
   const signal = new AbortController().signal;
   const input = { hook_event_name: "PreToolUse", session_id: "session", tool_use_id: "call", tool_name: native, tool_input: {} };
   let ready = false;
-  const waiting = workspace.beforeTool(input, "call", { signal }).then(value => { ready = true; return value; });
+  const waiting = mcp.beforeTool(input, "call", { signal }).then(value => { ready = true; return value; });
   await Promise.resolve();
   assert.equal(ready, false);
-  workspace.verify([...baseline, native], statuses, "session");
+  mcp.verify([...nativePreset, native], statuses, "session", false);
   assert.deepEqual(await waiting, {});
   assert.deepEqual(mcp.identities.get(native), { server: "installed", name: "echo.v1" });
-  assert.equal((await workspace.canUseTool(native, {}, { signal })).behavior, "allow");
-  assert.equal((await workspace.canUseTool("mcp__installed__undeclared", {}, { signal })).behavior, "deny");
-  assert.equal((await workspace.canUseTool("Read", { file_path: join(dirs.secrets, "model.key") }, { signal })).behavior, "allow");
-  assert.equal((await workspace.canUseTool("Bash", { command: "pwd", dangerouslyDisableSandbox: true }, { signal })).behavior, "allow");
-  assert.equal((await workspace.beforeTool({ ...input, tool_name: "Read", tool_input: { file_path: "ok.txt" } }, "call", { signal })).hookSpecificOutput.updatedInput.file_path, join(dirs.work, "ok.txt"));
-  for (const fields of [{ session_id: "other" }, { agent_id: "child" }, { tool_name: "mcp__ambient__echo" }]) {
-    assert.equal((await workspace.beforeTool({ ...input, ...fields }, "call", { signal })).hookSpecificOutput.permissionDecision, "deny");
+  for (const tool_name of ["Read", "Write", "Bash"]) assert.deepEqual(await mcp.beforeTool({ ...input, tool_name }, "call", { signal }), {});
+  for (const fields of [{ session_id: "other" }, { agent_id: "child" }, { tool_name: "mcp__installed__undeclared" }]) {
+    assert.equal((await mcp.beforeTool({ ...input, ...fields }, "call", { signal })).hookSpecificOutput.permissionDecision, "deny");
   }
-  assert.deepEqual(workspace.options.allowedTools, ["mcp__installed__*"]);
   assert.equal(mcp.servers.installed.alwaysLoad, true);
-  assert.deepEqual(workspace.options.tools, baseline);
-  assert.deepEqual(workspace.options.sandbox, {enabled:false});
+  assert.deepEqual(workspace.options.tools, { type: "preset", preset: "claude_code" });
   mcp.close();
-  assert.equal((await workspace.canUseTool(native, {}, { signal })).behavior, "deny");
+  assert.equal((await mcp.beforeTool(input, "call", { signal })).hookSpecificOutput.permissionDecision, "deny");
 });
 
-test("combined inventory rejects extra servers, tools and normalized identity collisions", t => {
-  const { dirs, config } = fixture(t);
+test("workspace inventory tolerates native tools and servers, but not unavailable or ambiguous declared ones", t => {
+  const mcp = new MCPProfile([stdio], []);
+  mcp.verify([...nativePreset, native, "mcp__ambient__echo"], [...statuses, { name: "ambient", status: "connected", tools: [{ name: "echo" }] }], "session", false);
+  mcp.close();
   for (const [tools, servers] of [
-    [[...baseline, native, "Write"], statuses],
-    [[...baseline, native], [...statuses, { name: "ambient", status: "connected", tools: [] }]],
-    [[...baseline, native], [{ ...statuses[0], tools: [{ name: "echo.v1" }, { name: "echo_v1" }] }]],
-    [[...baseline, native], [{ ...statuses[0], status: "pending" }]],
+    [[...nativePreset, native], [{ ...statuses[0], tools: [{ name: "echo.v1" }, { name: "echo_v1" }] }]],
+    [nativePreset, []],
   ]) {
-    const mcp = new MCPProfile([stdio], []);
-    assert.throws(() => new WorkspaceProfile(dirs.work, config, [], mcp).verify(tools, servers, "session"));
-    mcp.close();
+    const declared = new MCPProfile([stdio], []);
+    assert.throws(() => declared.verify(tools, servers, "session", false));
+    declared.close();
   }
+  const exact = new MCPProfile([stdio], []);
+  assert.throws(() => exact.verify([...nativePreset, native], statuses, "session"));
+  exact.close();
+  // An optional server that did not connect contributes no tools; a required one fails.
+  const optional = new MCPProfile([stdio], []);
+  optional.verify(nativePreset, [{ ...statuses[0], status: "failed" }], "session", false);
+  assert.equal(optional.identities.size, 0);
+  optional.close();
+  const required = new MCPProfile([{ ...stdio, required: true }], []);
+  assert.throws(() => required.verify(nativePreset, [{ ...statuses[0], status: "pending" }], "session", false), /required/);
+  required.close();
 });
 
 test("workspace bearer references reach native HTTP without leaking values into the request", t => {
@@ -99,26 +103,26 @@ test("workspace bearer references reach native HTTP without leaking values into
   process.env[reference] = "selected-user-token";
   process.env.OAC_RUNTIME_MCP_BEARER_UNSELECTED = "other-token";
   const mcp = new MCPProfile([http], []);
-  const workspace = new WorkspaceProfile(dirs.work, config, [], mcp);
+  const workspace = new WorkspaceProfile(dirs.work, config, mcp);
   assert.equal(workspace.options.env[reference], "selected-user-token");
   assert.equal(workspace.options.env.OAC_RUNTIME_MCP_BEARER_UNSELECTED, "other-token");
   assert.deepEqual(mcp.servers.remote.headers, { Authorization: `Bearer \${${reference}}` });
   assert.equal(JSON.stringify(mcp.servers).includes("selected-user-token"), false);
   delete process.env[reference];
-  assert.throws(() => new WorkspaceProfile(dirs.work, config, [], mcp), /invalid_request/);
+  assert.throws(() => new WorkspaceProfile(dirs.work, config, mcp), /invalid_request/);
 });
 
 test("MCP identity validation preserves host functions and ordinary child environment", async t => {
   const { dirs, config } = fixture(t);
   const functions = ["mcp__functions__lookup"];
   const mcp = new MCPProfile([stdio], functions);
-  const workspace = new WorkspaceProfile(dirs.work, { ...config, tool_env: { USER_VALUE: "initialized" } }, functions, mcp);
-  workspace.verify([...baseline, native, ...functions], [...statuses, { name: "functions", status: "connected" }], "session");
+  const workspace = new WorkspaceProfile(dirs.work, { ...config, tool_env: { USER_VALUE: "initialized" } }, mcp);
+  mcp.verify([...nativePreset, native, ...functions], [...statuses, { name: "functions", status: "connected" }], "session", false);
   const signal = new AbortController().signal;
   const input = { hook_event_name: "PreToolUse", session_id: "session", tool_use_id: "call", tool_name: "Bash", tool_input: { command: "printf ok" } };
-  assert.deepEqual(await workspace.beforeTool(input, "call", { signal }), {});
+  assert.deepEqual(await mcp.beforeTool(input, "call", { signal }), {});
   assert.equal(workspace.options.env.USER_VALUE, "initialized");
-  assert.equal((await workspace.canUseTool(functions[0], {}, { signal })).behavior, "allow");
+  assert.deepEqual(await mcp.beforeTool({ ...input, tool_name: functions[0] }, "call", { signal }), {});
   mcp.close();
 });
 
@@ -130,14 +134,21 @@ test("public workspace HTTP preserves required startup and null versus empty all
     const declaration={...http,allowed_tools};
     assert.deepEqual(parseEnvironmentMCP([declaration]),[declaration]);
     const mcp=new MCPProfile([declaration],[]);
-    const workspace=new WorkspaceProfile(dirs.work,{...config,mcp:[declaration]},[],mcp);
+    const workspace=new WorkspaceProfile(dirs.work,{...config,mcp:[declaration]},mcp);
     assert.throws(()=>mcp.verifyRequired([{name:"remote",status:"pending"}]),/required/);
     const statuses=[{name:"remote",status:"connected",tools:[{name:"prove"},{name:"other"}]}];
     mcp.verifyRequired(statuses);
     const selected=allowed_tools===null?["prove","other"]:allowed_tools;
-    workspace.verify([...baseline,...selected.map(name=>"mcp__remote__"+name)],statuses,"session");
-    assert.equal(mcp.permits("mcp__remote__prove"),allowed_tools===null||allowed_tools.includes("prove"));
-    assert.equal(mcp.permits("mcp__remote__other"),allowed_tools===null);
+    mcp.verify([...nativePreset,...selected.map(name=>"mcp__remote__"+name)],statuses,"session",false);
     mcp.close();
   }
 });
+
+test("declared stdio MCP runs the caller's command natively", () => {
+  const declared = { server_label: "local", command: "run", args: ["-c", "a\nb"], allowed_tools: null, required: true, declared: true };
+  assert.deepEqual(parseEnvironmentMCP([declared]), [declared]);
+  for (const value of [{ ...declared, allowed_tools: ["x"] }, { ...declared, declared: false }, { ...declared, command: " " }, { ...declared, env: {} }]) {
+    assert.throws(() => parseEnvironmentMCP([value]), /invalid_request/);
+  }
+  assert.deepEqual(new MCPProfile([declared], []).servers.local, { type: "stdio", command: "run", args: ["-c", "a\nb"], env: {}, alwaysLoad: true });
+});
diff --git a/packages/claude-sdk-adapter/tests/messages.test.mjs b/packages/claude-sdk-adapter/tests/messages.test.mjs
index 35d5aaaf0..a0cef6fb1 100644
--- a/packages/claude-sdk-adapter/tests/messages.test.mjs
+++ b/packages/claude-sdk-adapter/tests/messages.test.mjs
@@ -2,7 +2,6 @@ import assert from "node:assert/strict";
 import { randomUUID } from "node:crypto";
 import test from "node:test";
 import { MessageObserver } from "../dist/messages.js";
-import { parseStart } from "../dist/adapter.js";
 
 const stream = (event, parent = null) => ({
   type: "stream_event", uuid: randomUUID(), session_id: "session", parent_tool_use_id: parent, event,
@@ -92,9 +91,17 @@ test("unmatched text cannot acquire an invented identity", () => {
   assert.throws(() => observer.consume(snapshot("other", "wrong")), /unmatched/);
 });
 
-test("observation opt-in is an optional boolean", () => {
-  const request = { type: "start", input: [{ content: [{ type: "input_text", text: "hello" }] }], model: "model", system_prompt: "", cwd: "/tmp" };
-  assert.equal(parseStart(JSON.stringify(request)).observe_messages, undefined);
-  assert.equal(parseStart(JSON.stringify({ ...request, observe_messages: true })).observe_messages, true);
-  assert.throws(() => parseStart(JSON.stringify({ ...request, observe_messages: "true" })), /invalid_request/);
+test("thinking blocks with text are reasoning only when summaries are requested", () => {
+  const think = [start("native"), stream({ type: "content_block_start", index: 0, content_block: { type: "thinking", thinking: "" } }),
+    stream({ type: "content_block_delta", index: 0, delta: { type: "thinking_delta", thinking: "hmm " } }),
+    stream({ type: "content_block_delta", index: 0, delta: { type: "signature_delta", signature: "sig" } }), blockStop(0),
+    stream({ type: "content_block_start", index: 1, content_block: { type: "thinking", thinking: "" } }),
+    stream({ type: "content_block_delta", index: 1, delta: { type: "signature_delta", signature: "sig" } }), blockStop(1), stop()];
+  const off = new MessageObserver();
+  assert.deepEqual(think.flatMap(message => off.consume(message)), []);
+  const observer = new MessageObserver(true);
+  assert.deepEqual(think.flatMap(message => observer.consume(message)), [
+    { type: "reasoning", reasoning: { id: "native:0", status: "in_progress", delta: "hmm " } },
+    { type: "reasoning", reasoning: { id: "native:0", status: "completed" } },
+  ]);
 });
diff --git a/packages/claude-sdk-adapter/tests/native_tools.test.mjs b/packages/claude-sdk-adapter/tests/native_tools.test.mjs
new file mode 100644
index 000000000..baa35cbb6
--- /dev/null
+++ b/packages/claude-sdk-adapter/tests/native_tools.test.mjs
@@ -0,0 +1,21 @@
+import assert from "node:assert/strict";
+import { registerHooks } from "node:module";
+import test from "node:test";
+
+const sdk = 'export async function getSessionInfo(){return {sessionId:"native"};} export function query(call){globalThis.options=call.options;return {close(){},async *[Symbol.asyncIterator](){}};} export function startup(){throw new Error("Unexpected preparation");}';
+registerHooks({ resolve(specifier, context, next) {
+  if (specifier === "@anthropic-ai/claude-agent-sdk") return { url: "data:text/javascript," + encodeURIComponent(sdk), shortCircuit: true };
+  return next(specifier, context);
+}});
+const { execute } = await import("../dist/adapter.js");
+
+const start = patch => ({ type: "start", input: [{ content: [{ type: "input_text", text: "hello" }] }], model: "model", system_prompt: "", cwd: process.cwd(), ...patch });
+const selected = async patch => { await execute(start(patch), async () => {}, new AbortController()); return globalThis.options; };
+
+test("environment none adds WebSearch, never WebFetch, when web search is live", async () => {
+  for (const search of ["live", "disabled", undefined]) {
+    const options = await selected({ web_search: search });
+    assert.deepEqual(options.tools, search === "live" ? ["WebSearch"] : []);
+    assert.deepEqual(options.allowedTools, options.tools);
+  }
+});
diff --git a/packages/claude-sdk-adapter/tests/preparation.test.mjs b/packages/claude-sdk-adapter/tests/preparation.test.mjs
index 8b7a4a590..6b8bf3b10 100644
--- a/packages/claude-sdk-adapter/tests/preparation.test.mjs
+++ b/packages/claude-sdk-adapter/tests/preparation.test.mjs
@@ -22,9 +22,9 @@ globalThis.startupFixture = async ({options, initializeTimeoutMs}) => {
   assert.equal(options.model,"fixed-model");
   assert.equal(options.env.UNSELECTED_CANARY,"must-not-inherit");
   assert.equal(options.env.HOME,process.env.HOME);
-  assert.deepEqual(options.tools,["Bash","Read","Edit"]);
-  assert.equal(options.sandbox.enabled,false);
-  assert.equal(options.hooks.PreToolUse.length,1);
+  assert.deepEqual(options.tools,{type:"preset",preset:"claude_code"});
+  assert.equal(options.sandbox,undefined);
+  assert.equal(options.hooks,undefined);
   const child = options.spawnClaudeCodeProcess({command:process.execPath,env:options.env,signal:options.abortController.signal,
     args:["-e","process.stdin.resume();process.stdin.on('end',()=>process.exit(0));"]});
   process.send({kind:"spawn",pid:child.pid});
@@ -47,7 +47,7 @@ globalThis.startupFixture = async ({options, initializeTimeoutMs}) => {
           await new Promise(resolve=>setTimeout(resolve,80));
           return {absPath:path,encoding,contents:Buffer.from([0,255,128,1]).toString("base64")};
         },
-        async initializationResult(){return {hooks_applied:mode !== "missing-hooks"};},
+        async initializationResult(){return {hooks_applied:true};},
         async *[Symbol.asyncIterator](){
           const command={type:"assistant",session_id:"native",parent_tool_use_id:null,
             message:{content:[{type:"tool_use",id:"command",name:"Bash",input:{command:"printf 'prepared'"}}]}};
@@ -57,7 +57,7 @@ globalThis.startupFixture = async ({options, initializeTimeoutMs}) => {
           if(first.done)return;
           process.send({kind:"input",text:first.value.message.content[0].text});
           yield {type:"system",subtype:"init",session_id:mode === "resume-mismatch"?"other":"native",mcp_servers:[],
-            tools:mode === "bad-inventory"?["Bash","Read","Edit","Agent"]:["Bash","Read","Edit"]};
+            tools:["Bash","Read","Edit"]};
           const ids=[first.value.uuid];
           if(mode === "commands") {
             yield command;
@@ -96,12 +96,12 @@ test("prepare validates a workspace-only immutable configuration and prompt-only
   try {
     assert.deepEqual(parseRequest(JSON.stringify(request)), request);
     assert.deepEqual(parseRequest(JSON.stringify({ ...request, functions: [] })), { ...request, functions: [] });
-    for (const fields of [{ input: [{ content: [{ type: "input_text", text: "" }] }] }, { input: [{ content: [{ type: "input_text", text: "input" }] }] }, { workspace: undefined },
+    for (const fields of [{ input: [{ content: [{ type: "input_text", text: "input" }] }] }, { workspace: undefined },
       { mcp_http_servers: [] }, { env: {} }, { resume: "" }, { type: "prepared" }]) {
       assert.throws(() => parseRequest(JSON.stringify({ ...request, ...fields })), /invalid_request/);
     }
     assert.deepEqual(preparedInput({ type: "start", input: [{ content: [{ type: "input_text", text: "first" }] }] }), [{ content: [{ type: "input_text", text: "first" }] }]);
-    for (const value of [{ type: "start", input: [{ content: [{ type: "input_text", text: "" }] }] }, { type: "start", input: [{ content: [{ type: "input_text", text: "first" }] }], model: "other" },
+    for (const value of [{ type: "start", input: [{ content: [] }] }, { type: "start", input: [{ content: [{ type: "input_text", text: "first" }] }], model: "other" },
       { type: "start", input: [{ content: [{ type: "input_text", text: "first" }] }], resume: "other" }, { type: "start", input: [{ content: [{ type: "input_text", text: "first" }] }], workspace: request.workspace },
       { type: "steer", text: "first" }, null]) assert.throws(() => preparedInput(value), /invalid_request/);
   } finally { rmSync(root, { recursive: true, force: true }); }
@@ -149,7 +149,7 @@ async function launch(t, mode) {
   return { child, request, events, observations, send, wait, finish };
 }
 
-for (const mode of ["release", "resume", "steer", "commands", "unused", "owner-cancel", "native-exit", "duplicate", "replacement", "early-steer", "bad-inventory", "resume-mismatch"]) {
+for (const mode of ["release", "resume", "steer", "commands", "unused", "owner-cancel", "native-exit", "duplicate", "replacement", "early-steer", "resume-mismatch"]) {
   test(`prepared entrypoint lifecycle: ${mode}`, { timeout: 10000 }, async t => {
     const bridge = await launch(t, mode);
     const { child, request, events, observations, send, wait, finish } = bridge;
@@ -167,7 +167,7 @@ for (const mode of ["release", "resume", "steer", "commands", "unused", "owner-c
     else {
       send({ type: "start", input: [{ content: [{ type: "input_text", text: "first" }] }] });
       if (mode === "duplicate") { send({ type: "start", input: [{ content: [{ type: "input_text", text: "second" }] }] }); await finish("invalid_request"); }
-      else if (["bad-inventory", "resume-mismatch"].includes(mode)) {
+      else if (mode === "resume-mismatch") {
         await finish("execution_failed");
         assert.equal(events.some(event => event.type === "input_ready"), false);
       } else {
@@ -193,7 +193,7 @@ test("preparation cannot observe commands before actual input", { timeout: 10000
   assert.equal(observations.some(value=>value.kind === "input"),false);
 });
 
-for (const mode of ["missing-history", "missing-hooks", "startup-error", "early-start", "cancel-startup"]) {
+for (const mode of ["missing-history", "startup-error", "early-start", "cancel-startup"]) {
   test(`preparation rejects before receipt: ${mode}`, { timeout: 10000 }, async t => {
     const { child, request, events, observations, send, wait, finish } = await launch(t, mode === "cancel-startup" ? "slow-startup" : mode);
     send(request);
diff --git a/packages/claude-sdk-adapter/tests/search_observer.test.mjs b/packages/claude-sdk-adapter/tests/search_observer.test.mjs
new file mode 100644
index 000000000..cffafc299
--- /dev/null
+++ b/packages/claude-sdk-adapter/tests/search_observer.test.mjs
@@ -0,0 +1,31 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { SearchObserver } from "../dist/search_observer.js";
+
+const assistant = (id, name, input) => ({ type: "assistant", session_id: "session", parent_tool_use_id: null,
+  message: { content: [{ type: "tool_use", id, name, input }] } });
+const user = (id, is_error = false) => ({ type: "user", session_id: "session", parent_tool_use_id: null,
+  message: { content: [{ type: "tool_result", tool_use_id: id, content: "native result", is_error }] } });
+const consume = (observer, message) => [...observer.consume(message, "session")];
+
+test("WebSearch and WebFetch project as web search actions with a completion status", () => {
+  const observer = new SearchObserver();
+  assert.deepEqual(consume(observer, assistant("search", "WebSearch", { query: "agents api" })), [{ type: "search_observation", session_id: "session", id: "search", stage: "before",
+    observation: { kind: "web_search", status: "in_progress", action: { type: "search", query: "agents api" } } }]);
+  consume(observer, assistant("fetch", "WebFetch", { url: "https://example.com", prompt: "summarize" }));
+  assert.throws(() => observer.assertComplete());
+  assert.equal(consume(observer, user("search"))[0].observation.status, "completed");
+  assert.deepEqual(consume(observer, user("fetch", true))[0].observation, { kind: "web_search", status: "failed", action: { type: "open_page", url: "https://example.com" } });
+  observer.assertComplete();
+  assert.deepEqual(observer.close("session"), []);
+});
+
+test("other tools, child work and replays are not observed; open calls close as incomplete", () => {
+  const observer = new SearchObserver();
+  for (const message of [assistant("bash", "Bash", { command: "true" }), { ...assistant("child", "WebSearch", { query: "q" }), parent_tool_use_id: "parent" },
+    { ...assistant("replay", "WebSearch", { query: "q" }), isReplay: true }, assistant("blank", "WebSearch", {})]) {
+    assert.deepEqual(consume(observer, message), []);
+  }
+  consume(observer, assistant("open", "WebSearch", { query: "q" }));
+  assert.deepEqual(observer.close("session").map(event => [event.id, event.stage, event.observation.status]), [["open", "after", "incomplete"]]);
+});
diff --git a/packages/claude-sdk-adapter/tests/structured_output.test.mjs b/packages/claude-sdk-adapter/tests/structured_output.test.mjs
index 878c9fcd9..e38e420c9 100644
--- a/packages/claude-sdk-adapter/tests/structured_output.test.mjs
+++ b/packages/claude-sdk-adapter/tests/structured_output.test.mjs
@@ -21,8 +21,9 @@ test('unrelated or failed results cannot publish a candidate',()=>{
   const o=new StructuredOutput();o.consume(call('id'),'session');o.consume(receipt('id'),'session');assert.throws(()=>o.complete(r));
  }
 });
-test('output configuration is restricted to the qualified profile',()=>{
- const r={type:'start',input: [{ content: [{ type: "input_text", text: 'hello' }] }],model:'model',system_prompt:'',cwd:'/tmp',observe_messages:true,output_format:{type:'json_schema',schema:{type:'object'}}};
+test('output configuration combines with agents and MCP',()=>{
+ const r={type:'start',input: [{ content: [{ type: "input_text", text: 'hello' }] }],model:'model',system_prompt:'',cwd:'/tmp',output_format:{type:'json_schema',schema:{type:'object'}}};
  assert.deepEqual(parseStart(JSON.stringify(r)),r);
- for(const change of [{observe_messages:false},{subagents:{max_concurrent:1}},{mcp_http_servers:[]},{output_format:{type:'text',schema:{}}}]) assert.throws(()=>parseStart(JSON.stringify({...r,...change})));
+ for(const change of [{subagents:{max_concurrent:1}},{mcp_http_servers:[]}]) assert.deepEqual(parseStart(JSON.stringify({...r,...change})),{...r,...change});
+ for(const change of [{output_format:{type:'text',schema:{}}}]) assert.throws(()=>parseStart(JSON.stringify({...r,...change})));
 });
diff --git a/packages/claude-sdk-adapter/tests/subagents.test.mjs b/packages/claude-sdk-adapter/tests/subagents.test.mjs
index bb30972a8..b34d45dba 100644
--- a/packages/claude-sdk-adapter/tests/subagents.test.mjs
+++ b/packages/claude-sdk-adapter/tests/subagents.test.mjs
@@ -22,7 +22,9 @@ test("native child input owns its Turn and stable creation time; completion is n
   assert.equal(facts[0].fact.native_created_at, 1700000000);
   assert.equal(facts[0].fact.parent_turn_id, "root-turn");
   assert.equal(facts.filter(e => e.type === "subagent_turn").length, 2);
-  assert.deepEqual(facts.filter(e => e.type === "subagent_item").map(e => e.fact.kind), ["message", "reasoning", "output_message"]);
+  const kinds = history => history.filter(e => e.type === "subagent_item").map(e => e.fact.kind);
+  assert.deepEqual(kinds(projectHistory("root", root, children, { reasoning: true })), ["message", "reasoning", "output_message"]);
+  assert.deepEqual(kinds(facts), ["message", "output_message"]);
   assert.equal(facts.find(e => e.type === "subagent_turn" && e.fact.status === "completed").fact.completed_at_ms, 1700000000030);
   assert(!facts.some(e => e.type === "subagent_lifecycle"));
   assert.deepEqual(facts, projectHistory("root", structuredClone(root), structuredClone(children)));
@@ -49,11 +51,11 @@ test("native admission reserves before start across the whole tree and releases
   const profile = new Subagents("/workspace", 1, undefined), context = { signal: new AbortController().signal };
   profile.consume({ type: "system", subtype: "init", session_id: "root" });
   const before = (id, actor) => profile.beforeTool({ hook_event_name: "PreToolUse", session_id: "root", tool_name: "Agent", tool_use_id: id, agent_id: actor,
-    tool_input: { subagent_type: "oac_worker", prompt: "work" } }, id, context);
+    tool_input: { subagent_type: "general-purpose", prompt: "work" } }, id, context);
   assert.equal((await before("one")).hookSpecificOutput.permissionDecision, "allow");
   assert.equal((await before("two")).hookSpecificOutput.permissionDecision, "deny");
   profile.consume({ type: "system", subtype: "task_started", task_type: "local_agent", task_id: "child", session_id: "root", tool_use_id: "one" });
-  await profile.childStart({ hook_event_name: "SubagentStart", session_id: "root", agent_id: "child", agent_type: "oac_worker" }, undefined, context);
+  await profile.childStart({ hook_event_name: "SubagentStart", session_id: "root", agent_id: "child", agent_type: "general-purpose" }, undefined, context);
   assert.equal((await before("nested", "child")).hookSpecificOutput.permissionDecision, "deny");
   const send = await profile.beforeTool({ hook_event_name: "PreToolUse", session_id: "root", tool_name: "SendMessage", tool_use_id: "send",
     tool_input: { to: "child", message: "continue" } }, "send", context);
@@ -68,7 +70,7 @@ test("native admission reserves before start across the whole tree and releases
 test("an unadmitted native start cannot authorize a child tool actor", async () => {
   const profile = new Subagents("/workspace", 1, undefined);
   profile.consume({ type: "system", subtype: "init", session_id: "root" });
-  await assert.rejects(profile.childStart({ hook_event_name: "SubagentStart", session_id: "root", agent_id: "foreign", agent_type: "oac_worker" }), /invalid native child start/);
+  await assert.rejects(profile.childStart({ hook_event_name: "SubagentStart", session_id: "root", agent_id: "foreign", agent_type: "general-purpose" }), /invalid native child start/);
   assert.equal(profile.permitsActor("foreign"), false);
 });
 
@@ -123,3 +125,54 @@ test("child input uses the shared neutral input envelope", () => {
   assert.equal(input.fact.item_id, "child-turn");
   assert.equal(input.fact.position, 0);
 });
+
+test("native agent types, model, mode and worktree isolation pass; remote isolation is refused", async () => {
+  const profile = new Subagents("/workspace", 9, undefined), context = { signal: new AbortController().signal };
+  profile.consume({ type: "system", subtype: "init", session_id: "root" });
+  const decide = (id, extra) => profile.beforeTool({ hook_event_name: "PreToolUse", session_id: "root", tool_name: "Agent", tool_use_id: id,
+    tool_input: { subagent_type: "Explore", prompt: "work", ...extra } }, id, context).then(r => r.hookSpecificOutput.permissionDecision);
+  assert.equal(await decide("a", { model: "sonnet", mode: "plan", run_in_background: true, isolation: "worktree" }), "allow");
+  assert.equal(await decide("b", { isolation: "remote" }), "deny");
+});
+
+test("SendMessage addresses a child by its spawned name and the model is reported", async () => {
+  const profile = new Subagents("/workspace", 6, undefined), context = { signal: new AbortController().signal };
+  profile.consume({ type: "system", subtype: "init", session_id: "root" });
+  await profile.beforeTool({ hook_event_name: "PreToolUse", session_id: "root", tool_name: "Agent", tool_use_id: "one",
+    tool_input: { prompt: "work", name: "Helper Bot" } }, "one", context);
+  profile.consume({ type: "system", subtype: "task_started", task_type: "local_agent", task_id: "child", session_id: "root", tool_use_id: "one" });
+  profile.consume({ type: "system", subtype: "task_notification", task_id: "child", session_id: "root", tool_use_id: "one", status: "completed" });
+  // Native also matches the normalized name.
+  const send = await profile.beforeTool({ hook_event_name: "PreToolUse", session_id: "root", tool_name: "SendMessage", tool_use_id: "send",
+    tool_input: { to: " helper-bot ", message: "continue" } }, "send", context);
+  assert.equal(send.hookSpecificOutput.permissionDecision, "allow");
+
+  const { root, children } = fixture();
+  root[1].message.content[0].input = { prompt: "child input", name: "helper", model: "sonnet" };
+  root[1].message.content.push({ type: "tool_use", id: "send", name: "SendMessage", input: { to: "helper", message: "continue" } });
+  root.push({ type: "user", message: { content: [{ type: "tool_result", tool_use_id: "send", content: "ok" }] }, toolUseResult: { pin: { id: "child" } } });
+  const facts = projectHistory("root", root, children).filter(e => e.type === "subagent_coordination");
+  assert.equal(facts.find(e => e.fact.kind === "create_subagent_call").fact.model, "sonnet");
+  assert.deepEqual(facts.find(e => e.fact.kind === "send_subagent_input_call").fact.recipients, ["child"]);
+});
+
+test("a running child projects its open Turn only; function and MCP calls of a finished child become observations", () => {
+  const { root, children } = fixture(), rows = children[0].rows, tools = new Map([["mcp__docs__find", { server: "docs", name: "find" }]]);
+  rows.splice(1, 0,
+    { ...rows[1], uuid: "calls", timestamp: timestamp(15), message: { id: "calls", content: [
+      { type: "tool_use", id: "fn", name: "mcp__functions__lookup", input: { topic: "sky" } },
+      { type: "tool_use", id: "doc", name: "mcp__docs__find", input: { q: "x" } }] } },
+    { ...rows[0], uuid: "answers", parentUuid: "calls", timestamp: timestamp(16), message: { content: [
+      { type: "tool_result", tool_use_id: "fn", content: [{ type: "text", text: "CODE" }, { type: "image", source: { type: "base64", media_type: "image/png", data: "AA==" } }] }] } },
+    { ...rows[0], uuid: "doc-answer", parentUuid: "answers", timestamp: timestamp(17), toolUseResult: [{ type: "text", text: "7" }], mcpMeta: { structuredContent: { value: 7 } },
+      message: { content: [{ type: "tool_result", tool_use_id: "doc", content: [{ type: "text", text: "7" }] }] } });
+  const observations = facts => facts.filter(e => e.type === "subagent_item" && e.fact.kind === "tool_call").map(e => e.fact.payload.observation);
+  assert.deepEqual(observations(projectHistory("root", root, children, { tools })), [
+    { kind: "function", name: "lookup", arguments: { topic: "sky" }, status: "completed", content: [{ type: "input_text", text: "CODE" }, { type: "input_image", image_url: "data:image/png;base64,AA==" }] },
+    { kind: "mcp", server: "docs", name: "find", arguments: { q: "x" }, status: "completed", output: { content: [{ type: "text", text: "7" }], structuredContent: { value: 7 } } },
+  ]);
+  root.pop(); rows.pop(); rows.pop();
+  const live = projectHistory("root", root, children, { live: new Map([["child", "spawn"]]) });
+  assert.deepEqual(live.map(e => e.type), ["subagent_identity", "subagent_turn"]);
+  assert.deepEqual(live[1].fact, { native_id: "child", turn_id: "child-turn", created_at_ms: 1700000000010, started_at_ms: 1700000000010, status: "in_progress" });
+});
diff --git a/packages/claude-sdk-adapter/tests/tool_search.test.mjs b/packages/claude-sdk-adapter/tests/tool_search.test.mjs
index 7e184f247..f33da1e65 100644
--- a/packages/claude-sdk-adapter/tests/tool_search.test.mjs
+++ b/packages/claude-sdk-adapter/tests/tool_search.test.mjs
@@ -1,26 +1,19 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import { parseStart } from "../dist/request.js";
-import { toolSearchEnvironment } from "../dist/tool_search.js";
 
 const request = () => ({type:"start", input:[{content:[{type:"input_text",text:"lookup"}]}], model:"model", system_prompt:"", cwd:process.cwd(),
   tool_search:true, functions:[{name:"lookup",description:"Lookup",parameters:{type:"object"},defer_loading:true}]});
 
-test("discovery preserves intent and rejects unqualified native combinations", () => {
+test("discovery preserves intent and rejects a mismatch with deferred functions", () => {
   assert.deepEqual(parseStart(JSON.stringify(request())), request());
-  for (const patch of [{tool_search:false}, {tool_search:null}, {output_format:{type:"json_schema",schema:{type:"object"}}},
-    {mcp_http_servers:[]}, {subagents:{max_concurrent:2}}, {functions:[{...request().functions[0],defer_loading:false}]}]) {
+  for (const patch of [{tool_search:false}, {tool_search:null}, {functions:[{...request().functions[0],defer_loading:false}]}]) {
     assert.throws(() => parseStart(JSON.stringify({...request(),...patch})), /invalid_request/);
   }
 });
 
-test("native search uses explicit mode without overriding conflicting operator settings", () => {
-  const env = {ANTHROPIC_BASE_URL:"https://example.test/anthropic", RETAIN:"yes"};
-  assert.deepEqual(toolSearchEnvironment(env,"model"), {...env, ENABLE_TOOL_SEARCH:"true"});
-  assert.equal(env.ENABLE_TOOL_SEARCH,undefined);
-  for (const patch of [{ENABLE_TOOL_SEARCH:"false"},{ENABLE_TOOL_SEARCH:"force"},{ENABLE_TOOL_SEARCH:"auto"},
-    {CLAUDE_CODE_USE_BEDROCK:"1"},{CLAUDE_CODE_USE_VERTEX:"1"},{CLAUDE_CODE_USE_FOUNDRY:"1"},{CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS:"true"}]) {
-    assert.throws(() => toolSearchEnvironment({...env,...patch},"model"), /unqualified/);
-  }
-  assert.throws(() => toolSearchEnvironment(env,"claude-3-5-haiku-latest"), /unqualified/);
+test("discovery combines with structured output and MCP", () => {
+  const combined = {...request(), output_format:{type:"json_schema",schema:{type:"object"}},
+    mcp_http_servers:[{server_label:"docs",server_url:"https://example.test/mcp",allowed_tools:null}]};
+  assert.deepEqual(parseStart(JSON.stringify(combined)), combined);
 });
diff --git a/packages/claude-sdk-adapter/tests/workspace.test.mjs b/packages/claude-sdk-adapter/tests/workspace.test.mjs
index 817c8e0cc..9e6eb9fc0 100644
--- a/packages/claude-sdk-adapter/tests/workspace.test.mjs
+++ b/packages/claude-sdk-adapter/tests/workspace.test.mjs
@@ -69,116 +69,33 @@ test("workspace environment copies only selected refs and fixed values", t => {
   process.env.CLAUDE_CODE_PROJECT_DIR_NAME = "ambient-history-override";
   assert.throws(() => new WorkspaceProfile(dirs.workspace, config), /invalid_request/);
 });
-
-test("workspace native options bypass isolation and preserve selected tool inventory", t => {
+test("workspace runs the native tool preset and removes only what cannot run unattended", async t => {
   const { dirs, config } = fixture(t);
-  const profile = new WorkspaceProfile(dirs.workspace, config);
-  const options = profile.options;
-  assert.deepEqual(options.tools, ["Bash", "Read", "Edit"]);
-  assert.deepEqual(options.allowedTools, []);
-  assert.deepEqual(options.settingSources, []);
-  assert.deepEqual(options.mcpServers, {});
-  assert.equal(options.strictMcpConfig, true);
-  assert.equal(options.permissionMode, "default");
-  assert.equal(options.persistSession, true);
-  assert.equal(options.sandbox.enabled, false);
-  assert.deepEqual(options.sandbox, { enabled: false });
-  assert.equal(options.allowDangerouslySkipPermissions, undefined);
-  assert.deepEqual(options.settings, {});
-  profile.verify(["Read", "Edit", "Bash"], []);
-  for (const tools of [[], ["Bash", "Read", "Read"], ["Bash", "Read", "Write"], ["Bash", "Read", "Edit", "Agent"]]) {
-    assert.throws(() => profile.verify(tools, []), /unexpected native workspace inventory/);
-  }
-  assert.throws(() => profile.verify(options.tools, [{ name: "untrusted", status: "connected" }]), /unexpected native workspace inventory/);
-});
-
-test("structured workspace admits only its configured native terminal tool", async t => {
-  const { dirs, config, request } = fixture(t);
-  const output_format = { type: "json_schema", schema: { type: "object" } };
-  const configured = { ...request, observe_messages: true, output_format };
-  assert.deepEqual(parseStart(JSON.stringify(configured)), configured);
-  const ordinary = new WorkspaceProfile(dirs.workspace, config);
-  const structured = new WorkspaceProfile(dirs.workspace, config, [], undefined, undefined, true);
-  const { canUseTool: ordinaryPermission, hooks: ordinaryHooks, ...ordinaryOptions } = ordinary.options;
-  const { canUseTool: structuredPermission, hooks: structuredHooks, ...structuredOptions } = structured.options;
-  assert.deepEqual(structuredOptions, ordinaryOptions);
-  const inventory = ["Bash", "Read", "Edit", "StructuredOutput"];
-  structured.verify(inventory, []);
-  assert.throws(() => ordinary.verify(inventory, []));
-  assert.throws(() => structured.verify(["Bash", "Read", "Edit"], []));
-  assert.throws(() => structured.verify([...inventory, "Write"], []));
-  const context = { signal: new AbortController().signal, toolUseID: "terminal", requestId: "request" };
-  assert.equal((await ordinary.canUseTool("StructuredOutput", {}, context)).behavior, "deny");
-  assert.equal((await structured.canUseTool("StructuredOutput", {}, context)).behavior, "allow");
-  for (const extra of [{ agentID: "child" }, { signal: AbortSignal.abort() }]) {
-    assert.equal((await structured.canUseTool("StructuredOutput", {}, { ...context, ...extra })).behavior, "deny");
+  const options = new WorkspaceProfile(dirs.workspace, config).options;
+  assert.deepEqual(options.tools, { type: "preset", preset: "claude_code" });
+  assert.deepEqual(options.disallowedTools, ["AskUserQuestion", "CronCreate", "CronDelete", "CronList", "ScheduleWakeup", "Monitor", "Workflow", "ListAgents", "Agent", "SendMessage"]);
+  assert.equal(options.permissionMode, undefined);
+  for (const key of ["allowedTools", "settingSources", "mcpServers", "strictMcpConfig", "persistSession", "sandbox", "settings", "allowDangerouslySkipPermissions"]) {
+    assert.equal(options[key], undefined, key);
   }
-  const hook = { hook_event_name: "PreToolUse", tool_name: "StructuredOutput", tool_input: {}, tool_use_id: "terminal" };
-  assert.deepEqual(await structured.beforeTool(hook, "terminal", context), {});
-  for (const [input, id, ctx] of [[{ ...hook, agent_id: "child" }, "terminal", context], [hook, "wrong", context], [hook, "terminal", { ...context, signal: AbortSignal.abort() }]]) {
-    assert.equal((await structured.beforeTool(input, id, ctx)).hookSpecificOutput.permissionDecision, "deny");
+  const signal = new AbortController().signal;
+  for (const [name, input] of [["Bash", { command: "true" }], ["Write", { file_path: "file.txt" }], ["Read", { file_path: "../protected/value" }]]) {
+    assert.deepEqual(await options.canUseTool(name, input, { signal }), { behavior: "allow", updatedInput: input });
   }
 });
 
-test("workspace permissions preserve host authority and synchronous command ownership", async t => {
+test("Core declarations remove subagent and search tools only when declared", t => {
   const { dirs, config } = fixture(t);
-  writeFileSync(join(dirs.workspace, "file.txt"), "fixture");
-  symlinkSync(dirs.protected, join(dirs.workspace, "escape"));
-  symlinkSync(join(dirs.protected, "missing"), join(dirs.workspace, "dangling"));
-  symlinkSync(join(dirs.workspace, "file.txt"), join(dirs.workspace, "inside"));
-  const profile = new WorkspaceProfile(dirs.workspace, config);
-  const options = { signal: new AbortController().signal, toolUseID: "tool", requestId: "request" };
-  const hook = async (name, input) => profile.beforeTool({ hook_event_name: "PreToolUse", session_id: "native", cwd: dirs.workspace,
-    transcript_path: join(dirs.state, "session"), tool_name: name, tool_input: input, tool_use_id: "tool" }, "tool", options);
-  for (const [name, input] of [["Bash", { command: "printf value" }], ["Bash", { command: "true", dangerouslyDisableSandbox: true }], ["Read", { file_path: "file.txt" }],
-    ["Read", { file_path: "inside" }], ["Edit", { file_path: "new/file.txt", old_string: "", new_string: "value" }]]) {
-    const permission = await profile.canUseTool(name, input, options);
-    assert.equal(permission.behavior, "allow");
-    if (name === "Bash") assert.deepEqual(await hook(name, input), {});
-    else {
-      assert.equal(permission.updatedInput.file_path, join(dirs.workspace, input.file_path));
-      assert.deepEqual((await hook(name, input)).hookSpecificOutput.updatedInput, permission.updatedInput);
-    }
-  }
-  for (const [name, input] of [["Bash", { command: "true", run_in_background: true }],
-    ["Bash", { command: "true", run_in_background: "false" }],
-    ["Write", { file_path: "file.txt" }]]) {
-    assert.equal((await profile.canUseTool(name, input, options)).behavior, "deny");
-    assert.equal((await hook(name, input)).hookSpecificOutput.permissionDecision, "deny");
-  }
-  assert.equal((await profile.canUseTool("Bash", { command: "true" }, { ...options, agentID: "child" })).behavior, "deny");
-  assert.equal((await profile.canUseTool("Bash", { command: "true" }, { ...options, signal: AbortSignal.abort() })).behavior, "deny");
-});
-
-test("Runtime rejects network isolation requests", t => {
- const {dirs,config}=fixture(t);
- assert.deepEqual(new WorkspaceProfile(dirs.workspace,{...config,network_access:"enabled"}).options.sandbox,{enabled:false});
- for(const network_access of ["disabled","restricted"]) assert.throws(()=>parseWorkspace({...config,network_access,allowed_domains:network_access==="restricted"?["example.com"]:[]},dirs.workspace),/invalid_request/);
+  const subagents = new WorkspaceProfile(dirs.workspace, config, undefined, {}).options.disallowedTools;
+  assert.ok(!subagents.includes("Agent") && !subagents.includes("SendMessage") && !subagents.includes("WebSearch"));
+  const disabled = new WorkspaceProfile(dirs.workspace, config, undefined, undefined, true).options.disallowedTools;
+  assert.ok(disabled.includes("WebSearch") && disabled.includes("WebFetch"));
 });
 
-test("workspace functions retain native sandbox and exact tool authority", async t => {
-  const { dirs, config, request } = fixture(t);
+test("workspace functions are parsed", async t => {
+  const { request } = fixture(t);
   const functions = [{ name: "lookup", description: "Lookup", parameters: { type: "object" } }];
   assert.deepEqual(parseStart(JSON.stringify({ ...request, functions })).functions, functions);
-  const profile = new WorkspaceProfile(dirs.workspace, config, ["mcp__functions__lookup"]);
-  profile.verify(["Bash", "Read", "Edit", "mcp__functions__lookup"], [{ name: "functions", status: "connected" }]);
-  for (const servers of [[], [{ name: "functions", status: "failed" }], [{ name: "external", status: "connected" }]]) {
-    assert.throws(() => profile.verify(["Bash", "Read", "Edit", "mcp__functions__lookup"], servers));
-  }
-  assert.throws(() => profile.verify(["Bash", "Read", "Edit", "mcp__functions__unknown"], [{ name: "functions", status: "connected" }]));
-  const controller = new AbortController();
-  const input = { id: "fixture" };
-  const options = { signal: controller.signal };
-  assert.deepEqual(await profile.canUseTool("mcp__functions__lookup", input, options), { behavior: "allow", updatedInput: input });
-  assert.equal((await profile.canUseTool("mcp__functions__unknown", input, options)).behavior, "deny");
-  assert.equal((await profile.canUseTool("mcp__functions__lookup", input, { ...options, agentID: "child" })).behavior, "deny");
-  const event = { hook_event_name: "PreToolUse", tool_name: "mcp__functions__lookup", tool_input: input, tool_use_id: "call" };
-  assert.deepEqual(await profile.beforeTool(event, "call", options), {});
-  assert.equal((await profile.beforeTool({ ...event, tool_name: "mcp__external__lookup" }, "call", options)).hookSpecificOutput.permissionDecision, "deny");
-  assert.equal((await profile.canUseTool("Bash", { command: "true", dangerouslyDisableSandbox: true }, options)).behavior, "allow");
-  assert.equal((await profile.canUseTool("Read", { file_path: dirs.state + "/history" }, options)).behavior, "allow");
-  controller.abort();
-  assert.equal((await profile.canUseTool("mcp__functions__lookup", input, options)).behavior, "deny");
 });
 
 test("initialized environment is ordinary child environment on every layout", t => {
@@ -189,37 +106,26 @@ test("initialized environment is ordinary child environment on every layout", t
   assert.equal(profile.options.env.HOME,dirs.home);
   assert.equal(profile.options.env.CLAUDE_CONFIG_DIR,dirs.state);
   assert.equal(profile.options.env.home,undefined);
-  assert.deepEqual(profile.options.sandbox,{enabled:false});
  }
 });
 
-test("host tools can access paths outside the workspace", async t => {
- const {dirs,config}=fixture(t);
- const profile=new WorkspaceProfile(dirs.workspace,config);
- for(const file_path of ["../protected/value",join(dirs.home,"credentials")]) {
-  assert.equal((await profile.canUseTool("Read",{file_path},{signal:new AbortController().signal})).behavior,"allow");
- }
+test("Core sets only the environment that cloud operation needs", t => {
+  const { dirs, config } = fixture(t);
+  const env = new WorkspaceProfile(dirs.workspace, config).options.env;
+  for (const name of ["DISABLE_TELEMETRY", "DISABLE_ERROR_REPORTING", "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"]) assert.equal(env[name], undefined, name);
 });
 
-
-test("workspace discovery preserves native file tools and the function boundary", async t => {
-  const { dirs, config, request } = fixture(t);
+test("workspace discovery keeps the function boundary on the native tool set", t => {
+  const { request } = fixture(t);
   const functions = [{name:"lookup", description:"Lookup", parameters:{type:"object"}, defer_loading:true}];
   const configured = {...request, tool_search:true, functions};
   assert.deepEqual(parseStart(JSON.stringify(configured)), configured);
-  const profile = new WorkspaceProfile(dirs.workspace, config, ["mcp__functions__lookup"], undefined, undefined, false, true);
-  assert.deepEqual(profile.options.tools, ["Bash", "Read", "Edit", "ToolSearch"]);
-  assert.deepEqual(profile.options.allowedTools, ["mcp__functions__lookup", "ToolSearch"]);
-  const tools = [...profile.options.tools, "mcp__functions__lookup"];
-  profile.verify(tools, [{name:"functions",status:"connected"}]);
-  assert.throws(() => profile.verify(tools.filter(name => name !== "ToolSearch"), [{name:"functions",status:"connected"}]));
-  const ordinary = new WorkspaceProfile(dirs.workspace, config);
-  const context = {signal:new AbortController().signal, toolUseID:"search", requestId:"request"};
-  assert.equal((await profile.canUseTool("ToolSearch", {query:"lookup"}, context)).behavior,"allow");
-  assert.equal((await ordinary.canUseTool("ToolSearch", {query:"lookup"}, context)).behavior,"deny");
-  assert.equal((await profile.canUseTool("mcp__functions__undeclared", {}, context)).behavior,"deny");
-  assert.equal((await profile.canUseTool("ToolSearch", {}, {...context, agentID:"child"})).behavior,"deny");
-  assert.equal((await profile.canUseTool("ToolSearch", {}, {...context, signal:AbortSignal.abort()})).behavior,"deny");
+});
+
+test("web search control is the disabled or live mode", t => {
+  const { request } = fixture(t);
+  assert.equal(parseStart(JSON.stringify({ ...request, web_search: "live" })).web_search, "live");
+  assert.throws(() => parseStart(JSON.stringify({ ...request, web_search: true })), /invalid_request/);
 });
 
 test("workspace forwards selected activity headers and preserves explicit empty selection", t => {
diff --git a/packages/claude-sdk-adapter/tests/workspace_directories.test.mjs b/packages/claude-sdk-adapter/tests/workspace_directories.test.mjs
index d9c3ae1bb..dd3abf7a1 100644
--- a/packages/claude-sdk-adapter/tests/workspace_directories.test.mjs
+++ b/packages/claude-sdk-adapter/tests/workspace_directories.test.mjs
@@ -41,7 +41,7 @@ test("bounded literal metadata, missing directory, and traversal denial", async
   assert.deepEqual((await f.list("nested")).entries, []);
   assert.equal((await f.list("", 1)).truncated, true);
   assert.equal((await f.list("absent")).error, "not_found");
-  assert.deepEqual((await f.list("inside")).entries, []);
+  for (const path of ["inside", "outside", "outside/workspace", "binary"]) assert.equal((await f.list(path)).error, "invalid");
   for (const path of ["/", "a//b", ".", "..", "a/../b", "a\\b", "a\n"]) assert.equal((await f.list(path)).error, "invalid");
   for (const limit of [0, -1, 1001, 1.1]) assert.equal((await f.list("", limit)).error, "invalid");
 });
diff --git a/packages/claude-sdk-adapter/tests/workspace_execution.test.mjs b/packages/claude-sdk-adapter/tests/workspace_execution.test.mjs
index 50ff156d8..00d29ab6d 100644
--- a/packages/claude-sdk-adapter/tests/workspace_execution.test.mjs
+++ b/packages/claude-sdk-adapter/tests/workspace_execution.test.mjs
@@ -4,7 +4,7 @@ import test from "node:test";
 
 const fixture = `
 import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, realpathSync, rmSync } from "node:fs";
+import { mkdtempSync, mkdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { registerHooks } from "node:module";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -15,14 +15,18 @@ registerHooks({ resolve(specifier, context, next) {
 }});
 const { execute } = await import(${JSON.stringify(new URL("../dist/adapter.js", import.meta.url).href)});
 const root = realpathSync(mkdtempSync(join(tmpdir(), "oac-workspace-execute-")));
-const dirs = Object.fromEntries(["workspace", "home", "state", "scratch", "deps"].map(name => {
+const dirs = Object.fromEntries(["workspace", "home", "state", "scratch", "deps", "capability"].map(name => {
   const path = join(root, name); mkdirSync(path); return [name, path];
 }));
 const mode = process.argv[1];
+mkdirSync(join(dirs.capability, "pkg", "skill"), { recursive: true });
+writeFileSync(join(dirs.capability, "pkg", "skill", "SKILL.md"), "---\\nname: fixture\\ndescription: Fixture.\\n---\\nDo it.\\n");
 const workspace = { home: dirs.home, state: dirs.state, scratch: dirs.scratch,
-    env_names: ["ANTHROPIC_API_KEY"] };
-const request = { type: "start", input: [{ content: [{ type: "input_text", text: "fixture" }] }], model: "fixture", system_prompt: "", cwd: dirs.workspace,
-  workspace, ...(mode.startsWith("resume") ? { resume: "native" } : {}) };
+    env_names: ["ANTHROPIC_API_KEY"], ...(mode.startsWith("skills") ? { capability_root: dirs.capability,
+      skills: [{ metadata: { type: "inline", name: "fixture", description: "Fixture." }, relative_root: "pkg/skill", package_root: "pkg" }] } : {}) };
+const request = { type: "start", input: [{ content: [{ type: "input_text", text: "fixture" }] }], model: "fixture", system_prompt: mode === "instructions" ? "Be brief." : "", cwd: dirs.workspace,
+  workspace, ...(mode.startsWith("resume") ? { resume: "native" } : {}),
+  ...(mode.startsWith("functions") ? { functions: [{ name: "lookup", description: "Lookup", parameters: { type: "object" }, defer_loading: false }] } : {}) };
 process.env.HOME = dirs.home;
 process.env.CLAUDE_CONFIG_DIR = dirs.state;
 process.env.ANTHROPIC_API_KEY = "fixture-secret";
@@ -43,15 +47,20 @@ globalThis.queryFixture = ({prompt, options}) => {
   assert.equal(options.env.UNSELECTED_CANARY, "must-not-inherit");
   assert.equal(options.env.ANTHROPIC_API_KEY, "fixture-secret");
   assert.equal(options.env.HOME, dirs.home);
-  assert.deepEqual(options.tools, ["Bash", "Read", "Edit"]);
-  assert.equal(options.sandbox.enabled, false);
+  assert.deepEqual(options.tools, {type:"preset",preset:"claude_code"});
+  assert.equal(options.settingSources, undefined);
+  // A project's settings cannot bring background work back.
+  assert.deepEqual(options.settings, {env:{CLAUDE_CODE_DISABLE_BACKGROUND_TASKS:"1",DISABLE_AUTOUPDATER:"1"}});
+  assert.deepEqual(options.systemPrompt, {type:"preset",preset:"claude_code",...(mode === "instructions" ? {append:"Be brief."} : {})});
   assert.equal(options.resume, request.resume);
   const child = options.spawnClaudeCodeProcess({ command: process.execPath, env: options.env, signal: abort.signal,
     args: ["-e", "const assert=require('node:assert/strict');assert.equal(process.env.UNSELECTED_CANARY,'must-not-inherit');assert.equal(process.env.ANTHROPIC_API_KEY,'fixture-secret');process.stdin.resume();process.stdin.on('end',()=>process.exit(0));"] });
   return { close() { child.stdin.end(); }, async *[Symbol.asyncIterator]() {
     const first = (await prompt[Symbol.asyncIterator]().next()).value;
-    yield { type: "system", subtype: "init", session_id: "native", mcp_servers: mode === "extra-mcp" ? [{name:"other",status:"connected"}] : [],
-      tools: mode === "extra-tool" ? ["Bash", "Read", "Edit", "Agent"] : ["Bash", "Read", "Edit"] };
+    yield { type: "system", subtype: "init", session_id: "native", mcp_servers: request.functions ? [{ name: "functions", status: "connected" }] : [],
+      tools: ["Bash", "Read", "Edit", ...(mode === "functions" ? ["mcp__functions__lookup"] : []), ...(mode.startsWith("skills") ? ["Skill"] : [])],
+      // A project's settings can disable a user Skill while the Skill tool stays.
+      skills: mode === "skills" ? ["fixture"] : [] };
     if (mode.startsWith("commands")) {
       const call = id => ({type:"assistant",session_id:"native",parent_tool_use_id:null,
         message:{content:[{type:"tool_use",name:"Bash",id,input:{command:"printf 'observed'"}}]}});
@@ -78,10 +87,7 @@ try {
       assert.deepEqual(events, [{type:"error",code:"history_unavailable"}]);
     } else {
       assert.deepEqual(calls, mode === "resume-existing" ? ["history", "query"] : ["query"]);
-      if (mode.startsWith("extra")) {
-        assert.deepEqual(events.at(-1), {type:"error",code:"execution_failed"});
-        assert.equal(events.some(e => e.type === "input_ready"), false);
-      } else if (mode.startsWith("commands")) {
+      if (mode.startsWith("commands")) {
         const observations=events.filter(e=>e.type==="command_observation");
         assert.deepEqual(observations.slice(0,2).map(e=>[e.id,e.stage,e.observation.output]),
           [["observed","before",undefined],["observed","after","observed"]]);
@@ -93,13 +99,14 @@ try {
           assert.deepEqual(observations.at(-1).observation,{kind:"command",status:"incomplete",command:"printf 'observed'"});
           assert.deepEqual(events.at(-1),{type:"error",code:mode === "commands-cancel"?"cancelled":"execution_failed"});
         }
-      } else assert.equal(events.at(-1).type, "result");
+      } else if (mode === "functions-missing" || mode === "skills-missing") assert.deepEqual(events.at(-1), {type:"error",code:"execution_failed"});
+      else assert.equal(events.at(-1).type, "result");
     }
   }
 } finally { rmSync(root, {recursive:true,force:true}); }
 `;
 
-for (const mode of ["fresh", "resume-existing", "resume-missing", "resume-mismatch", "extra-tool", "extra-mcp", "commands-success", "commands-cancel", "commands-missing"]) {
+for (const mode of ["fresh", "instructions", "resume-existing", "resume-missing", "resume-mismatch", "commands-success", "commands-cancel", "commands-missing", "functions", "functions-missing", "skills", "skills-missing"]) {
   test(`workspace execution boundary: ${mode}`, { timeout: 15000 }, () => {
     const child = spawnSync(process.execPath, ["--input-type=module", "-e", fixture, mode], { encoding: "utf8", timeout: 10000 });
     assert.equal(child.status, 0, child.stderr || child.error?.message);
diff --git a/packages/claude-sdk-adapter/tests/workspace_skill_alias.test.mjs b/packages/claude-sdk-adapter/tests/workspace_skill_alias.test.mjs
deleted file mode 100644
index 1a0cc640e..000000000
--- a/packages/claude-sdk-adapter/tests/workspace_skill_alias.test.mjs
+++ /dev/null
@@ -1,36 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, realpathSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { WorkspaceProfile } from "../dist/workspace.js";
-
-test("selected public Skill names resolve to their native plugin identities", async t => {
-  const root = realpathSync(mkdtempSync(join(tmpdir(), "oac-skill-alias-")));
-  const previous = process.env;
-  process.env = { ...previous, HOME: root, CLAUDE_CONFIG_DIR: root };
-  delete process.env.CLAUDE_CODE_PROJECT_DIR_NAME;
-  t.after(() => { process.env = previous; rmSync(root, { recursive: true, force: true }); });
-  const skills = ["first", "second"].map((name, index) => {
-    const package_root = `plugins/${index}`;
-    const relative_root = `${package_root}/skills/${name}`;
-    mkdirSync(join(root, relative_root), { recursive: true });
-    writeFileSync(join(root, relative_root, "SKILL.md"), `---\nname: ${name}\ndescription: Selected fixture.\n---\nFixture.`);
-    return { metadata: { type: "inline", name, description: "Selected fixture." }, package_root, relative_root };
-  });
-  const profile = new WorkspaceProfile(root, { home: root, state: root, scratch: root, env_names: [], skills, capability_root: root });
-  const context = { signal: new AbortController().signal };
-  for (const [index, name] of ["first", "second"].entries()) {
-    const qualified = `environment-skills-${index}:${name}`;
-    for (const skill of [name, qualified]) {
-      const input = { skill, args: "fixture argument" };
-      assert.deepEqual(await profile.canUseTool("Skill", input, context),
-        { behavior: "allow", updatedInput: { ...input, skill: qualified } });
-      const result = await profile.beforeTool({ hook_event_name: "PreToolUse", tool_use_id: "call", tool_name: "Skill", tool_input: input }, "call", context);
-      assert.deepEqual(result.hookSpecificOutput.updatedInput, { ...input, skill: qualified });
-    }
-  }
-  for (const skill of ["unselected", "other:first", "environment-skills-0:second"]) {
-    assert.equal((await profile.canUseTool("Skill", { skill }, context)).behavior, "deny");
-  }
-});
diff --git a/packages/claude-sdk-adapter/tests/workspace_skills.test.mjs b/packages/claude-sdk-adapter/tests/workspace_skills.test.mjs
index 4f32cd444..43087b147 100644
--- a/packages/claude-sdk-adapter/tests/workspace_skills.test.mjs
+++ b/packages/claude-sdk-adapter/tests/workspace_skills.test.mjs
@@ -16,21 +16,22 @@ test('Runtime Skill paths remain inside the declared package; public metadata is
   assert.throws(() => parseSkills([skill, skill]), /invalid_request/);
 });
 
-test('native Skill envelope stays under the resolved Runtime root', async t => {
-  const { mkdtempSync, mkdirSync, writeFileSync, rmSync, statSync } = await import('node:fs');
+test('Skills install as bare-named user Skills under the private state path', async t => {
+  const { mkdtempSync, mkdirSync, writeFileSync, rmSync, realpathSync } = await import('node:fs');
   const { tmpdir } = await import('node:os');
   const { join } = await import('node:path');
-  const { workspaceSkills } = await import('../dist/workspace_skills.js');
-  const root = mkdtempSync(join(tmpdir(), 'oac-capability-root-'));
+  const { installSkills } = await import('../dist/workspace_skills.js');
+  const root = realpathSync(mkdtempSync(join(tmpdir(), 'oac-capability-root-')));
   t.after(() => rmSync(root, { recursive: true, force: true }));
   const source = join(root, 'plugins/0/custom/proof');
   mkdirSync(source, { recursive: true });
-  writeFileSync(join(source, 'SKILL.md'), '---\nname: proof\ndescription: A proof.\n---\nUse this Skill.');
+  writeFileSync(join(source, 'SKILL.md'), '---\nname: proof\ndescription: A proof.\n---\nToday is !`date`.');
   const skill = { metadata: { type: 'inline', name: 'proof', description: 'A proof.' },
     relative_root: 'plugins/0/custom/proof', package_root: 'plugins/0' };
-  const result = workspaceSkills([skill], root);
-  assert.deepEqual(result.paths, [join(root, 'native/claude/environment-skills-0')]);
-  const projected = join(result.paths[0], 'content/custom/proof/SKILL.md');
-  assert.equal(statSync(projected).ino, statSync(join(source, 'SKILL.md')).ino);
-  assert.deepEqual(workspaceSkills([skill], root), result);
+  const state = join(root, 'state');
+  assert.deepEqual(installSkills([skill], root, state), ['proof']);
+  assert.deepEqual(installSkills([skill], root, state), ['proof']);
+  assert.equal(realpathSync(join(state, 'skills/proof')), source);
+  mkdirSync(join(source, '.claude-plugin'));
+  assert.throws(() => installSkills([{ ...skill, metadata: { ...skill.metadata, name: 'plugin' } }], root, state), /invalid_request/);
 });
diff --git a/packages/mcode-harness/README.md b/packages/mcode-harness/README.md
index d0893d1c8..8a66d12fd 100644
--- a/packages/mcode-harness/README.md
+++ b/packages/mcode-harness/README.md
@@ -1,45 +1,31 @@
-# MiniMax Code workspace bridge
+# MiniMax Code companion
 
-This companion package lets the daemon run MiniMax Code with OpenAgentCore's workspace. MiniMax Code keeps its own ACP Session, model loop and history. The package supplies a trusted MCP server (`bridge.mjs`), which the daemon registers as `oac_workspace` (its MCP server info names it `oac-workspace`). It exposes six native MiniMax Code tools rooted at the Session's workspace: `workspace_read`, `workspace_write`, `workspace_edit`, `workspace_bash`, `workspace_grep` and `workspace_glob`. The tools run as the daemon's user with ordinary permissions; the package adds no inner sandbox. The [MiniMax Code Runtime](../../services/core/deploy/mcode/README.md) guide owns the Runtime image, configuration and qualified deployment.
+This companion package carries what the daemon needs beside the native MiniMax Code CLI: one patch to the pinned CLI source, a readiness check and a read-only Subagent history reader. MiniMax Code keeps its own ACP Session, model loop, tools and history, and the workspace tools are the native ones. The [MiniMax Code Runtime](../../services/core/deploy/mcode/README.md) guide owns the Runtime image, configuration and qualified deployment. The daemon finds the installed package through `OAC_RUNTIME_MCODE_COMPANION`.
 
-One patch script (`patch-native.mjs`) makes three edits to the pinned native CLI source. The SQLite task-admission transaction enforces the daemon's Subagent concurrency limit before child work starts; foreground, background, nested and idle-child append admissions share that transaction, and terminal native tasks release capacity. ACP initialization reports `oac/subagents` metadata: its version, the applied workspace tool policy and the admission limit. The native tool catalog applies the `protected-mcp-v1` tool gate described under [Subagents and cancellation](#subagents-and-cancellation). No second model or scheduling loop is introduced. Hosted public execution is not qualified by this package alone.
+## Patch
 
-## Workspace tools
+`patch-native.mjs` edits the pinned native CLI source before its upstream build. `native-patch.json` in the artifact records the upstream revision and exact patch hashes.
 
-The native process, its ACP Session and the workspace tools share the Session's workspace as their working directory; native configuration, Skills and history stay in the private Session data directory. Builtin file tools are disabled, so project files are read and written through the bridge's tools. Only the adapter registers this bridge; callers cannot supply its command, profile, working directory or environment. Native diff/undo capture is not provided by this path. Common Files and Artifacts use the same bound workspace.
+- The SQLite task-admission transaction enforces the daemon's Subagent concurrency limit before child work starts. Foreground, background, nested and idle-child append admissions share that transaction, and terminal native tasks release capacity.
+- Background Bash is native behavior tied to `task_output`. When `OAC_RUNTIME_MCODE_BACKGROUND_BASH=off`, the executor neither promotes Bash to the background nor accepts `run_in_background`, so no work outlives a Turn.
+- ACP initialization reports `oac/subagents` metadata: its version, whether background Bash is on and the admission limit. The daemon rejects an unpatched CLI, or one with background Bash on, before accepting model input.
 
-For each tool call, the bridge starts `launch.mjs` with the Session's private profile (`workspace-profile.json`, written by the daemon). The launcher checks that the profile's `workspace` is a canonical absolute path and that `network` is `enabled`, creates the `scratch` directory, and runs the worker in the workspace. An optional `toolEnvFile` supplies the Runtime's frozen tool environment, read only at launch. A present `capabilityRoot` must be a canonical absolute path, and `skills` requires one. A mismatched or invalid profile rejects the call.
+No second model or scheduling loop is introduced. Hosted public execution is not qualified by this package alone.
 
 ## Build
 
-`source.json` pins the CLI and native tool source. The pinned npm package supplies native runtime dependencies; the CLI is built from source into the same artifact. On Linux x86_64 or macOS arm64:
+`source.json` pins the CLI source. The pinned npm package supplies native runtime dependencies; the CLI is built from the patched source with its upstream build script and lockfile. On Linux x86_64 or macOS arm64:
 
 ```sh
 MCODE_NATIVE_SOURCE=/absolute/upstream/checkout MCODE_CLI_DIR=/absolute/pinned/package bash scripts/build-mcode-harness.sh
 ```
 
-This standalone companion uses its own npm lock and is excluded from the root pnpm workspace. The build archives the exact source revision, bundles its native tools and installs pinned MCP dependencies. The same source archive builds the CLI with its upstream build script and lockfile; the pinned package supplies only native runtime dependencies. `native-patch.json` in the artifact records the upstream revision and exact patch hashes, and `provenance.json` the hash of every artifact file. The artifact lands in `MCODE_HARNESS_BUILD_DIR`, or a new `${OAC_DEV_HOME:-$HOME/.oac}/build/mcode-harness-<timestamp>` directory. Runtime packaging uses this single CLI artifact and installs it immutably at `/opt/mcode-harness`.
+`provenance.json` records the hash of every artifact file. The artifact lands in `MCODE_HARNESS_BUILD_DIR`, or a new `${OAC_DEV_HOME:-$HOME/.oac}/build/mcode-harness-<timestamp>` directory. Runtime packaging uses this single artifact and installs it immutably at `/opt/mcode-harness`.
 
-## Subagents and cancellation
+## Subagent history
 
-`subagent-snapshot.mjs` is a daemon-only reader of the private native SQLite history. It opens a read-only transaction, scopes recursive descendants to the bound root, and fails explicitly if a complete snapshot exceeds its bounds. It never executes a model or exposes native history to workspace tools. The adapter freezes root output and keeps the same ACP owner for bounded child settlement. A completed or idle task remains an active public Subagent; native abort is a Turn cancellation and never implies a closed Subagent.
-
-The bridge owns each launcher until exit. MCP cancellation and transport shutdown stop all owned workers before releasing the bridge. The outer Runtime owns the native process group. Both boundaries require real Docker cancellation tests.
-
-The daemon sets the protected `protected-mcp-v1` tool policy independently of the concurrency limit. The native catalog applies it to root and child profiles, withholding direct native filesystem and process tools. The Session-private `oac_workspace` MCP server supplies the authorized workspace tools to workers. Other MCP servers keep their native selection rules. Native Explore and Verifier profiles keep their stricter native capability ceiling. ACP initialization reports the applied policy and admission limit; enabled Subagents reject an unpatched CLI before accepting model input.
-
-Native tool schemas are retained. Text and image results use standard MCP content; video results are rejected. The pinned native CLI may add task and Skill utility tools, so qualification must inspect the actual inventory rather than assume exactly six.
+`subagent-snapshot.mjs` is a daemon-only reader of the private native SQLite history. It opens a read-only transaction, scopes recursive descendants to the bound root, and fails explicitly if a complete snapshot exceeds its bounds. It never executes a model. The adapter freezes root output and keeps the same ACP owner for bounded child settlement. A completed or idle task remains an active public Subagent; native abort is a Turn cancellation and never implies a closed Subagent. Native Explore and Verifier profiles keep their stricter native capability ceiling.
 
 ## Tests
 
-`make check-mcode-harness` runs the package's Node tests and syntax checks. Qualify changes with the [Harness acceptance checklist](../../contracts/agents-api/harness-onboarding.md#qualify-the-adapter); synthetic probes and native model runs do not complete public Files/Artifacts or independent Core acceptance.
-
-For the packaged Linux regression, provide an operator-owned private profile and artifact directory, then run `native.test.mjs` inside the qualified Docker Runtime:
-
-```sh
-OAC_TEST_MCODE_NATIVE_PROFILE=/absolute/private-profile.json \
-OAC_TEST_MCODE_NATIVE_ARTIFACT=/opt/mcode-harness \
-node --test packages/mcode-harness/native.test.mjs
-```
-
-It verifies a writable native TMPDIR, large Bash output retention and a later native Read. The repository gate skips this case without those inputs; it does not replace Docker cancellation or real-model acceptance.
+`make check-mcode-harness` runs the package's Node tests and syntax checks. The build applies the patch and fails when the pinned source no longer matches it. Qualify changes with the [Harness acceptance checklist](../../contracts/agents-api/harness-onboarding.md#qualify-the-adapter); synthetic probes and native model runs do not complete public Files/Artifacts or independent Core acceptance.
diff --git a/packages/mcode-harness/bridge.mjs b/packages/mcode-harness/bridge.mjs
deleted file mode 100644
index 89b9bd3b9..000000000
--- a/packages/mcode-harness/bridge.mjs
+++ /dev/null
@@ -1,35 +0,0 @@
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
-import { readFileSync } from 'node:fs';
-import { isAbsolute } from 'node:path';
-import { ToolExecutor } from './tool-executor.mjs';
-
-const profile = process.argv[2];
-if (!profile || !isAbsolute(profile)) throw new Error('Private workspace profile is required');
-const workspace = JSON.parse(readFileSync(profile, 'utf8')).workspace;
-const definitions = JSON.parse(readFileSync(new URL('./dist/tools.json', import.meta.url), 'utf8'));
-const tools = new Map(definitions.map(tool => ['workspace_' + tool.name, tool]));
-const executor = new ToolExecutor(profile);
-const server = new Server({ name: 'oac-workspace', version: '1' }, { capabilities: { tools: {} } });
-server.setRequestHandler(ListToolsRequestSchema, async () => ({
-  tools: [...tools].map(([name, tool]) => ({ ...tool, name,
-    description: 'Bound working directory: ' + workspace + '. ' + tool.description })),
-}));
-server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
-  const tool = tools.get(request.params.name);
-  if (!tool) throw new Error('Unknown workspace tool');
-  const result = await executor.execute(tool.name, request.params.arguments, extra.signal);
-  if (result.content.some(item => item.type !== 'text' && item.type !== 'image'))
-    return { isError: true, content: [{ type: 'text', text: 'This workspace transport supports text and image results only.' }] };
-  return { isError: result.isError === true,
-    content: result.content.length ? result.content : [{ type: 'text', text: result.text }] };
-});
-
-let shutdown;
-const close = () => shutdown ??= executor.close().then(() => server.close());
-server.onclose = () => { void close(); };
-process.stdin.on('end', () => { void close(); });
-process.on('SIGTERM', () => { void close(); });
-process.on('SIGINT', () => { void close(); });
-await server.connect(new StdioServerTransport());
diff --git a/packages/mcode-harness/build.mjs b/packages/mcode-harness/build.mjs
deleted file mode 100644
index f2adcd897..000000000
--- a/packages/mcode-harness/build.mjs
+++ /dev/null
@@ -1,31 +0,0 @@
-import { build } from 'esbuild';
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-import { resolve, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-const here = dirname(fileURLToPath(import.meta.url));
-const source = process.env.MCODE_SOURCE;
-if (!source) throw new Error('MCODE_SOURCE is required');
-const revision = '33b259bbbeb1c16433390869938191d09bdb0680';
-if (readFileSync(resolve(source, '.oac-source-revision'), 'utf8').trim() !== revision)
-  throw new Error('source revision mismatch');
-const paths = JSON.parse(readFileSync(resolve(source, 'tsconfig.standalone.json'))).compilerOptions.paths;
-const plugin = { name: 'pinned-native-source', setup(builder) {
-  builder.onResolve({ filter: /^[^./]/ }, ({ path }) => {
-    if (path === '@earendil-works/pi-coding-agent') return { path: resolve(here, 'native-pi-tools.ts') };
-    if (path.startsWith('@native/')) return { path: resolve(source, 'packages/agent-tools/src/desktop', path.slice(8) + '.ts') };
-    if (path.startsWith('@pi/')) return { path: resolve(source, 'third_party/pi-mono/packages/coding-agent/src', path.slice(4) + '.ts') };
-    if (paths[path]) return { path: resolve(source, paths[path][0]) };
-  });
-}};
-mkdirSync(resolve(here, 'dist'), { recursive: true });
-const result = await build({ entryPoints: [resolve(here, 'worker.ts')], outfile: resolve(here, 'dist/worker.mjs'),
-  bundle: true, platform: 'node', format: 'esm', target: 'node22', packages: 'external',
-  plugins: [plugin], tsconfig: resolve(source, 'tsconfig.standalone.json'), metafile: true,
-  banner: { js: 'import { createRequire as workerCreateRequire } from "node:module"; const require = workerCreateRequire(import.meta.url);' },
-  logLevel: 'info' });
-writeFileSync(resolve(here, 'dist/metafile.json'), JSON.stringify(result.metafile, null, 2) + '\n');
-const external = [...new Set(Object.values(result.metafile.outputs).flatMap(o => o.imports)
-  .filter(i => i.external && !i.path.startsWith('node:')).map(i => i.path))];
-writeFileSync(resolve(here, 'dist/build-evidence.json'), JSON.stringify({ revision,
-  sourceFiles: Object.keys(result.metafile.inputs).length, external }, null, 2) + '\n');
-console.log(JSON.stringify({ sourceFiles: Object.keys(result.metafile.inputs).length, external }));
diff --git a/packages/mcode-harness/cancellation.test.mjs b/packages/mcode-harness/cancellation.test.mjs
deleted file mode 100644
index 5910df622..000000000
--- a/packages/mcode-harness/cancellation.test.mjs
+++ /dev/null
@@ -1,63 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { existsSync } from 'node:fs';
-import { mkdtemp, mkdir, writeFile, readFile, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { setTimeout as delay } from 'node:timers/promises';
-
-const artifact = process.env.OAC_TEST_MCODE_CLEANUP_ARTIFACT ?? dirname(fileURLToPath(import.meta.url));
-const available = existsSync(join(artifact, 'dist/worker.mjs'));
-const quote = value => "'" + value.replaceAll("'", "'\\''") + "'";
-
-for (const operation of ['cancel', 'close']) {
-  test(`native Bash ${operation} settles detached parent and child before returning`, { skip: !available, timeout: 20_000 }, async t => {
-    const root = await mkdtemp(join(tmpdir(), 'oac-mcode-cancel-'));
-    const scratch = join(root, 'scratch');
-    await mkdir(scratch);
-    const pids = [];
-    let cleaned = false;
-    t.after(async () => {
-      if (!cleaned) for (const pid of pids) { try { process.kill(pid, 'SIGKILL'); } catch {} }
-      await rm(root, { recursive: true, force: true });
-    });
-    await writeFile(join(root, 'ticks.mjs'), `
-      import { spawn } from 'node:child_process';
-      import { appendFileSync, writeFileSync } from 'node:fs';
-      const name=process.argv[2];
-      process.on('SIGTERM',()=>{});
-      writeFileSync(name+'.pid',String(process.pid));
-      if(name==='parent') spawn(process.execPath,['ticks.mjs','child'],{stdio:'inherit'});
-      setInterval(()=>appendFileSync(name+'.ticks','tick\\n'),20);
-    `);
-    const profile = join(root, 'profile.json');
-    await writeFile(profile, JSON.stringify({ workspace: root, scratch, network: 'enabled' }));
-    const { ToolExecutor } = await import(pathToFileURL(join(artifact, 'tool-executor.mjs')));
-    const executor = new ToolExecutor(profile);
-    t.after(() => executor.close());
-    const abort = new AbortController();
-    const finished = executor.execute('bash', { command: `${quote(process.execPath)} ticks.mjs parent` }, abort.signal);
-    const rejected = assert.rejects(finished);
-    for (const name of ['parent', 'child']) {
-      let started = false;
-      for (let i = 0; i < 500; i++) {
-        try {
-          if ((await readFile(join(root, name+'.ticks'))).length > 0) {
-            pids.push(Number(await readFile(join(root, name+'.pid'), 'utf8')));
-            started = true; break;
-          }
-        } catch {}
-        await delay(10);
-      }
-      assert.equal(started, true, name+' began writing');
-    }
-    if (operation === 'cancel') abort.abort(); else await executor.close();
-    await rejected;
-    const before = await Promise.all(['parent','child'].map(name => readFile(join(root,name+'.ticks'),'utf8')));
-    await delay(300);
-    const after = await Promise.all(['parent','child'].map(name => readFile(join(root,name+'.ticks'),'utf8')));
-    assert.deepEqual(after, before, 'cancel receipt preceded native descendant cleanup');
-    cleaned = true;
-  });
-}
diff --git a/packages/mcode-harness/check.mjs b/packages/mcode-harness/check.mjs
index e77cb1c92..1794221c0 100644
--- a/packages/mcode-harness/check.mjs
+++ b/packages/mcode-harness/check.mjs
@@ -1,18 +1,15 @@
-import '@modelcontextprotocol/sdk/server/index.js';
 import { accessSync, readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 
 if (!['linux', 'darwin'].includes(process.platform)) throw new Error('MiniMax native execution requires Linux or macOS');
-for (const file of ['bridge.mjs', 'launch.mjs', 'tool-executor.mjs', 'dist/worker.mjs',
-  'subagent-snapshot.mjs',
-  'native/cli.js', 'native-patch.json']) accessSync(new URL(file, import.meta.url));
+for (const file of ['subagent-snapshot.mjs', 'native/cli.js', 'native-patch.json']) accessSync(new URL(file, import.meta.url));
 for (const command of ['bash', 'rg']) execFileSync('which', [command], { stdio: 'ignore' });
 const pin = JSON.parse(readFileSync(new URL('source.json', import.meta.url)));
 const patch = JSON.parse(readFileSync(new URL('native-patch.json', import.meta.url)));
 if (patch.revision !== pin.revision || !/^[a-f0-9]{64}$/.test(patch.files?.['patch-native.mjs'] ?? '') ||
-    !/^[a-f0-9]{64}$/.test(patch.files?.['native-subagent-admission.mjs'] ?? '')) throw new Error('Native admission patch provenance mismatch');
+    !/^[a-f0-9]{64}$/.test(patch.files?.['native-subagent-admission.mjs'] ?? '')) throw new Error('Native patch provenance mismatch');
 // Load the installed native closure, never a global addon or user database.
 const require = createRequire(import.meta.url);
 try {
@@ -20,7 +17,4 @@ try {
   const database = new Database(':memory:');
   database.close();
 } catch { throw new Error('Native database dependency check failed'); }
-const tools = JSON.parse(execFileSync(process.execPath,
-  [fileURLToPath(new URL('dist/worker.mjs', import.meta.url)), process.cwd(), '--describe'], { maxBuffer: 1024 * 1024 }));
-if (tools.map(t => t.name).sort().join(',') !== 'bash,edit,glob,grep,read,write') throw new Error('Native tool inventory mismatch');
-process.stdout.write(JSON.stringify({ protocol: 2, native: pin.version, source: pin.revision }) + '\n');
+process.stdout.write(JSON.stringify({ protocol: 3, native: pin.version, source: pin.revision }) + '\n');
diff --git a/packages/mcode-harness/launch.mjs b/packages/mcode-harness/launch.mjs
deleted file mode 100644
index 3400808ff..000000000
--- a/packages/mcode-harness/launch.mjs
+++ /dev/null
@@ -1,47 +0,0 @@
-import { spawn } from 'node:child_process';
-import { readFileSync, mkdirSync } from 'node:fs';
-import { isIP } from 'node:net';
-import { dirname, join, isAbsolute, normalize } from 'node:path';
-import { fileURLToPath } from 'node:url';
-const here = dirname(fileURLToPath(import.meta.url));
-const profile = JSON.parse(readFileSync(process.argv[2], 'utf8'));
-if (!isAbsolute(profile.workspace) || normalize(profile.workspace) !== profile.workspace || (process.argv[3] && profile.workspace !== process.argv[3]))
-  throw new Error('Workspace profile does not match execution binding');
-if (profile.network !== 'enabled') throw new Error('Invalid network policy');
-const domains=profile.allowedDomains??[];
-const hostname=/^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i;
-if (!Array.isArray(domains) || (profile.network==='restricted'
- ? domains.length<1 || domains.length>100 || domains.some(host=>typeof host!=='string'||!hostname.test(host)||host.trim()!==host||isIP(host)!==0)
- : domains.length!==0)) throw new Error('Invalid network domains');
-const baseEnv = {...process.env};
-if (Object.hasOwn(profile, 'toolEnv')) throw new Error('Inline tool environment is unsupported');
-if (profile.toolEnvFile !== undefined) {
- // Resolve values only at tool launch, from the Runtime-owned frozen snapshot.
- // Never include parser diagnostics: malformed input can contain credentials.
- let values;
- try {
-  const path = profile.toolEnvFile;
-  if (typeof path !== 'string' || !isAbsolute(path) || normalize(path) !== path) throw new Error();
-  const raw = readFileSync(path);
-  if (raw.length > 1024 * 1024) throw new Error();
-  values = JSON.parse(raw.toString('utf8'));
-  if (!values || typeof values !== 'object' || Array.isArray(values) ||
-      Object.entries(values).some(([key, value]) => !key || /[=\x00\r\n]/.test(key) || typeof value !== 'string' || value.includes('\0'))) throw new Error();
- } catch { throw new Error('Runtime tool environment unavailable'); }
- Object.assign(baseEnv, values);
-}
-if (profile.capabilityRoot && (typeof profile.capabilityRoot !== 'string' || !isAbsolute(profile.capabilityRoot) || normalize(profile.capabilityRoot) !== profile.capabilityRoot || profile.capabilityRoot === '/' || /[\\\x00-\x1f\x7f]/.test(profile.capabilityRoot))) throw new Error('Invalid capability root');
-if (profile.skills && !profile.capabilityRoot) throw new Error('Missing capability root');
-let child;
-let cancelled=false;
-const cancel=()=>{cancelled=true;child?.kill('SIGTERM');};
-process.on('SIGTERM',cancel);process.on('SIGINT',cancel);
-try {
- mkdirSync(profile.scratch,{recursive:true});
- if (cancelled) throw new Error('Cancelled before workspace tool start');
- child=spawn(process.execPath,[join(here,'dist/worker.mjs'),profile.workspace],{cwd:profile.workspace,env:baseEnv,stdio:['pipe','pipe','pipe']});
- process.stdin.pipe(child.stdin);child.stdout.pipe(process.stdout);child.stderr.pipe(process.stderr);
- child.stdin.on('error',()=>cancel());
- const status=await new Promise((resolve,reject)=>{child.on('error',reject);child.on('close',resolve);});
- process.exitCode=cancelled?1:(status??1);
-} catch(error) {process.stderr.write(String(error)+'\n');process.exitCode=1;}
diff --git a/packages/mcode-harness/launch.test.mjs b/packages/mcode-harness/launch.test.mjs
deleted file mode 100644
index a2aa3859c..000000000
--- a/packages/mcode-harness/launch.test.mjs
+++ /dev/null
@@ -1,28 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import {mkdtemp,mkdir,writeFile,copyFile,rm,realpath} from 'node:fs/promises';
-import {tmpdir} from 'node:os';
-import {join} from 'node:path';
-import {ToolExecutor} from './tool-executor.mjs';
-
-test('Runtime directly executes host worker with bound cwd and initialized environment',async t=>{
- const root=await realpath(await mkdtemp(join(tmpdir(),'mcode-host-')));
- t.after(()=>rm(root,{recursive:true,force:true}));
- await mkdir(join(root,'dist'));
- const workspace=join(root,'workspace');await mkdir(workspace);
- const launcher=join(root,'launch.mjs');await copyFile(new URL('./launch.mjs',import.meta.url),launcher);
- await writeFile(join(root,'dist','worker.mjs'),`import {readFileSync} from 'node:fs';const request=JSON.parse(readFileSync(0,'utf8'));console.log(JSON.stringify({tool_name:request.tool,text:JSON.stringify({cwd:process.cwd(),value:process.env.INITIALIZED}),content:[]}));`);
- const profile=join(root,'profile.json');
- const environment=join(root,'runtime-env.json');
- await writeFile(environment,JSON.stringify({INITIALIZED:'ordinary'}),{mode:0o600});
- await writeFile(profile,JSON.stringify({workspace,scratch:join(root,'scratch'),network:'enabled',toolEnvFile:environment}));
- const executor=new ToolExecutor(profile,launcher);t.after(()=>executor.close());
- const result=await executor.execute('bash',{});
- assert.deepEqual(JSON.parse(result.text),{cwd:workspace,value:'ordinary'});
- for (const body of ['{\"SECRET\":\"fixture-canary\",', '[]', '{\"KEY\":123}']) {
-  await writeFile(environment,body);
-  await assert.rejects(executor.execute('bash',{}));
- }
- await rm(environment);
- await assert.rejects(executor.execute('bash',{}));
-});
diff --git a/packages/mcode-harness/native-pi-tools.ts b/packages/mcode-harness/native-pi-tools.ts
deleted file mode 100644
index dadd17e4f..000000000
--- a/packages/mcode-harness/native-pi-tools.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-export { createReadTool } from '@pi/core/tools/read';
-export { createWriteTool } from '@pi/core/tools/write';
-export { createEditTool } from '@pi/core/tools/edit';
-export { createBashTool } from '@pi/core/tools/bash';
-export { getShellConfig } from '@pi/utils/shell';
diff --git a/packages/mcode-harness/native.test.mjs b/packages/mcode-harness/native.test.mjs
deleted file mode 100644
index ad34ac463..000000000
--- a/packages/mcode-harness/native.test.mjs
+++ /dev/null
@@ -1,36 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { readFile } from 'node:fs/promises';
-import { isAbsolute, join, sep } from 'node:path';
-import { pathToFileURL } from 'node:url';
-
-const profile = process.env.OAC_TEST_MCODE_NATIVE_PROFILE;
-const artifact = process.env.OAC_TEST_MCODE_NATIVE_ARTIFACT;
-
-test('packaged native tools use writable scratch and retain large output', {
-  skip: !profile || !artifact,
-  timeout: 30_000,
-}, async t => {
-  assert.ok(isAbsolute(profile) && isAbsolute(artifact));
-  const config = JSON.parse(await readFile(profile, 'utf8'));
-  const { ToolExecutor } = await import(pathToFileURL(join(artifact, 'tool-executor.mjs')));
-  const executor = new ToolExecutor(profile);
-  t.after(() => executor.close());
-  const temporary = await executor.execute('bash', {
-    command: 'node -p "require(\'os\').tmpdir()"; f=$(mktemp) && printf TEMP_OK > "$f" && cat "$f" && rm "$f"',
-  });
-  assert.notEqual(temporary.isError, true);
-  assert.ok(temporary.text.includes(config.scratch));
-  assert.ok(temporary.text.includes('TEMP_OK'));
-  const output = await executor.execute('bash', {
-    command: 'python3 -c "print((\'native-spill-line\' + chr(10)) * 16000, end=\'\')"',
-  });
-  assert.notEqual(output.isError, true);
-  const full = output.details?.fullOutputPath;
-  assert.equal(typeof full, 'string');
-  assert.ok(full.startsWith(config.scratch + sep));
-  assert.equal(await readFile(full, 'utf8'), 'native-spill-line\n'.repeat(16000));
-  const read = await executor.execute('read', { path: full, offset: 1, limit: 1 });
-  assert.notEqual(read.isError, true);
-  assert.ok(read.text.includes('native-spill-line'));
-});
diff --git a/packages/mcode-harness/package-lock.json b/packages/mcode-harness/package-lock.json
deleted file mode 100644
index 24741c0f3..000000000
--- a/packages/mcode-harness/package-lock.json
+++ /dev/null
@@ -1,1841 +0,0 @@
-{
-  "name": "@oac/mcode-harness",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "@oac/mcode-harness",
-      "dependencies": {
-        "@modelcontextprotocol/sdk": "1.30.0",
-        "@pondwader/socks5-server": "1.0.10",
-        "@silvia-odwyer/photon-node": "0.3.4",
-        "@sinclair/typebox": "0.34.52",
-        "chalk": "5.6.2",
-        "cross-spawn": "7.0.6",
-        "diff": "8.0.4",
-        "get-east-asian-width": "1.6.0",
-        "highlight.js": "10.7.3",
-        "marked": "18.0.12",
-        "minimatch": "10.2.6",
-        "node-forge": "1.4.0",
-        "typebox": "1.1.38",
-        "unpdf": "1.8.1",
-        "zod": "3.25.76"
-      },
-      "devDependencies": {
-        "esbuild": "0.28.2"
-      }
-    },
-    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.2.tgz",
-      "integrity": "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.2.tgz",
-      "integrity": "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.2.tgz",
-      "integrity": "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.2.tgz",
-      "integrity": "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.2.tgz",
-      "integrity": "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.2.tgz",
-      "integrity": "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.2.tgz",
-      "integrity": "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.2.tgz",
-      "integrity": "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.2.tgz",
-      "integrity": "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.2.tgz",
-      "integrity": "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.2.tgz",
-      "integrity": "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.2.tgz",
-      "integrity": "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.2.tgz",
-      "integrity": "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.2.tgz",
-      "integrity": "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.2.tgz",
-      "integrity": "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.2.tgz",
-      "integrity": "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.2.tgz",
-      "integrity": "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.2.tgz",
-      "integrity": "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.2.tgz",
-      "integrity": "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.2.tgz",
-      "integrity": "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.2.tgz",
-      "integrity": "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.2.tgz",
-      "integrity": "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.2.tgz",
-      "integrity": "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.2.tgz",
-      "integrity": "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.2.tgz",
-      "integrity": "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-x64": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.2.tgz",
-      "integrity": "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@hono/node-server": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.1.tgz",
-      "integrity": "sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "hono": "^4"
-      }
-    },
-    "node_modules/@modelcontextprotocol/sdk": {
-      "version": "1.30.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz",
-      "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==",
-      "license": "MIT",
-      "dependencies": {
-        "@hono/node-server": "^1.19.9 || ^2.0.5",
-        "ajv": "^8.17.1",
-        "ajv-formats": "^3.0.1",
-        "content-type": "^1.0.5",
-        "cors": "^2.8.5",
-        "cross-spawn": "^7.0.5",
-        "eventsource": "^3.0.2",
-        "eventsource-parser": "^3.0.0",
-        "express": "^5.2.1",
-        "express-rate-limit": "^8.2.1",
-        "hono": "^4.11.4",
-        "jose": "^6.1.3",
-        "json-schema-typed": "^8.0.2",
-        "pkce-challenge": "^5.0.0",
-        "raw-body": "^3.0.0",
-        "zod": "^3.25 || ^4.0",
-        "zod-to-json-schema": "^3.25.1"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@cfworker/json-schema": "^4.1.1",
-        "zod": "^3.25 || ^4.0"
-      },
-      "peerDependenciesMeta": {
-        "@cfworker/json-schema": {
-          "optional": true
-        },
-        "zod": {
-          "optional": false
-        }
-      }
-    },
-    "node_modules/@pondwader/socks5-server": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/@pondwader/socks5-server/-/socks5-server-1.0.10.tgz",
-      "integrity": "sha512-bQY06wzzR8D2+vVCUoBsr5QS2U6UgPUQRmErNwtsuI6vLcyRKkafjkr3KxbtGFf9aBBIV2mcvlsKD1UYaIV+sg==",
-      "license": "MIT"
-    },
-    "node_modules/@silvia-odwyer/photon-node": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/@silvia-odwyer/photon-node/-/photon-node-0.3.4.tgz",
-      "integrity": "sha512-bnly4BKB3KDTFxrUIcgCLbaeVVS8lrAkri1pEzskpmxu9MdfGQTy8b8EgcD83ywD3RPMsIulY8xJH5Awa+t9fA==",
-      "license": "Apache-2.0"
-    },
-    "node_modules/@sinclair/typebox": {
-      "version": "0.34.52",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.52.tgz",
-      "integrity": "sha512-XiMQh7qqVlxZzcVD+kkGMNGMzcTrDMLWI7S4x7z1MkCkbDPrekpZXEUK0eZqZFMuHQg2a2DZOcDIh9o5v3Gonw==",
-      "license": "MIT"
-    },
-    "node_modules/accepts": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
-      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-types": "^3.0.0",
-        "negotiator": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/ajv": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
-      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
-      "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/ajv-formats": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
-      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^8.0.0"
-      },
-      "peerDependencies": {
-        "ajv": "^8.0.0"
-      },
-      "peerDependenciesMeta": {
-        "ajv": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "license": "MIT",
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
-    "node_modules/body-parser": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
-      "license": "MIT",
-      "dependencies": {
-        "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
-        "debug": "^4.4.3",
-        "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
-        "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
-        "raw-body": "^3.0.2",
-        "type-is": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/body-parser/node_modules/content-type": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
-      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/brace-expansion": {
-      "version": "5.0.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
-      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/bytes": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
-      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/call-bind-apply-helpers": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
-      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "function-bind": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/call-bound": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
-      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.2",
-        "get-intrinsic": "^1.3.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/chalk": {
-      "version": "5.6.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-5.6.2.tgz",
-      "integrity": "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==",
-      "license": "MIT",
-      "engines": {
-        "node": "^12.17.0 || ^14.13 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/content-disposition": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz",
-      "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/content-type": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
-      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/cookie": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/cookie-signature": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
-      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.6.0"
-      }
-    },
-    "node_modules/cors": {
-      "version": "2.8.6",
-      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
-      "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
-      "license": "MIT",
-      "dependencies": {
-        "object-assign": "^4",
-        "vary": "^1"
-      },
-      "engines": {
-        "node": ">= 0.10"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/cross-spawn": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "license": "MIT",
-      "dependencies": {
-        "path-key": "^3.1.0",
-        "shebang-command": "^2.0.0",
-        "which": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/debug": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.3"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/depd": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
-      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/diff": {
-      "version": "8.0.4",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.4.tgz",
-      "integrity": "sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==",
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=0.3.1"
-      }
-    },
-    "node_modules/dunder-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
-      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "gopd": "^1.2.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/ee-first": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
-      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
-      "license": "MIT"
-    },
-    "node_modules/encodeurl": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
-      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/es-define-property": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
-      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-errors": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
-      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-object-atoms": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
-      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/esbuild": {
-      "version": "0.28.2",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
-      "integrity": "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.28.2",
-        "@esbuild/android-arm": "0.28.2",
-        "@esbuild/android-arm64": "0.28.2",
-        "@esbuild/android-x64": "0.28.2",
-        "@esbuild/darwin-arm64": "0.28.2",
-        "@esbuild/darwin-x64": "0.28.2",
-        "@esbuild/freebsd-arm64": "0.28.2",
-        "@esbuild/freebsd-x64": "0.28.2",
-        "@esbuild/linux-arm": "0.28.2",
-        "@esbuild/linux-arm64": "0.28.2",
-        "@esbuild/linux-ia32": "0.28.2",
-        "@esbuild/linux-loong64": "0.28.2",
-        "@esbuild/linux-mips64el": "0.28.2",
-        "@esbuild/linux-ppc64": "0.28.2",
-        "@esbuild/linux-riscv64": "0.28.2",
-        "@esbuild/linux-s390x": "0.28.2",
-        "@esbuild/linux-x64": "0.28.2",
-        "@esbuild/netbsd-arm64": "0.28.2",
-        "@esbuild/netbsd-x64": "0.28.2",
-        "@esbuild/openbsd-arm64": "0.28.2",
-        "@esbuild/openbsd-x64": "0.28.2",
-        "@esbuild/openharmony-arm64": "0.28.2",
-        "@esbuild/sunos-x64": "0.28.2",
-        "@esbuild/win32-arm64": "0.28.2",
-        "@esbuild/win32-ia32": "0.28.2",
-        "@esbuild/win32-x64": "0.28.2"
-      }
-    },
-    "node_modules/escape-html": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
-      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
-      "license": "MIT"
-    },
-    "node_modules/etag": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
-      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/eventsource": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/eventsource/-/eventsource-3.0.7.tgz",
-      "integrity": "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==",
-      "license": "MIT",
-      "dependencies": {
-        "eventsource-parser": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/eventsource-parser": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/eventsource-parser/-/eventsource-parser-3.1.1.tgz",
-      "integrity": "sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/express": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
-      "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
-      "license": "MIT",
-      "dependencies": {
-        "accepts": "^2.0.0",
-        "body-parser": "^2.2.1",
-        "content-disposition": "^1.0.0",
-        "content-type": "^1.0.5",
-        "cookie": "^0.7.1",
-        "cookie-signature": "^1.2.1",
-        "debug": "^4.4.0",
-        "depd": "^2.0.0",
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "etag": "^1.8.1",
-        "finalhandler": "^2.1.0",
-        "fresh": "^2.0.0",
-        "http-errors": "^2.0.0",
-        "merge-descriptors": "^2.0.0",
-        "mime-types": "^3.0.0",
-        "on-finished": "^2.4.1",
-        "once": "^1.4.0",
-        "parseurl": "^1.3.3",
-        "proxy-addr": "^2.0.7",
-        "qs": "^6.14.0",
-        "range-parser": "^1.2.1",
-        "router": "^2.2.0",
-        "send": "^1.1.0",
-        "serve-static": "^2.2.0",
-        "statuses": "^2.0.1",
-        "type-is": "^2.0.1",
-        "vary": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/express-rate-limit": {
-      "version": "8.7.0",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.0.tgz",
-      "integrity": "sha512-hOwV7WOxXfjRpAM1DSJWZDXx3GhplwD8IfwuwvogD8i1Qnkgosw/H45s4ZnFAUHDAhPjlY9hLBvJhKmGMyY26g==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.3",
-        "ip-address": "^10.2.0"
-      },
-      "engines": {
-        "node": ">= 16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/express-rate-limit"
-      },
-      "peerDependencies": {
-        "express": ">= 4.11"
-      }
-    },
-    "node_modules/fast-deep-equal": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "license": "MIT"
-    },
-    "node_modules/fast-uri": {
-      "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
-      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/finalhandler": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
-      "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.0",
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "on-finished": "^2.4.1",
-        "parseurl": "^1.3.3",
-        "statuses": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 18.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/forwarded": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
-      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/fresh": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
-      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/function-bind": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
-      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-east-asian-width": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.6.0.tgz",
-      "integrity": "sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/get-intrinsic": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
-      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.2",
-        "es-define-property": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "es-object-atoms": "^1.1.1",
-        "function-bind": "^1.1.2",
-        "get-proto": "^1.0.1",
-        "gopd": "^1.2.0",
-        "has-symbols": "^1.1.0",
-        "hasown": "^2.0.2",
-        "math-intrinsics": "^1.1.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
-      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
-      "license": "MIT",
-      "dependencies": {
-        "dunder-proto": "^1.0.1",
-        "es-object-atoms": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/gopd": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
-      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-symbols": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
-      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/hasown": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
-      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
-      "license": "MIT",
-      "dependencies": {
-        "function-bind": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/highlight.js": {
-      "version": "10.7.3",
-      "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-10.7.3.tgz",
-      "integrity": "sha512-tzcUFauisWKNHaRkN4Wjl/ZA07gENAjFl3J/c480dprkGTg5EQstgaNFqBfUqCq54kZRIEcreTsAgF/m2quD7A==",
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/hono": {
-      "version": "4.13.8",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.8.tgz",
-      "integrity": "sha512-/Gng7NfoykZl2pjukW5Z6+8Yxm3BPRf86GTbQnt0SbySkvax4fyL4H3HhY1cCpBGmiW9XDRFzRV+CXK2W8QudQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.9.0"
-      }
-    },
-    "node_modules/http-errors": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
-      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
-      "license": "MIT",
-      "dependencies": {
-        "depd": "~2.0.0",
-        "inherits": "~2.0.4",
-        "setprototypeof": "~1.2.0",
-        "statuses": "~2.0.2",
-        "toidentifier": "~1.0.1"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/iconv-lite": {
-      "version": "0.7.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
-      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
-      "license": "MIT",
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "license": "ISC"
-    },
-    "node_modules/ip-address": {
-      "version": "10.7.2",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
-      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12"
-      }
-    },
-    "node_modules/ipaddr.js": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
-      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.10"
-      }
-    },
-    "node_modules/is-promise": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
-      "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
-      "license": "MIT"
-    },
-    "node_modules/isexe": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "license": "ISC"
-    },
-    "node_modules/jose": {
-      "version": "6.2.12",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.12.tgz",
-      "integrity": "sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/panva"
-      }
-    },
-    "node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "license": "MIT"
-    },
-    "node_modules/json-schema-typed": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-8.0.2.tgz",
-      "integrity": "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==",
-      "license": "BSD-2-Clause"
-    },
-    "node_modules/marked": {
-      "version": "18.0.12",
-      "resolved": "https://registry.npmjs.org/marked/-/marked-18.0.12.tgz",
-      "integrity": "sha512-LEm4ga2YeI2T3GVHj9b0BaDPPk93LLTHMFeMyQbNIzPxc8vCI0y/scy0ZA6z6lXKyT9j9Nhl/OC6ZYKYGuFScA==",
-      "license": "MIT",
-      "bin": {
-        "marked": "bin/marked.js"
-      },
-      "engines": {
-        "node": ">= 20"
-      }
-    },
-    "node_modules/math-intrinsics": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
-      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/media-typer": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.1.tgz",
-      "integrity": "sha512-yz3xRaG20c6/BOzvYoDaGtPmGscs7YivItZEEqe6GbwNfHuxu9YNmvnEkMzKldAGY4/80pRcQRZSEnhquk9XuQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/merge-descriptors": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
-      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/mime-db": {
-      "version": "1.54.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
-      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/mime-types": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
-      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-db": "^1.54.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/minimatch": {
-      "version": "10.2.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
-      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "brace-expansion": "^5.0.8"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "license": "MIT"
-    },
-    "node_modules/negotiator": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.1.0.tgz",
-      "integrity": "sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg==",
-      "license": "MIT",
-      "dependencies": {
-        "content-type": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/negotiator/node_modules/content-type": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
-      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/node-forge": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
-      "integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
-      "license": "(BSD-3-Clause OR GPL-2.0)",
-      "engines": {
-        "node": ">= 6.13.0"
-      }
-    },
-    "node_modules/object-assign": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
-      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-inspect": {
-      "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
-      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/on-finished": {
-      "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
-      "license": "MIT",
-      "dependencies": {
-        "ee-first": "1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
-      "license": "ISC",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
-    "node_modules/parseurl": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
-      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/path-key": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/path-to-regexp": {
-      "version": "8.4.2",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
-      "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/pkce-challenge": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/pkce-challenge/-/pkce-challenge-5.0.1.tgz",
-      "integrity": "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/proxy-addr": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
-      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
-      "license": "MIT",
-      "dependencies": {
-        "forwarded": "0.2.0",
-        "ipaddr.js": "1.9.1"
-      },
-      "engines": {
-        "node": ">= 0.10"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/qs": {
-      "version": "6.16.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
-      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "es-define-property": "^1.0.1",
-        "side-channel": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=0.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/range-parser": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
-      "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/raw-body": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
-      "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
-      "license": "MIT",
-      "dependencies": {
-        "bytes": "~3.1.2",
-        "http-errors": "~2.0.1",
-        "iconv-lite": "~0.7.0",
-        "unpipe": "~1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.10"
-      }
-    },
-    "node_modules/require-from-string": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/router": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
-      "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.0",
-        "depd": "^2.0.0",
-        "is-promise": "^4.0.0",
-        "parseurl": "^1.3.3",
-        "path-to-regexp": "^8.0.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/safer-buffer": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "license": "MIT"
-    },
-    "node_modules/send": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
-      "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.3",
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "etag": "^1.8.1",
-        "fresh": "^2.0.0",
-        "http-errors": "^2.0.1",
-        "mime-types": "^3.0.2",
-        "ms": "^2.1.3",
-        "on-finished": "^2.4.1",
-        "range-parser": "^1.2.1",
-        "statuses": "^2.0.2"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/serve-static": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
-      "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
-      "license": "MIT",
-      "dependencies": {
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "parseurl": "^1.3.3",
-        "send": "^1.2.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/setprototypeof": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
-      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
-      "license": "ISC"
-    },
-    "node_modules/shebang-command": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "license": "MIT",
-      "dependencies": {
-        "shebang-regex": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shebang-regex": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/side-channel": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
-      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.4",
-        "side-channel-list": "^1.0.1",
-        "side-channel-map": "^1.0.1",
-        "side-channel-weakmap": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/side-channel-list": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
-      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.4"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/side-channel-map": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
-      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bound": "^1.0.2",
-        "es-errors": "^1.3.0",
-        "get-intrinsic": "^1.2.5",
-        "object-inspect": "^1.13.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/side-channel-weakmap": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
-      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bound": "^1.0.2",
-        "es-errors": "^1.3.0",
-        "get-intrinsic": "^1.2.5",
-        "object-inspect": "^1.13.3",
-        "side-channel-map": "^1.0.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/statuses": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/toidentifier": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
-      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.6"
-      }
-    },
-    "node_modules/type-is": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
-      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
-      "license": "MIT",
-      "dependencies": {
-        "content-type": "^2.0.0",
-        "media-typer": "^1.1.0",
-        "mime-types": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/type-is/node_modules/content-type": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
-      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/typebox": {
-      "version": "1.1.38",
-      "resolved": "https://registry.npmjs.org/typebox/-/typebox-1.1.38.tgz",
-      "integrity": "sha512-pZ0aQPmMmXoUvSbeuWf/Hzsc+avNw/Zd6VeE8CFgkVGWyuHPJvqeJJDeJqLve+K70LvjYIoleGcoJHPT17cWoA==",
-      "license": "MIT"
-    },
-    "node_modules/unpdf": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/unpdf/-/unpdf-1.8.1.tgz",
-      "integrity": "sha512-xkURhy2SoGpOIH0a1gLHNkASPIQYonadDJs2AQwPEfUakafeD9EA1WTWWsaR++gfTCXJpV27W7tU1nXuk82UKQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=22"
-      },
-      "peerDependencies": {
-        "@napi-rs/canvas": "^0.1.69 || ^1.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@napi-rs/canvas": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/unpipe": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
-      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/vary": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
-      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/which": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "license": "ISC",
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/node-which"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "license": "ISC"
-    },
-    "node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    },
-    "node_modules/zod-to-json-schema": {
-      "version": "3.25.2",
-      "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz",
-      "integrity": "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==",
-      "license": "ISC",
-      "peerDependencies": {
-        "zod": "^3.25.28 || ^4"
-      }
-    }
-  }
-}
diff --git a/packages/mcode-harness/package.json b/packages/mcode-harness/package.json
deleted file mode 100644
index c509c7d02..000000000
--- a/packages/mcode-harness/package.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "name": "@oac/mcode-harness",
-  "private": true,
-  "type": "module",
-  "devDependencies": {
-    "esbuild": "0.28.2"
-  },
-  "dependencies": {
-    "@pondwader/socks5-server": "1.0.10",
-    "@silvia-odwyer/photon-node": "0.3.4",
-    "@sinclair/typebox": "0.34.52",
-    "chalk": "5.6.2",
-    "cross-spawn": "7.0.6",
-    "diff": "8.0.4",
-    "get-east-asian-width": "1.6.0",
-    "highlight.js": "10.7.3",
-    "marked": "18.0.12",
-    "minimatch": "10.2.6",
-    "node-forge": "1.4.0",
-    "typebox": "1.1.38",
-    "unpdf": "1.8.1",
-    "zod": "3.25.76",
-    "@modelcontextprotocol/sdk": "1.30.0"
-  },
-  "scripts": {
-    "test": "node --test *.test.mjs"
-  }
-}
diff --git a/packages/mcode-harness/patch-native.mjs b/packages/mcode-harness/patch-native.mjs
index 13700c1bc..7d03ab0b2 100644
--- a/packages/mcode-harness/patch-native.mjs
+++ b/packages/mcode-harness/patch-native.mjs
@@ -22,22 +22,16 @@ const acpPath = join(root, 'packages/tui/src/acp/agent.ts');
 const acp = readFileSync(acpPath, 'utf8');
 const marker = "      _meta: {\n        'minimax-code/extensions': {";
 if (acp.split(marker).length !== 2) throw new Error('Pinned native ACP initialization changed');
-writeFileSync(acpPath, acp.replace(marker, "      _meta: {\n        'oac/subagents': { version: 1, workspaceTools: process.env.OAC_RUNTIME_MCODE_TOOL_POLICY ?? null, maxConcurrent: Number(process.env.OAC_RUNTIME_MCODE_MAX_SUBAGENTS ?? 0) },\n        'minimax-code/extensions': {"));
-const catalogPath = join(root, 'packages/local-runtime-v2/src/service/turn-system/agent-host/assembly/local-turn-tool-catalog.ts');
-const catalog = readFileSync(catalogPath, 'utf8');
-const gate = "  if (!isFeatureEnabled(ceiling, toolName)) return false;";
-if (catalog.split(gate).length !== 2) throw new Error('Pinned native tool capability gate changed');
-const selectorGate = "  if (!input.selector.allowsTool(input.tool.def.name, input.options.selectorAlias)) return false;\n  if (!isMcpServerAllowed(input.selector, input.options)) return false;";
-if (catalog.split(selectorGate).length !== 2) throw new Error('Pinned native selector gate changed');
-const withWorkspace = catalog.replace(selectorGate, `  const protectedWorkspace = process.env.OAC_RUNTIME_MCODE_TOOL_POLICY === 'protected-mcp-v1' &&
-    input.source === 'configured' && input.options.mcp === true && input.options.serverName === 'oac_workspace';
-  if (!protectedWorkspace && !input.selector.allowsTool(input.tool.def.name, input.options.selectorAlias)) return false;
-  if (!protectedWorkspace && !isMcpServerAllowed(input.selector, input.options)) return false;`);
-writeFileSync(catalogPath, withWorkspace.replace(gate, `  if (process.env.OAC_RUNTIME_MCODE_TOOL_POLICY === 'protected-mcp-v1') {
-    if (source === 'builtin' && toolName !== 'skill' && !DELEGATION_TOOL_NAMES.has(toolName) && !TASK_CONTROL_TOOL_NAMES.has(toolName)) return false;
-    if (source === 'builtin-matrix') return false;
-  }
-${gate}`));
+writeFileSync(acpPath, acp.replace(marker, "      _meta: {\n        'oac/subagents': { version: 2, backgroundBash: process.env.OAC_RUNTIME_MCODE_BACKGROUND_BASH !== 'off', maxConcurrent: Number(process.env.OAC_RUNTIME_MCODE_MAX_SUBAGENTS ?? 0) },\n        'minimax-code/extensions': {"));
+// Background bash outlives the Turn. With the adapter's switch set, bash runs in the foreground only;
+// task_output stays admitted, so Subagent results remain readable.
+const executorPath = join(root, 'packages/local-runtime-v2/src/service/turn-system/agent-host/execution/executor.ts');
+const executor = readFileSync(executorPath, 'utf8');
+const context = "    const toolContext = {\n      ...toolResolution.context,";
+const promotion = "      allowBashAutoPromotion: canConsumeBackgroundBashOutput,\n      canConsumeBackgroundBashOutput,\n";
+if (executor.split(context).length !== 2 || executor.split(promotion).length !== 2) throw new Error('Pinned native background bash gate changed');
+writeFileSync(executorPath, executor.replace(context, "    const backgroundBash =\n      canConsumeBackgroundBashOutput && process.env.OAC_RUNTIME_MCODE_BACKGROUND_BASH !== 'off';\n" + context)
+  .replace(promotion, "      allowBashAutoPromotion: backgroundBash,\n      canConsumeBackgroundBashOutput: backgroundBash,\n"));
 copyFileSync(join(here, 'native-subagent-admission.mjs'), join(root, 'packages/local-runtime/src/background-task/oac-subagent-admission.mjs'));
 const digest = name => createHash('sha256').update(readFileSync(join(here, name))).digest('hex');
 writeFileSync(join(root, '.oac-native-patch.json'), JSON.stringify({ revision: pin.revision,
diff --git a/packages/mcode-harness/snapshot.test.mjs b/packages/mcode-harness/snapshot.test.mjs
deleted file mode 100644
index e5463f13d..000000000
--- a/packages/mcode-harness/snapshot.test.mjs
+++ /dev/null
@@ -1,74 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { copyFile, mkdir, mkdtemp, readFile, rm, stat, symlink, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-import { spawnSync } from 'node:child_process';
-
-// This opt-in test requires an isolated Linux Runtime containing the built
-// sandbox/worker artifact. It runs only native tools; no model is contacted.
-const artifact = process.env.OAC_TEST_MCODE_NATIVE_ARTIFACT;
-const isolated = process.env.OAC_TEST_MCODE_SNAPSHOT_ISOLATED === '1';
-test('capability read exceptions preserve denied ancestors and immutable snapshots', {
-  skip: !artifact || !isolated, timeout: 60_000,
-}, async t => {
-  const fixture = await mkdtemp(join(tmpdir(), 'oac-mcode-snapshot-'));
-  t.after(() => rm(fixture, { recursive: true, force: true }));
-  await copyFile(new URL('./launch.mjs', import.meta.url), join(fixture, 'launch.mjs'));
-  await symlink(join(artifact, 'dist'), join(fixture, 'dist'));
-  const quote = value => "'" + value.replaceAll("'", "'\\''") + "'";
-  for (const [name, ancestor, root] of [
-    ['standard', '/environment', '/environment/initialization/capabilities'],
-    ['custom', join(fixture, 'private-layout'), join(fixture, 'private-layout', 'frozen', 'skills')],
-  ]) {
-    await t.test(name, async t => {
-      const scratch = join(fixture, name + '-scratch');
-      const secret = join(ancestor, 'private', 'snapshot-test-secret');
-      await mkdir(root, { recursive: true });
-      await mkdir(join(ancestor, 'private'), { recursive: true });
-      await mkdir(scratch);
-      const script = join(root, 'proof.sh'), attachment = join(root, 'attachment.txt');
-      await writeFile(script, 'printf SNAPSHOT_SCRIPT_READABLE', { mode: 0o700 });
-      await writeFile(attachment, 'SNAPSHOT_ATTACHMENT_READABLE', { mode: 0o600 });
-      await writeFile(secret, 'PRIVATE_SNAPSHOT_CANARY', { mode: 0o600 });
-      const profile = join(fixture, name + '.json');
-      const config = { workspace: '/workspace', scratch, network: 'disabled',
-        allowedDomains: [], protectedDirs: [ancestor], capabilityRoot: root, skills: true };
-      await writeFile(profile, JSON.stringify(config));
-      const executor = { execute(tool, input) {
-        const child = spawnSync(process.execPath, [join(fixture, 'launch.mjs'), profile, '/workspace'], {
-          input: JSON.stringify({ tool, input }), encoding: 'utf8', timeout: 15_000,
-          env: { PATH: '/usr/local/bin:/usr/bin:/bin', HOME: '/tmp', LANG: 'C.UTF-8' },
-        });
-        assert.ok(child.stdout, child.stderr || String(child.error));
-        return JSON.parse(child.stdout);
-      } };
-      const read = await executor.execute('bash', {
-        command: 'sh ' + quote(script) + '; cat ' + quote(attachment),
-      });
-      assert.notEqual(read.isError, true, read.text);
-      assert.ok(read.text.includes('SNAPSHOT_SCRIPT_READABLE'));
-      assert.ok(read.text.includes('SNAPSHOT_ATTACHMENT_READABLE'));
-      const protectedResult = await executor.execute('bash', {
-        command: [
-          'if printf changed >> ' + quote(attachment) + '; then exit 41; fi',
-          'if chmod 0777 ' + quote(script) + '; then exit 42; fi',
-          'if touch ' + quote(join(root, 'new-sibling')) + '; then exit 43; fi',
-          'if cat ' + quote(secret) + '; then exit 44; fi',
-          'printf SNAPSHOT_PROTECTION_OK',
-        ].join('; '),
-      });
-      assert.notEqual(protectedResult.isError, true);
-      assert.ok(protectedResult.text.includes('SNAPSHOT_PROTECTION_OK'));
-      assert.ok(!protectedResult.text.includes('PRIVATE_SNAPSHOT_CANARY'));
-      assert.equal(await readFile(attachment, 'utf8'), 'SNAPSHOT_ATTACHMENT_READABLE');
-      assert.equal((await stat(script)).mode & 0o777, 0o700);
-      await assert.rejects(stat(join(root, 'new-sibling')), { code: 'ENOENT' });
-      // Negative control proves that the ancestor deny really masks this root.
-      await writeFile(profile, JSON.stringify({ ...config, capabilityRoot: undefined, skills: false }));
-      const hidden = await executor.execute('bash', { command: 'cat ' + quote(attachment) });
-      assert.equal(hidden.isError, true);
-      assert.ok(!hidden.text.includes('SNAPSHOT_ATTACHMENT_READABLE'));
-    });
-  }
-});
diff --git a/packages/mcode-harness/tool-executor.mjs b/packages/mcode-harness/tool-executor.mjs
deleted file mode 100644
index 16de8ea1f..000000000
--- a/packages/mcode-harness/tool-executor.mjs
+++ /dev/null
@@ -1,65 +0,0 @@
-import { spawn } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-
-const limit = 16 * 1024 * 1024;
-const launcher = fileURLToPath(new URL('./launch.mjs', import.meta.url));
-
-// One bridge owns every launcher until its stdio and native tools have settled.
-export class ToolExecutor {
-  #calls = new Set();
-  #closed = false;
-
-  constructor(profile, entrypoint = launcher) {
-    this.profile = profile;
-    this.entrypoint = entrypoint;
-  }
-
-  async execute(tool, input, signal) {
-    if (this.#closed) throw new Error('Workspace transport is closed');
-    signal?.throwIfAborted();
-    const request = JSON.stringify({ tool, input });
-    if (Buffer.byteLength(request) > limit) throw new Error('Workspace tool input exceeds limit');
-    const child = spawn(process.execPath, [this.entrypoint, this.profile], {
-      env: process.env,
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-    const call = { stop: () => child.kill('SIGTERM') };
-    this.#calls.add(call);
-    let output = Buffer.alloc(0);
-    let failure;
-    signal?.addEventListener('abort', call.stop, { once: true });
-    if (signal?.aborted) call.stop();
-    child.on('error', error => { failure = error; });
-    child.stdin.on('error', error => { failure = error; call.stop(); });
-    child.stderr.resume();
-    child.stdout.on('data', chunk => {
-      if (output.length + chunk.length > limit) {
-        failure = new Error('Workspace tool output exceeds limit');
-        call.stop();
-      } else output = Buffer.concat([output, chunk]);
-    });
-    call.settled = new Promise(resolve => child.on('close', resolve));
-    child.stdin.end(request);
-    try {
-      const code = await call.settled;
-      if (failure) throw failure;
-      signal?.throwIfAborted();
-      if (this.#closed) throw new Error('Workspace transport is closed');
-      const result = JSON.parse(output.toString('utf8'));
-      if (result.tool_name !== tool || typeof result.text !== 'string' || !Array.isArray(result.content))
-        throw new Error('Invalid native workspace tool result');
-      if (code !== 0 && result.isError !== true) throw new Error('Workspace tool execution failed');
-      return result;
-    } finally {
-      signal?.removeEventListener('abort', call.stop);
-      this.#calls.delete(call);
-    }
-  }
-
-  async close() {
-    this.#closed = true;
-    const calls = [...this.#calls];
-    for (const call of calls) call.stop();
-    await Promise.all(calls.map(call => call.settled));
-  }
-}
diff --git a/packages/mcode-harness/tool-executor.test.mjs b/packages/mcode-harness/tool-executor.test.mjs
deleted file mode 100644
index 955c6854e..000000000
--- a/packages/mcode-harness/tool-executor.test.mjs
+++ /dev/null
@@ -1,64 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { mkdtemp, mkdir, writeFile, rm, access } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-import { setTimeout as delay } from 'node:timers/promises';
-import { ToolExecutor } from './tool-executor.mjs';
-
-async function fixture(t, body) {
-  const root = join(homedir(), '.oac', 'tests');
-  await mkdir(root, { recursive: true });
-  const dir = await mkdtemp(join(root, 'mcode-worker-'));
-  t.after(() => rm(dir, { recursive: true, force: true }));
-  const script = join(dir, 'launcher.mjs');
-  await writeFile(script, body);
-  const executor = new ToolExecutor(dir, script);
-  t.after(() => executor.close());
-  return { dir, executor };
-}
-
-test('returns the original native result, including a native tool error', async t => {
-  const { executor } = await fixture(t, `
-    process.stdin.resume(); process.stdin.on('end', () => {
-      console.log(JSON.stringify({tool_name:'read',text:'denied',content:[],isError:true}));
-      process.exitCode=1;
-    });`);
-  assert.deepEqual(await executor.execute('read', { path: 'private' }), {
-    tool_name: 'read', text: 'denied', content: [], isError: true,
-  });
-});
-
-test('rejects a result attributed to a different native tool', async t => {
-  const { executor } = await fixture(t, `
-    process.stdin.resume(); process.stdin.on('end', () =>
-      console.log(JSON.stringify({tool_name:'write',text:'wrong',content:[]})));`);
-  await assert.rejects(executor.execute('read', {}), /Invalid native/);
-});
-
-for (const shutdown of ['cancel', 'transport close']) {
-  test(`${shutdown} waits for worker exit and prevents late effects`, async t => {
-    const { dir, executor } = await fixture(t, `
-      import { writeFileSync } from 'node:fs';
-      process.stdin.resume();
-      process.stdin.on('end', () => {
-        writeFileSync(process.argv[2]+'/ready','1');
-        setTimeout(() => writeFileSync(process.argv[2]+'/late','1'),500);
-      });`);
-    const controller = new AbortController();
-    const failed = assert.rejects(executor.execute('bash', {}, controller.signal));
-    let ready = false;
-    for (let i = 0; i < 100; i++) {
-      try { await access(join(dir, 'ready')); ready = true; break; }
-      catch { await delay(10); }
-    }
-    assert.equal(ready, true, 'fixture worker started');
-    if (shutdown === 'cancel') controller.abort();
-    else await executor.close();
-    await failed;
-    await delay(550);
-    await assert.rejects(access(join(dir, 'late')), { code: 'ENOENT' });
-    await executor.close();
-    await assert.rejects(executor.execute('read', {}), /transport is closed/);
-  });
-}
diff --git a/packages/mcode-harness/worker.ts b/packages/mcode-harness/worker.ts
deleted file mode 100644
index f034b1ef6..000000000
--- a/packages/mcode-harness/worker.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-import { LocalReadTool, LocalWriteTool, LocalEditTool, LocalBashTool } from '@native/local-pi-tools';
-import { LocalGrepTool } from '@native/local-grep';
-import { LocalGlobTool } from '@native/local-glob';
-import { toRuntimeTool, isRuntimeToolInputValid } from '@mavis/agent-core/tools';
-import { readFileSync } from 'node:fs';
-import { killTrackedDetachedChildren } from '@pi/utils/shell';
-import { isAbsolute } from 'node:path';
-
-const root = process.argv[2];
-if (!root || !isAbsolute(root)) throw new Error('absolute workspace argument required');
-const tools = [new LocalReadTool(root), new LocalWriteTool(root), new LocalEditTool(root),
-  new LocalBashTool(root, undefined, { mode: 'off' }), new LocalGrepTool(root), new LocalGlobTool(root)]
-  .map(toRuntimeTool);
-if (process.argv[3] === '--describe') {
-  process.stdout.write(JSON.stringify(tools.map(t => ({ name: t.def.name,
-    description: t.def.description, inputSchema: t.def.schema }))) + '\n');
-  process.exit(0);
-}
-const abort = new AbortController();
-const cancel = () => {
-  abort.abort();
-  // Native Bash owns a detached process group outside the daemon's group.
-  // Keep the worker alive to settle its tool after stopping that owned group.
-  killTrackedDetachedChildren();
-};
-process.on('SIGTERM', cancel);
-process.on('SIGINT', cancel);
-const request = JSON.parse(readFileSync(0, 'utf8'));
-const tool = tools.find(value => value.def.name === request.tool);
-if (!tool || !request.input || typeof request.input !== 'object' || Array.isArray(request.input) ||
-    !isRuntimeToolInputValid(tools, request.tool, request.input))
-  throw new Error('invalid tool request');
-const context = { sessionId: 'worker', turnId: 'call', allowBashAutoPromotion: false,
-  canConsumeBackgroundBashOutput: false };
-try {
-  const result = await tool.impl.execute(context, request.input, abort.signal);
-  process.stdout.write(JSON.stringify(result) + '\n');
-} catch (error) {
-  process.stdout.write(JSON.stringify({ tool_name: request.tool, isError: true,
-    text: error instanceof Error ? error.message : String(error), content: [] }) + '\n');
-  process.exitCode = 1;
-} finally {
-  process.removeListener('SIGTERM', cancel);
-  process.removeListener('SIGINT', cancel);
-}
diff --git a/scripts/acceptance/acceptance.py b/scripts/acceptance/acceptance.py
index 078ddeeb2..82856720c 100644
--- a/scripts/acceptance/acceptance.py
+++ b/scripts/acceptance/acceptance.py
@@ -112,14 +112,6 @@ def settings(args):
         key = provider["api_key"]
         require(isinstance(key, str) and key and len(key) <= 16384
                 and not any(c in key for c in "\r\n\0"), "invalid_model_provider_key")
-        for name in ("context_window", "max_output_tokens"):
-            require(type(provider.get(name, 0)) is int and provider.get(name, 0) >= 0,
-                    "invalid_model_limits")
-        if PROVIDERS[harness][protocol]["requires_token_limits"]:
-            require(provider.get("context_window", 0) > 0 and provider.get("max_output_tokens", 0) > 0,
-                    "harness_requires_positive_model_limits")
-        if provider.get("context_window") and provider.get("max_output_tokens"):
-            require(provider["max_output_tokens"] <= provider["context_window"], "invalid_model_limits")
         secrets.append(key)
     return token, models, secrets
 
diff --git a/scripts/acceptance/harness_catalog.py b/scripts/acceptance/harness_catalog.py
index 2c565796c..79d8b6f57 100644
--- a/scripts/acceptance/harness_catalog.py
+++ b/scripts/acceptance/harness_catalog.py
@@ -1,7 +1,5 @@
 # Code generated by scripts/generate-harness-catalog.py; DO NOT EDIT.
-# Provider support comes from the adapter-owned Go configuration declarations.
-PROVIDERS = {'claude_sdk': {'anthropic': {'requires_token_limits': False}},
- 'codex': {'responses': {'requires_token_limits': False}},
- 'mcode': {'anthropic': {'requires_token_limits': True},
-           'chat_completions': {'requires_token_limits': True},
-           'responses': {'requires_token_limits': True}}}
+# Protocol support comes from the Go Harness declarations.
+PROVIDERS = {'claude_sdk': ['anthropic'],
+ 'codex': ['responses'],
+ 'mcode': ['anthropic', 'responses', 'chat_completions']}
diff --git a/scripts/acceptance/test_acceptance.py b/scripts/acceptance/test_acceptance.py
index fcb8f5e59..4b9fd3823 100644
--- a/scripts/acceptance/test_acceptance.py
+++ b/scripts/acceptance/test_acceptance.py
@@ -37,7 +37,7 @@ def test_catalog_support_does_not_expand_campaign(self):
             with self.subTest(protocol=protocol), self.assertRaisesRegex(
                     acceptance.Failure, "provider_protocol_does_not_match_campaign"):
                 self.settings()
-        expanded = {**acceptance.PROVIDERS, "additional": {"responses": {"requires_token_limits": False}}}
+        expanded = {**acceptance.PROVIDERS, "additional": ["responses"]}
         with mock.patch.object(acceptance, "PROVIDERS", expanded):
             self.models["mcode"]["model_provider"]["protocol"] = "anthropic"
             self.settings()
@@ -53,39 +53,12 @@ def test_unsupported_campaign_is_rejected_before_reading_secrets(self):
                     acceptance.settings(SimpleNamespace())
                 private_file.assert_not_called()
 
-    def test_token_limit_requirements_follow_declarations(self):
+    def test_token_limits_are_optional(self):
         for harness in acceptance.CAMPAIGN:
             models = copy.deepcopy(self.models)
             del models[harness]["model_provider"]["context_window"]
             del models[harness]["model_provider"]["max_output_tokens"]
-            if harness == "mcode":
-                with self.assertRaisesRegex(acceptance.Failure, "harness_requires_positive_model_limits"):
-                    self.settings(models)
-            else:
-                self.settings(models)
-        providers = copy.deepcopy(acceptance.PROVIDERS)
-        providers["codex"]["responses"]["requires_token_limits"] = True
-        del self.models["codex"]["model_provider"]["context_window"]
-        with mock.patch.object(acceptance, "PROVIDERS", providers):
-            with self.assertRaisesRegex(acceptance.Failure, "harness_requires_positive_model_limits"):
-                self.settings()
-
-    def test_model_limit_validation(self):
-        for field in ("context_window", "max_output_tokens"):
-            for value in (False, -1, "100", 1.5, None):
-                models = copy.deepcopy(self.models)
-                models["codex"]["model_provider"][field] = value
-                with self.subTest(field=field, value=value), self.assertRaisesRegex(
-                        acceptance.Failure, "invalid_model_limits"):
-                    self.settings(models)
-        for field in ("context_window", "max_output_tokens"):
-            models = copy.deepcopy(self.models)
-            models["mcode"]["model_provider"][field] = 0
-            with self.assertRaisesRegex(acceptance.Failure, "harness_requires_positive_model_limits"):
-                self.settings(models)
-        self.models["codex"]["model_provider"]["max_output_tokens"] = 64001
-        with self.assertRaisesRegex(acceptance.Failure, "invalid_model_limits"):
-            self.settings()
+            self.settings(models)
 
     def test_provider_validation_is_preserved(self):
         for patch, label in (
diff --git a/scripts/build-claude-sdk-runtime.sh b/scripts/build-claude-sdk-runtime.sh
index 28d8edd84..e530f9615 100755
--- a/scripts/build-claude-sdk-runtime.sh
+++ b/scripts/build-claude-sdk-runtime.sh
@@ -11,7 +11,6 @@ for directory in "$runtime_root" "$output_dir"; do
   fi
 done
 
-node -e 'if (Number(process.versions.node.split(".")[0]) < 20) throw new Error("Claude SDK runtime builds require Node 20 or newer")'
 mkdir -p "$runtime_root/cache/claude-sdk-builds"
 build_context="$(mktemp -d "$runtime_root/cache/claude-sdk-builds/runtime.XXXXXX")"
 trap 'rm -rf "$build_context"' EXIT
diff --git a/scripts/build-core-distribution.sh b/scripts/build-core-distribution.sh
index cb403f83f..a2a3c5249 100755
--- a/scripts/build-core-distribution.sh
+++ b/scripts/build-core-distribution.sh
@@ -231,7 +231,7 @@ msb=(docker run --rm --network none --user "$(id -u):$(id -g)" \
   --entrypoint /opt/microsandbox/msb "$core_image")
 "${msb[@]}" image load --input /runtime.tar --tag oac-runtime:distribution --quiet
 "${msb[@]}" image inspect oac-runtime:distribution --format json > "$stage/runtime-inspect.json"
-python3 scripts/core-distribution-manifest.py node-payload "$bundle" "$stage" "$revision" "$source_tree" "$source_epoch" "$release_base_url" "$offline"
+python3 scripts/core-distribution-manifest.py node-payload "$bundle" "$stage" "$revision" "$source_tree" "$release_base_url" "$offline"
 mkdir -p "$stage/ingress"
 cp deploy/distribution/Ingress.Dockerfile "$stage/ingress/Dockerfile"
 cp "$stage/core/bin/oac" "$stage/ingress/oac"
diff --git a/scripts/build-mcode-harness.sh b/scripts/build-mcode-harness.sh
index d08b0bccb..1df969b58 100644
--- a/scripts/build-mcode-harness.sh
+++ b/scripts/build-mcode-harness.sh
@@ -32,27 +32,16 @@ if [[ -f "$source/.cache/artifacts/code-0.3.11.tgz" ]]; then
   cp "$source/.cache/artifacts/code-0.3.11.tgz" "$context/upstream/.cache/artifacts/"
 fi
 printf '%s\n' "$revision" > "$context/upstream/.oac-source-revision"
-cp "$package/"*.mjs "$package/"*.ts "$package/"*.json "$context/"
 test "$(node "$native/cli.js" --version)" = 0.4.12
 (
-  cd "$context"
-  MCODE_SOURCE="$context/upstream" node patch-native.mjs
-  cd upstream
+  MCODE_SOURCE="$context/upstream" node "$package/patch-native.mjs"
+  cd "$context/upstream"
   corepack pnpm install --frozen-lockfile
   node scripts/build.mjs
 )
-(
-  cd "$context"
-  npm ci --no-audit --no-fund
-  MCODE_SOURCE="$context/upstream" node build.mjs
-  node dist/worker.mjs /workspace --describe > dist/tools.json
-  npm prune --omit=dev --no-audit --no-fund
-)
 artifact="$context/artifact"
 mkdir "$artifact"
-cp -R "$context/dist" "$context/node_modules" "$artifact/"
-cp "$package/launch.mjs" "$package/bridge.mjs" "$package/check.mjs" "$package/tool-executor.mjs" "$package/source.json" "$artifact/"
-cp "$package/subagent-snapshot.mjs" "$artifact/"
+cp "$package/check.mjs" "$package/subagent-snapshot.mjs" "$package/source.json" "$artifact/"
 mkdir "$artifact/native"
 cp -R "$context/upstream/dist/." "$artifact/native/"
 cp -R "$native/node_modules" "$artifact/native/"
diff --git a/scripts/build-native-catalog.mjs b/scripts/build-native-catalog.mjs
index ab97b7e96..688772434 100644
--- a/scripts/build-native-catalog.mjs
+++ b/scripts/build-native-catalog.mjs
@@ -3,7 +3,7 @@
 import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { createReadStream } from 'node:fs';
-import { copyFile, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { copyFile, mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 
 const [input, output] = process.argv.slice(2);
@@ -12,14 +12,20 @@ const version = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' })
 const protocol_version = (await readFile('internal/agentdaemon/proto/version.go', 'utf8')).match(/const Version = "([^"]+)"/)?.[1];
 if (!protocol_version) throw new Error('Runtime protocol version is missing');
 await mkdir(output, { recursive: true });
+// INPUT holds <os>-<arch>.tar.gz (the daemon and bundle.json) and <os>-<arch>-<component>.tar.gz per platform.
+const names = (await readdir(input)).filter(file => file.endsWith('.tar.gz')).map(file => file.slice(0, -'.tar.gz'.length)).sort();
 const artifacts = {};
-for (const [ci, platform] of Object.entries({ 'Linux-X64': 'linux-amd64', 'macOS-ARM64': 'darwin-arm64', 'Windows-X64': 'windows-amd64' })) {
-  const archive = resolve(input, `oac-native-installer-${ci}.tar.gz`);
-  const bundle = JSON.parse(execFileSync('tar', ['-xOzf', archive, './bundle.json'], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }));
+for (const platform of ['linux-amd64', 'darwin-arm64', 'windows-amd64']) {
+  const bundle = JSON.parse(execFileSync('tar', ['-xOzf', resolve(input, `${platform}.tar.gz`), 'bundle.json'], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }));
   if (bundle.daemon_version !== version || `${bundle.os}-${bundle.arch}` !== platform) throw new Error(`Mismatched native artifact: ${platform}`);
-  const hash = createHash('sha256');
-  for await (const chunk of createReadStream(archive)) hash.update(chunk);
-  artifacts[platform] = { sha256: hash.digest('hex') };
-  await copyFile(archive, join(output, `${platform}.tar.gz`));
+  const parts = Object.keys(bundle.components).map(component => `${platform}-${component}`).sort();
+  if (JSON.stringify(names.filter(name => name.startsWith(platform + '-'))) !== JSON.stringify(parts)) throw new Error(`Native archives do not match the components of ${platform}`);
+  for (const name of [platform, ...parts]) {
+    const archive = resolve(input, `${name}.tar.gz`);
+    const hash = createHash('sha256');
+    for await (const chunk of createReadStream(archive)) hash.update(chunk);
+    artifacts[name] = { sha256: hash.digest('hex') };
+    await copyFile(archive, join(output, `${name}.tar.gz`));
+  }
 }
 await writeFile(join(output, 'catalog.json'), JSON.stringify({ version, protocol_version, artifacts }, null, 2)+'\n');
diff --git a/scripts/build-native-catalog.test.mjs b/scripts/build-native-catalog.test.mjs
index 9328b3d35..4bcc7ecff 100644
--- a/scripts/build-native-catalog.test.mjs
+++ b/scripts/build-native-catalog.test.mjs
@@ -6,7 +6,7 @@ import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import test from 'node:test';
 
-test('catalog accepts large native manifests and still rejects a foreign revision', async () => {
+test('catalog lists each platform base and component archive and rejects a foreign revision', async () => {
   const directory = await mkdtemp(join(tmpdir(), 'oac-native-catalog-'));
   try {
     const input = join(directory, 'input');
@@ -14,20 +14,27 @@ test('catalog accepts large native manifests and still rejects a foreign revisio
     const bundle = join(directory, 'bundle');
     await Promise.all([mkdir(input), mkdir(bundle)]);
     const version = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
-    for (const [ci, os, arch] of [['Linux-X64', 'linux', 'amd64'], ['macOS-ARM64', 'darwin', 'arm64'], ['Windows-X64', 'windows', 'amd64']]) {
-      await writeFile(join(bundle, 'bundle.json'), JSON.stringify({ daemon_version: version, os, arch, files: { fixture: 'x'.repeat(2 * 1024 * 1024) } }));
-      execFileSync('tar', ['-czf', join(input, `oac-native-installer-${ci}.tar.gz`), '-C', bundle, './bundle.json']);
+    const pack = (name, daemon_version, os, arch, components) => {
+      return writeFile(join(bundle, 'bundle.json'), JSON.stringify({ daemon_version, os, arch, components, filler: 'x'.repeat(2 * 1024 * 1024) })).then(() => {
+        execFileSync('tar', ['-czf', join(input, `${name}.tar.gz`), '-C', bundle, 'bundle.json']);
+      });
+    };
+    for (const [os, arch] of [['linux', 'amd64'], ['darwin', 'arm64'], ['windows', 'amd64']]) {
+      const components = { node: {}, codex: {} };
+      await pack(`${os}-${arch}`, version, os, arch, components);
+      for (const name of Object.keys(components)) await pack(`${os}-${arch}-${name}`, version, os, arch, {});
     }
     const script = resolve('scripts/build-native-catalog.mjs');
     execFileSync(process.execPath, [script, input, output]);
     const catalog = JSON.parse(await readFile(join(output, 'catalog.json'), 'utf8'));
     assert.equal(catalog.version, version);
-    assert.equal(Object.keys(catalog.artifacts).length, 3);
-    const linux = await readFile(join(input, 'oac-native-installer-Linux-X64.tar.gz'));
-    assert.deepEqual(await readFile(join(output, 'linux-amd64.tar.gz')), linux);
-    assert.equal(catalog.artifacts['linux-amd64'].sha256, createHash('sha256').update(linux).digest('hex'));
-    await writeFile(join(bundle, 'bundle.json'), JSON.stringify({ daemon_version: 'foreign', os: 'linux', arch: 'amd64' }));
-    execFileSync('tar', ['-czf', join(input, 'oac-native-installer-Linux-X64.tar.gz'), '-C', bundle, './bundle.json']);
+    assert.deepEqual(Object.keys(catalog.artifacts).sort(), ['darwin-arm64', 'darwin-arm64-codex', 'darwin-arm64-node', 'linux-amd64', 'linux-amd64-codex', 'linux-amd64-node', 'windows-amd64', 'windows-amd64-codex', 'windows-amd64-node']);
+    const part = await readFile(join(input, 'linux-amd64-codex.tar.gz'));
+    assert.deepEqual(await readFile(join(output, 'linux-amd64-codex.tar.gz')), part);
+    assert.equal(catalog.artifacts['linux-amd64-codex'].sha256, createHash('sha256').update(part).digest('hex'));
+    await rm(join(input, 'linux-amd64-codex.tar.gz'));
+    assert.throws(() => execFileSync(process.execPath, [script, input, output], { stdio: 'pipe' }), error => error.stderr.toString().includes('do not match the components'));
+    await pack('linux-amd64', 'foreign', 'linux', 'amd64', {});
     assert.throws(() => execFileSync(process.execPath, [script, input, output], { stdio: 'pipe' }), error => error.stderr.toString().includes('Mismatched native artifact'));
   } finally {
     await rm(directory, { recursive: true, force: true });
diff --git a/scripts/build-native-installer-ci.mjs b/scripts/build-native-installer-ci.mjs
index ec874a0f6..4daeff856 100644
--- a/scripts/build-native-installer-ci.mjs
+++ b/scripts/build-native-installer-ci.mjs
@@ -3,9 +3,10 @@
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { access, mkdir, readdir, realpath, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { access, mkdir, readdir, realpath, stat, writeFile } from 'node:fs/promises';
 import { dirname, join, resolve } from 'node:path';
-import { buildBundle } from './build-native-installer.mjs';
+import { archiveBundle, buildBundle } from './build-native-installer.mjs';
 
 const root = resolve(process.env.RUNNER_TEMP ?? '');
 if (!process.env.RUNNER_TEMP) throw new Error('RUNNER_TEMP is required');
@@ -30,6 +31,7 @@ const candidates = await findCodex(join(root, 'native-tools', 'node_modules', '@
 assert.equal(candidates.length, 1, 'Expected exactly one native Codex artifact');
 const bundle = join(root, 'native-installer');
 const receipt = await buildBundle({ daemon, node: await realpath(node), codex: candidates[0], claude: join(root, 'claude-runtime'), ...(!windows ? { minimax: join(root, 'minimax-runtime') } : {}), output: bundle });
+await archiveBundle(bundle, join(root, 'native-archives'));
 console.log(JSON.stringify({ stage: 'bundle', os: receipt.os, arch: receipt.arch, components: Object.keys(receipt.components), model_requests: 0 }));
 const workspace = join(root, 'native-install-workspace'); await mkdir(workspace);
 const credential = join(root, 'native-install-credential.json');
@@ -53,6 +55,13 @@ const allHarnesses = windows ? 'codex,claude' : 'codex,claude,minimax';
 install(['--harness', allHarnesses], true);
 install(['--harness', allHarnesses], true);
 if (windows) install(['--harness', 'minimax'], false);
+// Components are installed once per machine and version, read-only, and the installation only references them.
+const store = join(env.OAC_RUNTIME_HOME, 'components', receipt.daemon_version);
+for (const name of ['node', ...allHarnesses.split(',')]) {
+  assert.ok(existsSync(join(store, name, '.oac-install.json')), `Shared ${name} component is missing`);
+  assert.equal((await stat(join(store, name, '.oac-install.json'))).mode & 0o200, 0, `Shared ${name} component is writable`);
+}
+assert.ok(!existsSync(join(installDir, 'components')), 'The installation holds its own component copy');
 const installedCommand = join(installDir, 'bin', windows ? 'oac-daemon.exe' : 'oac-daemon');
 const installedEnv = { ...process.env }; delete installedEnv.OAC_RUNTIME_HOME;
 const installedVersion = spawnSync(installedCommand, ['version'], { env: installedEnv, encoding: 'utf8', timeout: 10000 });
@@ -61,4 +70,23 @@ assert.equal(installedVersion.stdout.trim(), receipt.daemon_version, 'Installed
 const incomplete = spawnSync(command, ['install', '--non-interactive'], { env, input: '', encoding: 'utf8', timeout: 10000 });
 assert.equal(Boolean(incomplete.error), false, 'Missing arguments waited for interaction');
 assert.notEqual(incomplete.status, 0, 'Missing required arguments succeeded');
+// A second Session on the machine shares the same components; uninstalling both removes them.
+const secondEnvironment = randomUUID();
+const secondCredential = join(root, 'native-install-second-credential.json');
+await writeFile(secondCredential, JSON.stringify({ key_id: randomUUID(), executor_token: 'fixture-only-not-a-real-credential', environment_id: secondEnvironment }), { mode: 0o600 });
+const secondWorkspace = join(root, 'native-install-second-workspace'); await mkdir(secondWorkspace);
+const secondDir = join(root, 'native-install-second');
+const second = spawnSync(command, ['install', '--non-interactive', '--bundle-dir', bundle, '--harness', allHarnesses, '--install-dir', secondDir, '--remote', 'ws://localhost:1/api/v1/agent-daemon/ws',
+  '--environment-id', secondEnvironment, '--workspace', secondWorkspace, '--credential-file', secondCredential], { env, encoding: 'utf8', timeout: 120000, maxBuffer: 1024 * 1024 });
+assert.equal(second.status, 0, 'Second installation failed');
+assert.ok(!existsSync(join(secondDir, 'components')), 'The second installation holds its own component copy');
+function uninstall(directory) {
+  const result = spawnSync(join(directory, 'bin', windows ? 'oac-daemon.exe' : 'oac-daemon'), ['uninstall'], { env: installedEnv, input: 'y\n', encoding: 'utf8', timeout: 120000 });
+  assert.equal(result.status, 0, 'Uninstall failed');
+  return result.stdout;
+}
+assert.match(uninstall(installDir), /Shared components kept: 1 other/);
+assert.ok(existsSync(join(store, 'node', '.oac-install.json')), 'Uninstalling one installation removed components another uses');
+assert.match(uninstall(secondDir), /Shared components removed/);
+assert.ok(!existsSync(store), 'The last uninstall left the shared components');
 console.log(JSON.stringify({ stage: 'install', harnesses: allHarnesses.split(','), install: 'passed', additive: 'passed', reuse: 'passed', missing_arguments: 'rejected', connection: 'not_attempted', model: 'not_configured', model_requests: 0 }));
diff --git a/scripts/build-native-installer.mjs b/scripts/build-native-installer.mjs
index e8cc4a250..55c7f4e04 100644
--- a/scripts/build-native-installer.mjs
+++ b/scripts/build-native-installer.mjs
@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Package trusted, already-built native artifacts. This does not install on a host.
 import { createHash } from 'node:crypto';
-import { spawnSync } from 'node:child_process';
+import { execFileSync, spawnSync } from 'node:child_process';
 import { chmod, copyFile, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, relative, sep } from 'node:path';
 import { createRequire } from 'node:module';
@@ -131,10 +131,10 @@ export async function validateComponents(root, names, daemonVersion) {
       const upstream = await json(join(component, 'source.json'));
       const expected = await json(new URL('../packages/mcode-harness/source.json', import.meta.url));
       if (upstream.version !== pins.minimax || upstream.revision !== expected.revision) throw new Error('MiniMax source pin mismatch');
-      for (const entry of ['launch.mjs', 'dist/worker.mjs', 'provenance.json', 'native-patch.json']) await requireFile(join(component, entry));
+      for (const entry of ['check.mjs', 'subagent-snapshot.mjs', 'provenance.json', 'native-patch.json']) await requireFile(join(component, entry));
       if (probe(node, [join(component, 'native/cli.js'), '--version'], component, env) !== pins.minimax) throw new Error('MiniMax native pin mismatch');
       const info = JSON.parse(probe(node, [join(component, 'check.mjs')], component, env));
-      if (info.protocol !== 2 || info.native !== pins.minimax || info.source !== expected.revision) throw new Error('MiniMax companion compatibility failed');
+      if (info.protocol !== 3 || info.native !== pins.minimax || info.source !== expected.revision) throw new Error('MiniMax companion compatibility failed');
     }
   }
 }
@@ -178,3 +178,14 @@ export async function buildBundle(options) {
     return manifest;
   } finally { await rm(staging, { recursive: true, force: true }); }
 }
+
+// Split a built bundle into the small base archive (the daemon and bundle.json) and one archive
+// per component. Names are the artifact names Core serves: <os>-<arch>[-<component>].
+export async function archiveBundle(bundle, output) {
+  const { os, arch, components } = await json(join(bundle, 'bundle.json'));
+  const tar = process.platform === 'win32' ? join(process.env.SystemRoot, 'System32', 'tar.exe') : 'tar';
+  const pack = (name, entries) => execFileSync(tar, ['-czf', join(output, `${name}.tar.gz`), '-C', bundle, ...entries], { env: { ...process.env, COPYFILE_DISABLE: '1' } });
+  await mkdir(output, { recursive: true });
+  pack(`${os}-${arch}`, [process.platform === 'win32' ? 'oac-daemon.exe' : 'oac-daemon', 'bundle.json']);
+  for (const name of Object.keys(components)) pack(`${os}-${arch}-${name}`, [`components/${name}`]);
+}
diff --git a/scripts/build-native-installer.test.mjs b/scripts/build-native-installer.test.mjs
index 8ffa55b1f..700ea462c 100644
--- a/scripts/build-native-installer.test.mjs
+++ b/scripts/build-native-installer.test.mjs
@@ -4,7 +4,8 @@ import { chmod, copyFile, cp, lstat, mkdir, mkdtemp, readFile, rename, rm, symli
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import test from 'node:test';
-import { buildBundle, copyComponent, prepareNodeEntrypoints, validateNodeCommands } from './build-native-installer.mjs';
+import { execFileSync } from 'node:child_process';
+import { archiveBundle, buildBundle, copyComponent, prepareNodeEntrypoints, validateNodeCommands } from './build-native-installer.mjs';
 
 async function fixture(t) {
   const root = await mkdtemp(join(tmpdir(), 'oac-native-bundle-test-'));
@@ -95,3 +96,19 @@ test('real npm and npx remain runnable from PATH after regular-file copying and
     assert.equal(files[path].executable, true);
   }
 });
+
+test('archives hold the daemon alone and each component separately', async t => {
+  const { root, source } = await fixture(t);
+  const windows = process.platform === 'win32';
+  const daemon = windows ? 'oac-daemon.exe' : 'oac-daemon';
+  await writeFile(join(source, daemon), 'daemon');
+  await writeFile(join(source, 'bundle.json'), JSON.stringify({ os: 'linux', arch: 'amd64', components: { node: {}, codex: {} } }));
+  for (const name of ['node', 'codex']) { await mkdir(join(source, 'components', name), { recursive: true }); await writeFile(join(source, 'components', name, 'file'), name); }
+  const output = join(root, 'archives');
+  await archiveBundle(source, output);
+  const tar = windows ? join(process.env.SystemRoot, 'System32', 'tar.exe') : 'tar';
+  const list = name => execFileSync(tar, ['-tzf', join(output, `${name}.tar.gz`)], { encoding: 'utf8' }).split(/\r?\n/).filter(Boolean).map(entry => entry.replace(/\/$/, '')).sort();
+  assert.deepEqual(list('linux-amd64'), ['bundle.json', daemon].sort());
+  assert.deepEqual(list('linux-amd64-codex'), ['components/codex', 'components/codex/file']);
+  assert.deepEqual(list('linux-amd64-node'), ['components/node', 'components/node/file']);
+});
diff --git a/scripts/check-names.py b/scripts/check-names.py
deleted file mode 100644
index d1fba0a4f..000000000
--- a/scripts/check-names.py
+++ /dev/null
@@ -1,107 +0,0 @@
-#!/usr/bin/env python3
-"""Reject retired identifiers in tracked text, with reasoned span-level exceptions."""
-from __future__ import annotations
-
-import argparse
-from dataclasses import dataclass
-import fnmatch
-import json
-from pathlib import Path
-import re
-import subprocess
-import sys
-
-# These spellings are detection inputs, not supported compatibility aliases.
-FORBIDDEN = re.compile(
-    r"(?i:parsar)|\bAGENTS_CORE_WEB_[A-Z][A-Z0-9_]*|\bAGENTS_API_[A-Z][A-Z0-9_]*|\bCORE_CONSOLE_[A-Z][A-Z0-9_]*"
-    r"|\bagents-api(?:-(?:migrate|device|environment-key|e2b-provider|microsandbox-provider"
-    r"|tool-root|codex-directory|codex-write|workspace-export|runtime-initialize|claude-shell-prefix))?\b"
-    r"|\bcore-console\b|\bagents-runtime\b|(?i:\bAgents? Core(?: Web)?\b)|\bagents-core-web\b"
-    r"|(?i:\bminimax-ai-dev\b)",
-)
-
-
-@dataclass(frozen=True)
-class ExceptionRule:
-    path: str
-    regex: re.Pattern[str]
-    reason: str
-
-
-def load_rules(path: Path) -> list[ExceptionRule]:
-    entries = json.loads(path.read_text(encoding="utf-8"))
-    if not isinstance(entries, list):
-        raise ValueError("allowlist must be a list")
-    rules = []
-    for index, entry in enumerate(entries):
-        if not isinstance(entry, dict) or set(entry) != {"path", "regex", "reason"}:
-            raise ValueError(f"allowlist entry {index} needs path, regex and reason")
-        if any(not isinstance(entry[key], str) or not entry[key].strip() for key in entry):
-            raise ValueError(f"allowlist entry {index} has an empty path, regex or reason")
-        regex = re.compile(entry["regex"])
-        if regex.search("") is not None:
-            raise ValueError(f"allowlist entry {index} matches empty text")
-        rules.append(ExceptionRule(entry["path"], regex, entry["reason"]))
-    return rules
-
-
-def violations(path: str, content: str, rules: list[ExceptionRule],
-               used: set[int] | None = None) -> list[tuple[int, int, str]]:
-    """Return unexcused identifiers; add the index of each rule that excuses one to used."""
-    allowed = [(index, match.span()) for index, rule in enumerate(rules) if fnmatch.fnmatchcase(path, rule.path)
-               for match in rule.regex.finditer(content)]
-    result = []
-    for match in FORBIDDEN.finditer(content):
-        excusing = {index for index, (start, end) in allowed if start <= match.start() and match.end() <= end}
-        if excusing:
-            if used is not None:
-                used.update(excusing)
-            continue
-        line = content.count("\n", 0, match.start()) + 1
-        column = match.start() - content.rfind("\n", 0, match.start())
-        result.append((line, column, match.group()))
-    return result
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--root", type=Path, default=Path(__file__).resolve().parent.parent)
-    parser.add_argument("--allowlist", type=Path, default=Path(__file__).with_name("name-allowlist.json"))
-    args = parser.parse_args()
-    try:
-        rules = load_rules(args.allowlist)
-        names = subprocess.check_output(["git", "-C", str(args.root), "ls-files", "-z"]).split(b"\0")
-        failures = []
-        used: set[int] = set()
-        for raw in names:
-            if not raw:
-                continue
-            name = raw.decode("utf-8")
-            path = args.root / name
-            # Never follow a tracked symlink into files outside this repository.
-            if path.is_symlink() or not path.is_file():
-                continue
-            data = path.read_bytes()
-            if b"\0" in data:
-                continue
-            content = data.decode("utf-8")
-            failures.extend((name, *item) for item in violations(name, content, rules, used))
-    except (OSError, ValueError, re.error, subprocess.CalledProcessError) as error:
-        print(f"Name guard failed: {error}", file=sys.stderr)
-        return 2
-    for name, line, column, token in failures:
-        print(f"{name}:{line}:{column}: retired identifier {token!r}")
-    # An exception that excuses nothing hides nothing today but would silently allow the name later.
-    unused = [rule for index, rule in enumerate(rules) if index not in used]
-    for rule in unused:
-        print(f"{args.allowlist.name}: exception {rule.path} {rule.regex.pattern!r} excuses no retired identifier")
-    if failures or unused:
-        print(f"Name guard found {len(failures)} unapproved identifiers and {len(unused)} unused exceptions.",
-              file=sys.stderr)
-        return 1
-    print("OpenAgentCore name guard passed.")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
diff --git a/scripts/check-names.test.py b/scripts/check-names.test.py
deleted file mode 100644
index f72aca40c..000000000
--- a/scripts/check-names.test.py
+++ /dev/null
@@ -1,148 +0,0 @@
-#!/usr/bin/env python3
-"""Regression tests for scoped name exceptions and repository scanning."""
-import importlib.util
-import json
-from pathlib import Path
-import re
-import subprocess
-import sys
-import tempfile
-import unittest
-
-SPEC = importlib.util.spec_from_file_location("check_names", Path(__file__).with_name("check-names.py"))
-names = importlib.util.module_from_spec(SPEC)
-sys.modules[SPEC.name] = names
-SPEC.loader.exec_module(names)
-
-
-class NameGuardTests(unittest.TestCase):
-    def rule(self, pattern, path="*"):
-        return names.ExceptionRule(path, re.compile(pattern), "Deferred source identity")
-
-    def test_allowed_import_does_not_hide_setting_on_same_line(self):
-        content = 'import "github.com/MiniMax-AI-Dev/parsar/internal/foo"; setting = "PARSAR_HOME"'
-        rules = [self.rule(r"github\.com/MiniMax-AI-Dev/parsar/[a-z/]+")]
-        self.assertEqual(names.violations("main.go", content, rules), [(1, 68, "PARSAR")])
-
-    def test_partial_exception_cannot_hide_longer_retired_setting(self):
-        self.assertEqual(names.violations("main.go", "AGENTS_API_PORT", [self.rule("AGENTS_API")]),
-                         [(1, 1, "AGENTS_API_PORT")])
-
-    def test_exception_is_path_scoped_and_case_sensitive(self):
-        rule = self.rule("parsar", "history/*")
-        self.assertFalse(names.violations("history/source.json", "parsar", [rule]))
-        self.assertTrue(names.violations("README.md", "parsar", [rule]))
-        self.assertTrue(names.violations("history/source.json", "PARSAR", [rule]))
-
-    def test_detections_include_commands_settings_labels_and_display(self):
-        for value in ("PaRsAr", "io.parsar.installation", "AGENTS_API_PORT", "CORE_CONSOLE_BIND", "AGENTS_CORE_WEB_ADDR",
-                      "agents-api", "agents-api-codex-write", "core-console", "agents-runtime-dev",
-                      "Agent Core", "Agents Core Web"):
-            with self.subTest(value=value):
-                self.assertTrue(names.violations("x", value, []))
-
-    def test_new_names_and_pinned_public_contract_are_not_retired(self):
-        content = ("OpenAgentCore oac-core OAC_CORE_PORT agents_api AgentCoreError x_agents_core core_console_session"
-                   " github.com/MiniMax-AI/OpenAgentCore")
-        self.assertFalse(names.violations("x", content, []))
-
-    def test_coordinates_and_multiple_matches_do_not_disclose_line_content(self):
-        content = "first\n  parsar secret=value CORE_CONSOLE_BIND"
-        self.assertEqual(names.violations("x", content, []),
-                         [(2, 3, "parsar"), (2, 23, "CORE_CONSOLE_BIND")])
-
-    def test_multiline_exception_covers_only_its_span(self):
-        content = "Parsar\nproduct\nPARSAR_HOME"
-        rules = [self.rule("Parsar\\nproduct")]
-        self.assertEqual(names.violations("x", content, rules), [(3, 1, "PARSAR")])
-
-    def test_invalid_allowlist_fails_closed(self):
-        with tempfile.TemporaryDirectory() as directory:
-            path = Path(directory) / "rules.json"
-            for value in ({}, [{"path": "*", "regex": "parsar", "reason": " "}],
-                          [{"path": "*", "regex": ".*", "reason": "too broad"}],
-                          [{"path": "*", "regex": "[", "reason": "invalid"}],
-                          [{"path": "*", "regex": "parsar", "reason": "valid", "typo": True}]):
-                path.write_text(json.dumps(value))
-                with self.subTest(value=value), self.assertRaises((ValueError, re.error)):
-                    names.load_rules(path)
-
-    def test_repository_scan_uses_tracked_text_and_skips_binary_without_following_links(self):
-        with tempfile.TemporaryDirectory() as directory:
-            root = Path(directory)
-            subprocess.run(["git", "init", "-q", directory], check=True)
-            (root / "tracked.txt").write_text("PARSAR_HOME\n")
-            (root / "untracked.txt").write_text("PARSAR_OTHER\n")
-            (root / "binary").write_bytes(b"\0parsar")
-            (root / "link").symlink_to("untracked.txt")
-            subprocess.run(["git", "-C", directory, "add", "tracked.txt", "binary", "link"], check=True)
-            rules = root / "rules.json"
-            rules.write_text("[]")
-            command = [sys.executable, str(Path(names.__file__)), "--root", directory, "--allowlist", str(rules)]
-            result = subprocess.run(command, text=True, capture_output=True)
-            self.assertEqual(result.returncode, 1)
-            self.assertIn("tracked.txt:1:1:", result.stdout)
-            self.assertNotIn("untracked.txt", result.stdout)
-            self.assertNotIn("binary:", result.stdout)
-            (root / "tracked.txt").write_text("OAC_RUNTIME_HOME\n")
-            self.assertEqual(subprocess.run(command, capture_output=True).returncode, 0)
-
-    def test_exception_that_excuses_no_identifier_fails_the_scan(self):
-        with tempfile.TemporaryDirectory() as directory:
-            root = Path(directory)
-            subprocess.run(["git", "init", "-q", directory], check=True)
-            (root / "tracked.txt").write_text("PARSAR_HOME X-Core-Console-Actor\n")
-            subprocess.run(["git", "-C", directory, "add", "tracked.txt"], check=True)
-            rules = root / "rules.json"
-            used = {"path": "tracked.txt", "regex": "PARSAR_HOME", "reason": "Excuses the setting"}
-            command = [sys.executable, str(Path(names.__file__)), "--root", directory, "--allowlist", str(rules)]
-            for unused in ({"path": "missing/*", "regex": "parsar", "reason": "Matches no file"},
-                           {"path": "*", "regex": "X-Core-Console-Actor", "reason": "Matches only allowed text"}):
-                with self.subTest(unused=unused["regex"]):
-                    rules.write_text(json.dumps([used, unused]))
-                    result = subprocess.run(command, text=True, capture_output=True)
-                    self.assertEqual(result.returncode, 1)
-                    self.assertIn(repr(unused["regex"]), result.stdout)
-                    self.assertNotIn("PARSAR_HOME", result.stdout)
-            rules.write_text(json.dumps([used]))
-            self.assertEqual(subprocess.run(command, capture_output=True).returncode, 0)
-
-    def test_persisted_domain_exception_does_not_allow_other_settings_or_paths(self):
-        rules = names.load_rules(Path(__file__).with_name("name-allowlist.json"))
-        content = '"parsar.agents-api.credential"; "PARSAR_HOME"'
-        found = names.violations("services/core/internal/credentialcrypto/cipher.go", content, rules)
-        self.assertEqual([item[2] for item in found], ["PARSAR"])
-        self.assertTrue(names.violations("README.md", content, rules))
-
-    def test_scoped_exception_does_not_hide_runtime_setting(self):
-        rules = [self.rule(r"AGENTS_API_ADDR", path="services/core/cmd/server/process_configuration.go")]
-        content = '{"AGENTS_API_ADDR", "OAC_ADDR"}; os.Getenv("PARSAR_HOME")'
-        found = names.violations("services/core/cmd/server/process_configuration.go", content, rules)
-        self.assertEqual([item[2] for item in found], ["PARSAR"])
-
-    def test_checked_in_exceptions_do_not_hide_unrelated_retired_setting(self):
-        rules = names.load_rules(Path(__file__).with_name("name-allowlist.json"))
-        for content in ('"contracts/agents-api/index.md" PARSAR_HOME',
-                        '"Parsar product" PARSAR_HOME'):
-            with self.subTest(content=content):
-                self.assertEqual(len(names.violations("README.md", content, rules)), 1)
-
-    def test_retired_organization_is_rejected(self):
-        for content in ("Copyright (c) 2026 MiniMax-AI-Dev", "https://github.com/minimax-ai-dev/OpenAgentCore"):
-            with self.subTest(content=content):
-                self.assertEqual([item[2].lower() for item in names.violations("LICENSE", content, [])],
-                                 ["minimax-ai-dev"])
-
-    def test_former_repository_identities_are_rejected(self):
-        rules = names.load_rules(Path(__file__).with_name("name-allowlist.json"))
-        for content in ("https://github.com/MiniMax-AI/parsar-core", '"github.com/MiniMax-AI-Dev/parsar/internal/foo"',
-                        "services/agents-api/cmd/server", "services/core-console", "apps/parsar-daemon/cmd/parsar-daemon",
-                        "scripts/build-agents-api-image.sh", "scripts/build-core-console.sh",
-                        "scripts/agents-api-subagents-acceptance.py", "make check-agents-api", '"name": "parsar-core"',
-                        "@agents-core-web/web", "@parsar/claude-sdk-adapter", "parsar-mcode-harness"):
-            with self.subTest(content=content):
-                self.assertTrue(names.violations("README.md", content, rules))
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/scripts/ci_plan.py b/scripts/ci_plan.py
index b7af3d9c3..cc1d07df8 100644
--- a/scripts/ci_plan.py
+++ b/scripts/ci_plan.py
@@ -86,7 +86,7 @@
     (("scripts/generate-harness-catalog", "scripts/harness-catalog/", "scripts/openapi-split/", "scripts/patch-agents-openapi.py",
       "scripts/generate-public-api"), SCRIPTS, JOBS),
     (("scripts/check-sqlc.py", "scripts/go-test-shard.py"), (".py",), ("backend",)),
-    (("scripts/check-names", "scripts/name-allowlist.json", "scripts/ci_"), (".py", ".json"), ("hygiene",)),
+    (("scripts/ci_",), (".py",), ("hygiene",)),
     ((".github/workflows/", ".github/actions/"), (".yml", ".yaml"), JOBS),
 )
 # Embedded files and test fixtures are executable inputs regardless of suffix.
@@ -110,7 +110,7 @@
                 "services/core/deploy/e2b/")
 # Generated outputs retain freshness checks even when the file is documentation.
 GENERATED_OUTPUTS = {"contracts/agents-api/harness-catalog.md", "contracts/agents-api/zh/harness-catalog.md", "packages/agents-client/src/harness-catalog.ts",
-                     "services/core/internal/engine/catalog_generated.go"}
+                     "internal/harnessconfig/builtin/registry.go", "apps/daemon/internal/cli/harness_declarations.go"}
 
 
 def full(reason):
diff --git a/scripts/ci_plan_test.py b/scripts/ci_plan_test.py
index 4396e6c63..3de4d18c1 100644
--- a/scripts/ci_plan_test.py
+++ b/scripts/ci_plan_test.py
@@ -52,8 +52,8 @@ def test_generated_outputs_keep_freshness_checks(self):
         generator = importlib.util.module_from_spec(spec)
         spec.loader.exec_module(generator)
         with patch.object(generator, "go", side_effect=lambda source: source):
-            outputs = generator.render(generator.load_catalog(generator.ROOT / generator.CATALOG))
-        for path in [*map(str, outputs), "scripts/acceptance/harness_catalog.py"]:
+            outputs = {**generator.render_registrations(generator.packages()), **generator.render_docs([])}
+        for path in [*map(str, outputs), "packages/agents-client/src/harness-catalog.ts", "scripts/acceptance/harness_catalog.py"]:
             with self.subTest(path=path):
                 self.assertIn("distribution", self.jobs(path))
 
@@ -67,7 +67,7 @@ def test_distribution_image_build_keeps_api_acceptance(self):
         self.assertEqual(set(plan["jobs"]), {"hygiene", "distribution", "api"})
 
     def test_shared_protocol_and_catalog_propagate_to_consumers(self):
-        for path in ("contracts/agents-api/v1/session.go", "internal/harnessconfig/builtin/catalog.json"):
+        for path in ("contracts/agents-api/v1/session.go", "internal/harnessconfig/codex/declaration.go"):
             self.assertTrue({"backend", "api", "native", "web", "web-acceptance", "example", "distribution"} <= self.jobs(path))
         self.assertTrue({"web", "web-acceptance", "example", "api"} <= self.jobs("packages/agents-client/src/client.ts"))
 
diff --git a/scripts/ci_review.py b/scripts/ci_review.py
deleted file mode 100644
index e7fb16645..000000000
--- a/scripts/ci_review.py
+++ /dev/null
@@ -1,163 +0,0 @@
-#!/usr/bin/env python3
-"""Collect independent review reports and deliver one Feishu card."""
-
-import argparse
-import base64
-import hashlib
-import hmac
-import json
-import os
-from pathlib import Path
-import re
-import time
-import urllib.error
-import urllib.request
-
-
-STATUSES = {"ok": "未发现问题", "issues": "发现问题", "incomplete": "未完成"}
-MAX_SECTION = 900
-REPORT_FIELDS = {
-    "code": {"changes": "实际行为变化，1–3 条 Markdown 列表", "review": "代码正确性与仓库规则审查结论", "ci": "已有 CI 结果；失败或未完成时给出具体检查项"},
-    "docs": {"consistency": "文档与代码一致性", "organization": "文档矛盾、重复与归属；未改文档时写本次未修改文档"},
-}
-
-
-def report_schema(kind):
-    properties = {"status": {"type": "string", "enum": list(STATUSES)}}
-    properties.update({name: {"type": "string", "minLength": 1, "maxLength": MAX_SECTION, "description": description}
-                       for name, description in REPORT_FIELDS[kind].items()})
-    return {"type": "object", "properties": properties, "required": list(properties), "additionalProperties": False}
-
-
-def incomplete(reason, kind):
-    fields = dict.fromkeys(REPORT_FIELDS[kind], "未完成。")
-    fields[next(iter(fields))] = reason
-    return {"status": "incomplete", **fields}
-
-
-def parse_report(raw, kind):
-    try:
-        report = json.loads(raw)
-    except (ValueError, TypeError):
-        return incomplete("未收到有效报告，请查看审查日志。", kind)
-    if (not isinstance(report, dict) or set(report) != {"status", *REPORT_FIELDS[kind]}
-            or not isinstance(report["status"], str) or report["status"] not in STATUSES
-            or any(not isinstance(report[name], str) or not report[name].strip()
-                   or len(report[name]) > MAX_SECTION for name in REPORT_FIELDS[kind])):
-        return incomplete("报告格式不完整，请查看审查日志。", kind)
-    return report
-
-
-def collect(outcome, raw, kind):
-    if outcome != "success":
-        return incomplete("审查未成功结束，请查看审查日志。", kind)
-    return parse_report(raw, kind)
-
-
-def read_report(directory, kind):
-    try:
-        return parse_report((directory / f"review-{kind}.json").read_text(), kind)
-    except (OSError, UnicodeError):
-        return incomplete("审查报告缺失，请查看审查日志。", kind)
-
-
-def markdown_text(value):
-    return re.sub(r"([\\`*_{}\[\]()<>!])", r"\\\1", value)
-
-
-def build_card(event, reports, run_url):
-    pr = event["pull_request"]
-    statuses = {report["status"] for report in reports.values()}
-    color = "red" if "issues" in statuses else "yellow" if "incomplete" in statuses else "green"
-    heading = "❌ 审查发现问题" if "issues" in statuses else "⚠️ 审查未完成" if "incomplete" in statuses else "✅ 审查通过"
-    code, docs = reports["code"], reports["docs"]
-
-    def text(value):
-        # Feishu mentions use HTML-like tags; reports are ordinary Markdown.
-        return value.replace("<", "&lt;").replace(">", "&gt;")
-
-    sections = [
-        ("1. 哪个 PR", f"**github id:** {markdown_text(pr['user']['login'])}\n"
-         f"**标题:** {markdown_text(pr['title'][:200])}\n**链接:** [PR #{pr['number']}]({pr['html_url']})"),
-        ("2. 改了什么", text(code["changes"])),
-        ("3. 代码与仓库规则", text(code["review"])),
-        ("4. CI 结果", text(code["ci"])),
-        (f"5. 文档审查 · {STATUSES[docs['status']]}",
-         f"**文档与代码一致性**\n{text(docs['consistency'])}\n\n"
-         f"**文档矛盾、重复与归属**\n{text(docs['organization'])}"),
-    ]
-    elements = []
-    for title, content in sections:
-        if elements:
-            elements.append({"tag": "hr"})
-        elements.append({"tag": "markdown", "content": f"**{title}**\n\n{content}"})
-    elements.append({"tag": "markdown", "content": f"[查看审查日志]({run_url})"})
-    return {
-        "msg_type": "interactive",
-        "card": {
-            "schema": "2.0",
-            "header": {"template": color, "title": {"tag": "plain_text", "content": f"{heading} · PR #{pr['number']}"}},
-            "body": {"elements": elements},
-        },
-    }
-
-
-def card_markdown(card):
-    return "\n\n".join("---" if element["tag"] == "hr" else element["content"]
-                        for element in card["card"]["body"]["elements"]) + "\n"
-
-
-def send_card(webhook, secret, card):
-    if not webhook:
-        raise ValueError("FEISHU_WEBHOOK_URL is not configured")
-    payload = dict(card)
-    if secret:
-        timestamp = str(int(time.time()))
-        key = f"{timestamp}\n{secret}".encode()
-        payload.update(timestamp=timestamp, sign=base64.b64encode(hmac.new(key, b"", hashlib.sha256).digest()).decode())
-    data = json.dumps(payload, ensure_ascii=False).encode()
-    if len(data) > 20000:
-        raise ValueError("Review card exceeds the webhook message size limit")
-    request = urllib.request.Request(webhook, data=data, headers={"Content-Type": "application/json"}, method="POST")
-    # A timeout may follow successful delivery; retrying could send a duplicate.
-    try:
-        with urllib.request.urlopen(request, timeout=30) as response:
-            result = json.load(response)
-    except (OSError, ValueError, urllib.error.URLError):
-        raise ValueError("Feishu delivery failed; delivery status is unknown") from None
-    if not isinstance(result, dict) or type(result.get("code")) is not int or result["code"] != 0:
-        raise ValueError("Feishu did not confirm delivery")
-
-
-def main():
-    parser = argparse.ArgumentParser(description=__doc__)
-    commands = parser.add_subparsers(dest="command", required=True)
-    commands.add_parser("schema").add_argument("kind", choices=REPORT_FIELDS)
-    collector = commands.add_parser("collect")
-    collector.add_argument("kind", choices=REPORT_FIELDS)
-    collector.add_argument("output", type=Path)
-    commands.add_parser("notify").add_argument("directory", type=Path)
-    args = parser.parse_args()
-    if args.command == "schema":
-        print("schema=" + json.dumps(report_schema(args.kind), separators=(",", ":")))
-    elif args.command == "collect":
-        report = collect(os.environ.get("REVIEW_OUTCOME"), os.environ.get("REVIEW_RESULT", ""), args.kind)
-        args.output.write_text(json.dumps(report, ensure_ascii=False))
-    else:
-        event = json.loads(Path(os.environ["GITHUB_EVENT_PATH"]).read_text())
-        reports = {kind: read_report(args.directory, kind) for kind in ("code", "docs")}
-        run_url = f"{os.environ['GITHUB_SERVER_URL']}/{os.environ['GITHUB_REPOSITORY']}/actions/runs/{os.environ['GITHUB_RUN_ID']}"
-        card = build_card(event, reports, run_url)
-        summary = os.environ.get("GITHUB_STEP_SUMMARY")
-        if summary:
-            with open(summary, "a") as output:
-                output.write(card_markdown(card))
-        send_card(os.environ.get("FEISHU_WEBHOOK_URL"), os.environ.get("FEISHU_WEBHOOK_SECRET"), card)
-        print("代码与文档审查结果已合并发送至飞书群。")
-
-
-if __name__ == "__main__":
-    try:
-        main()
-    except ValueError as error:
-        raise SystemExit(str(error)) from None
diff --git a/scripts/ci_review_test.py b/scripts/ci_review_test.py
deleted file mode 100644
index c80fdfd99..000000000
--- a/scripts/ci_review_test.py
+++ /dev/null
@@ -1,132 +0,0 @@
-#!/usr/bin/env python3
-"""Exercise combined notification and incomplete-review behavior without sending messages."""
-
-import io
-import json
-from pathlib import Path
-import tempfile
-import unittest
-from unittest.mock import patch
-
-import ci_review as review
-
-
-class ReviewTests(unittest.TestCase):
-    event = {"pull_request": {"number": 485, "title": "Review docs", "html_url": "https://github.com/org/repo/pull/485", "user": {"login": "author"}}}
-    run_url = "https://github.com/org/repo/actions/runs/123"
-
-    def setUp(self):
-        self.ok = {"status": "ok", "changes": "- 更新安装流程", "review": "未发现问题", "ci": "全部通过 ✅"}
-        self.docs = {"status": "ok", "consistency": "与代码一致", "organization": "无矛盾或重复"}
-
-    def card(self, code=None, docs=None):
-        return review.build_card(self.event, {"code": code or self.ok, "docs": docs or self.docs}, self.run_url)
-
-    @patch("ci_review.urllib.request.urlopen")
-    def test_two_reports_make_one_delivery(self, post):
-        post.return_value = io.BytesIO(b'{"code":0}')
-        card = self.card(docs={**self.docs, "status": "issues", "consistency": "docs/install.md:12 与代码不符"})
-        review.send_card("https://example.invalid/webhook", "", card)
-        post.assert_called_once()
-        payload = json.loads(post.call_args.args[0].data)
-        self.assertEqual(payload["card"]["schema"], "2.0")
-        self.assertEqual(payload["card"]["header"]["template"], "red")
-        text = review.card_markdown(payload)
-        self.assertIn("3. 代码与仓库规则", text)
-        self.assertIn("文档审查 · 发现问题", text)
-        self.assertIn("docs/install.md:12", text)
-        self.assertIn(self.run_url, text)
-        self.assertNotIn("sign", payload)
-
-    def test_fixed_sections_preserve_markdown_and_separators(self):
-        card = self.card()
-        elements = card["card"]["body"]["elements"]
-        self.assertEqual(sum(element["tag"] == "hr" for element in elements), 4)
-        text = review.card_markdown(card)
-        for heading in ("1. 哪个 PR", "2. 改了什么", "3. 代码与仓库规则", "4. CI 结果", "5. 文档审查"):
-            self.assertIn(heading, text)
-        self.assertIn("- 更新安装流程", text)
-        self.assertIn("全部通过 ✅", text)
-        self.assertIn("文档与代码一致性", text)
-        self.assertIn("文档矛盾、重复与归属", text)
-        self.assertIn("---", text)
-        self.assertEqual(card["card"]["header"]["template"], "green")
-        self.assertIn("✅ 审查通过", card["card"]["header"]["title"]["content"])
-
-    def test_pending_ci_does_not_label_the_code_review_incomplete(self):
-        card = self.card(code={**self.ok, "status": "incomplete", "ci": "backend 仍在运行"})
-        text = review.card_markdown(card)
-        self.assertIn("**3. 代码与仓库规则**", text)
-        self.assertIn("未发现问题", text)
-        self.assertIn("backend 仍在运行", text)
-        self.assertEqual(card["card"]["header"]["template"], "yellow")
-
-    def test_each_kind_requires_its_own_sections(self):
-        for kind, report in (("code", self.ok), ("docs", self.docs)):
-            self.assertEqual(review.parse_report(json.dumps(report), kind), report)
-            self.assertEqual(set(review.report_schema(kind)["required"]), set(report))
-            for field in review.REPORT_FIELDS[kind]:
-                for value in (None, " ", "x" * (review.MAX_SECTION + 1)):
-                    invalid = {**report, field: value}
-                    self.assertEqual(review.parse_report(json.dumps(invalid), kind)["status"], "incomplete")
-                missing = {key: value for key, value in report.items() if key != field}
-                self.assertEqual(review.parse_report(json.dumps(missing), kind)["status"], "incomplete")
-
-    def test_failed_action_cannot_publish_a_success_report(self):
-        for outcome in ("failure", "cancelled", "skipped", None):
-            with self.subTest(outcome=outcome):
-                result = review.collect(outcome, json.dumps(self.ok), "code")
-                self.assertEqual(result["status"], "incomplete")
-                self.assertEqual(self.card(code=result)["card"]["header"]["template"], "yellow")
-
-    def test_invalid_or_missing_reports_are_incomplete(self):
-        for raw in ("", "not json", "null", "[]", '{"status":"ok"}', '{"status":[],"summary":"x"}', '{"status":"ok","summary":" "}', json.dumps({"status": "ok", "summary": "x" * 2001})):
-            with self.subTest(raw=raw[:50]):
-                self.assertEqual(review.collect("success", raw, "code")["status"], "incomplete")
-        root = Path.home() / ".oac/tests"
-        root.mkdir(parents=True, exist_ok=True)
-        with tempfile.TemporaryDirectory(dir=root) as directory:
-            path = Path(directory)
-            (path / "review-code.json").write_text(json.dumps(self.ok))
-            self.assertEqual(review.read_report(path, "code"), self.ok)
-            self.assertEqual(review.read_report(path, "docs")["status"], "incomplete")
-
-    @patch("ci_review.urllib.request.urlopen")
-    def test_http_success_requires_feishu_confirmation(self, post):
-        for body in (b'{"code":19021}', b'{}', b'{"code":false}', b'not json'):
-            with self.subTest(body=body):
-                post.reset_mock()
-                post.return_value = io.BytesIO(body)
-                with self.assertRaises(ValueError):
-                    review.send_card("https://example.invalid/webhook", "", self.card())
-                post.assert_called_once()
-
-    @patch("ci_review.urllib.request.urlopen", side_effect=TimeoutError("private-webhook"))
-    def test_ambiguous_delivery_is_not_retried_or_logged_with_secrets(self, post):
-        with self.assertRaisesRegex(ValueError, "delivery status is unknown") as error:
-            review.send_card("https://example.invalid/private-webhook", "private-signing-key", self.card())
-        self.assertNotIn("private", str(error.exception))
-        post.assert_called_once()
-
-    @patch("ci_review.time.time", return_value=1700000000)
-    @patch("ci_review.urllib.request.urlopen")
-    def test_optional_signing(self, post, _clock):
-        post.return_value = io.BytesIO(b'{"code":0}')
-        review.send_card("https://example.invalid/webhook", "test-secret", self.card())
-        payload = json.loads(post.call_args.args[0].data)
-        self.assertEqual(payload["timestamp"], "1700000000")
-        self.assertEqual(payload["sign"], "mbm4Y4oluIPQ00qlBIhX8vAZ0EKv3nw0LuTb91jPL84=")
-
-    @patch("ci_review.urllib.request.urlopen")
-    def test_bounded_unicode_reports_and_mentions(self, post):
-        post.return_value = io.BytesIO(b'{"code":0}')
-        reports = {kind: {"status": "issues", **dict.fromkeys(fields, "<at id=all>所有人</at>" + "问" * (review.MAX_SECTION - 20))}
-                   for kind, fields in review.REPORT_FIELDS.items()}
-        review.send_card("https://example.invalid/webhook", "", self.card(reports["code"], reports["docs"]))
-        data = post.call_args.args[0].data
-        self.assertLess(len(data), 20000)
-        self.assertNotIn(b"<at", data)
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/scripts/compose-smoke.py b/scripts/compose-smoke.py
index 163afafbc..671b08e54 100644
--- a/scripts/compose-smoke.py
+++ b/scripts/compose-smoke.py
@@ -3,8 +3,7 @@
 
 Core, Web and the ingress image are built from this checkout, with node
 metadata for this commit. Web serves a placeholder page instead of the console
-build. A second phase starts the published release pinned in
-deploy/compose/smoke-pins.json and upgrades it in place to this checkout.
+build.
 """
 
 import hashlib
@@ -24,7 +23,6 @@
 import uuid
 
 ROOT = Path(__file__).resolve().parents[1]
-RELEASES = 'https://github.com/MiniMax-AI/OpenAgentCore/releases/download/'
 
 
 def load(name, path):
@@ -49,7 +47,7 @@ def prepare_payload(destination, revision, source_time):
         shutil.copyfile(sources / 'node-install.pyz', destination / 'node-install.pyz')
     shutil.copyfile(ROOT / 'services/core/deploy/codex/seccomp.json', destination / 'runtime/seccomp.json')
     (destination / 'manifest.json').write_text(json.dumps(
-        {'source_commit': revision, 'source_time': int(source_time), 'platform': 'linux/amd64'}))
+        {'source_commit': revision, 'platform': 'linux/amd64'}))
     distribution.checksums(destination)
 
 
@@ -240,52 +238,6 @@ def terminate(_signum, _frame):
         assert compose('exec', '-T', 'web', '/usr/local/bin/oac-web', 'core-key').decode().strip() == rotated, 'Rotated key was not retained'
         private_logs(key, rotated, project_key)
         print('PASS: startup, origin validation, sign-in, API, upload, node installer, key rotation and persistent installation', flush=True)
-
-        pins = json.loads((ROOT / 'deploy/compose/smoke-pins.json').read_text())
-        print(f'Starting the published {pins["tag"]} release in a new installation and upgrading it to this checkout', flush=True)
-        compose('down', '--volumes')
-        published = directory / 'published-compose.yaml'
-        urllib.request.urlretrieve(RELEASES + pins['tag'] + '/compose.yaml', published)
-        if hashlib.sha256(published.read_bytes()).hexdigest() != pins['compose_sha256']:
-            raise ValueError('Pinned release compose.yaml checksum mismatch')
-        env.pop('OAC_PUBLIC_URL')
-        released = runner([published], {name: value for name, value in env.items() if not name.startswith('OAC_IMAGE_')})
-        released('up', '-d', '--wait', '--wait-timeout', '600', timeout=900)
-        address = 'http://' + released('port', 'web', '8080').decode().strip()
-        origin = 'http://localhost:8080'
-        browser = client()
-        key = released('exec', '-T', 'web', '/usr/local/bin/oac-web', 'core-key').decode().strip()
-        request('/console/auth/login', {'core_key': key})
-        facts = get('/core/v1/installation')
-        project_data = get('/core/v1/projects', body={'name': 'Upgrade smoke'}, status=201)
-        project_key = get('/core/v1/projects/' + project_data['id'] + '/keys', body={'name': 'smoke'}, status=201)['key']
-        api = {'Authorization': 'Bearer ' + project_key}
-        content = b'upgrade smoke\n'
-        uploaded = upload(api, content)
-
-        # The installer's preflight with the new release's images, then its start.
-        compose('run', '--rm', '--no-deps', '--entrypoint', '/usr/local/bin/oac-core', 'core', 'check-config')
-        compose('run', '--rm', '--no-deps', 'init')
-        compose('up', '-d', '--wait', '--wait-timeout', '180', '--pull', 'never', '--remove-orphans', timeout=240)
-        address = 'http://' + compose('port', 'web', '8080').decode().strip()
-        # The release's default origin ignored the Web port; this checkout's follows it.
-        origin = 'http://localhost:' + port
-        browser = client()
-        assert compose('exec', '-T', 'web', '/usr/local/bin/oac-web', 'core-key').decode().strip() == key, 'Upgrade changed the Core key'
-        request('/console/auth/login', {'core_key': key})
-        upgraded = get('/core/v1/installation')
-        assert upgraded['installation_id'] == facts['installation_id'], 'Upgrade changed the installation identity'
-        assert upgraded['public_url'] == origin, 'The upgraded default origin does not follow the Web port'
-        assert upgraded['source_commit'] == revision, 'Core does not run this checkout'
-        assert json.loads(request('/node-install/manifest.json'))['source_commit'] == revision, 'Web serves another release'
-        assert any(p['id'] == project_data['id'] for p in get('/core/v1/projects')['data']), 'Upgrade lost the Project'
-        assert get('/v1/files/' + uploaded['id'], headers=api)['bytes'] == len(content), 'Upgrade lost the Project key or file'
-        schema = compose('exec', '-T', 'database', 'psql', '-U', 'agents_api', '-d', 'agents_api', '-Atc',
-                         'SELECT max(version_id) FROM agents_api_schema_version').decode().strip()
-        latest = max(int(path.name.split('_', 1)[0]) for path in (ROOT / 'services/core/migrations').glob('*.sql'))
-        assert int(schema) == latest, 'Upgrade did not migrate the schema'
-        private_logs(key, project_key)
-        print(f'PASS: in-place upgrade from {pins["tag"]} keeps the installation, Core key, Project, Project key and file', flush=True)
     except BaseException:
         # Service status identifies failed containers without dumping secret-bearing logs.
         status = subprocess.run(['docker', 'compose', '-p', project, 'ps', '--all'], env=env, capture_output=True, timeout=30)
diff --git a/scripts/core-distribution-manifest.py b/scripts/core-distribution-manifest.py
index c8fcd05a4..fa9ad6de0 100644
--- a/scripts/core-distribution-manifest.py
+++ b/scripts/core-distribution-manifest.py
@@ -42,18 +42,25 @@
     "docs/getting-started/install-options.md",
     "docs/getting-started/nodes.md",
     "docs/getting-started/operations.md",
+    "docs/getting-started/public-address.md",
     "docs/getting-started/quickstart.md",
+    "docs/getting-started/sandbox-backends.md",
     "docs/getting-started/self-hosted.md",
+    "docs/getting-started/troubleshooting.md",
+    "docs/getting-started/workspace-storage.md",
     "contracts/agents-api/environment-executor-credentials.md",
 )
 # Files the bundled docs show, copied as they are, so they work offline.
 BUNDLED_FILES = (
-    "docs/assets/openagentcore-banner.jpeg",
+    "docs/assets/openagentcore-wordmark-light.svg",
+    "docs/assets/openagentcore-wordmark-dark.svg",
     "docs/assets/architecture.svg",
+    "docs/assets/architecture-dark.svg",
     "docs/assets/console-overview-en.webp",
     "docs/assets/console-overview-zh.webp",
     "docs/assets/console-agent-metrics-en.webp",
     "docs/assets/console-agent-metrics-zh.webp",
+    "docs/assets/console-connect-host-en.webp",
 )
 REPOSITORY_URL = "https://github.com/MiniMax-AI/OpenAgentCore"
 MARKDOWN_LINK = re.compile(r"(!?)\[((?:[^\[\]]|\[[^\]]*\])*)\]\(([^)\s]+)((?:\s+\"[^\"]*\")?)\)")
@@ -191,7 +198,7 @@ def verify_runtime(image, daemon, source):
     files = {"/usr/local/bin/oac-daemon": pathlib.Path(daemon)}
     environment = dict(value.split("=", 1) for value in details["Config"]["Env"] if "=" in value)
     if "OAC_RUNTIME_MCODE_BIN" in environment:
-        for name in ("launch.mjs", "bridge.mjs", "check.mjs", "tool-executor.mjs", "subagent-snapshot.mjs", "source.json"):
+        for name in ("check.mjs", "subagent-snapshot.mjs", "source.json"):
             files["/opt/mcode-harness/" + name] = source / "packages/mcode-harness" / name
     output = subprocess.check_output(
         ["docker", "run", "--rm", "--network", "none", "--entrypoint", "sha256sum", image, *files], text=True
@@ -231,6 +238,10 @@ def release_base(value):
     return value.rstrip("/")
 
 
+# A platform base archive or one named part of it.
+NATIVE_ARTIFACT = re.compile(r"(linux|darwin|windows)-(amd64|arm64)(-[a-z]+)?")
+
+
 def native_catalog(bundle, stage, revision, source, artifact_base_url=""):
     """Ship only catalog metadata in Core; publish native archives independently."""
     bundle, stage, source = pathlib.Path(bundle), pathlib.Path(stage), pathlib.Path(source)
@@ -242,30 +253,32 @@ def native_catalog(bundle, stage, revision, source, artifact_base_url=""):
         raise ValueError("Native catalog has no qualified artifacts")
     assets = stage / "native-artifacts"
     assets.mkdir()
-    for platform, entry in catalog["artifacts"].items():
-        if not re.fullmatch(r"(linux|darwin|windows)-(amd64|arm64)", platform):
-            raise ValueError("Invalid native installer platform")
-        archive = source / (platform + ".tar.gz")
+    for name, entry in catalog["artifacts"].items():
+        if not NATIVE_ARTIFACT.fullmatch(name):
+            raise ValueError("Invalid native installer artifact")
+        archive = source / (name + ".tar.gz")
         if archive.is_symlink() or sha256(archive) != entry["sha256"]:
             raise ValueError("Native installer checksum mismatch")
-        filename = f"oac-native-{revision}-{platform}.tar.gz"
+        filename = f"oac-native-{revision}-{name}.tar.gz"
         shutil.copyfile(archive, assets / filename)
         (assets / (filename + ".sha256")).write_text(entry["sha256"] + "  " + filename + "\n")
-        catalog["artifacts"][platform] = {"sha256": entry["sha256"], **({"url": base + "/" + filename} if base else {})}
+        catalog["artifacts"][name] = {"sha256": entry["sha256"], **({"url": base + "/" + filename} if base else {})}
     for directory in (stage / "core/native-installers", bundle / "native-installers"):
         directory.mkdir(parents=True, exist_ok=True)
         (directory / "catalog.json").write_text(json.dumps(catalog, indent=2) + "\n")
 
 
 def native_offline(bundle, stage):
+    """Carry the offline host's own platform; Core redirects the others to their release URL."""
     bundle, stage = pathlib.Path(bundle), pathlib.Path(stage)
     path = bundle / "native-installers/catalog.json"
     if not path.exists():
         return
     catalog = json.loads(path.read_text())
-    for platform in catalog["artifacts"]:
-        source = stage / "native-artifacts" / f"oac-native-{catalog['version']}-{platform}.tar.gz"
-        os.link(source, path.parent / (platform + ".tar.gz"))
+    for name, entry in catalog["artifacts"].items():
+        if name.startswith("linux-amd64") or "url" not in entry:
+            source = stage / "native-artifacts" / f"oac-native-{catalog['version']}-{name}.tar.gz"
+            os.link(source, path.parent / (name + ".tar.gz"))
 
 
 @contextmanager
@@ -320,7 +333,7 @@ def bootstraps(bundle, epoch, revision):
         zipapp.create_archive(directory, bundle / "node-install.pyz", compressed=True)
 
 
-def node_payload(bundle, stage, revision, source_tree, source_time, artifact_base_url="", offline="0"):
+def node_payload(bundle, stage, revision, source_tree, artifact_base_url="", offline="0"):
     bundle, stage = pathlib.Path(bundle), pathlib.Path(stage)
     artifact_base_url = release_base(artifact_base_url)
     if not artifact_base_url and offline != "1":
@@ -339,8 +352,6 @@ def node_payload(bundle, stage, revision, source_tree, source_time, artifact_bas
     metadata = {
         "source_commit": revision,
         "source_tree": source_tree,
-        # The commit time orders releases: initialization refuses an older one.
-        "source_time": int(source_time),
         "platform": "linux/amd64",
         "artifact_base_url": artifact_base_url,
         "artifacts": package_artifacts(bundle, stage, revision),
diff --git a/scripts/core-distribution-manifest.test.py b/scripts/core-distribution-manifest.test.py
index 5d3730f8f..c2f3cf679 100644
--- a/scripts/core-distribution-manifest.test.py
+++ b/scripts/core-distribution-manifest.test.py
@@ -21,7 +21,6 @@
 
 REVISION = "a" * 40
 TREE = "b" * 40
-SOURCE_TIME = "1760000000"
 RELEASE_BASE = "https://example.com/releases/" + REVISION
 
 
@@ -52,11 +51,11 @@ def descriptor(data, media_type, label):
 
 
 class DistributionTests(unittest.TestCase):
-    def test_native_payload_is_independent_and_offline_has_one_copy(self):
+    def test_native_payload_is_independent_and_offline_has_only_linux_archives(self):
         source = self.stage / "qualified-native"
         source.mkdir()
         catalog = {"version": REVISION, "protocol_version": "fixture", "artifacts": {}}
-        for platform in ("linux-amd64", "darwin-arm64", "windows-amd64"):
+        for platform in ("linux-amd64", "linux-amd64-codex", "darwin-arm64", "darwin-arm64-codex", "windows-amd64"):
             raw = ("native:" + platform).encode()
             (source / (platform + ".tar.gz")).write_bytes(raw)
             catalog["artifacts"][platform] = {"sha256": hashlib.sha256(raw).hexdigest()}
@@ -75,16 +74,28 @@ def test_native_payload_is_independent_and_offline_has_one_copy(self):
         distribution.archive(self.bundle, "1", "offline")
         with tarfile.open(self.bundle.with_name(self.bundle.name + "-offline.tar.gz")) as archive:
             native = [p for p in archive.getmembers() if "native-installers/" in p.name and p.name.endswith(".tar.gz")]
-            self.assertEqual(len(native), 3)
+            self.assertEqual(sorted(pathlib.Path(p.name).name for p in native), ["linux-amd64-codex.tar.gz", "linux-amd64.tar.gz"])
             for member in native:
-                platform = pathlib.Path(member.name).name.removesuffix(".tar.gz")
-                self.assertEqual(archive.extractfile(member).read(), (source / (platform + ".tar.gz")).read_bytes())
+                self.assertEqual(archive.extractfile(member).read(), (source / pathlib.Path(member.name).name).read_bytes())
         metadata = json.loads((self.bundle / "native-installers/catalog.json").read_text())
         for platform, entry in metadata["artifacts"].items():
             filename = f"oac-native-{REVISION}-{platform}.tar.gz"
             self.assertEqual(entry["url"], RELEASE_BASE + "/" + filename)
             self.assertEqual(distribution.sha256(self.stage / "native-artifacts" / filename), entry["sha256"])
 
+    def test_offline_without_release_urls_keeps_every_native_installer(self):
+        source = self.stage / "qualified-native"
+        source.mkdir()
+        catalog = {"version": REVISION, "protocol_version": "fixture", "artifacts": {}}
+        for platform in ("linux-amd64", "darwin-arm64", "windows-amd64"):
+            (source / (platform + ".tar.gz")).write_bytes(platform.encode())
+            catalog["artifacts"][platform] = {"sha256": hashlib.sha256(platform.encode()).hexdigest()}
+        (source / "catalog.json").write_text(json.dumps(catalog))
+        distribution.native_catalog(self.bundle, self.stage, REVISION, source)
+        distribution.native_offline(self.bundle, self.stage)
+        self.assertEqual(sorted(p.name for p in (self.bundle / "native-installers").iterdir()),
+                         ["catalog.json", "darwin-arm64.tar.gz", "linux-amd64.tar.gz", "windows-amd64.tar.gz"])
+
     def setUp(self):
         self.temporary = tempfile.TemporaryDirectory()
         self.addCleanup(self.temporary.cleanup)
@@ -113,7 +124,7 @@ def setUp(self):
         self.runtime_bytes = (self.bundle / "images/runtime.tar").read_bytes()
 
     def manifest(self, base=RELEASE_BASE, offline="0"):
-        distribution.node_payload(self.bundle, self.stage, REVISION, TREE, SOURCE_TIME, base, offline)
+        distribution.node_payload(self.bundle, self.stage, REVISION, TREE, base, offline)
         distribution.manifest(self.bundle, self.stage)
 
     def write_inspection(self):
@@ -129,9 +140,8 @@ def test_init_payload_contains_only_verified_node_metadata(self):
             self.assertEqual(distribution.sha256(payload / name), checksum)
         bundled = json.loads((payload / "manifest.json").read_text())
         full = json.loads((self.bundle / "manifest.json").read_text())
-        for name in ("source_commit", "source_time", "platform", "artifacts", "runtime_ref", "microsandbox"):
+        for name in ("source_commit", "platform", "artifacts", "runtime_ref", "microsandbox"):
             self.assertEqual(bundled[name], full[name])
-        self.assertEqual(bundled["source_time"], 1760000000)
         self.assertEqual(list(bundled["images"]), ["runtime"])
 
     def test_oci_manifest_identity_is_distinct_from_docker_config_identity(self):
diff --git a/scripts/generate-architecture-diagram.py b/scripts/generate-architecture-diagram.py
index 586191f9a..682b9bcd3 100644
--- a/scripts/generate-architecture-diagram.py
+++ b/scripts/generate-architecture-diagram.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Draw the README architecture diagram, docs/assets/architecture.svg.
+"""Draw the architecture diagram, docs/assets/architecture.svg and architecture-dark.svg.
 
 Edit the layout below and run this script; never edit the SVG by hand. The SVG
 embeds IBM Plex Sans from Web's @fontsource dependency, so GitHub and the
@@ -14,7 +14,7 @@
 import zlib
 
 ROOT = Path(__file__).resolve().parent.parent
-OUTPUT = ROOT / "docs/assets/architecture.svg"
+ASSETS = ROOT / "docs/assets"
 FONTS = ROOT / "apps/web/node_modules/@fontsource/ibm-plex-sans/files"
 WIDTH, HEIGHT = 1560, 1270
 
@@ -31,27 +31,63 @@
 RADIUS = {"canvas": 18, "region": 10, "card": 7, "pill": 11}
 
 # Colors follow the README banner: sand control plane, sea-mist compute,
-# sunlit E2B, olive user machine and stone storage.
-CSS = """
-.canvas{fill:#f9f5ee}
-.region{stroke-width:1.2}
-.control{fill:#f3eadb;stroke:#d5be97}.control+g .band{fill:#ece0ca}
-.compute{fill:#e9eff0;stroke:#a6bdc3}.compute+g .band{fill:#dce7e9}
-.sandbox{fill:#f7fafa;stroke:#6f929d}.sandbox+g .band{fill:#e8f0f1}
-.managed{fill:#fbf1de;stroke:#d6a457;stroke-dasharray:6 5}.managed+g .band{fill:#f6e5c4}
-.user{fill:#eef0e4;stroke:#b0b68b}.user+g .band{fill:#e3e7d3}
-.storage{fill:#f1ebe2;stroke:#bfaa8e}.storage+g .band{fill:#e8dfd1}
-.external{fill:#f4f2ee;stroke:#cbc3b7}.external+g .band{fill:#ebe7e0}
-.sep{stroke:rgba(60,48,30,.14);stroke-width:1}
-.card{fill:#fffdf9;stroke:#dcd2c3;stroke-width:1}
-.rt,.t1{fill:#1f1c17}.rs,.t2,.lg{fill:#675e51}
-.pill rect{fill:#24211c}.pl{fill:#f7f1e6}
-.line{fill:none;stroke:#5b5346;stroke-width:1.4}.dash{stroke-dasharray:6 5}
-.arrow,.dot{fill:#5b5346}
-text{text-rendering:geometricPrecision;font-kerning:normal}
+# sunlit E2B, olive user machine and stone storage. The dark variant uses the
+# website's dark palette. Both paint the same shapes.
+def palette(c):
+    return f"""
+.canvas{{fill:{c['canvas']}}}
+.region{{stroke-width:1.2}}
+.control{{fill:{c['control'][0]};stroke:{c['control'][1]}}}.control+g .band{{fill:{c['control'][2]}}}
+.compute{{fill:{c['compute'][0]};stroke:{c['compute'][1]}}}.compute+g .band{{fill:{c['compute'][2]}}}
+.sandbox{{fill:{c['sandbox'][0]};stroke:{c['sandbox'][1]}}}.sandbox+g .band{{fill:{c['sandbox'][2]}}}
+.managed{{fill:{c['managed'][0]};stroke:{c['managed'][1]};stroke-dasharray:6 5}}.managed+g .band{{fill:{c['managed'][2]}}}
+.user{{fill:{c['user'][0]};stroke:{c['user'][1]}}}.user+g .band{{fill:{c['user'][2]}}}
+.storage{{fill:{c['storage'][0]};stroke:{c['storage'][1]}}}.storage+g .band{{fill:{c['storage'][2]}}}
+.external{{fill:{c['external'][0]};stroke:{c['external'][1]}}}.external+g .band{{fill:{c['external'][2]}}}
+.sep{{stroke:{c['sep']};stroke-width:1}}
+.card{{fill:{c['card'][0]};stroke:{c['card'][1]};stroke-width:1}}
+.rt,.t1{{fill:{c['ink']}}}.rs,.t2,.lg{{fill:{c['ink2']}}}
+.pill rect{{fill:{c['pill'][0]}}}.pl{{fill:{c['pill'][1]}}}
+.line{{fill:none;stroke:{c['line']};stroke-width:1.4}}.dash{{stroke-dasharray:6 5}}
+.arrow,.dot{{fill:{c['line']}}}
+text{{text-rendering:geometricPrecision;font-kerning:normal}}
 """
 
 
+PALETTES = {
+    "architecture.svg": palette({
+        "canvas": "#f9f5ee",
+        "control": ("#f3eadb", "#d5be97", "#ece0ca"),
+        "compute": ("#e9eff0", "#a6bdc3", "#dce7e9"),
+        "sandbox": ("#f7fafa", "#6f929d", "#e8f0f1"),
+        "managed": ("#fbf1de", "#d6a457", "#f6e5c4"),
+        "user": ("#eef0e4", "#b0b68b", "#e3e7d3"),
+        "storage": ("#f1ebe2", "#bfaa8e", "#e8dfd1"),
+        "external": ("#f4f2ee", "#cbc3b7", "#ebe7e0"),
+        "sep": "rgba(60,48,30,.14)",
+        "card": ("#fffdf9", "#dcd2c3"),
+        "ink": "#1f1c17", "ink2": "#675e51",
+        "pill": ("#24211c", "#f7f1e6"),
+        "line": "#5b5346",
+    }),
+    "architecture-dark.svg": palette({
+        "canvas": "#111712",
+        "control": ("#17201a", "#3f5f4a", "#1c2920"),
+        "compute": ("#131d1c", "#386058", "#182725"),
+        "sandbox": ("#162521", "#4f8574", "#1b302a"),
+        "managed": ("#1f1d13", "#b0924c", "#2a271a"),
+        "user": ("#181f14", "#6c7f4c", "#1f2919"),
+        "storage": ("#1c1c17", "#6e6852", "#25241d"),
+        "external": ("#161a19", "#4c5651", "#1d2321"),
+        "sep": "rgba(232,241,235,.08)",
+        "card": ("#1c2520", "#33433a"),
+        "ink": "#e8f1eb", "ink2": "#94a59b",
+        "pill": ("#4ade80", "#04210f"),
+        "line": "#8fa598",
+    }),
+}
+
+
 def woff_advances(data):
     """Return units per em and a code point to advance width map of a WOFF 1.0 font."""
     tables = {}
@@ -148,10 +184,10 @@ def pill(self, cx, cy, label, rotate=False):
         if rotate:
             self.parts.append("</g>")
 
-    def svg(self):
+    def svg(self, palette):
         if self.overflows:
             raise ValueError(f"text overflows its box: {self.overflows!r}")
-        css = [CSS.strip()]
+        css = [palette.strip()]
         for weight, (data, _, _) in sorted(self.fonts.items()):
             css.append(f'@font-face{{font-family:"OAC Plex";font-weight:{weight};'
                        f'src:url(data:font/woff;base64,{base64.b64encode(data).decode()}) format("woff")}}')
@@ -173,9 +209,9 @@ def svg(self):
 def draw(d):
     # Callers and their Core APIs.
     for x, title, text, api in [
-        (80, "Applications / official SDK", "Submit work · stream results", "P1 · Agents API /v1"),
-        (560, "Web console / operators", "Configure the platform · view status", "P2 · Core API /core/v1"),
-        (1040, "Nodes / Runtime connections", "Machine identity · register and connect", "P3 · Machine API /api/v1"),
+        (80, "Applications / official SDK", "Submit work · stream results", "Agents API /v1"),
+        (560, "Web console / operators", "Configure the platform · view status", "Core API /core/v1"),
+        (1040, "Nodes / Runtime connections", "Machine identity · register and connect", "Machine API /api/v1"),
     ]:
         d.card(x, 28, 440, 66, title, text)
         d.line(f"M{x + 220},94 V194")
@@ -192,12 +228,12 @@ def draw(d):
     # Every execution location connects through the same protocols.
     for cx in (400, 950, 1330):
         d.line(f"M{cx},454 V618")
-    d.pill(400, 489, "P4 · Sandbox Provider · compute lifecycle")
-    d.pill(400, 528, "P5 · Node · host management")
-    d.pill(400, 567, "P7 · Runtime · work and events")
-    d.pill(950, 508, "P4 · Sandbox Provider")
-    d.pill(950, 557, "P7 · Runtime")
-    d.pill(1330, 534, "P7 · Runtime")
+    d.pill(400, 489, "Sandbox Provider · compute lifecycle")
+    d.pill(400, 528, "Node · host management")
+    d.pill(400, 567, "Runtime · work and events")
+    d.pill(950, 508, "Sandbox Provider")
+    d.pill(950, 557, "Runtime")
+    d.pill(1330, 534, "Runtime")
 
     d.region(80, 618, 640, 302, "compute", "Compute servers × N · microsandbox")
     d.card(104, 672, 592, 52, "sandbox node · host manager", "Manages compute from outside the sandboxes")
@@ -208,7 +244,6 @@ def draw(d):
     d.region(800, 672, 300, 224, "sandbox", "E2B Sandbox")
     d.card(820, 734, 260, 62, "Runtime + Harness", "Agent and tools in the sandbox")
     d.text(950, 841, "Provider-owned filesystem", "t2", "middle")
-    d.text(950, 868, "No independent FS yet", "t2", "middle")
 
     d.region(1180, 618, 300, 302, "user", "Your machine · self_hosted")
     d.card(1200, 734, 260, 62, "Runtime + Harness", "You install and maintain it")
@@ -221,7 +256,7 @@ def draw(d):
     d.line("M550,920 V1010 H1330 V920", arrows=False)
     d.line("M950,920 V1060")
     d.parts.append('<circle cx="950" cy="1010" r="3.5" class="dot"/>')
-    d.pill(1040, 1010, "P13 · Model protocol")
+    d.pill(1040, 1010, "Model protocol")
     d.text(1190, 998, "HTTP MCP", "t2")
 
     d.region(80, 1060, 640, 156, "storage", "Independent storage server", "Deployed apart from compute servers")
@@ -232,7 +267,7 @@ def draw(d):
     d.card(1140, 1114, 316, 76, "Remote MCP servers", "HTTP MCP")
 
     d.line("M80,410 H40 V1148 H80", dashed=True)
-    d.pill(40, 785, "P14 · Workspace filesystem · storage lifecycle and binding", rotate=True)
+    d.pill(40, 785, "Workspace filesystem · storage lifecycle and binding", rotate=True)
     x = 80
     for item in ["Solid: communication or mount", "Dashed: independent storage management",
                  "Outer frame: deployment location", "Inner frame: sandbox isolation boundary"]:
@@ -242,7 +277,8 @@ def draw(d):
 def main():
     diagram = Diagram()
     draw(diagram)
-    OUTPUT.write_text(diagram.svg())
+    for name, palette in PALETTES.items():
+        (ASSETS / name).write_text(diagram.svg(palette))
 
 
 if __name__ == "__main__":
diff --git a/scripts/generate-harness-catalog.py b/scripts/generate-harness-catalog.py
index 86e86e4d8..b159e0c89 100644
--- a/scripts/generate-harness-catalog.py
+++ b/scripts/generate-harness-catalog.py
@@ -9,31 +9,31 @@
 from pprint import pformat
 
 ROOT = Path(__file__).resolve().parent.parent
-CATALOG = Path("internal/harnessconfig/builtin/catalog.json")
+DECLARATIONS = Path("internal/harnessconfig")
 MODULE = "github.com/MiniMax-AI/OpenAgentCore"
 HEADER = "// Code generated by scripts/generate-harness-catalog.py; DO NOT EDIT.\n"
+SOURCE = "https://github.com/MiniMax-AI/OpenAgentCore/blob/main/"
 
 
-def load_catalog(path):
-    entries = json.loads(path.read_text())
-    if not isinstance(entries, list) or not entries:
-        raise ValueError("Harness catalog must be a nonempty list")
-    kinds = set()
-    for entry in entries:
-        if not isinstance(entry, dict) or set(entry) != {"kind", "label", "configuration", "profile"}:
-            raise ValueError("Invalid Harness catalog fields")
-        if any(not isinstance(value, str) for value in entry.values()):
-            raise ValueError("Harness catalog values must be strings")
-        if not re.fullmatch(r"[a-z][a-z0-9_]*", entry["kind"]) or entry["kind"] in kinds:
-            raise ValueError("Invalid or duplicate Harness kind")
-        if not re.fullmatch(r"[a-z][a-z0-9]*", entry["configuration"]):
-            raise ValueError("Invalid configuration package")
-        if not re.fullmatch(r"[a-z][A-Za-z0-9]*", entry["profile"]):
-            raise ValueError("Invalid profile constructor")
-        if not entry["label"].strip() or any(c in entry["label"] for c in "\n\r\t|"):
-            raise ValueError("Invalid Harness label")
-        kinds.add(entry["kind"])
-    return sorted(entries, key=lambda entry: entry["kind"])
+def packages(root=ROOT):
+    """The Harness packages: every directory under internal/harnessconfig with a declaration.go."""
+    result = sorted(path.parent.name for path in (root / DECLARATIONS).glob("*/declaration.go"))
+    if not result:
+        raise ValueError("No Harness declarations found")
+    for name in result:
+        if not re.fullmatch(r"[a-z][a-z0-9]*", name):
+            raise ValueError("Invalid Harness package name: " + name)
+        if not re.search(r"^var Declaration = harnessconfig\.Declaration\{", (root / DECLARATIONS / name / "declaration.go").read_text(), re.M):
+            raise ValueError(name + "/declaration.go must declare `var Declaration = harnessconfig.Declaration{`")
+        if not (root / "apps/daemon/internal/agent" / name).is_dir():
+            raise ValueError("Missing Runtime adapter package apps/daemon/internal/agent/" + name)
+    return result
+
+
+def load_declared():
+    """Dump the built Go declarations; the Go values are the only authored source."""
+    return json.loads(subprocess.run(["go", "run", "./scripts/harness-catalog"], cwd=ROOT,
+                                     text=True, check=True, capture_output=True).stdout)
 
 
 def go(source):
@@ -41,16 +41,16 @@ def go(source):
                           check=True, capture_output=True).stdout
 
 
-def render_installer(providers):
+def render_installer(protocols):
     return ("# Code generated by scripts/generate-harness-catalog.py; DO NOT EDIT.\n"
-            "# Provider support comes from the adapter-owned Go configuration declarations.\n"
-            "PROVIDERS = " + pformat(providers, sort_dicts=True, width=100) + "\n")
+            "# Protocol support comes from the Go Harness declarations.\n"
+            "PROVIDERS = " + pformat(protocols, sort_dicts=True, width=100) + "\n")
 
 
-def render_client(entries, protocols):
-    kinds = ", ".join(json.dumps(entry["kind"]) for entry in entries)
-    labels = "\n".join(f'  {json.dumps(entry["kind"])}: {json.dumps(entry["label"])},' for entry in entries)
-    return HEADER + f'''
+def render_client(harnesses, protocols):
+    kinds = ", ".join(json.dumps(entry["kind"]) for entry in harnesses)
+    labels = "\n".join(f'  {json.dumps(entry["kind"])}: {json.dumps(entry["label"])},' for entry in harnesses)
+    return HEADER + f"""
 export const coreHarnessKinds = [{kinds}] as const;
 export type CoreHarnessKind = (typeof coreHarnessKinds)[number];
 export const coreHarnessNames: Record<CoreHarnessKind, string> = {{
@@ -58,79 +58,74 @@ def render_client(entries, protocols):
 }};
 export const modelProviderProtocols = [{", ".join(json.dumps(protocol) for protocol in protocols)}] as const;
 export type ModelProviderProtocol = (typeof modelProviderProtocols)[number];
-'''
-
-
-def render(entries):
-    packages = sorted({entry["configuration"] for entry in entries})
-    imports = "\n".join(f'\t"{MODULE}/internal/harnessconfig/{package}"' for package in packages)
-    configurations = "\n".join(
-        f'\t{json.dumps(entry["kind"])}: {entry["configuration"]}.Configuration(),'
-        for entry in entries)
-    kinds = ", ".join(json.dumps(entry["kind"]) for entry in entries)
-    profiles = "\n".join(
-        f'\t{json.dumps(entry["kind"])}: {entry["profile"]}(),' for entry in entries)
-    tick = chr(96)
-    rows = "\n".join(
-        f'| {tick}{e["kind"]}{tick} | {e["label"]} | {tick}{e["configuration"]}.Configuration{tick} | {tick}{e["profile"]}{tick} |'
-        for e in entries)
+"""
+
+
+def render_registrations(names):
+    """Go projections that need only the package names."""
+    imports = "\n".join(f'\t"{MODULE}/internal/harnessconfig/{name}"' for name in names)
+    declarations = ", ".join(f"{name}.Declaration" for name in names)
+    adapters = "\n".join(f'\t"{MODULE}/apps/daemon/internal/agent/{name}"' for name in names)
+    bindings = ", ".join(f"{name}.Declaration" for name in names)
     return {
-        Path("internal/harnessconfig/builtin/registry.go"): go(f'''package builtin
+        Path("internal/harnessconfig/builtin/registry.go"): go(f"""package builtin
 
 import (
     "{MODULE}/internal/harnessconfig"
 {imports}
 )
 
-var registry = harnessconfig.NewRegistry(map[string]harnessconfig.Configuration{{
-{configurations}
-}})
-
-func Registry() harnessconfig.Registry {{ return registry }}
-
-// Configuration binds a registered public Harness to its authored declaration.
-func Configuration(kind string) harnessconfig.Configuration {{
-    configuration, ok := registry.Lookup(kind)
-    if !ok {{ panic("unregistered public Harness configuration") }}
-    return configuration
-}}
-
-// Kinds returns the public identifiers in this build, not Runtime availability.
-func Kinds() []string {{ return []string{{{kinds}}} }}
-
-func Contains(kind string) bool {{
-    _, ok := registry.Lookup(kind)
-    return ok
-}}
-'''),
-        Path("services/core/internal/engine/catalog_generated.go"): go(f'''package engine
-
-var qualified = NewCatalog(map[string]Profile{{
-{profiles}
-}})
-'''),
-        Path("contracts/agents-api/harness-catalog.md"): f'''[//]: # (Generated by scripts/generate-harness-catalog.py; DO NOT EDIT.)
+var registry = harnessconfig.NewRegistry({declarations})
+"""),
+        Path("apps/daemon/internal/cli/harness_declarations.go"): go(f"""package cli
+
+import (
+    "{MODULE}/apps/daemon/internal/agent"
+{adapters}
+)
+
+// harnessDeclarations binds every built-in Harness declaration to its Runtime adapter.
+var harnessDeclarations = []agent.Declaration{{{bindings}}}
+"""),
+    }
+
+
+def render_docs(harnesses):
+    tick = chr(96)
+    rows = "\n".join(
+        f'| {tick}{h["kind"]}{tick} | {h["label"]} | [{tick}{h["package"]}/declaration.go{tick}]({SOURCE}internal/harnessconfig/{h["package"]}/declaration.go) |'
+        for h in harnesses)
+    return {
+        Path("contracts/agents-api/harness-catalog.md"): f"""---
+title: "Built-in Harness registrations"
+---
+
+[//]: # (Generated by scripts/generate-harness-catalog.py; DO NOT EDIT.)
 # Built-in Harness registrations
 
-The authored registration list is [{tick}catalog.json{tick}](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/builtin/catalog.json). Change it and run {tick}make generate-harness-catalog{tick}; {tick}make check-harness-catalog{tick} checks the generated projections.
+Each Harness is the one {tick}declaration.go{tick} in its {tick}internal/harnessconfig/<package>{tick} directory. Adding a directory with a {tick}declaration.go{tick} registers the Harness; {tick}make generate-harness-catalog{tick} regenerates the registrations and this page, and {tick}make check-harness-catalog{tick} checks them.
 
-| Identifier | Display name | Model configuration declaration | Core qualification constructor |
-| --- | --- | --- | --- |
+| Identifier | Display name | Declaration |
+| --- | --- | --- |
 {rows}
 
-Configuration declarations live in {tick}internal/harnessconfig/<package>{tick} and qualification constructors in {tick}services/core/internal/engine{tick}. These registrations describe the build. Which Harnesses a deployment enables is the {tick}OAC_HARNESSES{tick} [process setting](../../docs/configuration.md#settings), [Harness capabilities](./harness-capabilities.md) lists what each Harness supports, and a connected Runtime reports its own availability. [Harness onboarding](./harness-onboarding.md) describes the adapter and packaging steps.
-''',
-        Path("contracts/agents-api/zh/harness-catalog.md"): f'''[//]: # (Generated by scripts/generate-harness-catalog.py; DO NOT EDIT.)
+These registrations describe the build. Which Harnesses a deployment enables is the {tick}OAC_HARNESSES{tick} [process setting](../../docs/configuration.md#settings), [Harness capabilities](./harness-capabilities.md) lists what each Harness supports, and a connected Runtime reports its own availability. [Harness protocol](./harness-onboarding.md) describes the adapter and packaging steps.
+""",
+        Path("contracts/agents-api/zh/harness-catalog.md"): f"""---
+title: "内置 Harness 注册"
+---
+
+[//]: # (Generated by scripts/generate-harness-catalog.py; DO NOT EDIT.)
 # 内置 Harness 注册 {{#built-in-harness-registrations}}
 
-注册列表的源文件是 [{tick}catalog.json{tick}](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/builtin/catalog.json)。修改后运行 {tick}make generate-harness-catalog{tick}；{tick}make check-harness-catalog{tick} 检查生成结果。
+每个 Harness 对应 {tick}internal/harnessconfig/<package>{tick} 目录中唯一的 {tick}declaration.go{tick}。新增包含 {tick}declaration.go{tick} 的目录即注册该 Harness；{tick}make generate-harness-catalog{tick} 重新生成注册代码和本页，{tick}make check-harness-catalog{tick} 检查生成结果。
 
-| 标识符 | 显示名称 | 模型配置声明 | Core 验收构造函数 |
-| --- | --- | --- | --- |
+| 标识符 | 显示名称 | 声明 |
+| --- | --- | --- |
 {rows}
 
-配置声明位于 {tick}internal/harnessconfig/<package>{tick}，验收构造函数位于 {tick}services/core/internal/engine{tick}。这些注册描述当前构建。部署启用的 Harness 由 {tick}OAC_HARNESSES{tick} [进程设置](../../../docs/zh/configuration.md#settings)决定；[Harness 能力](./harness-capabilities.md)列出各 Harness 的支持范围，连接的 Runtime 报告自身可用性。[Harness 接入](./harness-onboarding.md)介绍适配器和打包步骤。
-''',
+这些注册描述当前构建。部署启用的 Harness 由 {tick}OAC_HARNESSES{tick} [进程设置](../../../docs/zh/configuration.md#settings)决定；[Harness 能力](./harness-capabilities.md)列出各 Harness 的支持范围，连接的 Runtime 报告自身可用性。[Harness protocol](./harness-onboarding.md)介绍适配器和打包步骤。
+""",
     }
 
 
@@ -138,7 +133,7 @@ def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--check", action="store_true")
     args = parser.parse_args()
-    entries = load_catalog(ROOT / CATALOG)
+    names = packages()
     stale = []
 
     def projection(relative, content):
@@ -149,16 +144,24 @@ def projection(relative, content):
         else:
             path.write_text(content)
 
-    for relative, content in render(entries).items():
+    for relative, content in render_registrations(names).items():
         projection(relative, content)
-    # Refresh the Go registration before loading the adapter declarations. In check
-    # mode a stale registration must fail before its declarations can be projected.
+    # The Go dump builds against the registration, so a stale registration must
+    # fail (or be refreshed) before the declarations can be projected.
     if stale:
         raise SystemExit("Stale Harness catalog projections; run make generate-harness-catalog:\n" + "\n".join(stale))
-    declared = json.loads(subprocess.run(["go", "run", "./scripts/harness-catalog"], cwd=ROOT,
-                                        text=True, check=True, capture_output=True).stdout)
-    projection(Path("scripts/acceptance/harness_catalog.py"), render_installer(declared["harnesses"]))
-    projection(Path("packages/agents-client/src/harness-catalog.ts"), render_client(entries, declared["protocols"]))
+    declared = load_declared()
+    harnesses = declared["harnesses"]
+    for harness in harnesses:
+        harness["package"] = harness["kind"].replace("_", "")
+        if harness["package"] not in names:
+            raise SystemExit("Harness " + harness["kind"] + " must live in internal/harnessconfig/" + harness["package"])
+    if len(harnesses) != len(names):
+        raise SystemExit("Registered Harnesses differ from the declaration packages")
+    for relative, content in render_docs(harnesses).items():
+        projection(relative, content)
+    projection(Path("scripts/acceptance/harness_catalog.py"), render_installer({h["kind"]: h["protocols"] for h in harnesses}))
+    projection(Path("packages/agents-client/src/harness-catalog.ts"), render_client(harnesses, declared["protocols"]))
     if stale:
         raise SystemExit("Stale Harness catalog projections; run make generate-harness-catalog:\n" + "\n".join(stale))
 
diff --git a/scripts/generate-harness-catalog.test.py b/scripts/generate-harness-catalog.test.py
index 70b9b7ce7..b54776f97 100644
--- a/scripts/generate-harness-catalog.test.py
+++ b/scripts/generate-harness-catalog.test.py
@@ -2,7 +2,6 @@
 """Verify catalog extension and generated contract freshness without live models."""
 
 import importlib.util
-import copy
 import json
 from pathlib import Path
 import tempfile
@@ -23,30 +22,33 @@ def module(name, file):
 
 class HarnessCatalogTests(unittest.TestCase):
     def test_installer_projection_includes_every_declaration(self):
-        providers = {"additional": {"responses": {"requires_token_limits": True},
-                                    "anthropic": {"requires_token_limits": False}}, "native": {}}
+        protocols = {"additional": ["responses", "anthropic"], "native": []}
         namespace = {}
-        exec(catalog.render_installer(providers), namespace)
-        self.assertEqual(namespace["PROVIDERS"], providers)
+        exec(catalog.render_installer(protocols), namespace)
+        self.assertEqual(namespace["PROVIDERS"], protocols)
 
-    def test_new_registration_reaches_all_projections(self):
-        entries = [{"kind": "example", "label": "Example",
-                    "configuration": "example", "profile": "exampleProfile"}]
-        with tempfile.TemporaryDirectory() as directory:
-            path = Path(directory) / "catalog.json"
-            path.write_text(json.dumps(entries))
-            loaded = catalog.load_catalog(path)
-            generated = catalog.render(loaded)
-        generated["client"] = catalog.render_client(loaded, ["responses"])
+    def test_new_declaration_reaches_all_projections(self):
+        harnesses = [{"kind": "example", "label": "Example", "package": "example"}]
+        generated = {**catalog.render_registrations(["example"]), **catalog.render_docs(harnesses)}
+        generated["client"] = catalog.render_client(harnesses, ["responses"])
         for content in generated.values():
             self.assertIn("example", content)
             for old in ("codex", "claude_sdk", "mcode"):
                 self.assertNotIn(old, content)
-        self.assertIn('"example": example.Configuration()', generated[Path("internal/harnessconfig/builtin/registry.go")])
-        self.assertIn('"example": exampleProfile()', generated[Path("services/core/internal/engine/catalog_generated.go")])
+        self.assertIn("harnessconfig.NewRegistry(example.Declaration)", generated[Path("internal/harnessconfig/builtin/registry.go")])
+        self.assertIn("[]agent.Declaration{example.Declaration}", generated[Path("apps/daemon/internal/cli/harness_declarations.go")])
+
+    def test_declaration_directory_is_the_registration(self):
+        self.assertEqual(catalog.packages(), ["claudesdk", "codex", "mcode"])
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / "internal/harnessconfig/bad").mkdir(parents=True)
+            (root / "internal/harnessconfig/bad/declaration.go").write_text("package bad\n")
+            with self.assertRaises(ValueError):
+                catalog.packages(root)
 
     def test_checked_in_openapi_enums_match_catalog(self):
-        expected = [entry["kind"] for entry in catalog.load_catalog(catalog.ROOT / catalog.CATALOG)]
+        expected = [entry["kind"] for entry in catalog.load_declared()["harnesses"]]
         surfaces = {
             "openapi.yaml": [("v1.AgentsCore", "harness"), ("v1.SavedAgentCoreInput", "harness"),
                              ("v1.SavedAgentCore", "harness")],
@@ -68,20 +70,6 @@ def test_checked_in_openapi_enums_match_catalog(self):
                     self.assertEqual(re.findall(r"^ +- ([a-z][a-z0-9_]*)$", field.group(1), re.M), expected,
                                      "stale Harness enum; run make openapi")
 
-    def test_invalid_or_duplicate_registration_is_rejected(self):
-        entry = {"kind": "example", "label": "Example",
-                 "configuration": "example", "profile": "exampleProfile"}
-        candidates = [[], [entry, entry], [{**entry, "kind": "bad/kind"}],
-                      [{**entry, "configuration": "../example"}],
-                      [{**entry, "profile": "bad()"}],
-                      [{**entry, "unknown": True}]]
-        with tempfile.TemporaryDirectory() as directory:
-            path = Path(directory) / "catalog.json"
-            for value in candidates:
-                path.write_text(json.dumps(value))
-                with self.subTest(value=value), self.assertRaises(ValueError):
-                    catalog.load_catalog(path)
-
     def test_openapi_projection_keeps_every_harness_constraint(self):
         document = "definitions:\n"
         fields = [("v1.AgentsCore", "harness"), ("v1.SavedAgentCoreInput", "harness"),
@@ -93,7 +81,7 @@ def test_openapi_projection_keeps_every_harness_constraint(self):
         for method in ("get", "put", "delete"):
             document += f"  /{method}:\n    parameters:\n      - description: Harness\n        in: path\n        name: harness\n        type: string\n"
         result = schema.harness_enums(document)
-        kinds = catalog.load_catalog(catalog.ROOT / catalog.CATALOG)
+        kinds = catalog.load_declared()["harnesses"]
         for entry in kinds:
             self.assertEqual(result.count("        - " + entry["kind"] + "\n"), 8)
         self.assertIn("type: string", result)
diff --git a/scripts/harness-catalog/main.go b/scripts/harness-catalog/main.go
index dff896066..d12aafc0c 100644
--- a/scripts/harness-catalog/main.go
+++ b/scripts/harness-catalog/main.go
@@ -1,4 +1,4 @@
-// Command harness-catalog projects adapter-owned provider declarations and the
+// Command harness-catalog projects the built-in Harness declarations and the
 // model-provider protocol vocabulary for tooling.
 package main
 
@@ -10,26 +10,29 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/modelprovider"
 )
 
-type provider struct {
-	RequiresTokenLimits bool `json:"requires_token_limits"`
+type harness struct {
+	Kind      string   `json:"kind"`
+	Label     string   `json:"label"`
+	Protocols []string `json:"protocols"`
 }
 
-func declarations() map[string]map[string]provider {
-	result := make(map[string]map[string]provider)
+func declarations() []harness {
+	var result []harness
 	for _, kind := range builtin.Kinds() {
-		providers := make(map[string]provider)
-		for _, declaration := range builtin.Configuration(kind).Providers {
-			providers[declaration.Protocol] = provider{RequiresTokenLimits: declaration.RequiresTokenLimits}
+		declaration, _ := builtin.Registry().Lookup(kind)
+		protocols := []string{}
+		for _, declared := range declaration.Providers {
+			protocols = append(protocols, declared.Protocol)
 		}
-		result[kind] = providers
+		result = append(result, harness{Kind: kind, Label: declaration.Label, Protocols: protocols})
 	}
 	return result
 }
 
 func main() {
 	projection := struct {
-		Harnesses map[string]map[string]provider `json:"harnesses"`
-		Protocols []modelprovider.Protocol       `json:"protocols"`
+		Harnesses []harness                `json:"harnesses"`
+		Protocols []modelprovider.Protocol `json:"protocols"`
 	}{declarations(), modelprovider.Protocols()}
 	if err := json.NewEncoder(os.Stdout).Encode(projection); err != nil {
 		panic(err)
diff --git a/scripts/harness-catalog/main_test.go b/scripts/harness-catalog/main_test.go
index db9cb748d..cbd6e1a7f 100644
--- a/scripts/harness-catalog/main_test.go
+++ b/scripts/harness-catalog/main_test.go
@@ -6,21 +6,19 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 )
 
-func TestProjectionMatchesEveryAdapterDeclaration(t *testing.T) {
+func TestProjectionMatchesEveryDeclaration(t *testing.T) {
 	got := declarations()
 	if len(got) != len(builtin.Kinds()) {
-		t.Fatal("projection membership differs from catalog")
+		t.Fatal("projection membership differs from the registry")
 	}
-	for _, kind := range builtin.Kinds() {
-		configuration := builtin.Configuration(kind)
-		providers, ok := got[kind]
-		if !ok || len(providers) != len(configuration.Providers) {
-			t.Fatalf("%s: missing provider declarations", kind)
+	for _, projected := range got {
+		declaration, ok := builtin.Registry().Lookup(projected.Kind)
+		if !ok || projected.Label != declaration.Label || len(projected.Protocols) != len(declaration.Providers) {
+			t.Fatalf("%s: projection differs from its declaration", projected.Kind)
 		}
-		for _, declaration := range configuration.Providers {
-			projected, ok := providers[declaration.Protocol]
-			if !ok || projected.RequiresTokenLimits != declaration.RequiresTokenLimits {
-				t.Fatalf("%s/%s: configuration rule differs", kind, declaration.Protocol)
+		for i, declared := range declaration.Providers {
+			if projected.Protocols[i] != declared.Protocol {
+				t.Fatalf("%s: protocol order differs", projected.Kind)
 			}
 		}
 	}
diff --git a/scripts/name-allowlist.json b/scripts/name-allowlist.json
deleted file mode 100644
index 69b3837f1..000000000
--- a/scripts/name-allowlist.json
+++ /dev/null
@@ -1,272 +0,0 @@
-[
-  {
-    "path": "*",
-    "regex": "contracts/agents-api(?:/[A-Za-z0-9_.*-]+)*",
-    "reason": "The Agents API contract directory is an existing source path, not an installed executable."
-  },
-  {
-    "path": "packages/agents-client/src/*",
-    "regex": "(?:\\./)?fixtures/parsar-[0-9a-f]+/[A-Za-z0-9_./-]+",
-    "reason": "Fixture directory paths identify historical product protocol snapshots."
-  },
-  {
-    "path": "packages/agents-client/src/protocol-types.test.ts",
-    "regex": "Parsar [0-9a-f]{8}\\b",
-    "reason": "The test profile labels cite the historical source revision, not the current Core brand."
-  },
-  {
-    "path": "*",
-    "regex": "Parsar product\\b",
-    "reason": "This phrase explicitly refers to the separate Parsar product."
-  },
-  {
-    "path": "packages/agents-client/v1/client.go",
-    "regex": "Parsar's execution path",
-    "reason": "The Go SDK does not switch the separate product execution path."
-  },
-  {
-    "path": "scripts/check-names.py",
-    "regex": "(?m)^    r\"[^\\n]+\"[,\\n]?",
-    "reason": "These exact regex literals are retired-name detection inputs, not supported settings."
-  },
-  {
-    "path": "scripts/name-allowlist.json",
-    "regex": "(?i)parsar|\\bAGENTS_CORE_WEB_[A-Z][A-Z0-9_]*|\\bAGENTS_API_[A-Z][A-Z0-9_]*|\\bCORE_CONSOLE_[A-Z][A-Z0-9_]*|\\bagents-api(?:-(?:migrate|device|environment-key|e2b-provider|microsandbox-provider|tool-root|codex-directory|codex-write|workspace-export|runtime-initialize|claude-shell-prefix))?\\b|\\bcore-console\\b|\\bagents-runtime-|\\bAgents? Core(?: Web)?\\b|@agents-core-web/|\\bminimax-ai-dev\\b",
-    "reason": "The reviewed guard policy must spell the names it explains; entries are checked for nonempty reasons."
-  },
-  {
-    "path": "scripts/check-names.test.py",
-    "regex": "(?i)parsar|\\bAGENTS_CORE_WEB_[A-Z][A-Z0-9_]*|\\bAGENTS_API_[A-Z][A-Z0-9_]*|\\bCORE_CONSOLE_[A-Z][A-Z0-9_]*|\\bagents-api(?:-(?:migrate|device|environment-key|e2b-provider|microsandbox-provider|tool-root|codex-directory|codex-write|workspace-export|runtime-initialize|claude-shell-prefix))?\\b|\\bcore-console\\b|\\bagents-runtime-|\\bAgents? Core(?: Web)?\\b|@agents-core-web/|\\bminimax-ai-dev\\b",
-    "reason": "Guard regression fixtures intentionally contain retired identifiers, including rejected examples."
-  },
-  {
-    "path": "services/core/migrations/000078_oac_runtime_names.sql",
-    "regex": "parsar-core-runtime@",
-    "reason": "The guarded up/down data migration must recognize and restore the historical stored Runtime reference prefix."
-  },
-  {
-    "path": "*",
-    "regex": "https://developers\\.openai\\.com/api/docs/guides/agents-api(?:/[A-Za-z0-9_./-]*)?",
-    "reason": "Official upstream documentation URLs are external protocol references."
-  },
-  {
-    "path": "services/core/internal/credentialcrypto/*.go",
-    "regex": "parsar\\.agents-api\\.(?:agent-model-execution\\.v1|credential(?:-fingerprint\\.v1)?|deployment-model-provider\\.v1|environment-file|environment-setup|session-model-execution\\.v1|sandbox-deployment\\.v1|skill)",
-    "reason": "These exact authenticated encryption domain/AAD strings must remain stable to decrypt existing stored credentials and assets."
-  },
-  {
-    "path": "services/core/internal/persistence/postgres/sessionpg/creation.go",
-    "regex": "parsar\\.agents-api\\.model-provider-api-key\\.v1",
-    "reason": "This persisted model-provider key fingerprint purpose remains stable across upgrade and request replay."
-  },
-  {
-    "path": "apps/daemon/internal/agent/codex/preparation_router_test.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "apps/daemon/internal/dispatch/local_directory_test.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "apps/daemon/internal/dispatch/preparation_test.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "apps/daemon/internal/localworkspace/binding.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "apps/daemon/internal/localworkspace/native_binding.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "apps/daemon/internal/localworkspace/binding_test.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "apps/daemon/internal/localworkspace/write.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "services/core/internal/execution/directory_preparation.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "services/core/internal/execution/request.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "services/core/internal/execution/recovery_test.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "services/core/tests/integration/dispatch_test.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "services/core/tests/integration/environment_directory_test.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "services/core/tests/integration/environment_worker_helpers_test.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "services/core/tests/integration/environment_worker_test.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "AgentStateKey is a persisted daemon/native-session resume identity carried on the existing machine wire contract; changing it would select another session."
-  },
-  {
-    "path": "services/core/tests/integration/oac_runtime_names_migration_test.go",
-    "regex": "parsar-core-runtime@sha256:|parsar_worker /home/runtime/\\.parsar",
-    "reason": "Migration input and historical Session content assertions prove only the Runtime reference changes, never stored conversation data."
-  },
-  {
-    "path": "services/core/migrations/000075_public_url_binding.sql",
-    "regex": "AGENTS_API_PUBLIC_URL",
-    "reason": "Historical migration commentary records the environment name used when this migration was written."
-  },
-  {
-    "path": "CONTRIBUTING.md",
-    "regex": "apps/parsar/|Parsar owns",
-    "reason": "These exact phrases refer to the separate Parsar product, its ownership or historical source, not the OpenAgentCore brand."
-  },
-  {
-    "path": "apps/web/PRODUCT.md",
-    "regex": "and Parsar itself",
-    "reason": "These exact phrases refer to the separate Parsar product, its ownership or historical source, not the OpenAgentCore brand."
-  },
-  {
-    "path": "services/core/tests/official_environment_plugin_mcp.py",
-    "regex": "'PARSAR_'",
-    "reason": "The external-client credential-leak test rejects product-secret prefixes in observed model tool output; this is a leak detector, not a runtime setting."
-  },
-  {
-    "path": "apps/web/.impeccable/surfaces/src-app-tsx.md",
-    "regex": "Parsar indigo",
-    "reason": "The design records explicitly attribute the copied indigo palette to its original product; it is not a rendered Core product label."
-  },
-  {
-    "path": "example/*",
-    "regex": "(?i)parsar",
-    "reason": "The explicitly named Parsar application example retains product branding; it does not rename the Core runtime."
-  },
-  {
-    "path": "pnpm-workspace.yaml",
-    "regex": "example/parsar",
-    "reason": "The explicitly named Parsar application example retains product branding; it does not rename the Core runtime."
-  },
-  {
-    "path": "docs/examples.md",
-    "regex": "(?i)parsar",
-    "reason": "The examples guide describes the explicitly named Parsar application example; it does not rename the Core runtime."
-  },
-  {
-    "path": "docs/zh/examples.md",
-    "regex": "(?i)parsar",
-    "reason": "The Chinese examples guide describes the explicitly named Parsar application example and its preserved source paths."
-  },
-  {
-    "path": "Makefile",
-    "regex": "@oac/parsar-example",
-    "reason": "The explicitly named Parsar application example retains product branding; it does not rename the Core runtime."
-  },
-  {
-    "path": "CONTRIBUTING.md",
-    "regex": "example/parsar/",
-    "reason": "The explicitly named Parsar application example retains product branding; it does not rename the Core runtime."
-  },
-  {
-    "path": "apps/daemon/internal/cli/connect_cleanup_test.go",
-    "regex": "\"agents-api-cleanup\"",
-    "reason": "Executor ownership validates the current Core and local-workspace AgentStateKey namespace; this change does not introduce an alternate identity or compatibility path."
-  },
-  {
-    "path": "apps/daemon/internal/dispatch/executor.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "Executor ownership validates the current Core and local-workspace AgentStateKey namespace; this change does not introduce an alternate identity or compatibility path."
-  },
-  {
-    "path": "apps/daemon/internal/dispatch/executor_handoff_test.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "Executor ownership validates the current Core and local-workspace AgentStateKey namespace; this change does not introduce an alternate identity or compatibility path."
-  },
-  {
-    "path": "apps/daemon/internal/dispatch/executor_test.go",
-    "regex": "\"agents-api-(?:session)?\"",
-    "reason": "Executor ownership validates the current Core and local-workspace AgentStateKey namespace; this change does not introduce an alternate identity or compatibility path."
-  },
-  {
-    "path": "apps/daemon/internal/cli/claude_sdk_live_linux_test.go",
-    "regex": "\"agents-api-registered-acceptance\"",
-    "reason": "Executor ownership validates the current Core and local-workspace AgentStateKey namespace; this change does not introduce an alternate identity or compatibility path."
-  },
-  {
-    "path": "services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go",
-    "regex": "\"agents-api-mcp-bearer-acceptance\"",
-    "reason": "Executor ownership validates the current Core and local-workspace AgentStateKey namespace; this change does not introduce an alternate identity or compatibility path."
-  },
-  {
-    "path": "apps/daemon/internal/localworkspace/capabilities.go",
-    "regex": "\"agents-api-\"",
-    "reason": "AgentStateKey retains the existing daemon/native-session resume identity; capability snapshots bind to the Session UUID carried in that identity."
-  },
-  {
-    "path": "apps/daemon/internal/localworkspace/capability_preparation_test.go",
-    "regex": "\"agents-api-\"",
-    "reason": "AgentStateKey retains the existing daemon/native-session resume identity; capability snapshots bind to the Session UUID carried in that identity."
-  },
-  {
-    "path": "internal/agentdaemon/proto/prototest/wire.go",
-    "regex": "agents-api-session",
-    "reason": "The shared wire scenarios use the existing Core Session state-key prefix required by execution admission."
-  },
-  {
-    "path": "apps/daemon/internal/agent/mcode/tool_environment_test.go",
-    "regex": "agents-api-",
-    "reason": "The regression fixture uses the existing persisted Session state-key namespace required by Runtime binding validation."
-  },
-  {
-    "path": "services/core/migrations/000015_retire_item_backfill.sql",
-    "regex": "services/agents-api/README\\.md",
-    "reason": "Landed migrations keep their original text."
-  },
-  {
-    "path": "packages/agents-client/src/fixtures/parsar-*",
-    "regex": "services/agents-api/internal/api/",
-    "reason": "Historical Parsar protocol snapshots record the upstream source path they were captured from."
-  },
-  {
-    "path": ".github/workflows/check.yml",
-    "regex": "(?:example/parsar|@oac/parsar-example)",
-    "reason": "The named Parsar example owns its dependency lock and component checks."
-  },
-  {
-    "path": "scripts/ci_plan.py",
-    "regex": "(?:example/parsar|@oac/parsar-example)",
-    "reason": "The named Parsar example owns its dependency lock and component checks."
-  },
-  {
-    "path": "scripts/ci_plan_test.py",
-    "regex": "(?:example/parsar|@oac/parsar-example)",
-    "reason": "The named Parsar example owns its dependency lock and component checks."
-  },
-  {
-    "path": "apps/daemon/internal/cli/connect_suspend_test.go",
-    "regex": "\"agents-api-\"",
-    "reason": "The cleanup regression uses the persisted Session state-key prefix required by Runtime executor ownership validation."
-  }
-]
diff --git a/scripts/native-onboarding-smoke.mjs b/scripts/native-onboarding-smoke.mjs
index 9bee4193f..05bf83c73 100644
--- a/scripts/native-onboarding-smoke.mjs
+++ b/scripts/native-onboarding-smoke.mjs
@@ -4,9 +4,8 @@ import assert from 'node:assert/strict';
 import { createHash, randomUUID } from 'node:crypto';
 import { createServer } from 'node:http';
 import { spawn, execFileSync } from 'node:child_process';
-import { createReadStream } from 'node:fs';
-import { existsSync } from 'node:fs';
-import { mkdir, readFile } from 'node:fs/promises';
+import { createReadStream, existsSync } from 'node:fs';
+import { readFile, readdir } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 
 const root = process.env.RUNNER_TEMP;
@@ -18,19 +17,31 @@ const protocol = (await readFile('internal/agentdaemon/proto/version.go', 'utf8'
 const environment = randomUUID(), session = randomUUID(), device = randomUUID();
 const workspace = join(root, 'onboarding-workspace');
 const installation = join(root, 'onboarding-installation');
-const archive = join(root, 'onboarding.tar.gz');
-const tar = windows ? join(process.env.SystemRoot, 'System32', 'tar.exe') : 'tar';
-execFileSync(tar, ['-czf', archive, '-C', bundle, '.']);
-const digest = createHash('sha256');
-for await (const chunk of createReadStream(archive)) digest.update(chunk);
-const checksum = digest.digest('hex');
+// Core serves the base archive and one archive per component, as the release publishes them.
+const archives = join(root, 'native-archives');
+const platform = `${manifest.os}-${manifest.arch}`;
+const checksums = new Map(), downloaded = new Set();
+let componentRequests = 0;
+async function checksum(name) {
+  if (!checksums.has(name)) {
+    const digest = createHash('sha256');
+    for await (const chunk of createReadStream(join(archives, `${name}.tar.gz`))) digest.update(chunk);
+    checksums.set(name, digest.digest('hex'));
+  }
+  return checksums.get(name);
+}
 let secret, connected = false, connections = 0, failClaim = true;
 const authorization = 'fixture-install-authorization';
 const server = createServer(async (request, response) => {
   const url = new URL(request.url, origin);
   const json = (status, value) => { response.writeHead(status, { 'Content-Type': 'application/json' }); response.end(JSON.stringify(value)); };
-  if (url.pathname.endsWith('.sha256')) { response.setHeader('Content-Type', 'text/plain; charset=utf-8'); return response.end(checksum+'\n'); }
-  if (url.pathname.endsWith('.tar.gz')) return createReadStream(archive).pipe(response);
+  const artifact = url.pathname.match(/\/install\/[^/]+\/([a-z0-9-]+)\.(sha256|tar\.gz)$/);
+  if (artifact) {
+    if (!existsSync(join(archives, `${artifact[1]}.tar.gz`))) return json(404, {});
+    if (artifact[2] === 'sha256') { response.setHeader('Content-Type', 'text/plain; charset=utf-8'); return response.end(await checksum(artifact[1])+'\n'); }
+    downloaded.add(artifact[1]); if (artifact[1] !== platform) componentRequests++;
+    return createReadStream(join(archives, `${artifact[1]}.tar.gz`)).pipe(response);
+  }
   if (url.pathname.endsWith('bootstrap.sh') || url.pathname.endsWith('bootstrap.ps1')) return createReadStream(resolve('services/core/internal/nativeinstaller/assets', url.pathname.split('/').at(-1))).pipe(response);
   const body = []; for await (const chunk of request) body.push(chunk);
   if (url.pathname.endsWith('/installation') || url.pathname.endsWith('/claim')) {
@@ -82,20 +93,34 @@ try {
   assert.notEqual((await run(executable, [...args, '--non-interactive', '--harness', 'codex'])).code, 0, 'Lost claim response should fail safely');
   const saved = JSON.parse(await readFile(join(installation, 'daemon', 'executor-credential.json'), 'utf8'));
   assert.equal(saved.executor_token, secret, 'Secret must survive a lost response');
+  // A failed first installation leaves no user entry, so it pins nothing; its components stay for the next run.
+  const store = join(root, 'unused-onboarding-home', 'components', manifest.daemon_version);
+  assert.deepEqual(existsSync(join(store, 'users')) ? await readdir(join(store, 'users')) : [], [], 'A failed installation is still registered as a user');
   const script = resolve(`services/core/internal/nativeinstaller/assets/bootstrap.${windows ? 'ps1' : 'sh'}`);
   const bootstrapArgs = windows ? ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', script, '-Base', base] : [script, base];
-  const result = await run(windows ? 'powershell.exe' : 'bash', [...bootstrapArgs, '--install-dir', installation], '\n\n');
+  // Select every Harness of this platform so each Harness archive passes the installer's extraction and readiness checks.
+  const harnesses = windows ? ['codex', 'claude'] : ['codex', 'claude', 'minimax'];
+  const result = await run(windows ? 'powershell.exe' : 'bash', [...bootstrapArgs, '--install-dir', installation], harnesses.join(',') + '\n\n');
   assert.equal(result.code, 0, `Interactive bootstrap failed: ${result.output}`);
   assert.match(result.output, /Daemon connection: connected/);
+  // The failed runs installed Node and Codex from the bundle; the bootstrap reuses them.
+  assert.deepEqual([...downloaded].sort(), [platform, ...harnesses.filter(name => name !== 'codex').map(name => `${platform}-${name}`)].sort(), 'Only the base and the missing Harnesses may be downloaded');
   assert.match(result.output, /Model configuration: not checked/);
+  // Components live once per machine and version, outside the installation.
+  assert.ok(existsSync(join(store, 'codex', '.oac-install.json')), 'Shared Codex component is missing');
+  assert.ok(!existsSync(join(installation, 'components')), 'The installation holds its own component copy');
+  assert.ok(!existsSync(join(root, 'unused-onboarding-home', 'native-download', manifest.daemon_version, `${platform}-codex.tar.gz.part`)), 'An archive remains after installation');
   assert.equal(connections, 1);
-  // The running daemon must not keep the bootstrap's download lock.
+  const downloads = componentRequests;
   const repeat = await run(windows ? 'powershell.exe' : 'bash', [...bootstrapArgs, '--install-dir', installation, '--non-interactive', '--harness', 'codex']);
   assert.equal(repeat.code, 0, `Repeat failed: ${repeat.output}`);
   assert.equal(connections, 1, 'Repeated installation created a duplicate daemon');
+  assert.equal(componentRequests, downloads, 'A repeated installation downloaded a component');
   const uninstall = await run(join(installation, 'bin', windows ? 'oac-daemon.exe' : 'oac-daemon'), ['uninstall'], 'y\n');
   assert.equal(uninstall.code, 0, `Uninstall failed: ${uninstall.output}`);
   assert.match(uninstall.output, /Revoke/);
+  assert.match(uninstall.output, /Shared components removed/);
+  assert.ok(!existsSync(store), 'Uninstall left the shared components');
   // Windows finishes deleting its own executable after the command exits.
   for (let wait = 0; existsSync(installation) && wait < 100; wait++) await new Promise(resolve => setTimeout(resolve, 100));
   assert.ok(!existsSync(installation), 'Uninstall left the installation');
diff --git a/scripts/patch-agents-openapi.py b/scripts/patch-agents-openapi.py
index def3b983d..e488c78fe 100644
--- a/scripts/patch-agents-openapi.py
+++ b/scripts/patch-agents-openapi.py
@@ -18,12 +18,12 @@
 
 
 def harness_enums(document):
-    # Read the authoring catalog, never another independently maintained enum.
+    # Read the Go declarations, never another independently maintained enum.
     spec = importlib.util.spec_from_file_location(
         "harness_catalog", Path(__file__).with_name("generate-harness-catalog.py"))
     catalog = importlib.util.module_from_spec(spec)
     spec.loader.exec_module(catalog)
-    kinds = [entry["kind"] for entry in catalog.load_catalog(catalog.ROOT / catalog.CATALOG)]
+    kinds = [entry["kind"] for entry in catalog.load_declared()["harnesses"]]
     for definition, member in [
         ("v1.AgentsCore", "harness"),
         ("v1.SavedAgentCoreInput", "harness"),
diff --git a/scripts/publish-core-release.py b/scripts/publish-core-release.py
index c480919db..8f6308995 100644
--- a/scripts/publish-core-release.py
+++ b/scripts/publish-core-release.py
@@ -268,10 +268,10 @@ def publish(assets, repository, revision, tag, mode):
         catalog = json.load(archive.extractfile(stem + "/native-installers/catalog.json"))
     if catalog["version"] != revision or not catalog["artifacts"]:
         raise ValueError("Native installer catalog does not match the release")
-    for platform, entry in catalog["artifacts"].items():
-        if not re.fullmatch(r"(linux|darwin|windows)-(amd64|arm64)", platform):
-            raise ValueError("Invalid native installer platform")
-        path = assets / f"oac-native-{revision}-{platform}.tar.gz"
+    for name, entry in catalog["artifacts"].items():
+        if not distribution.NATIVE_ARTIFACT.fullmatch(name):
+            raise ValueError("Invalid native installer artifact")
+        path = assets / f"oac-native-{revision}-{name}.tar.gz"
         if (distribution.sha256(path) != entry["sha256"]
                 or path.with_name(path.name + ".sha256").read_text() != entry["sha256"] + "  " + path.name + "\n"):
             raise ValueError("Native installer checksum mismatch")
diff --git a/scripts/publish-core-release.test.py b/scripts/publish-core-release.test.py
index b7870eef7..584b2e4b8 100644
--- a/scripts/publish-core-release.test.py
+++ b/scripts/publish-core-release.test.py
@@ -34,7 +34,7 @@ def setUp(self):
             (self.assets / (name + ".sha256")).write_text(
                 hashlib.sha256(b"archive fixture").hexdigest() + "  " + name + "\n")
         catalog = {"version": self.revision, "artifacts": {}}
-        for platform in ("linux-amd64", "darwin-arm64", "windows-amd64"):
+        for platform in ("linux-amd64", "darwin-arm64", "windows-amd64-codex"):
             name = f"oac-native-{self.revision}-{platform}.tar.gz"
             (self.assets / name).write_bytes(b"native archive")
             checksum = hashlib.sha256(b"native archive").hexdigest()
@@ -71,7 +71,7 @@ def test_draft_publishes_images_and_stays_unpublished(self):
         self.assertEqual(len(self.release["assets"]), 28)
 
     def test_missing_native_asset_refuses_release_creation(self):
-        (self.assets / f"oac-native-{self.revision}-windows-amd64.tar.gz").unlink()
+        (self.assets / f"oac-native-{self.revision}-windows-amd64-codex.tar.gz").unlink()
         with self.assertRaises(FileNotFoundError):
             self.publish()
         self.assertEqual(self.writes(), [])
diff --git a/services/core/IMPLEMENTATION.md b/services/core/IMPLEMENTATION.md
index ff2c18355..85da7e46d 100644
--- a/services/core/IMPLEMENTATION.md
+++ b/services/core/IMPLEMENTATION.md
@@ -1,6 +1,6 @@
 # Core implementation constraints
 
-These are the code-level rules of `services/core` that no contract states. Contracts own behavior: the [coverage ledger](../../contracts/agents-api/index.md) and its linked contracts own the public and administrator APIs, the [machine connection API](../../contracts/agents-api/machine-api.md) the `/api/v1` routes, the [Core–Runtime protocol](../../docs/runtime-protocol.md) the daemon wire, and the [Sandbox Provider guide](../../docs/sandbox-provider.md#managed-lifecycle) the managed compute lifecycle. When code changes one of these rules, change the rule here in the same branch.
+These are the code-level rules of `services/core` that no contract states. Contracts own behavior: [OpenAI compatibility](../../contracts/agents-api/index.md) and its linked contracts own the public and administrator APIs, the [machine connection API](../../contracts/agents-api/machine-api.md) the `/api/v1` routes, the [Core–Runtime protocol](../../docs/runtime-protocol.md) the daemon wire, and the [Sandbox Provider protocol](../../docs/sandbox-provider.md) what a Provider may rely on Core to do. When code changes one of these rules, change the rule here in the same branch.
 
 ## Layering
 
@@ -58,7 +58,7 @@ On the Beta group, the OpenAI-Beta check (exactly one `agents=v1` value) runs be
 
 ## Source Files and Artifacts
 
-Source Files are Project resources with a lifecycle independent of copied workspace files. `files` owns their vocabulary, the upload envelope and 512 MiB content bound, the list rules and the create and delete use cases; `filepg` stores immutable source metadata and PostgreSQL large objects in Core's database with the pinned pgx driver. Upload validation, metadata insertion, the bytes and the write audit commit atomically; deletion removes the metadata, unlinks the object and records the audit in one transaction. Keep OIDs private and authorize every metadata, content and delete lookup by tenant before opening a body. Write content through `pgunit`'s large-object writer, which streams bounded chunks and reports the size and SHA-256 digest; never hold an entire upload in memory or use a filename as a filesystem path. A direct download of the `user_data` purpose is rejected after the tenant-scoped metadata lookup, while workspace copies keep their authorized `filepg` read and Session creation copies an initial file's object inside its own transaction through `filepg.ReadSourceForCopy`, which locks the source and bounds the read. A read-only repeatable-read transaction preserves an admitted source across concurrent deletion; resolve that snapshot before entering the Environment write path, and a later deletion never undoes a completed workspace copy. Bound request and transaction lifetimes, roll back incomplete bodies and never retry an ambiguous commit automatically. Backups must include PostgreSQL large objects, and a schema rollback must not orphan them.
+Source Files are Project resources with a lifecycle independent of copied workspace files. `files` owns their vocabulary, the upload envelope and 512 MiB content bound, the list rules and the create and delete use cases; `filepg` stores immutable source metadata and PostgreSQL large objects in Core's database with the pinned pgx driver. Upload validation, metadata insertion, the bytes and the write audit commit atomically; deletion removes the metadata, unlinks the object and records the audit in one transaction. Keep OIDs private and authorize every metadata, content and delete lookup by tenant before opening a body. Write content through `pgunit`'s large-object writer, which streams bounded chunks and reports the size and SHA-256 digest; never hold an entire upload in memory or use a filename as a filesystem path. A direct download of the `user_data` purpose is rejected after the tenant-scoped metadata lookup, while workspace copies keep their authorized `filepg` read and Session creation copies an initial file's object inside its own transaction through `filepg.ReadSourceForCopy`, which locks the source and bounds the read. A read-only repeatable-read transaction preserves an admitted source across concurrent deletion; resolve that snapshot before entering the Environment write path, and a later deletion never undoes a completed workspace copy. Bound request and transaction lifetimes, roll back incomplete bodies and never retry an ambiguous commit automatically. Backups must include PostgreSQL large objects.
 
 Session Artifacts are immutable published copies, separate from live workspace files and source Files. The private output exporter reuses the authorized workspace path boundary and streams bounded bytes; publication requires complete capture and confirmed helper and transport success, not merely valid archive syntax. The daemon owns and drains the exporter's stdout pipe separately from child reaping, so pull-transport backpressure cannot consume the process-exit I/O deadline; after helper exit, each pipe read has one second, reset after consumer delays, which rejects inherited pipes that never close. Cancellation closes the owned reader and the dispatch consumer, then waits for the child. Core capture and both export peers use `proto.WorkspaceExportTimeout`; capture includes preparation and storage and preserves earlier parent cancellation. An authorized active export temporarily owns the preparation idle-expiry timer and restores its original deadline on settlement; expired preparations cannot be revived. Read-only release accepts an identity-validated `expired` receipt without a Run or error as confirmed cleanup and retains the consume result. Never extract an output archive into Core's filesystem or hold the execution lease through a large transfer.
 
@@ -94,6 +94,10 @@ The Dispatcher prepares pending Environment input only on its exact enrolled or
 
 The Worker scans pending inputs with the same scheduling slots, Session locks, durable deadlines and engine capability checks: once a second, at most 100 candidates per scan. At the end of the queue after a nonempty cursor it refills the first page once in the same scan, and an empty queue never spins. The cursor advances before readiness checks so an unavailable Runtime cannot starve later candidates. Execution concurrency (`OAC_EXECUTION_CONCURRENCY`) bounds simultaneous work, not attempt frequency, and the Worker alternates between ordinary Turns and Environment inputs. A self-hosted Session waits for its dedicated enrolled device; it never selects another device of the tenant or migrates a binding. Managed lifecycle polling keeps its separate five-second interval. Input HTTP response budgets follow the persisted Environment type, independently of operator switches.
 
+The Worker expires at most 32 due [Environment input reservations](../../contracts/agents-api/environments.md#reservations) per tick, after checking its lease and before checking devices or execution slots. The sweep uses the leased execution writer's connection with its transaction timeout, never a pooled writer. A partial deadline index and `SKIP LOCKED` Session locks let unrelated work proceed. The cutoff is statement time, and settlement rechecks the database clock after taking the Session lock. A restart resumes expiry on normal ticks; there is no separate scheduler.
+
+When next-Turn input is pending on a completed managed allocation that is suspended or recovering, Core hints the managed Runtime maintenance loop. Initial input, cold creation, running or disabled compute, terminal receipts, cancellation and function results, history and file operations send no hint. Hints are best effort and coalesced without blocking; they add at most one scan per normal five-second cycle and never bypass capacity, a busy lifecycle gate or ownership checks. Persisted work and the normal ticker stay authoritative.
+
 `OAC_HARNESSES` adds deployment-supported engines to the default engine and the managed profiles; a daemon's heartbeat alone never enables an engine.
 
 ## Runtime connections
@@ -110,7 +114,7 @@ The sandbox node Hub's global mutex protects only in-memory connection state. Au
 
 Turn writes serialize on the tenant-scoped Session row. Input requests are ordered batches committed under the same lock: a retry key identifies the complete batch, a changed length, order or content conflicts, and a failed transaction leaves no partial input or cancellation. A single-event request keeps its identity at batch position zero. Internal admission limits are 64 events and 512 KiB of payload per request; the API still validates the upstream event schema. Cancellation keeps its first target, including an idle no-op, so a retry never stops later work. Terminal states and outcomes are never overwritten.
 
-Session deletion takes its decision and commits the `deleted_at` marker under the tenant Session lock that orders Turn and input admission, so either an admission commits first and deletion conflicts, or admission observes the deletion. Admission checks visibility under that lock before its retry lookup. Internal Turn, receipt, finalization and restart reconciliation keep access to deleted Sessions so that work settles under the execution lease; queued work of a deleted Session is never claimed, and Runtime cleanup still cancels pending work. Deletion never revokes a shared device or removes a saved Agent. Deleted Session records are retained, and a migration rollback refuses to drop the column while any exist.
+Session deletion takes its decision and commits the `deleted_at` marker under the tenant Session lock that orders Turn and input admission, so either an admission commits first and deletion conflicts, or admission observes the deletion. Admission checks visibility under that lock before its retry lookup. Internal Turn, receipt, finalization and restart reconciliation keep access to deleted Sessions so that work settles under the execution lease; queued work of a deleted Session is never claimed, and Runtime cleanup still cancels pending work. Deletion never revokes a shared device or removes a saved Agent. Deleted Session records are retained.
 
 Every new Session needs an explicit typed creator at the `sessions` boundary, internal callers included; public creation derives it from the authenticated principal only. Creator kind and ID persist in the creation transaction and never change on retry, update or source mutation. Both the early saved-reference recovery and the authoritative creation upsert require a matching creator before returning a Session or event cursor. Tenant scope always comes from the authenticated identity before any storage call; metadata grants nothing. Tests supply explicit synthetic creators.
 
@@ -155,8 +159,7 @@ Accepted public MCP credential profiles are declared centrally by the service, s
 
 ## Message text and result targets
 
-- Admission and the Claude bridge share one whitespace set, the union of Go `unicode.IsSpace` and ECMAScript `String.prototype.trim` (`blankTextRune` in `services/core/internal/execution/message_support.go`). A shared table test keeps both sides equal; change them together.
-- Whitespace-only admission is a field of the engine profile (`WhitespaceOnlyText`) checked with the image profile during Worker admission. Never branch on the harness name in handlers.
+- Whitespace-only admission is a field of the Harness declaration (`WhitespaceOnlyText`) checked with image support during Worker admission. Never branch on the harness name in handlers.
 - `MessageInput.Validate` treats any non-empty text part as content and never trims. It runs in Core admission, Worker delivery, daemon steering and prepared start, and in the Codex and MiniMax adapters.
 - Resolve a tool result's target under the tenant Session lock, after the Session lookup: a well-formed `turn_id` is looked up in that Session and must own the call; otherwise the Session's own calls decide between "unknown call" and "different Turn". Never reject a malformed `turn_id` before the Session lookup, so missing, malformed and foreign Sessions keep one 404, and read only the caller's Session.
 - The recorded Environment failure reason is composed only from a fixed step label and integers (setup command index, exit status 1-255), so commands, environment values, package names, paths and process output cannot reach the reason, events, logs or responses.
@@ -201,7 +204,55 @@ At startup the Worker fails previously claimed work, keeps queued input and neve
 
 ## Hosted sandboxes
 
-The [managed lifecycle](../../docs/sandbox-provider.md#managed-lifecycle) describes publication, allocation, per-node workers, placement, suspension, reset and archive; the [sandbox node protocol](../../contracts/agents-api/node-generation-protocol.md) the node connection. In code:
+The [Sandbox Provider protocol](../../docs/sandbox-provider.md) owns what a Provider implements and what it may rely on Core to do, [Sandbox deployment](../../contracts/agents-api/sandbox-deployment.md) the administration API, and the [Sandbox node protocol](../../contracts/agents-api/node-generation-protocol.md) the node connection. The rules below are how Core meets those contracts.
+
+### Deployment publication
+
+At startup Core claims the stable installation identity and a new owner epoch before it selects a provider. The runtime manager keeps generation-aware provider facades. Initial setup and replacement prepare and validate candidates before any database write, and a rejected candidate leaves the active configuration and workers unchanged. A backend replacement uses the deployment mutation gate: it pauses manager admission, drains old calls and loops, then repeats the resource and generation guards in the commit transaction, where the new selection, its generation and the retirement of old nodes and unused enrollment tokens commit together. After commit, Core publishes the prevalidated configuration and the shared observation and bootstrap cache under the manager mutex, with no further external work or fallible step, so a request cancelled after commit cannot discard it. An interrupted drain stays a barrier for retries. Provider I/O and draining never hold a database transaction or the manager's map mutex.
+
+A locally unavailable provider dependency keeps hosted admission closed while the existing scan waits for repair; administrator recovery stays available, also after a restart. Database and ownership errors stay failures. An unconfigured deployment refuses hosted admission with 503 `execution_unavailable` and creates no Session state. Core derives the Runtime bootstrap and daemon WebSocket addresses from the installation public URL, never from request headers, and reads the current selection from the database, never from a startup file.
+
+Node readiness binds to the exact generation, the current connection and the owner epoch. A durable serving pin is promoted only for readiness of the then-current target, under deployment serialization, so a late report for a superseded target never acquires a pin.
+
+### Allocation lifecycle
+
+The allocation, its dedicated daemon credential digest and the exact Session binding commit atomically before `Create`, under the execution lease and the Session lock. An allocation is private compute ownership, separate from public Environment connection and native readiness.
+
+With a configured provider, the Worker scans committed pending hosted Environments that have no allocation, which covers idle Session creation and recovery after an interruption between commit and bootstrap; an existing allocation never re-enters that path. The scan is bounded and serialized by the lifecycle owner and needs no caller action. An initial reservation without a Turn leaves its Session idle, and a daemon connection is never treated as native readiness. The same scan publishes authenticated connection observations with durable generations, after verifying the exact Session and device binding and a settled bootstrap.
+
+The check between Turns changes nothing and never revives a cleanup request. Terminal cleanup atomically revokes the device's authority, records the Environment's failure or expiry, settles pending input and requests cancellation, and only then calls `Kill`; original input deadlines and retry outcomes are kept.
+
+### Per-node lifecycle workers
+
+Each registered node has one serial lifecycle worker that owns its gate, allocation and pending cursors, connections and wake hints; E2B allocations share one serial lifecycle without a node. A thin coordinator discovers nodes and shuts workers down, and never holds its map mutex during database, provider or wait operations. Workers advance independently, so a stuck provider on one online node never stalls another: lifecycle concurrency is one operation per node and grows with the node count. Offline workers stay, so their retained resources remain observable after reconnection.
+
+Allocation scans filter by node before their 32-row page limit, and pending scans join the unreleased committed placement. Each node advances its own cursor, including past failed observations, and wraps once at the end. Direct provisioning resolves the tenant-scoped placement before entering that node's gate, and an active allocation must agree with it. Only confirmed release permits a new placement; a disconnect never moves an active allocation.
+
+Before releasing the execution lease, the coordinator stops accepting work and cancels and drains every node worker and direct caller. Lease loss affects everything; ordinary provider failures stay within their node. A planned deployment drain or node retirement cancels lifecycle contexts synchronously between leased operations, through the lease gate with its five-second bound, including an active manual reconcile, and never cancels an in-flight leased query just to change configuration. A failed cancellation fence closes manager admission and reports owner failure. A failed retirement keeps the original lifecycle identity and gate until owner shutdown, and the drain barrier stays closed. Session locks, deployment capacity transactions and revision-checked receipts stay authoritative, and no external operation holds a database lock.
+
+### Placement and capacity
+
+Session creation commits durable pending work, and the common scheduler reserves a compatible node before allocation. Node capacity counts pending reservations and unresolved resources, and new placement and a suspended-to-restoring transition share a database lock. [Nodes and allocations](../../contracts/agents-api/sandbox-deployment.md#nodes-and-allocations) owns the capacity limits and the node removal rule.
+
+### Suspension
+
+The idle clock starts no earlier than the allocation entering the running compute phase, including after a wake. For node allocations Core records the first root or child terminal transition with the database clock in the same transaction. Candidate filtering and the Session-locked recheck compare elapsed database time with the idle duration, and the initial snapshot retention deadline is anchored to the same database observation, so Core and database host clocks need not agree. Native completion timestamps stay unchanged in public history but never drive idle admission, and heartbeats never reset activity.
+
+The Session-locked capacity-pressure decision rechecks pending work, wake requests and activity, then takes the shared deployment capacity lock and confirms compatible waiting demand. Pressure-triggered reclamation is conservative: an in-flight reclamation delays another only when its node is currently eligible to serve the same demand. Unavailable or incompatible nodes keep their ownership receipts without blocking healthy capacity.
+
+The Worker lease, the Session lock and the per-node gates own suspension for every provider. New Turn claims, file-write intents and capture admission serialize under the Session lock and share one compute-phase check; new pending work cancels a capture and wakes the same source. Normal preparation waits for the compute phase to be running, after the authenticated resume handshake, and pending input stays pending when its promotion conflicts with a lifecycle transition. Compute phases and revision-checked receipts live on the allocation. A consumed snapshot never rolls a running generation back.
+
+Live file requests wait for the current Runtime's credential-authorized connection and Harness declaration before entering the file work queue; a completed compute `Create` alone is not Runtime readiness. Planned suspension uses an Environment and suspension token on the daemon connection. A transient disconnect before confirmation retries the same armed suspension with bounded attempts and backoff; a permanent authentication or protocol rejection closes it.
+
+### Reset and archive
+
+A [reset](../../contracts/agents-api/sandbox-deployment.md#reset) is durable execution state that the runtime manager advances outside its counted work. Start, escalation, cancellation, setup, update and finalization serialize through the mutation gate. Idleness is rechecked with the Session lock and then the deployment lock, never in the reverse order during finalization. Work is keyset-paged and bound to the reset's request time and generation, with the absolute deadline and validated audit provenance persisted.
+
+One snapshot and timestamp partition the held resources. Offline ownership comes from the allocation's or active placement's node, with the same [online](../../contracts/agents-api/node-generation-protocol.md#connection) predicate as presence, independently of provider readiness; no cleanup failure, offline state or empty read authorizes a synthetic release. At zero held resources, Core drains outside database transactions, rechecks under the deployment lock and clears the deployment in one transaction, then publishes a generation-bearing empty provider without fallible work. If the final write or drain fails, it restores the committed provider with a bounded owner context before releasing the mutation gate; if that recovery fails, admission stays fenced and the owner stops.
+
+An administrator [Session archive](../../contracts/agents-api/admin-api.md#session-archive) keeps its Project scope and hosted eligibility checks in a Session-first transaction, together with Environment expiry, cancellation, Runtime authority revocation and audit; a reset's background archive reconstructs the actual Project scope from trusted records and keeps the requester's provenance. The ordinary provider lifecycle releases compute and snapshots. Archive cancellation keeps a healthy receipt path until the terminal commit: only the archive that first revokes a device records its exact `archive_cancel_turn_id` (ordinary revocation clears it, and repeated cleanup keeps it), and the existing authenticated delivery drains that cancellation within the bound that [Reset](../../contracts/agents-api/sandbox-deployment.md#reset) states. Core tracks the delivery through `done`, the cancellation acknowledgement and the terminal commit, independently of subscription removal, and grants no new connection, input, file or MCP authority or lease renewal. No transaction or lifecycle gate waits for the receipt, and a lost peer, expiry or restart falls back to ordinary failure and cleanup, never a fabricated cancelled outcome.
+
+### Specification, credentials and observations
 
 - Each allocation's immutable specification and the current credential resolve in one `deploymentpg` snapshot, with no stale-credential cache, no fallback to the current specification and no unloading of a provider map that retained allocations need.
 - Credential replacement fences provider calls and waits for helper subprocesses to exit, even after cancellation, before verifying again and committing; the audit entry never carries secret fields.
diff --git a/services/core/README.md b/services/core/README.md
index 0a29c26cc..37977eeea 100644
--- a/services/core/README.md
+++ b/services/core/README.md
@@ -1,6 +1,6 @@
 # Core service
 
-`services/core` is Core: one Go service that serves the Agents API (`/v1`), the Core API (`/core/v1`) and the machine connection routes (`/api/v1`), owns its PostgreSQL schema, and runs the execution Worker that dispatches Turns to Runtimes. [Architecture](../../docs/architecture.md) describes its role, and the [API index](../../docs/api/index.md) its namespaces and credentials. This guide is for contributors who build, run and test Core from source; operators install it with the [installer](../../docs/getting-started/install.md). The [implementation constraints](IMPLEMENTATION.md) hold the code-level rules.
+`services/core` is Core: one Go service that serves the Agents API (`/v1`), the Core API (`/core/v1`) and the machine connection routes (`/api/v1`), owns its PostgreSQL schema, and runs the execution Worker that dispatches Turns to Runtimes. [Architecture](../../docs/architecture.md) describes its role, and [API namespaces and credentials](../../docs/api/index.md) lists its namespaces and the credential each accepts. This guide is for contributors who build, run and test Core from source; operators install it with the [installer](../../docs/getting-started/install.md). The [implementation constraints](IMPLEMENTATION.md) hold the code-level rules.
 
 ## Commands
 
@@ -16,7 +16,7 @@
 
 ## Database
 
-Core uses its own PostgreSQL database and account and shares no tables with an application. Its migrations are embedded goose migrations in [`migrations/`](migrations), tracked in `agents_api_schema_version`; a migration is never edited after it lands. Core applies pending migrations when it starts and refuses a database whose schema version is newer than its own, which a [downgrade](../../docs/getting-started/operations.md#downgrades) would produce. Queries live in `internal/db/queries` and generate typed code with sqlc: run `make sqlc-generate` after changing a query and commit the generated files, which `make check-sqlc` compares.
+Core uses its own PostgreSQL database and account and shares no tables with an application. Its schema is the embedded goose migrations in [`migrations/`](migrations), tracked in `oac_schema_version`; [AGENTS.md](../../AGENTS.md#pre-release-no-compatibility-layers) states how schema changes land. Core applies the migrations when it starts. Queries live in `internal/db/queries` and generate typed code with sqlc: run `make sqlc-generate` after changing a query and commit the generated files, which `make check-sqlc` compares.
 
 ## Run from source
 
@@ -66,4 +66,4 @@ It checks the upstream and generated response schemas, retries, ordering, tenant
 
 ## Generated contracts
 
-Run `make openapi` after changing the pinned public schema, Go bindings, Core extensions or internal handler annotations. The [contract generation guide](../../contracts/agents-api/index.md#pinned-baseline) owns the inputs, generated files and checks. Review and commit the generated diffs. `make check-openapi` verifies freshness; contract tests check all three documents against registered routes.
+Run `make openapi` after changing the pinned public schema, Go bindings, Core extensions or internal handler annotations. [Contract and schema rules](../../CONTRIBUTING.md#contract-and-schema-rules) owns the inputs, generated files and checks. Review and commit the generated diffs. `make check-openapi` verifies freshness; contract tests check all three documents against registered routes.
diff --git a/services/core/cmd/environment-key/main_test.go b/services/core/cmd/environment-key/main_test.go
index 54cae3f0b..feebed0c3 100644
--- a/services/core/cmd/environment-key/main_test.go
+++ b/services/core/cmd/environment-key/main_test.go
@@ -79,7 +79,7 @@ func TestParseOptionsRequiresEveryIdentityFlag(t *testing.T) {
 		})
 	}
 	if _, err := parseOptions([]string{"--tenant", testTenant, "--environment", testEnvironment}, io.Discard); err == nil {
-		t.Fatal("legacy exact-Environment arguments were accepted")
+		t.Fatal("exact-Environment arguments were accepted")
 	}
 }
 
diff --git a/services/core/cmd/oac/init.go b/services/core/cmd/oac/init.go
index e2772e2d4..b56dc13d1 100644
--- a/services/core/cmd/oac/init.go
+++ b/services/core/cmd/oac/init.go
@@ -34,10 +34,8 @@ type releaseIdentity struct {
 }
 
 // releaseManifest holds the node manifest fields initialization reads.
-// source_time, the commit time in Unix seconds, orders releases.
 type releaseManifest struct {
 	SourceCommit string `json:"source_commit"`
-	SourceTime   int64  `json:"source_time"`
 	Platform     string `json:"platform"`
 }
 
@@ -211,16 +209,13 @@ func initialize(root string, release releaseIdentity, fetch func() (map[string][
 				}
 			}
 			if previous.SourceCommit == release.revision {
-				// The pointer follows the receipt, so a crash between the two heals here.
-				if err := writePointer(root, release); err != nil {
-					return err
-				}
 				if err := syncCoreKeyDigest(root); err != nil {
 					return err
 				}
 				logger.InfoContext(ctx, "Existing installation verified", "file_count", len(previous.Files))
 				return nil
 			}
+			return fmt.Errorf("existing data belongs to release %.12s; to use release %.12s, uninstall the installation, which deletes its data, then install again", previous.SourceCommit, release.revision)
 		}
 		nextStep("verify_bundled_metadata")
 		files, err := fetch()
@@ -228,23 +223,9 @@ func initialize(root string, release releaseIdentity, fetch func() (map[string][
 			return err
 		}
 		logger.InfoContext(ctx, "Bundled node installation metadata verified", "file_count", len(files))
-		if previous.SourceCommit != "" {
-			nextStep("verify_release_order")
-			if err := requireNewer(root, previous.SourceCommit, release, files["manifest.json"]); err != nil {
-				return err
-			}
-			logger.InfoContext(ctx, "Upgrading installation", "from_revision", previous.SourceCommit)
-		}
 		nextStep("publish_node_metadata")
-		// The receipt keeps every retained release authenticated; old releases stay
-		// for the nodes that still run them.
 		names := []string{}
-		for name := range previous.Files {
-			if strings.HasPrefix(name, "node-payload/releases/") {
-				names = append(names, name)
-			}
-		}
-		prefix := "node-payload/releases/" + release.revision + "/"
+		prefix := "node-payload/"
 		for _, name := range releaseMembers {
 			if err := writeOwned(filepath.Join(root, prefix+name), files[name]); err != nil {
 				return err
@@ -309,49 +290,14 @@ func initialize(root string, release releaseIdentity, fetch func() (map[string][
 			receipt.Files[name] = checksum
 		}
 		raw, _ = json.Marshal(receipt)
-		// The receipt is the commit point; the pointer follows it.
 		if err := writeOwned(marker, raw); err != nil {
 			return err
 		}
-		if err := writePointer(root, release); err != nil {
-			return err
-		}
 		logger.InfoContext(ctx, "Installation initialized", "sign_in_key_command", "docker compose exec web oac-web core-key")
 		return nil
 	})
 }
 
-// writePointer selects the installation's release for Web and node installs.
-func writePointer(root string, release releaseIdentity) error {
-	active, _ := json.Marshal(map[string]string{"source_commit": release.revision})
-	return writeOwned(filepath.Join(root, "node-payload", "active.json"), active)
-}
-
-// requireNewer refuses a release that is not newer than the installed one by
-// commit time. A manifest without source_time reads as 0, the oldest.
-func requireNewer(root, installed string, release releaseIdentity, manifest []byte) error {
-	raw, err := os.ReadFile(filepath.Join(root, "node-payload", "releases", installed, "manifest.json"))
-	if errors.Is(err, fs.ErrNotExist) {
-		return fmt.Errorf("installation receipt names release %.12s, whose node metadata is missing; restore the matching data directory", installed)
-	}
-	if err != nil {
-		return err
-	}
-	var current, next releaseManifest
-	if err := json.Unmarshal(raw, &current); err != nil {
-		return err
-	}
-	if err := json.Unmarshal(manifest, &next); err != nil {
-		return err
-	}
-	if next.SourceTime > current.SourceTime {
-		return nil
-	}
-	date := func(seconds int64) string { return time.Unix(seconds, 0).UTC().Format("2006-01-02 15:04 UTC") }
-	return fmt.Errorf("This installation runs release %.12s (%s); this release, %.12s (%s), is not newer. Downgrades are not supported: run that release or a newer one, or restore the backup taken before the upgrade.",
-		installed, date(current.SourceTime), release.revision, date(next.SourceTime))
-}
-
 func randomBytes(n int) []byte {
 	value := make([]byte, n)
 	if _, err := rand.Read(value); err != nil {
diff --git a/services/core/cmd/oac/init_test.go b/services/core/cmd/oac/init_test.go
index 5f0864978..64a2681e9 100644
--- a/services/core/cmd/oac/init_test.go
+++ b/services/core/cmd/oac/init_test.go
@@ -25,22 +25,17 @@ func initFixture(t *testing.T) (string, releaseIdentity, map[string][]byte) {
 	previous := chown
 	chown = func(string, int, int) error { return nil }
 	t.Cleanup(func() { chown = previous })
-	release, files := releaseFixture(strings.Repeat("d", 40), 1760000000)
+	release, files := releaseFixture(strings.Repeat("d", 40))
 	return t.TempDir(), release, files
 }
 
-// releaseFixture returns one release's metadata. A zero sourceTime omits
-// source_time, as v0.0.10 and v0.0.11 manifests do.
-func releaseFixture(revision string, sourceTime int64) (releaseIdentity, map[string][]byte) {
+// releaseFixture returns one release's metadata.
+func releaseFixture(revision string) (releaseIdentity, map[string][]byte) {
 	files := map[string][]byte{}
 	for _, name := range releaseMembers {
 		files[name] = []byte("fixture " + revision)
 	}
-	manifest := map[string]any{"source_commit": revision, "platform": "linux/amd64"}
-	if sourceTime != 0 {
-		manifest["source_time"] = sourceTime
-	}
-	files["manifest.json"], _ = json.Marshal(manifest)
+	files["manifest.json"], _ = json.Marshal(map[string]any{"source_commit": revision, "platform": "linux/amd64"})
 	return releaseIdentity{revision}, files
 }
 
@@ -154,75 +149,19 @@ func readReceipt(t *testing.T, root string) installReceipt {
 	return receipt
 }
 
-func TestInitializeUpgradesAnOlderInstallationInPlace(t *testing.T) {
-	root, release, files := initFixture(t)
-	old, oldFiles := releaseFixture(strings.Repeat("c", 40), 0)
-	if err := initialize(root, old, fixed(oldFiles)); err != nil {
-		t.Fatal(err)
-	}
-	// Receipts written by v0.0.10 and v0.0.11 also pin the release pointer.
-	receipt := readReceipt(t, root)
-	pointer := filepath.Join(root, "node-payload", "active.json")
-	receipt.Files["node-payload/active.json"], _ = fileDigest(pointer)
-	raw, _ := json.Marshal(receipt)
-	if err := os.WriteFile(filepath.Join(root, "installation.json"), raw, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	before := snapshot(t, root)
-
-	if err := initialize(root, release, fixed(files)); err != nil {
-		t.Fatal(err)
-	}
-	after := snapshot(t, root)
-	for name, data := range before {
-		if (strings.HasPrefix(name, "secrets/") || strings.HasPrefix(name, "node-payload/releases/")) && after[name] != data {
-			t.Fatalf("upgrade changed %s", name)
-		}
-	}
-	receipt = readReceipt(t, root)
-	if receipt.SourceCommit != release.revision {
-		t.Fatalf("receipt release = %s", receipt.SourceCommit)
-	}
-	for _, revision := range []string{old.revision, release.revision} {
-		for _, name := range releaseMembers {
-			if receipt.Files["node-payload/releases/"+revision+"/"+name] == "" {
-				t.Fatalf("receipt lacks %s of %s", name, revision)
-			}
-		}
-	}
-	if _, pinned := receipt.Files["node-payload/active.json"]; pinned {
-		t.Fatal("receipt still pins the release pointer")
-	}
-	want := `{"source_commit":"` + release.revision + `"}`
-	if after["node-payload/active.json"] != want {
-		t.Fatalf("pointer = %s", after["node-payload/active.json"])
-	}
-
-	// A crash between the receipt and the pointer heals on the next start.
-	if err := os.WriteFile(pointer, []byte(before["node-payload/active.json"]), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if err := initialize(root, release, refuseDownload(t)); err != nil {
-		t.Fatal(err)
-	}
-	if healed, _ := os.ReadFile(pointer); string(healed) != want {
-		t.Fatalf("pointer = %s", healed)
-	}
-}
-
-func TestInitializeRefusesAnOlderRelease(t *testing.T) {
+func TestInitializeRefusesDataOfAnotherRelease(t *testing.T) {
 	root, release, files := initFixture(t)
 	if err := initialize(root, release, fixed(files)); err != nil {
 		t.Fatal(err)
 	}
 	before := snapshot(t, root)
-	older, olderFiles := releaseFixture(strings.Repeat("e", 40), 1700000000)
-	want := "This installation runs release dddddddddddd (2025-10-09 08:53 UTC); this release, eeeeeeeeeeee (2023-11-14 22:13 UTC), is not newer. Downgrades are not supported: run that release or a newer one, or restore the backup taken before the upgrade."
-	if err := initialize(root, older, fixed(olderFiles)); err == nil || err.Error() != want {
+	other, otherFiles := releaseFixture(strings.Repeat("e", 40))
+	want := "existing data belongs to release dddddddddddd; to use release eeeeeeeeeeee, uninstall the installation, which deletes its data, then install again"
+	if err := initialize(root, other, fixed(otherFiles)); err == nil || err.Error() != want {
 		t.Fatalf("err = %v", err)
 	}
 	if !maps.Equal(before, snapshot(t, root)) {
-		t.Fatal("a refused downgrade changed installation files")
+		t.Fatal("a refused release changed installation files")
 	}
 }
 
diff --git a/services/core/cmd/oac/install.go b/services/core/cmd/oac/install.go
index 2ebb1b700..2f948fa52 100644
--- a/services/core/cmd/oac/install.go
+++ b/services/core/cmd/oac/install.go
@@ -30,7 +30,6 @@ import (
 type installOptions struct {
 	dir, version, publicURL, host string
 	port                          int
-	upgrade                       bool
 	// given names the settings flags the caller passed, which an existing installation ignores.
 	given []string
 }
@@ -52,7 +51,6 @@ func installCommand(ctx context.Context, args []string) error {
 	flags.StringVar(&o.publicURL, "public-url", "", "URL reachable by browsers and nodes")
 	flags.StringVar(&o.host, "host", "0.0.0.0", "Web bind address")
 	flags.IntVar(&o.port, "web-port", 8080, "Web port")
-	flags.BoolVar(&o.upgrade, "upgrade", false, "upgrade an existing installation to this release")
 	// The flag package's own report would repeat the error main prints.
 	flags.SetOutput(io.Discard)
 	if err := flags.Parse(args); err != nil {
@@ -252,10 +250,6 @@ func (i installer) installLocked(ctx context.Context, o installOptions, detected
 		return err
 	}
 	fresh := len(entries) == 0
-	if fresh && o.upgrade {
-		return fmt.Errorf("No installation in %s; pass the installation's --install-dir.", o.dir)
-	}
-	installed := buildRevision
 	if !fresh {
 		for _, name := range []string{"compose.yaml", ".env", cliName()} {
 			info, err := os.Lstat(filepath.Join(o.dir, name))
@@ -267,23 +261,21 @@ func (i installer) installLocked(ctx context.Context, o installOptions, detected
 		if err != nil {
 			return err
 		}
-		if installed = composeRevision(raw); installed == "" {
+		installed := composeRevision(raw)
+		if installed == "" {
 			return fmt.Errorf("incomplete installation: preserve %s and choose another directory", o.dir)
 		}
-	}
-	upgrade := installed != buildRevision
-	if upgrade && !o.upgrade {
-		return fmt.Errorf("This installation runs release %s; this installer is %s. Back up the installation (Upgrade in the operations guide), then rerun with --upgrade.", short(installed), short(buildRevision))
+		if installed != buildRevision {
+			return fmt.Errorf("This installation runs release %s; this installer is %s. To use this release, uninstall the installation, which deletes its data, then install again.", short(installed), short(buildRevision))
+		}
 	}
 	compose := installCompose{docker: i.docker, dir: o.dir}
-	if fresh || upgrade {
-		if fresh {
-			listener, err := net.Listen("tcp", net.JoinHostPort(o.host, strconv.Itoa(o.port)))
-			if err != nil {
-				return fmt.Errorf("Web port unavailable; choose --web-port: %w%s", err, i.portHolderHint(ctx, o.port))
-			}
-			listener.Close()
+	if fresh {
+		listener, err := net.Listen("tcp", net.JoinHostPort(o.host, strconv.Itoa(o.port)))
+		if err != nil {
+			return fmt.Errorf("Web port unavailable; choose --web-port: %w%s", err, i.portHolderHint(ctx, o.port))
 		}
+		listener.Close()
 		if err := os.Mkdir(stage, 0o700); err != nil {
 			return err
 		}
@@ -299,20 +291,11 @@ func (i installer) installLocked(ctx context.Context, o installOptions, detected
 		if err := os.WriteFile(filepath.Join(stage, "compose.yaml"), release, 0o600); err != nil {
 			return err
 		}
-		if fresh {
-			contents := fmt.Sprintf("COMPOSE_PROJECT_NAME=oac-%s\nOAC_HOST='%s'\nOAC_WEB_PORT='%d'\nOAC_PUBLIC_URL='%s'\n", randomHex(5), o.host, o.port, o.publicURL)
-			if err := os.WriteFile(filepath.Join(stage, ".env"), []byte(contents), 0o600); err != nil {
-				return err
-			}
-			compose.dir = stage
-		} else {
-			// The staged release runs with the installation's settings, project name and override.
-			compose.files = []string{"-f", filepath.Join(stage, "compose.yaml")}
-			if _, err := os.Stat(filepath.Join(o.dir, "compose.override.yaml")); err == nil {
-				compose.files = append(compose.files, "-f", filepath.Join(o.dir, "compose.override.yaml"))
-			}
-			compose.files = append(compose.files, "--project-directory", o.dir)
+		contents := fmt.Sprintf("COMPOSE_PROJECT_NAME=oac-%s\nOAC_HOST='%s'\nOAC_WEB_PORT='%d'\nOAC_PUBLIC_URL='%s'\n", randomHex(5), o.host, o.port, o.publicURL)
+		if err := os.WriteFile(filepath.Join(stage, ".env"), []byte(contents), 0o600); err != nil {
+			return err
 		}
+		compose.dir = stage
 		if err := copyExecutable(i.executable, filepath.Join(stage, cliName())); err != nil {
 			return err
 		}
@@ -336,24 +319,6 @@ func (i installer) installLocked(ctx context.Context, o installOptions, detected
 			return fmt.Errorf("Docker could not pull %s: %w\nImage pulls go through the Docker daemon, which does not use this shell's proxy settings: if the registry is unreachable, configure the daemon's proxy or a registry mirror, or install from the offline archive (Offline hosts in the installation options).", image, err)
 		}
 	}
-	if upgrade {
-		// Init upgrades the data volume or refuses; until then the running release is untouched.
-		fmt.Println("Checking the upgrade...")
-		for _, check := range [][]string{checkConfig, initVolume} {
-			if err := compose.Run(ctx, check...); err != nil {
-				return fmt.Errorf("Upgrade stopped; the running services are unchanged: %w", err)
-			}
-		}
-		for _, name := range []string{cliName(), "compose.yaml"} {
-			if err := os.Rename(filepath.Join(stage, name), filepath.Join(o.dir, name)); err != nil {
-				return err
-			}
-		}
-	}
-	if !fresh {
-		// Installations from earlier releases kept a checksum that no longer describes compose.yaml.
-		_ = os.Remove(filepath.Join(o.dir, "compose-sha256sums.txt"))
-	}
 	if fresh {
 		if _, err := os.Stat(o.dir); err == nil {
 			if err := os.Remove(o.dir); err != nil {
@@ -391,9 +356,6 @@ func (i installer) installLocked(ctx context.Context, o installOptions, detected
 		fmt.Printf("Core key: %s core-key --show\n", command)
 	}
 	fmt.Printf("Command: %s\n", command)
-	if upgrade {
-		fmt.Printf("Upgraded from %s to %s. Settings → Sandbox and scheduling offers this release's Runtime; sandboxes keep their current Runtime until you apply it.\n", short(installed), short(buildRevision))
-	}
 	if fresh && detected {
 		fmt.Printf("Browsers must open exactly %s. If they reach this host at another address, set OAC_PUBLIC_URL in .env and run %s apply.\n", origin, command)
 	}
@@ -415,7 +377,7 @@ func (i installer) portHolderHint(ctx context.Context, port int) string {
 			return fmt.Sprintf("\nThe Compose project %s holds it.", name)
 		}
 		if _, err := os.Stat(dir); err == nil {
-			return fmt.Sprintf("\nThe installation in %s holds it; upgrade or manage it with --install-dir %s.", dir, dir)
+			return fmt.Sprintf("\nThe installation in %s holds it; manage it with --install-dir %s.", dir, dir)
 		}
 		return fmt.Sprintf("\nThe Compose project %s holds it, and its installation directory %s no longer exists. Remove it with: docker compose -p %s down --volumes --remove-orphans (this deletes its data)", name, dir, name)
 	}
@@ -524,12 +486,11 @@ func copyExecutable(from, to string) error {
 type installCompose struct {
 	docker func(context.Context, string, ...string) ([]byte, error)
 	dir    string
-	files  []string
 }
 
 // Output reports a failure as the last line of Compose's output, which holds the cause; the progress lines before it only repeat what happened.
 func (c installCompose) Output(ctx context.Context, args ...string) ([]byte, error) {
-	output, err := c.docker(ctx, c.dir, append(append([]string{"compose"}, c.files...), args...)...)
+	output, err := c.docker(ctx, c.dir, append([]string{"compose"}, args...)...)
 	if err != nil {
 		if lines := strings.Split(strings.TrimSpace(err.Error()), "\n"); len(lines) > 1 {
 			err = errors.New(strings.TrimSpace(lines[len(lines)-1]))
diff --git a/services/core/cmd/oac/install_test.go b/services/core/cmd/oac/install_test.go
index 2a2311d2a..1960aa2d9 100644
--- a/services/core/cmd/oac/install_test.go
+++ b/services/core/cmd/oac/install_test.go
@@ -68,31 +68,13 @@ func newInstallFixture(t *testing.T) *installFixture {
 		}
 		return compose, nil
 	}
-	// Calls against the staged release are recorded with a "staged " prefix and without their file arguments.
 	f.docker = func(_ context.Context, dir string, args ...string) ([]byte, error) {
 		if _, err := os.Stat(dir); dir != "" && err != nil {
 			t.Fatalf("docker %v ran in a missing directory", args)
 		}
-		var words []string
-		staged := false
-		for i := 0; i < len(args); i++ {
-			if args[i] == "-f" || args[i] == "--project-directory" {
-				staged = staged || strings.HasPrefix(args[i+1], f.options.dir+".staging")
-				i++
-				continue
-			}
-			words = append(words, args[i])
-		}
-		command := strings.Join(words, " ")
-		if staged {
-			if f.installedRevision() == buildRevision {
-				t.Fatal("release published before its checks")
-			}
-			f.calls = append(f.calls, "staged "+command)
-		} else {
-			f.calls = append(f.calls, command)
-		}
-		if f.failure != "" && strings.HasPrefix(f.calls[len(f.calls)-1], f.failure) {
+		command := strings.Join(args, " ")
+		f.calls = append(f.calls, command)
+		if f.failure != "" && strings.HasPrefix(command, f.failure) {
 			if f.failureErr != nil {
 				return nil, f.failureErr
 			}
@@ -211,7 +193,6 @@ func TestDownloadRetriesTransientFailures(t *testing.T) {
 }
 
 func TestInstallResumePreservesConfigAndUsesCachedImages(t *testing.T) {
-	// The same release resumes with or without --upgrade.
 	f := newInstallFixture(t)
 	f.failure = "compose up"
 	if err := f.run(); err == nil {
@@ -229,7 +210,6 @@ func TestInstallResumePreservesConfigAndUsesCachedImages(t *testing.T) {
 		return nil, nil
 	}
 	f.options.publicURL = "https://replacement.invalid"
-	f.options.upgrade = true
 	if err := f.run(); err != nil {
 		t.Fatal(err)
 	}
@@ -246,54 +226,24 @@ func TestInstallResumePreservesConfigAndUsesCachedImages(t *testing.T) {
 	assertCallsInOrder(t, f.calls, "compose "+strings.Join(initVolume, " "), "compose "+strings.Join(checkConfig, " "), "compose "+strings.Join(startServices, " "))
 }
 
-func TestInstallUpgradesAnotherReleaseOnlyWhenRequested(t *testing.T) {
+func TestInstallRefusesAnotherRelease(t *testing.T) {
 	f := newInstallFixture(t)
 	setBuildRevision(t, "a1b2c3d4e5f6a7b8c9d0a1b2c3d4e5f6a7b8c9d0")
 	if err := f.run(); err != nil {
 		t.Fatal(err)
 	}
-	os.WriteFile(filepath.Join(f.options.dir, "compose-sha256sums.txt"), []byte("previous release"), 0o600)
 	before := installationFiles(t, f.options.dir)
 	setBuildRevision(t, "development")
-	os.WriteFile(f.executable, []byte("upgraded binary"), 0o700)
-
 	f.calls = nil
 	err := f.run()
-	if err == nil || err.Error() != "This installation runs release a1b2c3d4e5f6; this installer is development. Back up the installation (Upgrade in the operations guide), then rerun with --upgrade." {
+	if err == nil || err.Error() != "This installation runs release a1b2c3d4e5f6; this installer is development. To use this release, uninstall the installation, which deletes its data, then install again." {
 		t.Fatal(err)
 	}
 	if len(f.calls) != 3 {
 		t.Fatalf("refusal ran Docker beyond its checks: %v", f.calls)
 	}
-
-	f.options.upgrade = true
-	f.failure = "staged compose run --rm --no-deps init"
-	if err := f.run(); err == nil || !strings.HasPrefix(err.Error(), "Upgrade stopped; the running services are unchanged") {
-		t.Fatal(err)
-	}
 	if after := installationFiles(t, f.options.dir); !maps.Equal(before, after) {
-		t.Fatal("refused upgrade changed the installation directory")
-	}
-	if _, err := os.Stat(f.options.dir + ".staging"); !os.IsNotExist(err) {
-		t.Fatal("refused upgrade left its stage")
-	}
-
-	f.failure = ""
-	f.calls = nil
-	if err := f.run(); err != nil {
-		t.Fatal(err)
-	}
-	assertCallsInOrder(t, f.calls,
-		"pull example/core:latest",
-		"staged compose "+strings.Join(checkConfig, " "),
-		"staged compose run --rm --no-deps init",
-		"compose up -d --wait --wait-timeout 180 --pull never --remove-orphans")
-	after := installationFiles(t, f.options.dir)
-	if after[cliName()] != "upgraded binary" || after[".env"] != before[".env"] || f.installedRevision() != "development" {
-		t.Fatal("upgrade did not publish the release with the saved settings")
-	}
-	if _, ok := after["compose-sha256sums.txt"]; ok {
-		t.Fatal("upgrade kept the previous release checksum")
+		t.Fatal("refusal changed the installation directory")
 	}
 }
 
@@ -442,7 +392,6 @@ func captureOutput(t *testing.T, fn func()) string {
 
 func TestFreshInstallStartsLikeApplyAndPrintsTheKeyOnce(t *testing.T) {
 	f := newInstallFixture(t)
-	f.options.upgrade = false
 	var err error
 	out := captureOutput(t, func() { err = f.run() })
 	if err != nil {
@@ -476,7 +425,7 @@ func TestInstallReportsStartFailuresByCause(t *testing.T) {
 		call, stderr, want, unwanted string
 	}{
 		// A refusal is not fixed by rerunning, and only its own line is shown.
-		{"compose run --rm --no-deps init", "{\"msg\":\"Initialization started\"}\nthis data belongs to a newer release", "data volume check failed; no service was changed: this data belongs to a newer release", "startup failed"},
+		{"compose run --rm --no-deps init", "{\"msg\":\"Initialization started\"}\nexisting data belongs to release 0123456789ab", "data volume check failed; no service was changed: existing data belongs to release 0123456789ab", "startup failed"},
 		{"compose run --rm --no-deps --entrypoint", "OAC_EXECUTION_CONCURRENCY must be positive", "configuration check failed; no service was changed: OAC_EXECUTION_CONCURRENCY must be positive", "startup failed"},
 		{"compose up", progress, "startup failed; data retained, rerun the installer: dependency failed to start: container x-core-1 is unhealthy\nNot healthy: core (unhealthy), web (starting)\nSee why: docker compose -f '", "Healthy"},
 	} {
diff --git a/services/core/cmd/oac/main.go b/services/core/cmd/oac/main.go
index caa970331..fb8975bce 100644
--- a/services/core/cmd/oac/main.go
+++ b/services/core/cmd/oac/main.go
@@ -184,7 +184,7 @@ func accessError(root string, err error) error {
 var (
 	initVolume  = []string{"run", "--rm", "--no-deps", "init"}
 	checkConfig = []string{"run", "--rm", "--no-deps", "--entrypoint", "/usr/local/bin/oac-core", "core", "check-config"}
-	// Starting recreates changed services, so a resumed upgrade leaves no container on the previous release.
+	// Starting recreates changed services.
 	startServices = []string{"up", "-d", "--wait", "--wait-timeout", "180", "--pull", "never", "--remove-orphans"}
 )
 
diff --git a/services/core/cmd/oac/uninstall_test.go b/services/core/cmd/oac/uninstall_test.go
index f6c7fbc8c..e6b50d5de 100644
--- a/services/core/cmd/oac/uninstall_test.go
+++ b/services/core/cmd/oac/uninstall_test.go
@@ -171,14 +171,3 @@ func TestInstallPortHintOffersDeletionOnlyForAMissingDirectory(t *testing.T) {
 		}
 	}
 }
-
-func TestUpgradeWithoutAnInstallationRefuses(t *testing.T) {
-	f := newInstallFixture(t)
-	f.options.upgrade = true
-	if err := f.run(); err == nil || !strings.Contains(err.Error(), "No installation in "+f.options.dir) {
-		t.Fatal(err)
-	}
-	if exists(f.options.dir) || exists(f.options.dir+".staging") {
-		t.Fatal("a refused upgrade left files")
-	}
-}
diff --git a/services/core/cmd/sandbox-node/generations.go b/services/core/cmd/sandbox-node/generations.go
index 136aabac9..6274e89b0 100644
--- a/services/core/cmd/sandbox-node/generations.go
+++ b/services/core/cmd/sandbox-node/generations.go
@@ -40,14 +40,9 @@ func runGenerations(ctx context.Context, registry *providerconfig.Registry, conf
 	if err != nil {
 		return err
 	}
-	pending, err := filepath.Glob(filepath.Join(stateDir, "generations", "*.preparing"))
-	if err != nil {
-		return err
-	}
-	paths = append(append([]string{configFile}, paths...), pending...)
+	paths = append([]string{configFile}, paths...)
 	values := map[uint64]node.GenerationProvider{}
 	recovery := []sandbox.GenerationReference{}
-	collection := []sandbox.GenerationReference{}
 	seen := map[uint64]sandbox.NodeConfig{}
 	closeValues := func() {
 		for _, v := range values {
@@ -57,19 +52,7 @@ func runGenerations(ctx context.Context, registry *providerconfig.Registry, conf
 		}
 	}
 	for _, path := range paths {
-		var config sandbox.NodeConfig
-		if strings.HasSuffix(path, ".preparing") {
-			journal, readErr := readGenerationJournal(path)
-			err = readErr
-			if err == nil && journal.Configuration == nil {
-				err = sandbox.ErrOwnership
-			}
-			if err == nil {
-				config = *journal.Configuration
-			}
-		} else {
-			config, err = providerconfig.Load(path)
-		}
+		config, err := providerconfig.Load(path)
 		if err != nil {
 			closeValues()
 			return err
@@ -78,16 +61,16 @@ func runGenerations(ctx context.Context, registry *providerconfig.Registry, conf
 			closeValues()
 			return sandbox.ErrOwnership
 		}
-		if path != configFile && strings.TrimSuffix(strings.TrimSuffix(filepath.Base(path), ".json"), ".preparing") != strconv.FormatUint(config.Generation, 10) {
+		if path != configFile && strings.TrimSuffix(filepath.Base(path), ".json") != strconv.FormatUint(config.Generation, 10) {
 			closeValues()
 			return sandbox.ErrOwnership
 		}
-		state, err := generationLocalState(config, stateDir)
+		dropped, err := generationDropped(config, stateDir)
 		if err != nil {
 			closeValues()
 			return err
 		}
-		if state == "dropped" {
+		if dropped {
 			continue
 		}
 		if previous, ok := seen[config.Generation]; ok {
@@ -98,14 +81,6 @@ func runGenerations(ctx context.Context, registry *providerconfig.Registry, conf
 			continue
 		}
 		seen[config.Generation] = config
-		if state == "preparing" {
-			recovery = append(recovery, sandbox.GenerationReference{Generation: config.Generation, SpecificationDigest: config.Specification.Digest(config.Provider)})
-			continue
-		}
-		if state == "collecting" {
-			collection = append(collection, sandbox.GenerationReference{Generation: config.Generation, SpecificationDigest: config.Specification.Digest(config.Provider)})
-			continue
-		}
 		value, err := buildGeneration(registry, config, stateDir)
 		if errors.Is(err, os.ErrNotExist) {
 			recovery = append(recovery, sandbox.GenerationReference{Generation: config.Generation, SpecificationDigest: config.Specification.Digest(config.Provider)})
@@ -135,7 +110,7 @@ func runGenerations(ctx context.Context, registry *providerconfig.Registry, conf
 	for _, v := range values {
 		initial = append(initial, v)
 	}
-	manager, err := node.NewGenerationManager(ctx, node.GenerationManagerOptions{Initial: initial, Recover: recovery, Collect: collection,
+	manager, err := node.NewGenerationManager(ctx, node.GenerationManagerOptions{Initial: initial, Recover: recovery,
 		Prepare: func(ctx context.Context, generation uint64, digest string) (node.GenerationProvider, error) {
 			if err := runHelper(ctx, "prepare", generation, digest); err != nil {
 				return node.GenerationProvider{}, err
@@ -176,12 +151,9 @@ func buildGeneration(registry *providerconfig.Registry, config sandbox.NodeConfi
 }
 
 type generationJournal struct {
-	InstallationID      string              `json:"installation_id"`
-	Generation          uint64              `json:"generation"`
-	SpecificationDigest string              `json:"specification_digest"`
-	NativeComplete      json.RawMessage     `json:"native_complete,omitempty"`
-	ImportStarted       json.RawMessage     `json:"import_started,omitempty"`
-	Configuration       *sandbox.NodeConfig `json:"configuration,omitempty"`
+	InstallationID      string `json:"installation_id"`
+	Generation          uint64 `json:"generation"`
+	SpecificationDigest string `json:"specification_digest"`
 }
 
 func readGenerationJournal(path string) (generationJournal, error) {
@@ -211,62 +183,43 @@ func readGenerationJournal(path string) (generationJournal, error) {
 	return journal, nil
 }
 
-// The preparation configuration is an immutable plan, never a usable provider.
-// A generation's Core-visible envelope is fixed; native is the adapter's
-// node-local state, which preparation may resolve and the adapter validates
-// when it builds.
+// sameGenerationPlan compares the Core-visible envelope of two copies of one
+// generation; native is the adapter's node-local state.
 func sameGenerationPlan(final, plan sandbox.NodeConfig) bool {
 	final.Native, plan.Native = nil, nil
 	return reflect.DeepEqual(final, plan)
 }
 
-// Pending-only entries stay recovery/collection-only. No journal is readiness
-// or authority to collect without a fresh current-connection Core grant.
-func generationLocalState(config sandbox.NodeConfig, stateDir string) (string, error) {
+// generationDropped reports whether the permanent dropped receipt names this
+// generation. No receipt is readiness or authority to collect without a fresh
+// current-connection Core grant.
+func generationDropped(config sandbox.NodeConfig, stateDir string) (bool, error) {
 	directory := filepath.Join(stateDir, "generations")
 	info, err := os.Lstat(directory)
 	if os.IsNotExist(err) {
-		return "", nil
+		return false, nil
 	}
 	if err != nil {
-		return "", err
+		return false, err
 	}
 	owner, ok := info.Sys().(*syscall.Stat_t)
 	resolved, err := filepath.EvalSymlinks(directory)
 	if err != nil || resolved != directory || !info.IsDir() || info.Mode().Perm() != 0700 || !ok || owner.Uid != uint32(os.Getuid()) {
-		return "", sandbox.ErrOwnership
+		return false, sandbox.ErrOwnership
 	}
-	state := ""
-	for _, suffix := range []string{".preparing", ".collecting", ".dropped"} {
-		path := filepath.Join(directory, strconv.FormatUint(config.Generation, 10)+suffix)
-		journal, err := readGenerationJournal(path)
-		if errors.Is(err, os.ErrNotExist) {
-			continue
-		}
-		if err != nil || journal.InstallationID != config.InstallationID || journal.Generation != config.Generation || journal.SpecificationDigest != config.Specification.Digest(config.Provider) {
-			return "", sandbox.ErrOwnership
-		}
-		if suffix == ".preparing" {
-			if len(journal.NativeComplete) != 0 || (string(journal.ImportStarted) != "true" && string(journal.ImportStarted) != "false") || journal.Configuration == nil || !sameGenerationPlan(config, *journal.Configuration) {
-				return "", sandbox.ErrOwnership
-			}
-		} else if len(journal.ImportStarted) != 0 || journal.Configuration != nil || suffix == ".collecting" && string(journal.NativeComplete) != "true" && string(journal.NativeComplete) != "false" || suffix == ".dropped" && len(journal.NativeComplete) != 0 {
-			return "", sandbox.ErrOwnership
-		}
-		state = strings.TrimPrefix(suffix, ".")
+	journal, err := readGenerationJournal(filepath.Join(directory, strconv.FormatUint(config.Generation, 10)+".dropped"))
+	if errors.Is(err, os.ErrNotExist) {
+		return false, nil
 	}
-	return state, nil
+	if err != nil || journal.InstallationID != config.InstallationID || journal.Generation != config.Generation || journal.SpecificationDigest != config.Specification.Digest(config.Provider) {
+		return false, sandbox.ErrOwnership
+	}
+	return true, nil
 }
 
-// Exit 65 is reserved by the private preparer for artifact transfer/provenance.
-// Arbitrary provider output never selects a wire diagnostic.
 func generationHelperError(ctx context.Context, err error) error {
 	if ctx.Err() != nil {
 		return ctx.Err()
 	}
-	var exit *exec.ExitError
-	if errors.As(err, &exit) && exit.ExitCode() == 65 {
-		return sandbox.ErrRuntimeDownloadFailed
-	}
 	return errors.New("local generation operation did not complete")
 }
diff --git a/services/core/cmd/sandbox-node/generations_test.go b/services/core/cmd/sandbox-node/generations_test.go
index ae08f7ad0..d830b300c 100644
--- a/services/core/cmd/sandbox-node/generations_test.go
+++ b/services/core/cmd/sandbox-node/generations_test.go
@@ -14,143 +14,95 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
-func TestGenerationJournalRestartIdentity(t *testing.T) {
+func TestGenerationDroppedReceiptIdentity(t *testing.T) {
 	config := sandbox.NodeConfig{InstallationID: "installation", Generation: 9, Provider: "docker"}
 	stateDir := t.TempDir()
 	directory := filepath.Join(stateDir, "generations")
 	if err := os.Mkdir(directory, 0700); err != nil {
 		t.Fatal(err)
 	}
+	path := filepath.Join(directory, "9.dropped")
 	journal := map[string]any{"installation_id": config.InstallationID, "generation": config.Generation, "specification_digest": config.Specification.Digest(config.Provider)}
-	for _, suffix := range []string{".collecting", ".dropped"} {
-		t.Run(suffix, func(t *testing.T) {
-			path := filepath.Join(directory, "9"+suffix)
-			if suffix == ".collecting" {
-				journal["native_complete"] = true
-			} else {
-				delete(journal, "native_complete")
-			}
-			write := func(value map[string]any) {
-				raw, _ := json.Marshal(value)
-				if err := os.WriteFile(path, raw, 0600); err != nil {
-					t.Fatal(err)
-				}
-			}
-			write(journal)
-			state, err := generationLocalState(config, stateDir)
-			if err != nil || state != suffix[1:] {
-				t.Fatal(state, err)
-			}
-			for _, field := range []string{"installation_id", "generation", "specification_digest"} {
-				previous := journal[field]
-				journal[field] = "foreign"
-				write(journal)
-				if _, err = generationLocalState(config, stateDir); err == nil {
-					t.Fatal("accepted mismatched", field)
-				}
-				journal[field] = previous
-			}
-			journal["native_complete"] = nil
-			write(journal)
-			if _, err = generationLocalState(config, stateDir); err == nil {
-				t.Fatal("accepted null journal phase")
-			}
-			if suffix == ".collecting" {
-				journal["native_complete"] = true
-			} else {
-				delete(journal, "native_complete")
-			}
-			write(journal)
-			if err = os.Chmod(path, 0644); err != nil {
-				t.Fatal(err)
-			}
-			if _, err = generationLocalState(config, stateDir); err == nil {
-				t.Fatal("accepted non-private marker")
-			}
-			if err = os.Remove(path); err != nil {
-				t.Fatal(err)
-			}
-			foreign := filepath.Join(directory, "foreign")
-			raw, _ := json.Marshal(journal)
-			if err = os.WriteFile(foreign, raw, 0600); err != nil {
-				t.Fatal(err)
-			}
-			for _, link := range []func(string, string) error{os.Symlink, os.Link} {
-				if err = link(foreign, path); err != nil {
-					t.Fatal(err)
-				}
-				if _, err = generationLocalState(config, stateDir); err == nil {
-					t.Fatal("accepted linked journal")
-				}
-				if err = os.Remove(path); err != nil {
-					t.Fatal(err)
-				}
-			}
-			if err = syscall.Mkfifo(path, 0600); err != nil {
-				t.Fatal(err)
-			}
-			if _, err = generationLocalState(config, stateDir); err == nil {
-				t.Fatal("accepted FIFO journal")
-			}
-			if err = os.Remove(path); err != nil {
-				t.Fatal(err)
-			}
-		})
-	}
-}
-
-func TestGenerationHelperUsesOnlyTypedExit(t *testing.T) {
-	for _, code := range []string{"1", "65", "78"} {
-		err := exec.Command("sh", "-c", "exit "+code).Run()
-		got := generationHelperError(t.Context(), err)
-		if errors.Is(got, sandbox.ErrRuntimeDownloadFailed) != (code == "65") {
-			t.Fatal(code, got)
+	write := func(value map[string]any) {
+		raw, _ := json.Marshal(value)
+		if err := os.WriteFile(path, raw, 0600); err != nil {
+			t.Fatal(err)
 		}
-		ctx, cancel := context.WithCancel(t.Context())
-		cancel()
-		if !errors.Is(generationHelperError(ctx, err), context.Canceled) {
-			t.Fatal("cancellation was lost")
+	}
+	if dropped, err := generationDropped(config, stateDir); err != nil || dropped {
+		t.Fatal("absent receipt", dropped, err)
+	}
+	write(journal)
+	if dropped, err := generationDropped(config, stateDir); err != nil || !dropped {
+		t.Fatal(dropped, err)
+	}
+	for _, field := range []string{"installation_id", "generation", "specification_digest"} {
+		previous := journal[field]
+		journal[field] = "foreign"
+		write(journal)
+		if _, err := generationDropped(config, stateDir); err == nil {
+			t.Fatal("accepted mismatched", field)
 		}
+		journal[field] = previous
 	}
-	if errors.Is(generationHelperError(t.Context(), errors.New("runtime_download_failed")), sandbox.ErrRuntimeDownloadFailed) {
-		t.Fatal("parsed arbitrary provider text")
+	journal["native_complete"] = true
+	write(journal)
+	if _, err := generationDropped(config, stateDir); err == nil {
+		t.Fatal("accepted an unknown journal field")
 	}
-}
-
-func TestUnresolvedPreparationRemainsRecoveryOnly(t *testing.T) {
-	config := sandbox.NodeConfig{InstallationID: "installation", Generation: 2, Provider: "docker"}
-	stateDir := t.TempDir()
-	directory := filepath.Join(stateDir, "generations")
-	if err := os.Mkdir(directory, 0700); err != nil {
+	delete(journal, "native_complete")
+	write(journal)
+	if err := os.Chmod(path, 0644); err != nil {
 		t.Fatal(err)
 	}
-	path := filepath.Join(directory, "2.preparing")
-	for _, started := range []bool{false, true} {
-		raw, _ := json.Marshal(map[string]any{"installation_id": config.InstallationID, "generation": config.Generation, "specification_digest": config.Specification.Digest(config.Provider), "import_started": started, "configuration": config})
-		if err := os.WriteFile(path, raw, 0600); err != nil {
+	if _, err := generationDropped(config, stateDir); err == nil {
+		t.Fatal("accepted non-private marker")
+	}
+	if err := os.Remove(path); err != nil {
+		t.Fatal(err)
+	}
+	foreign := filepath.Join(directory, "foreign")
+	raw, _ := json.Marshal(journal)
+	if err := os.WriteFile(foreign, raw, 0600); err != nil {
+		t.Fatal(err)
+	}
+	for _, link := range []func(string, string) error{os.Symlink, os.Link} {
+		if err := link(foreign, path); err != nil {
 			t.Fatal(err)
 		}
-		journal, err := readGenerationJournal(path)
-		if err != nil || journal.Configuration == nil {
-			t.Fatal("pending-only discovery", err)
+		if _, err := generationDropped(config, stateDir); err == nil {
+			t.Fatal("accepted linked journal")
 		}
-		state, err := generationLocalState(*journal.Configuration, stateDir)
-		if err != nil || state != "preparing" {
-			t.Fatal(state, err)
-		}
-		if _, err := os.Stat(filepath.Join(directory, "2.json")); !os.IsNotExist(err) {
-			t.Fatal("unresolved plan published")
+		if err := os.Remove(path); err != nil {
+			t.Fatal(err)
 		}
 	}
+	if err := syscall.Mkfifo(path, 0600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := generationDropped(config, stateDir); err == nil {
+		t.Fatal("accepted FIFO journal")
+	}
+}
+
+func TestGenerationHelperKeepsCancellation(t *testing.T) {
+	err := exec.Command("sh", "-c", "exit 1").Run()
+	if got := generationHelperError(t.Context(), err); got == nil || errors.Is(got, context.Canceled) {
+		t.Fatal(got)
+	}
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	if !errors.Is(generationHelperError(ctx, err), context.Canceled) {
+		t.Fatal("cancellation was lost")
+	}
 }
 
 // Preparation may resolve native state, such as the digest a containerd image
 // store names the loaded Runtime image by; the envelope stays fixed.
 func TestGenerationPlanFixesOnlyTheEnvelope(t *testing.T) {
-	release := sandbox.RuntimeRelease{ImageID: "sha256:" + strings.Repeat("b", 64), ImageManifestDigest: "sha256:" + strings.Repeat("c", 64)}
-	plan := sandbox.NodeConfig{InstallationID: "installation", Generation: 2, Provider: "docker", Specification: sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048}, Runtime: &release}, Native: json.RawMessage(`{"image":"` + release.ImageID + `"}`)}
+	plan := sandbox.NodeConfig{InstallationID: "installation", Generation: 2, Provider: "docker", Specification: sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048}}, Native: json.RawMessage(`{"image":"sha256:` + strings.Repeat("b", 64) + `"}`)}
 	final := plan
-	final.Native = json.RawMessage(`{"image":"` + release.ImageManifestDigest + `"}`)
+	final.Native = json.RawMessage(`{"image":"sha256:` + strings.Repeat("c", 64) + `"}`)
 	if !sameGenerationPlan(final, plan) {
 		t.Fatal("refused a resolved native image")
 	}
@@ -186,7 +138,7 @@ func TestGenerationStateDirectoryOwnership(t *testing.T) {
 				}
 				stateDir = link
 			}
-			_, err := generationLocalState(sandbox.NodeConfig{Generation: 1}, stateDir)
+			_, err := generationDropped(sandbox.NodeConfig{Generation: 1}, stateDir)
 			if mode == "private" && err != nil || mode != "private" && !errors.Is(err, sandbox.ErrOwnership) {
 				t.Fatalf("directory ownership: %v", err)
 			}
diff --git a/services/core/cmd/sandbox-node/main.go b/services/core/cmd/sandbox-node/main.go
index 4e955be99..5b6695c6b 100644
--- a/services/core/cmd/sandbox-node/main.go
+++ b/services/core/cmd/sandbox-node/main.go
@@ -44,10 +44,6 @@ func exitCode(err error) int {
 }
 
 func run(ctx context.Context, args []string) error {
-	if len(args) == 1 && args[0] == "protocol-version" {
-		fmt.Println(node.ProtocolVersion)
-		return nil
-	}
 	if len(args) == 0 || (args[0] != "register" && args[0] != "run") {
 		return errors.New("usage: oac-node register|run --config PATH --state-dir PATH")
 	}
@@ -69,14 +65,10 @@ func run(ctx context.Context, args []string) error {
 	registry := providerconfig.Builtin()
 	if args[0] == "run" {
 		helper := filepath.Join(filepath.Dir(*configFile), "generation-preparer.pyz")
-		if info, err := os.Lstat(helper); err == nil {
-			if !info.Mode().IsRegular() || info.Mode().Perm() != 0600 {
-				return errors.New("generation preparer must be a private regular file")
-			}
-			return runGenerations(ctx, registry, *configFile, *stateDir)
-		} else if !os.IsNotExist(err) {
-			return err
+		if info, err := os.Lstat(helper); err != nil || !info.Mode().IsRegular() || info.Mode().Perm() != 0600 {
+			return errors.New("generation preparer must be a private regular file")
 		}
+		return runGenerations(ctx, registry, *configFile, *stateDir)
 	}
 	config, err := providerconfig.Load(*configFile)
 	if err != nil {
@@ -92,63 +84,41 @@ func run(ctx context.Context, args []string) error {
 		return errors.New("node configuration requires one local provider backend")
 	}
 	expected := node.Identity{SpecificationDigest: built.SpecificationDigest, DeploymentGeneration: config.Generation, InstallationID: built.InstallationID, Provider: config.Provider, BackendFingerprint: built.BackendFingerprint}
-	probe := func(ctx context.Context) (node.Health, error) {
-		checkpoint, err := built.Probe(ctx)
-		status := sandbox.GenerationStatus{Generation: config.Generation, SpecificationDigest: built.SpecificationDigest, State: "ready", Checkpoint: checkpoint}
-		if err != nil {
-			status.State, status.Diagnostic, status.Checkpoint = "failed", sandbox.NodeDiagnostic(err), nil
-		}
-		return node.Health{ProviderReady: err == nil, Generations: []sandbox.GenerationStatus{status}}, err
+	if !filepath.IsAbs(*tokenFile) {
+		return errors.New("enrollment-token-file must be absolute")
 	}
-	if args[0] == "register" {
-		if !filepath.IsAbs(*tokenFile) {
-			return errors.New("enrollment-token-file must be absolute")
-		}
 
-		fd, err := syscall.Open(*tokenFile, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0)
-		if err != nil {
-			return errors.New("cannot open enrollment token")
-		}
-		file := os.NewFile(uintptr(fd), "enrollment token")
-		st, err := file.Stat()
-		if err != nil || !st.Mode().IsRegular() || st.Mode().Perm() != 0600 {
-			file.Close()
-			return errors.New("enrollment token must be a private regular file (0600)")
-		}
-		raw, err := io.ReadAll(io.LimitReader(file, 4097))
+	fd, err := syscall.Open(*tokenFile, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0)
+	if err != nil {
+		return errors.New("cannot open enrollment token")
+	}
+	file := os.NewFile(uintptr(fd), "enrollment token")
+	st, err := file.Stat()
+	if err != nil || !st.Mode().IsRegular() || st.Mode().Perm() != 0600 {
 		file.Close()
-		if err != nil {
-			return errors.New("cannot read enrollment token")
-		}
-		token := strings.TrimSpace(string(raw))
-		if token == "" || len(token) > 4096 {
-			return errors.New("invalid enrollment token")
-		}
-		if _, err = node.InitIdentity(*stateDir, *coreURL, expected); err != nil {
-			return err
-		}
-		probeCtx, stopProbe := context.WithTimeout(ctx, 5*time.Second)
-		_, err = probe(probeCtx)
-		stopProbe()
-		if err != nil {
-			return fmt.Errorf("local provider readiness check failed (%s): %w", sandbox.NodeDiagnostic(err), err)
-		}
-		stored, err := node.Enroll(ctx, *coreURL, *stateDir, token, node.EnrollmentRequest{Name: *name})
-		if err != nil {
-			return err
-		}
-		return json.NewEncoder(os.Stdout).Encode(node.EnrollmentResponse{MaxActive: stored.Identity.MaxActive, MaxRetained: stored.Identity.MaxRetained, SpecificationDigest: stored.Identity.SpecificationDigest, DeploymentGeneration: stored.Identity.DeploymentGeneration, NodeID: stored.Identity.NodeID, InstallationID: stored.Identity.InstallationID, Provider: stored.Identity.Provider})
+		return errors.New("enrollment token must be a private regular file (0600)")
 	}
-	stored, err := node.RefreshIdentity(ctx, *stateDir)
+	raw, err := io.ReadAll(io.LimitReader(file, 4097))
+	file.Close()
 	if err != nil {
+		return errors.New("cannot read enrollment token")
+	}
+	token := strings.TrimSpace(string(raw))
+	if token == "" || len(token) > 4096 {
+		return errors.New("invalid enrollment token")
+	}
+	if _, err = node.InitIdentity(*stateDir, *coreURL, expected); err != nil {
 		return err
 	}
-	expected.NodeID = stored.Identity.NodeID
-	if expected.SpecificationDigest != stored.Identity.SpecificationDigest || expected.DeploymentGeneration != stored.Identity.DeploymentGeneration || expected.InstallationID != stored.Identity.InstallationID || expected.Provider != stored.Identity.Provider || expected.BackendFingerprint != stored.Identity.BackendFingerprint {
-		return errors.New("provider configuration differs from retained node identity")
+	probeCtx, stopProbe := context.WithTimeout(ctx, 5*time.Second)
+	_, err = built.Probe(probeCtx)
+	stopProbe()
+	if err != nil {
+		return fmt.Errorf("local provider readiness check failed (%s): %w", sandbox.NodeDiagnostic(err), err)
 	}
-	if *coreURL != "" && *coreURL != stored.CoreURL {
-		return errors.New("run uses the retained Core URL")
+	stored, err := node.Enroll(ctx, *coreURL, *stateDir, token, node.EnrollmentRequest{Name: *name})
+	if err != nil {
+		return err
 	}
-	return node.Run(ctx, node.AgentConfig{CoreURL: stored.CoreURL, StateDirectory: *stateDir, Identity: stored.Identity, Credential: stored.Credential, Provider: built.Provider, Probe: probe})
+	return json.NewEncoder(os.Stdout).Encode(node.EnrollmentResponse{MaxActive: stored.Identity.MaxActive, MaxRetained: stored.Identity.MaxRetained, SpecificationDigest: stored.Identity.SpecificationDigest, DeploymentGeneration: stored.Identity.DeploymentGeneration, NodeID: stored.Identity.NodeID, InstallationID: stored.Identity.InstallationID, Provider: stored.Identity.Provider})
 }
diff --git a/services/core/cmd/sandbox-node/main_test.go b/services/core/cmd/sandbox-node/main_test.go
index 4da4298bc..b83e08a41 100644
--- a/services/core/cmd/sandbox-node/main_test.go
+++ b/services/core/cmd/sandbox-node/main_test.go
@@ -58,13 +58,3 @@ func refreshIdentity(t *testing.T, coreURL string) error {
 	_, err := node.RefreshIdentity(t.Context(), dir)
 	return err
 }
-
-func TestProtocolVersionRequiresNoProviderOrIdentity(t *testing.T) {
-	// This is a binary capability check, not a provider readiness probe.
-	if err := run(t.Context(), []string{"protocol-version"}); err != nil {
-		t.Fatal(err)
-	}
-	if err := run(t.Context(), []string{"protocol-version", "--config", "/missing"}); err == nil {
-		t.Fatal("extra protocol capability arguments accepted")
-	}
-}
diff --git a/services/core/cmd/server/main.go b/services/core/cmd/server/main.go
index 27a697cb5..43749a87e 100644
--- a/services/core/cmd/server/main.go
+++ b/services/core/cmd/server/main.go
@@ -137,17 +137,17 @@ func run(config processconfig.Config) error {
 	err := migrations.Apply(migrating, config.DatabaseURL)
 	cancelMigration()
 	if err != nil {
-		return fmt.Errorf("Agents API database migration failed: %w", err)
+		return fmt.Errorf("OpenAgentCore database migration failed: %w", err)
 	}
 	pool, err := pgxpool.New(ctx, config.DatabaseURL)
 	if err != nil {
-		return errors.New("invalid Agents API database configuration")
+		return errors.New("invalid OpenAgentCore database configuration")
 	}
 	defer pool.Close()
 	ready, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
 	if err := pool.Ping(ready); err != nil {
-		return errors.New("Agents API database connection failed")
+		return errors.New("OpenAgentCore database connection failed")
 	}
 	oauthClient, err := oauthrefresh.NewClient(config.OAuthTrustedOrigins)
 	if err != nil {
@@ -269,7 +269,7 @@ func run(config processconfig.Config) error {
 	if err != nil {
 		return err
 	}
-	deploymentExecution, err := deployment.NewExecutionOperations(deploymentService, deploymentpg.NewExecution(lease, credentialKey), dispatcher.Engines)
+	deploymentExecution, err := deployment.NewExecutionOperations(deploymentService, deploymentpg.NewExecution(lease, credentialKey), dispatcher.Harnesses())
 	if err != nil {
 		return errors.Join(err, lease.Close(ctx))
 	}
diff --git a/services/core/cmd/server/managed_generation_operations.go b/services/core/cmd/server/managed_generation_operations.go
index aba23a97c..864ae28ab 100644
--- a/services/core/cmd/server/managed_generation_operations.go
+++ b/services/core/cmd/server/managed_generation_operations.go
@@ -117,3 +117,25 @@ func (p *generationRouter) RenewCompute(ctx context.Context, r sandbox.Reference
 	defer done()
 	return v.RenewCompute(ctx, r, c)
 }
+func (p *generationRouter) RestorePreparation(ctx context.Context, r sandbox.Reference, key string) (bool, error) {
+	if err := providercontract.Require(p, "RestorePreparation"); err != nil {
+		return false, err
+	}
+	v, done, err := p.route(ctx, r)
+	if err != nil {
+		return false, err
+	}
+	defer done()
+	return v.RestorePreparation(ctx, r, key)
+}
+func (p *generationRouter) SavePreparation(ctx context.Context, r sandbox.Reference, key string) error {
+	if err := providercontract.Require(p, "SavePreparation"); err != nil {
+		return err
+	}
+	v, done, err := p.route(ctx, r)
+	if err != nil {
+		return err
+	}
+	defer done()
+	return v.SavePreparation(ctx, r, key)
+}
diff --git a/services/core/cmd/server/managed_generations.go b/services/core/cmd/server/managed_generations.go
index 26dcf44db..a5b1dd2a5 100644
--- a/services/core/cmd/server/managed_generations.go
+++ b/services/core/cmd/server/managed_generations.go
@@ -140,8 +140,9 @@ func (s *managedSetup) routeGenerations(candidate execution.PreparedRuntimeDeplo
 		}
 		if err := verify(current, nil); err != nil {
 			if errors.Is(err, sandbox.ErrCredentialRejected) || errors.Is(err, sandbox.ErrCredentialOwnership) {
-				// A revoked legacy key or a public template outside its team cannot
-				// anchor ownership. This says nothing about the candidate key's validity.
+				// A revoked committed key, or a committed template its own key no
+				// longer owns, cannot anchor ownership. This says nothing about the
+				// candidate key's validity.
 				return &deployment.ResetRequiredError{CurrentProvider: setup.Provider, RequestedProvider: setup.Provider}
 			}
 			return err
diff --git a/services/core/cmd/server/managed_generations_test.go b/services/core/cmd/server/managed_generations_test.go
index c422f1986..9e350d853 100644
--- a/services/core/cmd/server/managed_generations_test.go
+++ b/services/core/cmd/server/managed_generations_test.go
@@ -101,15 +101,15 @@ print(json.dumps({'Version':q['Version'],'Info':info}))
 	}
 }
 
-// The empty resource set must not let a publicly readable template substitute
-// for a team identity. In particular, the old key must be checked as itself.
+// A publicly readable template must not substitute for a team identity, and the
+// committed key is checked as itself.
 func TestE2BReplacementRequiresCommittedOwnershipAnchor(t *testing.T) {
 	for _, tc := range []struct {
 		name, committedKey, committedTemplate, candidateKey, candidateTemplate string
 		want                                                                   error
 		reset                                                                  bool
 	}{
-		{name: "legacy public template cross team", committedKey: "team-a", committedTemplate: "public-b", candidateKey: "team-b", candidateTemplate: "public-b", reset: true},
+		{name: "committed template outside its key's team", committedKey: "team-a", committedTemplate: "public-b", candidateKey: "team-b", candidateTemplate: "public-b", reset: true},
 		{name: "revoked committed key", committedKey: "revoked", committedTemplate: "owned-a", candidateKey: "team-a", candidateTemplate: "owned-a", reset: true},
 		{name: "unknown committed ownership", committedKey: "unconfirmed", committedTemplate: "owned-a", candidateKey: "team-a", candidateTemplate: "owned-a", want: sandbox.ErrConfigurationUnconfirmed},
 		{name: "proven different team", committedKey: "team-a", committedTemplate: "owned-a", candidateKey: "team-b", candidateTemplate: "public-b", want: sandbox.ErrCredentialOwnership},
diff --git a/services/core/cmd/server/managed_nodes.go b/services/core/cmd/server/managed_nodes.go
index 402a1912c..1dbe711f7 100644
--- a/services/core/cmd/server/managed_nodes.go
+++ b/services/core/cmd/server/managed_nodes.go
@@ -30,7 +30,7 @@ func configureManagedNodes(nodes *deployment.Service, reader deployment.Reader,
 			if err := owner(ctx); err != nil {
 				return err
 			}
-			return nodes.HeartbeatGenerations(ctx, n.NodeID, connection, epoch, nodeHealthRecord(health), health.Generations)
+			return nodes.Heartbeat(ctx, n.NodeID, connection, epoch, nodeHealthRecord(health), health.Generations)
 		},
 		Retention: func(ctx context.Context, n node.Identity, connection string, epoch uint64, refs []sandbox.GenerationReference) (sandbox.NodeDeployment, []sandbox.GenerationRetention, error) {
 			if err := owner(ctx); err != nil {
@@ -63,12 +63,6 @@ func configureManagedNodes(nodes *deployment.Service, reader deployment.Reader,
 		Disconnected: func(ctx context.Context, n node.Identity, connection string, epoch uint64) {
 			_ = nodes.DisconnectNode(ctx, n.NodeID, connection, epoch)
 		},
-		Heartbeat: func(ctx context.Context, n node.Identity, connection string, epoch uint64, health node.Health) error {
-			if err := owner(ctx); err != nil {
-				return err
-			}
-			return nodes.Heartbeat(ctx, n.NodeID, connection, epoch, nodeHealthRecord(health), health.Generations)
-		},
 	})
 	result.setup = &managedSetup{capacity: config.SandboxCapacity, processPaths: config.ProviderPaths, registry: registry, deployment: nodes, allocations: reader, hub: result.hub, installationID: config.InstallationID, runtimeAPI: config.PublicOrigin.RuntimeAPI()}
 	result.runtime = execution.NewDeferredRuntimeProvider(config.InstallationID, result.setup.load, result.setup.prepare)
@@ -77,5 +71,5 @@ func configureManagedNodes(nodes *deployment.Service, reader deployment.Reader,
 }
 
 func nodeHealthRecord(health node.Health) deployment.NodeHealth {
-	return deployment.NodeHealth{Host: &deployment.NodeHost{EffectiveCPUCores: health.EffectiveCPUCores, CPUUtilization: health.CPUUtilization, TotalMemoryBytes: health.TotalMemoryBytes, AvailableMemoryBytes: health.AvailableMemoryBytes, AvailableDiskBytes: health.AvailableDiskBytes, ObservedAt: &health.ObservedAt}, ProviderReady: health.ProviderReady, Diagnostic: sandbox.NodeDiagnosticCode(health.Diagnostic), CPUCount: health.CPUCount, AvailableMemoryBytes: health.AvailableMemoryBytes, AvailableDiskBytes: health.AvailableDiskBytes}
+	return deployment.NodeHealth{Host: &deployment.NodeHost{EffectiveCPUCores: health.EffectiveCPUCores, CPUUtilization: health.CPUUtilization, TotalMemoryBytes: health.TotalMemoryBytes, AvailableMemoryBytes: health.AvailableMemoryBytes, AvailableDiskBytes: health.AvailableDiskBytes, ObservedAt: &health.ObservedAt}, CPUCount: health.CPUCount, AvailableMemoryBytes: health.AvailableMemoryBytes, AvailableDiskBytes: health.AvailableDiskBytes}
 }
diff --git a/services/core/cmd/server/managed_setup.go b/services/core/cmd/server/managed_setup.go
index 4b9384892..009ef8f4d 100644
--- a/services/core/cmd/server/managed_setup.go
+++ b/services/core/cmd/server/managed_setup.go
@@ -12,7 +12,6 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/execution"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/processconfig"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/providercontract"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimeobs"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/node"
@@ -123,20 +122,13 @@ func (s *managedSetup) prepare(ctx context.Context, setup deployment.Setup) (exe
 	if err != nil {
 		return execution.PreparedRuntimeDeployment{}, err
 	}
-	adapter, err := s.registry.Lookup(setup.Provider)
+	selection, err := s.registry.PrepareSelection(ctx, s.direct(setup))
 	if err != nil {
 		return execution.PreparedRuntimeDeployment{}, err
 	}
-	direct := s.direct(setup)
-	selection := direct.Selection
-	if adapter.Configuration.Requirements().SelectionDiscovery.State == providercontract.Supported {
-		if selection, err = s.registry.DiscoverSelection(ctx, direct); err != nil {
-			return execution.PreparedRuntimeDeployment{}, err
-		}
-		setup.Specification, setup.Configuration = selection.DeploymentSpec, selection.Configuration
-		if candidate, err = s.configuration(setup); err != nil {
-			return execution.PreparedRuntimeDeployment{}, err
-		}
+	setup.Specification, setup.Configuration = selection.DeploymentSpec, selection.Configuration
+	if candidate, err = s.configuration(setup); err != nil {
+		return execution.PreparedRuntimeDeployment{}, err
 	}
 	candidate.Selection = &selection
 	return s.routeGenerations(candidate, setup)
@@ -192,5 +184,5 @@ func (s *managedSetup) provider(setup deployment.Setup) (sandbox.SandboxProvider
 
 // direct is the setup's input to direct-mode construction and setup operations.
 func (s *managedSetup) direct(setup deployment.Setup) sandbox.DirectConfig {
-	return sandbox.DirectConfig{ProcessPaths: s.processPaths, InstallationID: setup.InstallationID, Selection: sandbox.Selection{Provider: setup.Provider, DeploymentSpec: setup.Specification, Configuration: setup.Configuration}, Fence: &s.providerCalls}
+	return sandbox.DirectConfig{ProcessPaths: s.processPaths, InstallationID: setup.InstallationID, Selection: sandbox.Selection{ComputeProfiles: setup.ComputeProfiles, Provider: setup.Provider, DeploymentSpec: setup.Specification, Configuration: setup.Configuration}, Fence: &s.providerCalls}
 }
diff --git a/services/core/deploy/claude/README.md b/services/core/deploy/claude/README.md
index 227af93f8..e81d42594 100644
--- a/services/core/deploy/claude/README.md
+++ b/services/core/deploy/claude/README.md
@@ -1,6 +1,6 @@
 # Claude Code Runtime
 
-The Claude adapter runs Claude Code through the pinned Claude Agent SDK. The SDK owns the model and tool loop. Two parts make up the adapter: the private TypeScript bridge in [`packages/claude-sdk-adapter`](../../../../packages/claude-sdk-adapter/README.md), which owns the bridge protocol and native SDK configuration, and the Go adapter in [`agent/claudesdk`](../../../../apps/daemon/internal/agent/claudesdk), which owns the bridge process. This page holds the Runtime-level rules and the Claude Runtime image. [Harness onboarding](../../../../contracts/agents-api/harness-onboarding.md) owns the obligations shared by all adapters.
+The Claude adapter runs Claude Code through the pinned Claude Agent SDK. The SDK owns the model and tool loop. Two parts make up the adapter: the private TypeScript bridge in [`packages/claude-sdk-adapter`](../../../../packages/claude-sdk-adapter/README.md), which owns the bridge protocol and native SDK configuration, and the Go adapter in [`agent/claudesdk`](../../../../apps/daemon/internal/agent/claudesdk), which owns the bridge process. This page holds the Runtime-level rules and the Claude Runtime image. [Harness protocol](../../../../contracts/agents-api/harness-onboarding.md) owns the obligations shared by all adapters.
 
 Native tools run with the daemon user's permissions; the outer sandbox provides isolation ([Runtime and outer isolation](../../../../docs/concepts.md#runtime-and-outer-isolation)).
 
@@ -10,7 +10,7 @@ The bundle pins Claude Agent SDK `0.3.269` ([`package.json`](../../../../package
 
 Workspace execution requires the bundle to report the `workspace_tools`, `workspace_prepare`, `workspace_command_observations` and `local_runtime_v2` features; matching SDK versions alone do not establish compatibility. Function tools in workspace execution additionally require `workspace_functions`. The native installer rejects a bundle that lacks the workspace features ([`installation.go`](../../../../apps/daemon/internal/agent/claudesdk/installation.go)).
 
-Claude accepts only the `anthropic` model protocol ([`harnessconfig/claudesdk`](../../../../internal/harnessconfig/claudesdk/configuration.go)). [Model execution](../../../../contracts/agents-api/model-execution.md#deployment-defaults) owns provider selection.
+Claude accepts only the `anthropic` model protocol ([`harnessconfig/claudesdk`](../../../../internal/harnessconfig/claudesdk/declaration.go)). [Model execution](../../../../contracts/agents-api/model-execution.md#deployment-defaults) owns provider selection.
 
 ## Native state and recovery
 
diff --git a/services/core/deploy/codex/README.md b/services/core/deploy/codex/README.md
index cbd87b007..c7d2be7fe 100644
--- a/services/core/deploy/codex/README.md
+++ b/services/core/deploy/codex/README.md
@@ -1,6 +1,6 @@
 # Codex Runtime
 
-The Codex adapter ([`agent/codex`](../../../../apps/daemon/internal/agent/codex)) runs the native Codex CLI through its app-server protocol inside the daemon. This page holds the Codex-specific adapter rules, the Codex Runtime image and the Docker sandbox settings that every Docker Runtime uses. [Harness onboarding](../../../../contracts/agents-api/harness-onboarding.md) owns the obligations shared by all adapters.
+The Codex adapter ([`agent/codex`](../../../../apps/daemon/internal/agent/codex)) runs the native Codex CLI through its app-server protocol inside the daemon. This page holds the Codex-specific adapter rules, the Codex Runtime image and the Docker sandbox settings that every Docker Runtime uses. [Harness protocol](../../../../contracts/agents-api/harness-onboarding.md) owns the obligations shared by all adapters.
 
 Native tools run with the daemon user's permissions; the outer sandbox provides isolation ([Runtime and outer isolation](../../../../docs/concepts.md#runtime-and-outer-isolation)).
 
@@ -10,7 +10,7 @@ The adapter accepts only Codex `0.153.4`: installation and recovery checks requi
 
 ## Model provider and native state
 
-Codex accepts only the `responses` model protocol ([`harnessconfig/codex`](../../../../internal/harnessconfig/codex/configuration.go)). A Chat Completions or Anthropic provider is rejected; nothing converts between protocols. [Model execution](../../../../contracts/agents-api/model-execution.md#deployment-defaults) owns provider selection, including the per-Harness deployment default.
+Codex accepts only the `responses` model protocol ([`harnessconfig/codex`](../../../../internal/harnessconfig/codex/declaration.go)). A Chat Completions or Anthropic provider is rejected; nothing converts between protocols. [Model execution](../../../../contracts/agents-api/model-execution.md#deployment-defaults) owns provider selection, including the per-Harness deployment default.
 
 Each Session has its own `CODEX_HOME` at `<StateRoot>/daemon/agent-sessions/<state key>/`, where the Runtime supplies `<StateRoot>` from the [state directory setting](../../../../docs/configuration.md#runtime-resource-directories). Native history stays there; Runtime device credentials stay in the Runtime home. The state layout alone does not qualify cross-node native continuation. The adapter regenerates that directory's `config.toml` on every prompt: the Session's frozen provider bundle becomes the `[model_providers.oac]` block, with `wire_api` `responses`, and the thread is pinned to that provider, so Codex never falls back to its built-in `openai` provider. Provider bearer credentials use the native `env_key` reference and enter the model-loop child process environment; they are not written into retained `config.toml`. The adapter excludes that variable from native shell environments with `shell_environment_policy.exclude` and disables `shell_snapshot`, whose capture in the pinned native version can otherwise persist the model-loop environment. This retains native thread history without retaining native shell snapshots; it introduces no user setting.
 
@@ -21,18 +21,18 @@ By default Codex retries a failed model connection forever, waiting up to 60 sec
 The adapter applies Core's typed controls and opt-ins, described in the [Runtime protocol](../../../../docs/runtime-protocol.md#capability-declarations), through native Codex settings on both new and resumed Turns.
 
 - **`environment: none`.** The daemon forces `CODEX_EXEC_SERVER_URL=none` and confirms that Codex reports its `local` and `remote` environments as unknown before it starts or resumes a thread; a binary that cannot do this fails closed. The engine process runs on the bound device, which is not a user execution environment.
-- **Web search.** The control becomes Codex's `web_search` option (`disabled`, `cached` or `live`); Core sends `disabled`.
-- **Programmatic tool calling.** An explicit disable turns off the native `code_mode`, `code_mode_only` and `code_mode_prewarm` features and checks managed requirements before a thread starts or resumes, rejecting a conflicting requirement.
-- **Text verbosity.** The adapter reads the model catalog with `codex debug models`, checks the model's support and pins that catalog snapshot for the execution. The probe needs Unix process-group cancellation, so other hosts do not declare `text_verbosity`. For a model without declared verbosity support, including Codex's unknown-model fallback, `medium` omits the override and keeps native default text; a supported model receives an explicit `medium`. Unsupported `low` or `high` and an unreadable catalog fail before model execution.
+- **Web search.** The control becomes Codex's `web_search` option (`disabled`, `cached` or `live`) with `tools.web_search` `context_size`, `allowed_domains` and `location`.
+- **Programmatic tool calling.** `enabled: true` turns on the native `code_mode` feature. An explicit disable turns off the native `code_mode`, `code_mode_only` and `code_mode_prewarm` features and checks managed requirements before a thread starts or resumes, rejecting a conflicting requirement.
+- **Reasoning, service tier and verbosity.** `reasoning.effort` and `reasoning.summary` become `model_reasoning_effort` and `model_reasoning_summary`, a null `reasoning.summary`, the official default, becomes `none` because Codex's own default depends on the model, a non-`auto` service tier becomes `service_tier` and the text verbosity becomes `model_verbosity`.
 - **Subagents.** Disabling Subagents turns off both native multi-agent feature generations, `multi_agent` and `multi_agent_v2`, overriding the operator's feature preferences.
 
 ## MCP servers
 
-The adapter renders a typed MCP declaration with the native renderer and the original tool names for `enabled_tools`, including `[]`. Before creating or resuming a thread it reads native `config/read` with the exact cwd and rejects additional servers or any difference in the effective configuration. It disables native plugins and apps, selects file-only MCP credentials, and rejects existing credentials in the private native home without deleting them or native history. Reserved native labels are an adapter restriction, not a rule of the saved resource. The check is a snapshot, not a barrier against concurrent operator configuration changes, and discovery of a deny-all server can still contact it.
+The adapter renders a typed MCP declaration with the native renderer and the original tool names for `enabled_tools`, including `[]`. It writes the native trust entry for the workspace into the generated configuration, so the workspace `.codex/config.toml` loads on thread start and cold resume as it does locally. Additional servers, plugins, apps and approval settings keep their native values. Before creating or resuming a thread, and so before any native connection that carries a Core credential, it reads native `config/read` with the exact cwd and requires every declared server to keep its `url` or command, `bearer_token_env_var`, headers, `required` and `enabled_tools`. Any difference fails the start or resume with a generic error and sends no native Turn; other fields of a declared server, such as `tool_timeout_sec`, may differ. It selects file-only MCP credentials, and rejects existing credentials in the private native home without deleting them or native history. Reserved native labels are an adapter restriction, not a rule of the saved resource. The check is a snapshot, not a barrier against concurrent operator configuration changes.
 
 With `required: true`, which needs `mcp_http_required`, root thread creation and cold resume wait for required servers to initialize and send no native Turn until they do; a failed strict resume is never replaced with a new thread. Public work may already be accepted while initialization waits.
 
-A selected bearer credential (`mcp_http_bearer_auth`) becomes a fresh daemon-owned `bearer_token_env_var` reference for each server and native process. The secret enters only that app-server child's environment, after auxiliary launch probes, and never global environment, arguments, configuration, history, snapshots or logs. Preflight accepts only the expected server and reference pairing and keeps rejecting ambient credential sources. Empty values and bytes outside RFC 6750 `b64token` syntax are rejected with generic errors, and tokens are never trimmed. Core-managed OAuth delivers access tokens through the same path.
+A selected bearer credential (`mcp_http_bearer_auth`) becomes a fresh daemon-owned `bearer_token_env_var` reference for each server and native process. The secret enters only that app-server child's environment, after auxiliary launch probes, and never global environment, arguments, configuration, history, snapshots or logs. The `OAC_RUNTIME_MCP_*` variables are excluded from native shell tools through `shell_environment_policy`, like the provider key. Empty values and bytes outside RFC 6750 `b64token` syntax are rejected with generic errors, and tokens are never trimmed. Core-managed OAuth delivers access tokens through the same path.
 
 ## Function results and command output
 
diff --git a/services/core/deploy/e2b/README.md b/services/core/deploy/e2b/README.md
index 5e2e3c31c..d6520fa72 100644
--- a/services/core/deploy/e2b/README.md
+++ b/services/core/deploy/e2b/README.md
@@ -21,16 +21,18 @@ python -m venv "$HOME/.oac/build/e2b-sdk"
   --output "$HOME/.oac/build/e2b-template.json"
 ```
 
-[`build-template.py`](build-template.py) requires a `sha256:` image ID, a Linux amd64 image and the Runtime layout (`OAC_RUNTIME_WORKSPACE=/environment/workspace`). It copies the image's `/usr/local/bin`, `/opt` and, when present, `/usr/local/codex-resources` and `/etc/codex`, together with its `HOME` and `OAC_*` environment, onto a digest-pinned `node:22.23.1-bookworm-slim` base with `ca-certificates`, `bash`, `git`, `python3`, `python3-pip`, `ripgrep` and `util-linux`. It installs [`init.py`](init.py) and [`managed_init.py`](managed_init.py) read-only under `/opt/oac-e2b`, runs the daemon as UID/GID 1000 (`runtime`, home `/home/runtime`) and builds with 2 vCPUs and 2048 MiB. Only the `usr`, `usr/local` and `etc` archive ancestors it creates get traversable modes; Runtime file modes, private build contexts, key inputs and the output's umask stay unchanged.
+[`build-template.py`](build-template.py) requires a `sha256:` image ID, a Linux amd64 image and the Runtime layout (`OAC_RUNTIME_WORKSPACE=/environment/workspace`). It copies the image's `/usr/local/bin`, `/opt` and, when present, `/usr/local/codex-resources` and `/etc/codex`, together with its `HOME` and `OAC_*` environment, onto a digest-pinned `node:22.23.1-bookworm-slim` base with `ca-certificates`, `bash`, `git`, `python3`, `python3-pip`, `ripgrep` and `util-linux`. It installs [`init.py`](init.py) and [`managed_init.py`](managed_init.py) read-only under `/opt/oac-e2b`, runs the daemon as UID/GID 1000 (`runtime`, home `/home/runtime`) and defaults to 2 vCPUs and 2048 MiB. Select `--compute-profile 2c8g` for 2 vCPUs and 8192 MiB or `--compute-profile 4c8g` for 4 vCPUs and 8192 MiB; only these profiles and the default `2c2g` are accepted. Only the `usr`, `usr/local` and `etc` archive ancestors it creates get traversable modes; Runtime file modes, private build contexts, key inputs and the output's umask stay unchanged.
 
-The output file records `template` (the immutable `templateID:build_UUID`), the source `image`, the packaged `runtime_sha256` and the `base`. Use that exact `template` value. The template must qualify every Harness its image advertises. Install system dependencies into the image; the daemon runs as UID/GID 1000. No E2B account key, executor key or model credential belongs in a build, template environment, metadata, command argument or log.
+The output file records `template` (the immutable `templateID:build_UUID`), the source `image`, the packaged `runtime_sha256`, the `base`, `compute_profile`, `cpu_count` and `memory_mb`. Use that exact `template` value. The template must qualify every Harness its image advertises. Install system dependencies into the image; the daemon runs as UID/GID 1000. No E2B account key, executor key or model credential belongs in a build, template environment, metadata, command argument or log.
+
+The `e2b-template-build` workflow exposes the same `compute_profile` choices and keeps `2c2g` as its default. The default omits the optional builder flag, allowing an exact historical source revision to retain its default allocation; 8 GiB selections require a source revision supporting `--compute-profile` and never fall back. It verifies the registered build’s CPU and memory before uploading, including when `resume_build` is supplied; missing or mismatched resource metadata stops the build. The build receipt records the verified allocation, and the final report takes its CPU and memory from that receipt after checking the immutable template identity. Building a separate 8 GiB template does not change the deployment’s default template.
 
 ## Launch an application-managed Runtime
 
 For browser and video Skills, first build the [Creative Runtime tools image](../creative/README.md). The `e2b-template-build` workflow defaults to `tool_profile: creative` and wraps the combined Runtime from the selected source revision before packaging it. Select `base` explicitly when building a revision without these tools. The builder detects the bundled installer and restores system libraries and fonts in the E2B base after extraction; the pinned browser and npm payload stay under `/opt`. Its output records `creative_tools: true`. The resulting template still needs Runtime and Skill qualification before activation.
 
 1. Create a `self_hosted` Environment through Core and keep its ID and the exact returned `remote_url` (`wss://…/api/v1/agent-daemon/ws`). The VM must reach it. Set `workspace_directory` to `/workspace`, which the template binds to `/environment/workspace`.
-2. Obtain a connect-only executor key for that Environment; [Environment executor credentials](../../../../contracts/agents-api/environment-executor-credentials.md) owns issuance. The key file is `{"key_id":"UUID","executor_token":"SECRET"}`, with an optional `environment_id` restriction. Store it and the E2B API key in private files with mode `0600`.
+2. Obtain a connect-only executor key for that Environment; [Executor credentials](../../../../contracts/agents-api/environment-executor-credentials.md) owns issuance. The key file is `{"key_id":"UUID","executor_token":"SECRET"}`, with an optional `environment_id` restriction. Store it and the E2B API key in private files with mode `0600`.
 3. Generate an application launch UUID once and keep it. Run [`launch.py`](launch.py), a thin SDK example rather than a service:
 
 ```sh
diff --git a/services/core/deploy/e2b/build-template.py b/services/core/deploy/e2b/build-template.py
index 7d1f10cbc..429caabc3 100644
--- a/services/core/deploy/e2b/build-template.py
+++ b/services/core/deploy/e2b/build-template.py
@@ -13,12 +13,15 @@
 from helper_contract_generated import SUSPEND_CONTROL_FILE
 
 BASE = 'node:22.23.1-bookworm-slim@sha256:8607a9064d4a571140998ae9e52a3b3fcf9cff361d04642d5971e6cd76d39e27'
+COMPUTE_PROFILES = {'2c2g': (2, 2048), '2c8g': (2, 8192), '4c8g': (4, 8192)}
 parser = argparse.ArgumentParser()
 parser.add_argument('--image', required=True, help='Qualified linux/amd64 Runtime image digest')
 parser.add_argument('--name', required=True)
 parser.add_argument('--api-key-file', type=Path, required=True)
 parser.add_argument('--output', type=Path, required=True)
+parser.add_argument('--compute-profile', choices=COMPUTE_PROFILES, default='2c2g')
 args = parser.parse_args()
+cpu_count, memory_mb = COMPUTE_PROFILES[args.compute_profile]
 if not args.image.startswith('sha256:') or not args.output.is_absolute() or not args.api_key_file.is_absolute():
     parser.error('Use an image digest and absolute private key/output paths')
 image = json.loads(subprocess.check_output(['docker', 'image', 'inspect', args.image]))[0]
@@ -90,12 +93,13 @@
     # Reinstall their system dependencies in E2B using the image's own installer.
     if creative_tools:
         template = template.run_cmd('sh /opt/oac-creative/install.sh --system-only', user='root')
-    result = Template.build(template, name=args.name, cpu_count=2, memory_mb=2048,
+    result = Template.build(template, name=args.name, cpu_count=cpu_count, memory_mb=memory_mb,
                             on_build_logs=lambda entry: print(entry.message, flush=True),
                             api_key=args.api_key_file.read_text().strip())
     report = {'template': result.template_id + ':' + result.build_id, 'image': image['Id'],
               'runtime_sha256': hashlib.sha256(bundle.read_bytes()).hexdigest(), 'base': BASE,
-              'creative_tools': creative_tools}
+              'creative_tools': creative_tools, 'compute_profile': args.compute_profile,
+              'cpu_count': cpu_count, 'memory_mb': memory_mb}
     args.output.parent.mkdir(parents=True, exist_ok=True)
     args.output.write_text(json.dumps(report, indent=2) + '\n')
     print(json.dumps(report))
diff --git a/services/core/deploy/e2b/build_template_test.py b/services/core/deploy/e2b/build_template_test.py
index 164e15263..657e38666 100644
--- a/services/core/deploy/e2b/build_template_test.py
+++ b/services/core/deploy/e2b/build_template_test.py
@@ -1,4 +1,6 @@
 """Exercise real Runtime tar metadata without Docker or provider calls."""
+import argparse
+import ast
 import contextlib
 import io
 import itertools
@@ -7,9 +9,11 @@
 from pathlib import Path
 import runpy
 import stat
+import subprocess
 import sys
 import tarfile
 import tempfile
+import textwrap
 from types import SimpleNamespace
 import unittest
 from unittest.mock import Mock, patch
@@ -17,7 +21,8 @@
 
 class BundlePermissionsTest(unittest.TestCase):
     def test_public_parents_and_runtime_modes_under_both_umasks(self):
-        for mask, creative in itertools.product((0o022, 0o077), (False, True)):
+        for mask, creative, profile in itertools.product((0o022, 0o077), (False, True), (None, '2c8g', '4c8g')):
+            expected_cpu, expected_memory = (4 if profile == '4c8g' else 2), (8192 if profile else 2048)
             with self.subTest(umask=oct(mask), creative=creative), tempfile.TemporaryDirectory() as temporary:
                 root = Path(temporary)
                 key = root / 'key'
@@ -65,6 +70,7 @@ def run(argv, **kwargs):
 
                 def build(instance, **kwargs):
                     self.assertIs(instance, template)
+                    self.assertEqual((kwargs['cpu_count'], kwargs['memory_mb']), (expected_cpu, expected_memory))
                     context = Path(factory.call_args.kwargs['file_context_path'])
                     self.assertEqual(stat.S_IMODE(context.stat().st_mode), 0o700)
                     from helper_contract_generated import SUSPEND_CONTROL_FILE
@@ -96,7 +102,8 @@ def build(instance, **kwargs):
                     with patch.dict(sys.modules, {'e2b': SimpleNamespace(Template=factory)}), \
                             patch.dict(os.environ, {'OAC_DEV_HOME': str(root / 'state')}), \
                             patch.object(sys, 'argv', ['build-template.py', '--image', 'sha256:fixture',
-                                '--name', 'fixture', '--api-key-file', str(key), '--output', str(output)]), \
+                                '--name', 'fixture', '--api-key-file', str(key), '--output', str(output)] +
+                                (['--compute-profile', profile] if profile else [])), \
                             patch('subprocess.check_output', side_effect=check_output), \
                             patch('subprocess.run', side_effect=run), contextlib.redirect_stdout(io.StringIO()):
                         runpy.run_path(str(Path(__file__).with_name('build-template.py')), run_name='__main__')
@@ -106,9 +113,108 @@ def build(instance, **kwargs):
                     self.assertEqual(key.read_text(), 'fixture-only')
                     self.assertEqual(json.loads(output.read_text())['creative_tools'], creative)
                     factory.build.assert_called_once()
+                    report = json.loads(output.read_text())
+                    self.assertEqual((report['cpu_count'], report['memory_mb']), (expected_cpu, expected_memory))
+                    self.assertEqual(report['compute_profile'], profile or '2c2g')
                 finally:
                     os.umask(original_mask)
 
 
+class ComputeProfileTest(unittest.TestCase):
+    def test_invalid_profile_fails_before_docker_or_provider(self):
+        for profile in ('', '4c2g', '8c8g', '4c8g;command'):
+            factory = Mock()
+            with self.subTest(profile=profile), patch.dict(sys.modules, {'e2b': SimpleNamespace(Template=factory)}), \
+                    patch.object(sys, 'argv', ['build-template.py', '--image', 'sha256:fixture',
+                        '--name', 'fixture', '--api-key-file', '/private/key', '--output', '/private/result',
+                        '--compute-profile', profile]), patch('subprocess.check_output') as docker, \
+                    contextlib.redirect_stderr(io.StringIO()), self.assertRaises(SystemExit) as error:
+                runpy.run_path(str(Path(__file__).with_name('build-template.py')), run_name='__main__')
+            self.assertEqual(error.exception.code, 2)
+            docker.assert_not_called()
+            factory.assert_not_called()
+
+    def test_workflow_checks_fresh_and_resumed_build_resources(self):
+        workflow = Path(__file__).resolve().parents[4] / '.github/workflows/e2b-template.yml'
+        source = workflow.read_text()
+        start = source.index('          def request(client, **kwargs):')
+        end = source.index('          sdk.request_build = request', start)
+        function = compile(ast.parse(textwrap.dedent(source[start:end])), str(workflow), 'exec')
+        cases = (
+            ('valid', [{'buildID': 'build', 'cpuCount': 4, 'memoryMB': 8192}]),
+            ('wrong-resource', [{'buildID': 'build', 'cpuCount': 2, 'memoryMB': 2048}]),
+            ('missing-memory', [{'buildID': 'build', 'cpuCount': 4}]),
+            ('non-integer', [{'buildID': 'build', 'cpuCount': True, 'memoryMB': 8192}]),
+            ('missing-build', []),
+            ('different-build', [{'buildID': 'other', 'cpuCount': 4, 'memoryMB': 8192}]),
+            ('duplicate', [{'buildID': 'build', 'cpuCount': 4, 'memoryMB': 8192}] * 2),
+            ('default', [{'buildID': 'build', 'cpuCount': 2, 'memoryMB': 2048}]),
+        )
+        for resumed, (name, builds) in itertools.product((False, True), cases):
+            with self.subTest(resumed=resumed, case=name), tempfile.TemporaryDirectory() as temporary:
+                output = Path(temporary)
+                client = Mock()
+                status = {'templateID': 'template', 'buildID': 'build', 'status': 'waiting', 'logs': []}
+                detail = {'templateID': 'template', 'builds': builds}
+                responses = [Mock(json=Mock(return_value=detail))]
+                if resumed:
+                    responses.insert(0, Mock(json=Mock(return_value=status)))
+                client.get_httpx_client.return_value.get.side_effect = responses
+                original = Mock(return_value=SimpleNamespace(template_id='template', build_id='build'))
+                namespace = dict(os=os, json=json, SimpleNamespace=SimpleNamespace,
+                                 original_request=original, output=output)
+                exec(function, namespace)
+                resources = (2, 2048) if name == 'default' else (4, 8192)
+                with patch.dict(os.environ, {'RESUME_BUILD': 'template:build' if resumed else '',
+                                             'SOURCE_COMMIT': 'fixture', 'E2B_API_URL': 'https://fixture.invalid'}):
+                    if name in ('valid', 'default'):
+                        namespace['request'](client, cpu_count=resources[0], memory_mb=resources[1])
+                        receipt = json.loads((output / 'build-request.json').read_text())
+                        self.assertEqual((receipt['cpu_count'], receipt['memory_mb']), resources)
+                    else:
+                        with self.assertRaisesRegex(RuntimeError, 'CPU/memory'):
+                            namespace['request'](client, cpu_count=4, memory_mb=8192)
+                        self.assertFalse(json.loads((output / 'build-request.json').read_text())['resources_verified'])
+                self.assertEqual(original.call_count, 0 if resumed else 1)
+
+    def test_default_omits_optional_flag_for_historical_source_parser(self):
+        workflow = Path(__file__).resolve().parents[4] / '.github/workflows/e2b-template.yml'
+        source = workflow.read_text()
+        start = source.index('          compute_args=()')
+        end = source.index('          esac', start) + len('          esac')
+        script = textwrap.dedent(source[start:end]) + '\nif (( ${#compute_args[@]} )); then printf "%s\\0" "${compute_args[@]}"; fi'
+        for profile in ('2c2g', '2c8g', '4c8g'):
+            result = subprocess.run(['bash', '-c', script], env={**os.environ, 'COMPUTE_PROFILE': profile},
+                                    capture_output=True, check=True)
+            args = result.stdout.decode().split('\0')[:-1]
+            old_parser = argparse.ArgumentParser()
+            if profile == '2c2g':
+                self.assertEqual(vars(old_parser.parse_args(args)), {})
+            else:
+                self.assertEqual(args, ['--compute-profile', profile])
+                with contextlib.redirect_stderr(io.StringIO()), self.assertRaises(SystemExit):
+                    old_parser.parse_args(args)
+
+    def test_report_uses_verified_receipt_for_old_builder_and_rejects_mismatch(self):
+        workflow = Path(__file__).resolve().parents[4] / '.github/workflows/e2b-template.yml'
+        source = workflow.read_text()
+        start = source.index("          value = json.loads(report.read_text())")
+        end = source.index('          value.update(source_commit=', start)
+        code = compile(textwrap.dedent(source[start:end]), str(workflow), 'exec')
+        for verified, template in itertools.product((True, False), ('template:build', 'template:other')):
+            with self.subTest(verified=verified, template=template), tempfile.TemporaryDirectory() as temporary:
+                report = Path(temporary) / 'template.json'
+                report.write_text(json.dumps({'template': 'template:build', 'image': 'fixture'}))
+                report.with_name('build-request.json').write_text(json.dumps({
+                    'template': template, 'resources_verified': verified, 'cpu_count': 2, 'memory_mb': 2048}))
+                namespace = {'json': json, 'report': report}
+                if verified and template == 'template:build':
+                    exec(code, namespace)
+                    self.assertEqual((namespace['value']['cpu_count'], namespace['value']['memory_mb']), (2, 2048))
+                else:
+                    with self.assertRaisesRegex(RuntimeError, 'verified allocation receipt'):
+                        exec(code, namespace)
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/services/core/deploy/e2b/helper_contract_generated.py b/services/core/deploy/e2b/helper_contract_generated.py
index d454cdd8c..3144cb41c 100644
--- a/services/core/deploy/e2b/helper_contract_generated.py
+++ b/services/core/deploy/e2b/helper_contract_generated.py
@@ -2,15 +2,14 @@
 """Adapter-private wire declarations. No SDK or repository dependency."""
 COMPUTE_FIELDS = ["Generation","Name","ID","RestoredFrom"]
 ERROR_CODES = ["","invalid","ownership","exists","not_found","command_unconfirmed","unconfirmed","template_invalid","team_mismatch","unauthorized"]
-MANAGED_BOOTSTRAP_FIELDS = ["Workspace","TenantID","EnvironmentID","AllocationID","SessionID","DeviceID","NetworkAccess","AllowedDomains","InstallationID","RuntimeBootstrap"]
-MANAGED_BOOTSTRAP_REQUIRED_FIELDS = ["TenantID","EnvironmentID","AllocationID","SessionID","DeviceID","NetworkAccess","AllowedDomains","InstallationID","RuntimeBootstrap"]
+MANAGED_BOOTSTRAP_FIELDS = ["Workspace","TenantID","EnvironmentID","AllocationID","SessionID","DeviceID","InstallationID","RuntimeBootstrap"]
+MANAGED_BOOTSTRAP_REQUIRED_FIELDS = ["TenantID","EnvironmentID","AllocationID","SessionID","DeviceID","InstallationID","RuntimeBootstrap"]
 MANAGED_IDENTITY_FIELDS = ["TenantID","EnvironmentID","AllocationID","SessionID","DeviceID","InstallationID"]
 MAX_COMMAND_INPUT = 52428832
 MAX_CREDENTIAL_REFERENCES = 32
 MAX_OUTPUT = 1048576
 MAX_REQUEST = 75497472
 MAX_RESPONSE = 16777216
-NETWORK_ACCESS = ["enabled","disabled","restricted"]
 OPERATIONS = ["create","inspect","renew","kill","command","validate_deployment","observe","list_templates","list_builds","verify_credential","compute_info","compute_renew","suspend","resume","compute_kill","delete_retained","compute_command","resume_compute"]
 PROTOCOL_VERSION = 4
 REFERENCE_FIELDS = ["TenantID","EnvironmentID","AllocationID"]
diff --git a/services/core/deploy/e2b/managed_init.py b/services/core/deploy/e2b/managed_init.py
index fa8a68ed1..ebc598554 100644
--- a/services/core/deploy/e2b/managed_init.py
+++ b/services/core/deploy/e2b/managed_init.py
@@ -28,11 +28,6 @@ def identity(payload):
         value = payload[field]
         if not isinstance(value, str) or str(UUID(value)) != value or UUID(value).int == 0:
             raise ValueError('Invalid managed bootstrap identity')
-    if (payload['NetworkAccess'] not in contract.NETWORK_ACCESS or
-            payload['AllowedDomains'] is not None and
-            (not isinstance(payload['AllowedDomains'], list) or
-             any(not isinstance(domain, str) for domain in payload['AllowedDomains']))):
-        raise ValueError('Invalid managed bootstrap configuration')
     return {field: payload[field] for field in fields}
 
 
@@ -59,9 +54,7 @@ def initialize():
         os.chown(control_directory, 1000, 1000)
         control_directory.chmod(0o700)
         environment.update(OAC_RUNTIME_ENVIRONMENT_ID=payload['EnvironmentID'],
-                           OAC_RUNTIME_SESSION_ID=payload['SessionID'],
-                           OAC_RUNTIME_NETWORK_ACCESS=payload['NetworkAccess'],
-                           OAC_RUNTIME_ALLOWED_DOMAINS=json.dumps(payload['AllowedDomains'] or []))
+                           OAC_RUNTIME_SESSION_ID=payload['SessionID'])
         connection = Path(environment['OAC_RUNTIME_HOME']).parent / 'runtime-bootstrap.json'
         shared.write_private(connection, payload['RuntimeBootstrap'], owner=1000)
         source.unlink()
diff --git a/services/core/deploy/e2b/managed_init_test.py b/services/core/deploy/e2b/managed_init_test.py
index 9a3ed1408..91312cbbb 100644
--- a/services/core/deploy/e2b/managed_init_test.py
+++ b/services/core/deploy/e2b/managed_init_test.py
@@ -18,8 +18,7 @@ def payload():
     value = {key: str(uuid4()) for key in ['InstallationID', 'TenantID', 'EnvironmentID',
                                           'AllocationID', 'SessionID', 'DeviceID']}
     return dict(value, RuntimeBootstrap={'version': 2, 'harness': 'codex', 'core_url': 'https://core.example/api/v1',
-                'device_id': value['DeviceID'], 'credential': 'private-managed-token'},
-                NetworkAccess='restricted', AllowedDomains=['example.com'])
+                'device_id': value['DeviceID'], 'credential': 'private-managed-token'})
 
 
 class ManagedStartupTest(unittest.TestCase):
@@ -46,10 +45,8 @@ def test_shared_bootstrap_exchanges(self):
                 self.assertEqual(valid, case['valid'])
 
     def test_invalid_binding_rejected(self):
-        source = payload()
-        for key, value in [('DeviceID', 'other'), ('NetworkAccess', 'unknown')]:
-            with self.subTest(key=key), self.assertRaises(ValueError):
-                managed_init.identity(dict(source, **{key: value}))
+        with self.assertRaises(ValueError):
+            managed_init.identity(dict(payload(), DeviceID='other'))
 
     def exercise(self, failed=False):
         with tempfile.TemporaryDirectory() as temporary:
diff --git a/services/core/deploy/mcode/Dockerfile b/services/core/deploy/mcode/Dockerfile
index aa43dbbb4..2887b20fd 100644
--- a/services/core/deploy/mcode/Dockerfile
+++ b/services/core/deploy/mcode/Dockerfile
@@ -12,7 +12,7 @@ COPY mcode-harness /opt/mcode-harness
 ENV HOME=/home/runtime OAC_RUNTIME_HOME=/home/runtime/.oac \
     OAC_RUNTIME_MCODE_NODE=/usr/local/bin/node \
     OAC_RUNTIME_MCODE_BIN=/opt/mcode-harness/native/cli.js \
-    OAC_RUNTIME_MCODE_WORKSPACE_BRIDGE=/opt/mcode-harness/bridge.mjs \
+    OAC_RUNTIME_MCODE_COMPANION=/opt/mcode-harness \
     OAC_RUNTIME_WORKSPACE=/environment/workspace \
     OAC_RUNTIME_INITIALIZATION_DIRECTORY=/environment/initialization \
     OAC_RUNTIME_PACKAGE_DIRECTORY=/environment/packages \
diff --git a/services/core/deploy/mcode/README.md b/services/core/deploy/mcode/README.md
index 499a6cc18..c8c7f2cba 100644
--- a/services/core/deploy/mcode/README.md
+++ b/services/core/deploy/mcode/README.md
@@ -1,18 +1,18 @@
 # MiniMax Code Runtime
 
-The MiniMax Code adapter ([`agent/mcode`](../../../../apps/daemon/internal/agent/mcode)) runs the native MiniMax Code CLI over ACP inside the daemon. MiniMax Code keeps its own ACP Session, model loop and history. The companion package [`packages/mcode-harness`](../../../../packages/mcode-harness/README.md) owns the workspace tool bridge, the native patch and the Subagent history reader. This page holds the Runtime-level adapter rules and the MiniMax Code Runtime image. [Harness onboarding](../../../../contracts/agents-api/harness-onboarding.md) owns the obligations shared by all adapters.
+The MiniMax Code adapter ([`agent/mcode`](../../../../apps/daemon/internal/agent/mcode)) runs the native MiniMax Code CLI over ACP inside the daemon. MiniMax Code keeps its own ACP Session, model loop and history. The companion package [`packages/mcode-harness`](../../../../packages/mcode-harness/README.md) owns the native patch and the Subagent history reader. This page holds the Runtime-level adapter rules and the MiniMax Code Runtime image. [Harness protocol](../../../../contracts/agents-api/harness-onboarding.md) owns the obligations shared by all adapters.
 
-Native tools run with the daemon user's permissions; the outer sandbox provides isolation ([Runtime and outer isolation](../../../../docs/concepts.md#runtime-and-outer-isolation)).
+Native tools run with the daemon user's permissions; the outer sandbox provides isolation ([Runtime and outer isolation](../../../../docs/concepts.md#runtime-and-outer-isolation)). The native data directory, including the generated configuration with the provider credential, is readable by those tools, as for [Claude Code](../../../../contracts/agents-api/model-execution.md#session-override).
 
 ## Native pin and readiness
 
 The adapter accepts only `@minimax-ai/code` `0.4.12` ([`version.go`](../../../../apps/daemon/internal/agent/mcode/version.go)), built from the upstream source revision in [`source.json`](../../../../packages/mcode-harness/source.json) and run with Node.js 22. MiniMax Code runs on Linux and macOS.
 
-Workspace execution also requires the companion's readiness report: private protocol 2, the pinned native version and the pinned source revision ([`workspace_readiness.go`](../../../../apps/daemon/internal/agent/mcode/workspace_readiness.go)). An older companion is rejected even when the upstream version matches.
+Workspace execution also requires the companion's readiness report: private protocol 3, the pinned native version and the pinned source revision ([`workspace_readiness.go`](../../../../apps/daemon/internal/agent/mcode/workspace_readiness.go)). An older companion is rejected even when the upstream version matches.
 
 ## Model provider
 
-MiniMax Code accepts the `anthropic`, `responses` and `chat_completions` protocols, and each requires the provider's context window and maximum output tokens ([`harnessconfig/mcode`](../../../../internal/harnessconfig/mcode/configuration.go)). The adapter writes the frozen bundle as the native custom provider for the Session's exact `agent.model`, with those limits, using the native `anthropic-messages`, `openai-responses` or `openai-completions` API ([`model_provider.go`](../../../../apps/daemon/internal/agent/mcode/model_provider.go)). It selects that provider explicitly; there is no native account fallback. [Model execution](../../../../contracts/agents-api/model-execution.md#deployment-defaults) owns provider selection.
+MiniMax Code accepts the `anthropic`, `responses` and `chat_completions` protocols, and the provider's context window and maximum output tokens are optional ([`harnessconfig/mcode`](../../../../internal/harnessconfig/mcode/declaration.go)). The adapter writes the frozen bundle as the native custom provider for the Session's exact `agent.model`, with the limits that are set and, when the Agent sets `reasoning.effort`, that effort as the model's only thinking option (the adapter then selects it with ACP `thinkingEffort`), using the native `anthropic-messages`, `openai-responses` or `openai-completions` API ([`model_provider.go`](../../../../apps/daemon/internal/agent/mcode/model_provider.go)). It selects that provider explicitly; there is no native account fallback. A limit that is not set is omitted from the native configuration, so MiniMax Code applies its own defaults of 200000 context tokens and 16384 output tokens. [Model execution](../../../../contracts/agents-api/model-execution.md#deployment-defaults) owns provider selection.
 
 ## Execution profiles
 
@@ -20,22 +20,22 @@ Each Session has its own native data directory, `$OAC_RUNTIME_HOME/runtime/mcode
 
 | Profile | Where it runs | Native configuration |
 | --- | --- | --- |
-| Text (`environment: none`) | A private working directory inside the Session's data directory | No native tools, Skills, web search, browser tools, `mcode-tools`, thread goals or user questions. With Subagents enabled, the default agent gets only the task tools (`task`, `task_append`, `task_query`, `task_output`, `task_stop`) and delegation |
-| Workspace | The Environment's workspace directory, for the native process, the ACP Session and the workspace tools | The text configuration plus permission mode `bypassPermissions`, the native sandbox off, the selected workspace Skills and the `oac_workspace` MCP bridge for file and shell tools |
+| Text (`environment: none`) | A private working directory inside the Session's data directory | No native file, process or fetch tools, web search, `mcode-tools`, thread goals or user questions. The native task controls (`task_query`, `task_output`, `task_stop`) are always present; with Subagents enabled, the default agent also gets delegation. Permission mode `bypassPermissions`, so MCP tools run without approval prompts |
+| Workspace | The Environment's workspace directory, for the native process, the ACP Session and the native tools | The native `read`, `write`, `edit`, `bash`, `grep`, `glob`, `todowrite` and `web_fetch` tools, permission mode `bypassPermissions`, the selected workspace Skills and the frozen tool environment in the native process environment |
 
-The text profile rejects workspace, function tools and MCP servers. Workspace execution requires Linux or macOS and an unrestricted Environment network policy ([`workspace.go`](../../../../apps/daemon/internal/agent/mcode/workspace.go)); the adapter enforces no network restriction.
+The text profile rejects workspace tools; it accepts service-origin HTTP MCP servers, which the adapter passes in the ACP `mcpServers` of the native Session. In both profiles public functions run as native MCP tools: the daemon serves them from a loopback HTTP MCP server named `functions` that exists for the Session, and passes it in `mcpServers` with a per-Session bearer token. Native fails a call after 120 s ([difference](../../../../contracts/agents-api/index.md#differences-from-openai)). Functions and `multi_agent` cannot be combined. Workspace execution requires Linux or macOS ([`workspace.go`](../../../../apps/daemon/internal/agent/mcode/workspace.go)).
 
-In the workspace profile, the frozen installation's Skills are linked into the Session's `skills` directory under their exact names and loaded through the native `skill` tool; external Skill discovery stays off. Public MCP servers use the Environment origin only, as the [MCP origin contract](../../../../contracts/agents-api/environments.md#public-mcp-connection-origin) describes. With Subagents enabled, the Session's native `mcp.json` holds only the `oac_workspace` server, so child agents get the same workspace tools.
+In the workspace profile, the frozen installation's Skills are linked into the Session's `skills` directory under their exact names and loaded through the native `skill` tool. Native discovery also reads the workspace's `.minimax`, `.claude` and `.agents` Skills, as a local run does. Public MCP servers use the Environment origin on a workspace and the service origin on the text profile, as the [MCP origin contract](../../../../contracts/agents-api/environments.md#public-mcp-connection-origin) describes. With Subagents enabled, child agents use the same native tools. In both profiles the adapter turns off what needs a MiniMax account or outlives a Turn or asks the user: `askUser`, `beta.mcodeTools`, `beta.threadGoal`, `features.mavis` (its tool carries cron, session send, agent create and MCP create) and `features.webSearch`, and it leaves `website_deploy` out of `tools`. `web_search: disabled` also removes `web_fetch`. Background Bash is off: the patched CLI gates it on `OAC_RUNTIME_MCODE_BACKGROUND_BASH=off`, and the adapter rejects a CLI that does not report it off.
 
 ## Turns, cancellation and continuation
 
 - Normal Turns reuse one ACP connection and native Session.
 - Active input uses ACP `mcode/session/steer`. Its receipt confirms that the active native Turn accepted the input, not that the model consumed it. Unknown outcomes are never replayed.
-- Public input stays a model message: the adapter adds an empty text block so that ACP does not treat slash text as an operator command.
+- Public input stays a model message: ACP joins text blocks with a blank line, so the adapter sends one block, and adds an empty second block only when the text starts with `/`, so that ACP does not treat slash text as an operator command.
 - A Turn that ends with an error, a cancellation, an unknown input outcome, an unfinished tool call or an unanswered permission or question makes the Executor non-reusable. The adapter stops the native process group and waits for it to exit before the Turn settles; later work loads the same native history in a new Executor.
 - Continuation requires the exact recorded native Session ID and the same working directory. Recovery without a recorded ID is rejected.
 - MiniMax Code reports no usage: ACP context occupancy and cumulative cost are not per-Turn usage.
-- Workspace `workspace_bash` calls become command observations with the command text, output text and status; exit code and duration stay unknown. Native task and Skill utilities produce no public Items.
+- Native `bash` calls become command observations with the command, the Session's workspace as the working directory, the output and status; the exit code is reported only when the native result carries one, and duration stays unknown. Native `web_fetch` calls become `web_search` observations with an `open_page` action. Native task and Skill utilities produce no public Items.
 - The adapter attaches no [native failure classification](../../../../docs/runtime-protocol.md#native-failure-classification) to its errors: MiniMax Code `0.4.12` reports a model provider rejection over ACP as JSON-RPC internal error `-32603` whose only detail is prose, so these failures stay unclassified.
 - MiniMax Code `0.4.12` retries a failed model request up to 5 times and stops retrying after 120 seconds, so a model host that does not resolve fails the Turn, unclassified, in about two minutes. Its retries stay inside MiniMax Code and never reach ACP.
 
@@ -46,9 +46,9 @@ In the workspace profile, the frozen installation's Skills are linked into the S
 | Item | Value |
 | --- | --- |
 | Base | Digest-pinned `node:22.23.1-bookworm-slim` with `ca-certificates`, `bash`, `git`, `python3`, `python3-pip` and `ripgrep` |
-| Programs | `/usr/local/bin/oac-daemon` and the companion at `/opt/mcode-harness` (native CLI at `native/cli.js`, bridge at `bridge.mjs`) |
+| Programs | `/usr/local/bin/oac-daemon` and the companion at `/opt/mcode-harness` (native CLI at `native/cli.js`) |
 | User | UID/GID 1000 with `HOME=/home/runtime` |
-| Environment | `OAC_RUNTIME_HOME=/home/runtime/.oac`, `OAC_RUNTIME_MCODE_NODE`, `OAC_RUNTIME_MCODE_BIN`, `OAC_RUNTIME_MCODE_WORKSPACE_BRIDGE`, `OAC_RUNTIME_WORKSPACE=/environment/workspace`, `OAC_RUNTIME_INITIALIZATION_DIRECTORY=/environment/initialization`, `OAC_RUNTIME_PACKAGE_DIRECTORY=/environment/packages`, `OAC_RUNTIME_STATE_DIRECTORY=/environment/runtime-state` |
+| Environment | `OAC_RUNTIME_HOME=/home/runtime/.oac`, `OAC_RUNTIME_MCODE_NODE`, `OAC_RUNTIME_MCODE_BIN`, `OAC_RUNTIME_MCODE_COMPANION`, `OAC_RUNTIME_WORKSPACE=/environment/workspace`, `OAC_RUNTIME_INITIALIZATION_DIRECTORY=/environment/initialization`, `OAC_RUNTIME_PACKAGE_DIRECTORY=/environment/packages`, `OAC_RUNTIME_STATE_DIRECTORY=/environment/runtime-state` |
 | Entry point | `oac-daemon connect --profile default`, working directory `/environment/workspace` |
 
 The build runs the companion's `check.mjs` and the native `--version`. The combined Runtime image uses this image as its base. Sandboxes run it with the [Docker sandbox settings](../../../../docs/sandbox-provider.md#docker-adapter).
diff --git a/services/core/internal/api/admin_resources_test.go b/services/core/internal/api/admin_resources_test.go
index cf323c93c..32c4660f0 100644
--- a/services/core/internal/api/admin_resources_test.go
+++ b/services/core/internal/api/admin_resources_test.go
@@ -109,7 +109,7 @@ func TestAdminResourcesHaveExplicitTargetWithoutCallerImpersonation(t *testing.T
 	}
 	for _, path := range []string{"/core/v1/project-api-keys/" + key.TokenSHA256, "/core/v1/resource-owners", "/core/v1/write-operations"} {
 		if w := projectKeyHTTP(h, "GET", path, "admin", ""); w.Code != 404 {
-			t.Fatal("retired route still served", path, w.Code)
+			t.Fatal("removed route still served", path, w.Code)
 		}
 	}
 }
diff --git a/services/core/internal/api/artifact_delivery_qa_test.go b/services/core/internal/api/artifact_delivery_qa_test.go
index 194e53912..c9048537b 100644
--- a/services/core/internal/api/artifact_delivery_qa_test.go
+++ b/services/core/internal/api/artifact_delivery_qa_test.go
@@ -162,7 +162,7 @@ func TestArtifactDeliveryMediaFixtureQA(t *testing.T) {
 		t.Fatal(err)
 	}
 	conn := &deliveryConn{archive: archive.Bytes(), incoming: make(chan []byte, 1), closed: make(chan struct{})}
-	gateway := runtimegateway.NewSessionWithOwner(conn, "device", "tenant", "test", runtimegateway.NewRegistry(), func(string, ...any) {}, nil)
+	gateway := runtimegateway.NewSession(conn, "device", "tenant", "test", runtimegateway.NewRegistry(), func(string, ...any) {})
 	gateway.Start()
 	defer gateway.Close("test")
 	storage := &deliveryStorage{}
diff --git a/services/core/internal/api/claude_admission_test.go b/services/core/internal/api/claude_admission_test.go
index 683af40e1..bb467664a 100644
--- a/services/core/internal/api/claude_admission_test.go
+++ b/services/core/internal/api/claude_admission_test.go
@@ -23,8 +23,6 @@ func TestClaudeSessionConfigurationAdmission(t *testing.T) {
 				{"schema", `,"text":{"format":{"type":"json_schema","schema":{"type":"object","properties":{"value":{"type":"string"}}}}}`, true},
 				{"lossy schema", `,"text":{"format":{"type":"json_schema","schema":{"type":"object","const":9007199254740993}}}`, false},
 				{"array schema", `,"text":{"format":{"type":"json_schema","schema":{"type":"array"}}}`, false},
-				{"schema and MCP", `,"text":{"format":{"type":"json_schema","schema":{"type":"object"}}},"tools":[` + publicMCP + `]`, false},
-				{"schema and subagents", `,"text":{"format":{"type":"json_schema","schema":{"type":"object"}}},"multi_agent":{"enabled":true}`, false},
 				{"medium", `,"text":{"verbosity":"medium"}`, true},
 				{"low", `,"text":{"verbosity":"low"}`, false},
 				{"high", `,"text":{"verbosity":"high"}`, false},
@@ -38,7 +36,6 @@ func TestClaudeSessionConfigurationAdmission(t *testing.T) {
 				{"MCP required", `,"tools":[` + strings.TrimSuffix(publicMCP, "}") + `,"required":true}]`, true},
 				{"MCP reserved label", `,"tools":[` + strings.Replace(publicMCP, `"records"`, `"functions"`, 1) + `]`, false},
 				{"MCP invalid label", `,"tools":[` + strings.Replace(publicMCP, `"records"`, `"records.v1"`, 1) + `]`, false},
-				{"MCP wildcard name", `,"tools":[` + strings.TrimSuffix(publicMCP, "}") + `,"allowed_tools":["*"]}]`, false},
 				{"MCP empty fragment", `,"tools":[` + strings.Replace(publicMCP, `/tools"`, `/tools#"`, 1) + `]`, false},
 			} {
 				t.Run(fmt.Sprintf("%s/stream=%t/input=%s", test.name, stream, input), func(t *testing.T) {
diff --git a/services/core/internal/api/compute_profile.go b/services/core/internal/api/compute_profile.go
new file mode 100644
index 000000000..fd041cac9
--- /dev/null
+++ b/services/core/internal/api/compute_profile.go
@@ -0,0 +1,3 @@
+package api
+
+var errComputeProfile = &fieldError{param: "x_agents_core.environment.compute_profile", message: "The requested compute profile is not available for hosted execution."}
diff --git a/services/core/internal/api/compute_profile_test.go b/services/core/internal/api/compute_profile_test.go
new file mode 100644
index 000000000..5269dac90
--- /dev/null
+++ b/services/core/internal/api/compute_profile_test.go
@@ -0,0 +1,28 @@
+package api
+
+import (
+	"encoding/json"
+	"errors"
+	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
+	"testing"
+)
+
+func TestComputeProfileExtensionPreservesOfficialEnvironment(t *testing.T) {
+	raw := json.RawMessage(`{"type":"openai_hosted"}`)
+	for _, value := range []string{`null`, `""`, `"BAD"`, `"a/b"`, `42`, `"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"`} {
+		_, err := preparationEnvironmentInput(raw, &v1.SessionExecutionInput{Environment: json.RawMessage(`{"compute_profile":` + value + `}`)})
+		if !errors.Is(err, errComputeProfile) {
+			t.Fatalf("%s: %v", value, err)
+		}
+	}
+	result, err := preparationEnvironmentInput(raw, &v1.SessionExecutionInput{Environment: json.RawMessage(`{"compute_profile":"memory-8g"}`)})
+	if err != nil || string(result) != string(raw) {
+		t.Fatal(string(result), err)
+	}
+	if _, err = preparationEnvironmentInput(json.RawMessage(`{"type":"self_hosted","workspace_directory":"/work"}`), &v1.SessionExecutionInput{Environment: json.RawMessage(`{"compute_profile":"memory-8g"}`)}); !errors.Is(err, errComputeProfile) {
+		t.Fatal(err)
+	}
+	if _, err = preparationEnvironmentInput(json.RawMessage(`{"type":"openai_hosted","compute_profile":"memory-8g"}`), nil); err == nil {
+		t.Fatal("official placement accepted extension field")
+	}
+}
diff --git a/services/core/internal/api/configuration.go b/services/core/internal/api/configuration.go
index 7150241f3..5d4b1b818 100644
--- a/services/core/internal/api/configuration.go
+++ b/services/core/internal/api/configuration.go
@@ -11,6 +11,7 @@ import (
 )
 
 type configuration struct {
+	ComputeProfile string                        `json:"compute_profile,omitempty"`
 	Agent          v1.Agent                      `json:"agent"`
 	Environment    v1.Environment                `json:"environment"`
 	VaultIDs       []string                      `json:"vault_ids,omitempty"`
@@ -34,5 +35,5 @@ func resolve(input sessionRequest, tenant, key string, saved *v1.SavedAgent) (js
 	} else {
 		agent.ID = saved.ID
 	}
-	return json.Marshal(configuration{Agent: agent, Environment: *input.Environment, VaultIDs: input.VaultIDs})
+	return json.Marshal(configuration{ComputeProfile: input.computeProfile, Agent: agent, Environment: *input.Environment, VaultIDs: input.VaultIDs})
 }
diff --git a/services/core/internal/api/configuration_validation.go b/services/core/internal/api/configuration_validation.go
index 577621a26..2fb0a933f 100644
--- a/services/core/internal/api/configuration_validation.go
+++ b/services/core/internal/api/configuration_validation.go
@@ -207,8 +207,7 @@ func checkMembers(path string, raw json.RawMessage, members []member) error {
 // configurationConflict reports the official semantic rejections of a
 // well-formed configuration: a non-object schema root, a repeated function name
 // and a repeated web_search or tool_search declaration. Schemas without a string
-// root type are unchanged. Session admission also applies it to the resolved
-// saved configuration, so records saved before these checks cannot execute.
+// root type are unchanged.
 func configurationConflict(tools []json.RawMessage, formatType string, schema json.RawMessage) error {
 	names, declared := map[string]bool{}, map[string]bool{}
 	for _, raw := range tools {
diff --git a/services/core/internal/api/configuration_validation_test.go b/services/core/internal/api/configuration_validation_test.go
index ed4f7fa6c..06753adbc 100644
--- a/services/core/internal/api/configuration_validation_test.go
+++ b/services/core/internal/api/configuration_validation_test.go
@@ -227,7 +227,7 @@ func TestAgentConfigurationAcceptedValuesUnchanged(t *testing.T) {
 	}
 	saved := append([]string{
 		`"tools":[{"type":"programmatic_tool_calling","enabled":true}]`,
-		// TV-05: every pinned web_search mode is saved; admission still qualifies only disabled.
+		// TV-05: every pinned web_search mode is saved.
 		`"tools":[{"type":"web_search"}]`, `"tools":[{"type":"web_search","mode":null}]`,
 		`"tools":[{"type":"web_search","mode":"live","allowed_domains":[]}]`,
 		`"tools":[{"type":"web_search","mode":"cached","context_size":"high","allowed_domains":["example.com"],"location":{"country":"FR","city":"Paris"}}]`,
@@ -253,22 +253,15 @@ func TestAgentConfigurationAcceptedValuesUnchanged(t *testing.T) {
 	}
 }
 
-// K2: execution admission limits keep their codes. Enabled or omitted-mode
-// web_search is saved (TV-05) but still rejected at Session admission.
+// K2: execution admission limits keep their codes, and a value the selected
+// Harness does not declare is rejected with the field named.
 func TestAgentConfigurationLocalLimitsKeepCodes(t *testing.T) {
 	h, s := configurationHandler(t, nil)
 	session := configurationOperations()[2]
 	for _, tc := range []struct{ fields, message string }{
-		{`"tools":[{"type":"web_search","mode":"live"}]`, "Only disabled web_search is qualified for execution."},
-		{`"tools":[{"type":"web_search","mode":"cached"}]`, "Only disabled web_search is qualified for execution."},
-		{`"tools":[{"type":"web_search","mode":null}]`, "Only disabled web_search is qualified for execution."},
-		{`"tools":[{"type":"web_search"}]`, "Only disabled web_search is qualified for execution."},
-		{`"tools":[{"type":"programmatic_tool_calling","enabled":true}]`, "Programmatic tool calling is not qualified for execution."},
 		{`"tools":[{"type":"programmatic_tool_calling","enabled":false},{"type":"programmatic_tool_calling","enabled":false}]`, "Execution requires distinct tool controls."},
-		{`"text":{"format":{"type":"json_schema","schema":{"type":"object"}}}`, "Harness codex does not support the requested Agent/environment configuration: Structured output is not qualified for this engine."},
-		{`"reasoning":{"effort":"max"}`, "Explicit reasoning execution options are not supported by this service yet."},
-		{`"service_tier":"flex"`, "Execution currently supports service_tier=auto only."},
-		{`"tools":[{"type":"function","name":"","description":"","parameters":{}}]`, "Function names must be nonempty, unique and at most 512 bytes."},
+		{`"multi_agent":{"enabled":true},"tools":[{"type":"programmatic_tool_calling","enabled":true}]`, "Harness codex does not support the requested Agent/environment configuration: programmatic_tool_calling.enabled=true is not supported with multi_agent by this Harness."},
+		{`"tools":[{"type":"function","name":"","description":"","parameters":{}}]`, "Function names must be nonempty and unique."},
 	} {
 		assertConfigurationError(t, credentialRequest(h, http.MethodPost, session.path, session.body(tc.fields)), "unsupported_or_invalid_configuration", nil, tc.message)
 	}
@@ -276,7 +269,7 @@ func TestAgentConfigurationLocalLimitsKeepCodes(t *testing.T) {
 		assertConfigurationError(t, credentialRequest(h, http.MethodPost, op.path, op.body(`"multi_agent":{"enabled":true,"max_concurrent_subagents":4294967296}`)), "unsupported_or_invalid_configuration", nil, "max_concurrent_subagents must be an integer from 1 to 4294967295.")
 	}
 	for _, op := range configurationOperations()[:3] {
-		assertConfigurationError(t, credentialRequest(h, http.MethodPost, op.path, op.body(`"tools":[{"type":"mcp","server_label":"x","transport":{"type":"stdio","command":"run","cwd":"/"}}]`)), "unsupported_or_invalid_configuration", nil, "MCP currently supports HTTP transport only.")
+		assertConfigurationError(t, credentialRequest(h, http.MethodPost, op.path, op.body(`"tools":[{"type":"mcp","server_label":"x","connection_origin":"service","transport":{"type":"stdio","command":"run","cwd":"/"}}]`)), "unsupported_or_invalid_configuration", nil, "MCP stdio servers run in the Environment; connection_origin must be environment.")
 	}
 	if s.writes != 0 {
 		t.Fatal("rejected configuration reached storage")
@@ -286,8 +279,8 @@ func TestAgentConfigurationLocalLimitsKeepCodes(t *testing.T) {
 // C4 and SES-33: only configuration errors precede the input requirement;
 // accepted configurations and saved-Agent lookup keep their order.
 func TestSessionConfigurationValidationOrder(t *testing.T) {
-	legacy := uuid.NewString()
-	h, s := configurationHandler(t, map[string]string{legacy: `{"model":"m","tools":[{"type":"web_search","mode":"disabled"}]}`})
+	saved := uuid.NewString()
+	h, s := configurationHandler(t, map[string]string{saved: `{"model":"m","tools":[{"type":"web_search","mode":"disabled"}]}`})
 	const input = "conversation-only sessions currently require initial input"
 	for _, body := range []string{
 		`{"agent":{"model":"m","tools":[{"type":"web_search","mode":"live"}]},"environment":{"type":"none"}}`,
@@ -295,7 +288,7 @@ func TestSessionConfigurationValidationOrder(t *testing.T) {
 		`{"agent":{"model":"m","reasoning":{"effort":"max"}},"environment":{"type":"none"}}`,
 		`{"agent":{"instructions":"x"},"environment":{"type":"none"}}`,
 		`{"agent_id":"` + uuid.NewString() + `","environment":{"type":"none"}}`,
-		`{"agent_id":"` + legacy + `","agent":{"tools":[{"type":"tool_search"}]},"environment":{"type":"none"}}`,
+		`{"agent_id":"` + saved + `","agent":{"tools":[{"type":"tool_search"}]},"environment":{"type":"none"}}`,
 	} {
 		assertConfigurationError(t, credentialRequest(h, http.MethodPost, "/v1/agents/sessions", body), "invalid_request_error", nil, input)
 	}
@@ -304,7 +297,7 @@ func TestSessionConfigurationValidationOrder(t *testing.T) {
 		t.Fatal(w.Code, w.Body)
 	}
 	// An invalid inline override is reported before the saved-Agent lookup.
-	for _, id := range []string{missing, legacy} {
+	for _, id := range []string{missing, saved} {
 		for _, suffix := range []string{``, `,"input":"x"`} {
 			w := credentialRequest(h, http.MethodPost, "/v1/agents/sessions", `{"agent_id":"`+id+`","agent":{"tools":[{"type":"tool_search"},{"type":"tool_search"}]},"environment":{"type":"none"}`+suffix+`}`)
 			assertConfigurationError(t, w, "invalid_request_error", nil, "duplicate tool_search tool")
@@ -315,46 +308,6 @@ func TestSessionConfigurationValidationOrder(t *testing.T) {
 	}
 }
 
-// Saved records that predate the conflict checks cannot execute.
-func TestSessionAdmissionRejectsSavedConfigurationConflicts(t *testing.T) {
-	saved := func(fields string) string {
-		return `{"model":"m","multi_agent":{"enabled":false,"max_concurrent_subagents":null},"reasoning":{},"service_tier":"auto","text":{"format":{"type":"text"},"verbosity":"medium"},` + fields + `}`
-	}
-	records := map[string]struct{ configuration, message string }{
-		uuid.NewString(): {saved(`"tools":[{"type":"function","name":"lookup","description":"","parameters":{"type":"string"},"defer_loading":false}]`), `Invalid schema for function 'lookup': schema must be a JSON Schema of 'type: "object"', got 'type: "string"'.`},
-		uuid.NewString(): {saved(`"tools":[{"type":"function","name":"f","description":"","parameters":{},"defer_loading":false},{"type":"function","name":"f","description":"","parameters":{},"defer_loading":false}]`), "duplicate function tool name: f"},
-		uuid.NewString(): {saved(`"tools":[{"type":"tool_search"},{"type":"tool_search"}]`), "duplicate tool_search tool"},
-		uuid.NewString(): {saved(`"tools":[],"text":{"format":{"type":"json_schema","schema":{"type":"array"}},"verbosity":"medium"}`), `agent.text.format.schema must have top-level type "object"; got "array"`},
-	}
-	agents := map[string]string{}
-	for id, record := range records {
-		agents[id] = record.configuration
-	}
-	valid := uuid.NewString()
-	agents[valid] = saved(`"tools":[{"type":"function","name":"f","description":"","parameters":{"type":"object"},"defer_loading":false}]`)
-	h, s := configurationHandler(t, agents)
-	for id, record := range records {
-		w := credentialRequest(h, http.MethodPost, "/v1/agents/sessions", `{"agent_id":"`+id+`","environment":{"type":"none"},"input":"x"}`)
-		assertConfigurationError(t, w, "invalid_request_error", nil, record.message)
-	}
-	if s.writes != 0 {
-		t.Fatal("rejected configuration reached storage")
-	}
-	// A replacement of the conflicting field admits the saved record.
-	for id, record := range records {
-		field := `"tools":[]`
-		if strings.Contains(record.configuration, "json_schema") {
-			field = `"text":{"format":{"type":"text"}}`
-		}
-		if w := credentialRequest(h, http.MethodPost, "/v1/agents/sessions", `{"agent_id":"`+id+`","agent":{`+field+`},"environment":{"type":"none"},"input":"x"}`); w.Code != http.StatusCreated {
-			t.Fatal(id, w.Code, w.Body)
-		}
-	}
-	if w := credentialRequest(h, http.MethodPost, "/v1/agents/sessions", `{"agent_id":"`+valid+`","environment":{"type":"none"},"input":"x"}`); w.Code != http.StatusCreated {
-		t.Fatal(w.Code, w.Body)
-	}
-}
-
 // Caller-supplied names and values are repeated only when short and printable
 // (the Environment Files rule), so every response stays small.
 func TestAgentConfigurationErrorsBoundEchoedInput(t *testing.T) {
diff --git a/services/core/internal/api/core_error_catalog_test.go b/services/core/internal/api/core_error_catalog_test.go
index 42d36dee5..27d4b3d72 100644
--- a/services/core/internal/api/core_error_catalog_test.go
+++ b/services/core/internal/api/core_error_catalog_test.go
@@ -23,7 +23,7 @@ var nonAdministrationCodes = []string{
 	// Session creation and input admission on /v1.
 	"environment_input_cancelled", "environment_input_expired", "model_provider_required", "sandbox_nodes_preparing", "turn_conflict",
 	// Machine routes for nodes and native installers.
-	"installation_authorization_invalid", "installation_unavailable", "invalid_node_credential", "sandbox_node_address_mismatch",
+	"installation_authorization_invalid", "installation_unavailable", "invalid_node_credential", "sandbox_node_address_mismatch", "sandbox_node_host_unmeasured",
 }
 
 // The shared catalog lists every code an administration caller (/core/v1 or
diff --git a/services/core/internal/api/core_model_provider_validation_test.go b/services/core/internal/api/core_model_provider_validation_test.go
index 5a9e743cd..e3ea48f90 100644
--- a/services/core/internal/api/core_model_provider_validation_test.go
+++ b/services/core/internal/api/core_model_provider_validation_test.go
@@ -56,8 +56,6 @@ func TestCoreModelProviderValidationFields(t *testing.T) {
 		{"protocol", "codex", `{"protocol":"private-protocol","base_url":"https://example.test","api_key":"private-key"}`, "model_provider_protocol_unsupported", "protocol", map[string]any{"harness": "codex", "allowed_protocols": []any{"responses"}}},
 		{"key", "codex", `{"protocol":"responses","base_url":"https://example.test","api_key":"private-key\n"}`, "model_provider_api_key_invalid", "api_key", map[string]any{"max_length": float64(16384)}},
 		{"output", "codex", `{"protocol":"responses","base_url":"https://example.test","api_key":"private-key","context_window":1,"max_output_tokens":2}`, "model_provider_token_limits_invalid", "max_output_tokens", nil},
-		{"context required", "mcode", `{"protocol":"anthropic","base_url":"https://example.test","api_key":"private-key"}`, "model_provider_token_limits_invalid", "context_window", nil},
-		{"output required", "mcode", `{"protocol":"anthropic","base_url":"https://example.test","api_key":"private-key","context_window":2}`, "model_provider_token_limits_invalid", "max_output_tokens", nil},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			out := projectKeyHTTP(h, http.MethodPut, "/core/v1/harnesses/"+tc.harness+"/model-configuration", "admin", `{"model":"fixture","model_provider":`+tc.body+`}`)
diff --git a/services/core/internal/api/core_store_validation_test.go b/services/core/internal/api/core_store_validation_test.go
index bd950b480..ab72175a1 100644
--- a/services/core/internal/api/core_store_validation_test.go
+++ b/services/core/internal/api/core_store_validation_test.go
@@ -33,7 +33,6 @@ func TestCoreStoreValidationFieldsAndPublicFallback(t *testing.T) {
 	upperCapacityErr := nodes.UpdateNode(context.Background(), managementProjectID, deployment.NodeUpdate{Name: "node", MaxActive: 1000001, MaxRetained: 8})
 	capacityErr := nodes.UpdateNode(context.Background(), managementProjectID, deployment.NodeUpdate{Name: "node", MaxActive: 0})
 	_, resourceErr := nodes.SetupForSelection(managementProjectID, sandbox.Selection{Provider: "docker", DeploymentSpec: sandbox.DeploymentSpec{}})
-	_, runtimeErr := nodes.SetupForSelection(managementProjectID, sandbox.Selection{Provider: "docker", DeploymentSpec: sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 1, MemoryMiB: 512}}})
 	for _, tc := range []struct {
 		err                       error
 		code, param               string
@@ -46,7 +45,6 @@ func TestCoreStoreValidationFieldsAndPublicFallback(t *testing.T) {
 		{upperCapacityErr, "invalid_node_capacity", "max_active", map[string]any{"min": float64(1), "max": float64(1000000)}, "Invalid resource identifier or request limits.", "invalid_request", writeDeploymentError},
 		{capacityErr, "invalid_node_capacity", "max_active", map[string]any{"min": float64(1), "max": float64(1000000)}, "Invalid resource identifier or request limits.", "invalid_request", writeDeploymentError},
 		{resourceErr, "invalid_sandbox_configuration", "resources.cpus", map[string]any{"min": float64(1), "max": float64(255)}, "invalid sandbox configuration: cpus must be 1..255 and memory_mib must be 512..1048576", "invalid_sandbox_configuration", writeDeploymentError},
-		{runtimeErr, "invalid_sandbox_configuration", "runtime", nil, "invalid sandbox configuration: managed nodes require a pinned Runtime release", "invalid_sandbox_configuration", writeDeploymentError},
 	} {
 		if tc.err == nil {
 			t.Fatal("missing validator error")
@@ -86,8 +84,8 @@ func TestCoreStoreValidationFieldsAndPublicFallback(t *testing.T) {
 
 func TestCoreActiveCapacityUpperBoundNamesSubmittedField(t *testing.T) {
 	deps, fakes := sandboxFakes(t)
-	fakes.deployment.createEnrollment = func(_ context.Context, capacity deployment.Capacity) (deployment.EnrollmentToken, error) {
-		return deployment.EnrollmentToken{}, nodeCapacity(capacity.MaxActive)
+	fakes.deployment.createEnrollment = func(_ context.Context, limits deployment.EnrollmentLimits) (deployment.EnrollmentToken, error) {
+		return deployment.EnrollmentToken{}, nodeCapacity(*limits.MaxActive)
 	}
 	fakes.deployment.updateNode = func(_ context.Context, _ string, input deployment.NodeUpdate) error {
 		return nodeCapacity(input.MaxActive)
diff --git a/services/core/internal/api/environment_creation_test.go b/services/core/internal/api/environment_creation_test.go
index e9f03cd95..13cc1db50 100644
--- a/services/core/internal/api/environment_creation_test.go
+++ b/services/core/internal/api/environment_creation_test.go
@@ -169,7 +169,6 @@ func TestSelfHostedCreationRejectsBeforePersistence(t *testing.T) {
 		{name: "scalar capabilities", environment: `{"type":"self_hosted","workspace_directory":"/workspace","capability_directories":"/remote/skills"}`},
 		{name: "output field", environment: `{"type":"self_hosted","workspace_directory":"/workspace","remote_url":"https://forged.example"}`},
 		{name: "none extra field", environment: `{"type":"none","workspace_directory":null}`},
-		{name: "initial image", environment: validEnvironment, input: `,"input":[{"role":"user","content":[{"type":"input_image","image_url":"https://example.com/image.png"}]}]`},
 		{name: "initial assistant message", environment: validEnvironment, input: `,"input":[{"role":"assistant","content":[{"type":"input_text","text":"start"}]}]`},
 		{name: "deferred functions", environment: validEnvironment, agentFields: `,"tools":[{"type":"function","name":"lookup","description":"Find a value","parameters":{"type":"object"},"defer_loading":true}]`},
 		{name: "unregistered harness placement", environment: validEnvironment, engine: "unregistered"},
diff --git a/services/core/internal/api/environment_input_test.go b/services/core/internal/api/environment_input_test.go
index a0803f2b3..7e8f832e1 100644
--- a/services/core/internal/api/environment_input_test.go
+++ b/services/core/internal/api/environment_input_test.go
@@ -25,6 +25,7 @@ func TestPublicEnvironmentInputFailureMappings(t *testing.T) {
 		{execution.ErrEnvironmentInputCancelled, http.StatusConflict, "environment_input_cancelled"},
 		{execution.ErrExecutionUnavailable, http.StatusServiceUnavailable, "execution_unavailable"},
 		{execution.ErrWhitespaceOnlyText, http.StatusBadRequest, "unsupported_or_invalid_configuration"},
+		{sessions.ErrRetainedHistoryUnsupported, http.StatusBadRequest, "unsupported_or_invalid_configuration"},
 	} {
 		t.Run(tc.code, func(t *testing.T) {
 			recorder := &inputRecorder{err: fmt.Errorf("submission: %w", tc.err)}
diff --git a/services/core/internal/api/environment_preparation_input.go b/services/core/internal/api/environment_preparation_input.go
index d0d43e4e7..8453bd1a2 100644
--- a/services/core/internal/api/environment_preparation_input.go
+++ b/services/core/internal/api/environment_preparation_input.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 
 	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 )
 
@@ -28,6 +29,12 @@ func preparationEnvironmentInput(raw json.RawMessage, extension *v1.SessionExecu
 	}
 	for name, value := range setup {
 		switch name {
+		case "compute_profile":
+			var profile string
+			if kind != "openai_hosted" || json.Unmarshal(value, &profile) != nil || !sandbox.ValidComputeProfile(profile) {
+				return nil, errComputeProfile
+			}
+			continue
 		case "environment_template_id", "files", "env", "packages", "setup_commands", "skills", "plugins", "capability_directories":
 		default:
 			return nil, sessions.ErrInvalidInput
diff --git a/services/core/internal/api/environment_templates_test.go b/services/core/internal/api/environment_templates_test.go
index 077694c45..38b722249 100644
--- a/services/core/internal/api/environment_templates_test.go
+++ b/services/core/internal/api/environment_templates_test.go
@@ -73,7 +73,7 @@ func (l *templateLookup) resolved() environmenttemplates.Resolved {
 }
 
 // Session creation resolves the Template for the caller's tenant and answers
-// with the error of a Template it cannot resolve or cannot apply.
+// with the error of a Template it cannot resolve.
 func TestSessionCreationResolvesTemplateForTenant(t *testing.T) {
 	for _, test := range []struct {
 		body   string
@@ -82,7 +82,6 @@ func TestSessionCreationResolvesTemplateForTenant(t *testing.T) {
 		want   string
 	}{
 		{`{"agent":{"model":"test"},"environment":{"type":"openai_hosted","environment_template_id":"saved"},"input":"Start."}`, environmenttemplates.ErrNotFound, http.StatusNotFound, `"not_found_error"`},
-		{`{"agent":{"model":"test"},"environment":{"type":"self_hosted","workspace_directory":"/work"},"x_agents_core":{"environment":{"environment_template_id":"saved"}}}`, nil, http.StatusBadRequest, `"type":"invalid_request_error","code":"invalid_request_error","param":"x_agents_core.environment.environment_template_id"`},
 	} {
 		var resolved []string
 		h, _, tenant := testHandler(t, func(_ *Dependencies, f *testFakes) {
diff --git a/services/core/internal/api/errors.go b/services/core/internal/api/errors.go
index 3b4b6c0b2..af339ab6d 100644
--- a/services/core/internal/api/errors.go
+++ b/services/core/internal/api/errors.go
@@ -98,8 +98,13 @@ func writeOperationError(w http.ResponseWriter, r *http.Request, err error) {
 const invalidInputMessage = "Invalid resource identifier or request limits."
 
 // writeInternalError reports an unmapped failure. Driver errors can include
-// submitted values, so the raw error is never logged.
+// submitted values, so the raw error is never logged. Once the client has gone,
+// the failure is its ended request context: nothing is reported, and the request
+// log records the request as aborted.
 func writeInternalError(w http.ResponseWriter, r *http.Request) {
+	if r.Context().Err() != nil {
+		return
+	}
 	log.Ctx(r.Context()).Error("oac-core persistence operation failed")
 	writeError(w, http.StatusInternalServerError, "internal_error", "The operation could not be completed.")
 }
diff --git a/services/core/internal/api/errors_agents.go b/services/core/internal/api/errors_agents.go
index f8577c622..728c9e481 100644
--- a/services/core/internal/api/errors_agents.go
+++ b/services/core/internal/api/errors_agents.go
@@ -4,7 +4,6 @@ import (
 	"errors"
 	"net/http"
 
-	"github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/agents"
 )
 
@@ -19,7 +18,6 @@ func writeAgentsError(w http.ResponseWriter, r *http.Request, err error) {
 	case errors.Is(err, agents.ErrInvalidInput):
 		writeError(w, http.StatusBadRequest, "invalid_request", "Invalid resource identifier or request limits.")
 	default:
-		log.Ctx(r.Context()).Error("oac-core persistence operation failed")
-		writeError(w, http.StatusInternalServerError, "internal_error", "The operation could not be completed.")
+		writeInternalError(w, r)
 	}
 }
diff --git a/services/core/internal/api/errors_deployment.go b/services/core/internal/api/errors_deployment.go
index 76646108d..135f31bce 100644
--- a/services/core/internal/api/errors_deployment.go
+++ b/services/core/internal/api/errors_deployment.go
@@ -72,6 +72,8 @@ func writeSandboxError(w http.ResponseWriter, err error) bool {
 		}
 	case errors.As(err, &unsupported):
 		writeError(w, http.StatusBadRequest, "sandbox_operation_unsupported", "The selected sandbox provider does not support this operation.")
+	case errors.Is(err, sandbox.ErrWorkspaceRequired):
+		writeError(w, http.StatusConflict, "workspace_storage_required", "This sandbox provider runs every Environment on workspace storage. Select workspace storage first.")
 	case errors.Is(err, sandbox.ErrInvalid):
 		writeError(w, http.StatusBadRequest, "invalid_sandbox_configuration", "Invalid sandbox provider configuration.", "configuration")
 	case errors.As(err, &stale):
@@ -86,14 +88,18 @@ func writeSandboxError(w http.ResponseWriter, err error) bool {
 		writeError(w, http.StatusBadRequest, "invalid_sandbox_configuration", deploymentConfiguration.Message)
 	case errors.Is(err, placement.ErrResetAdmission):
 		writeError(w, http.StatusServiceUnavailable, "sandbox_reset_in_progress", "A sandbox reset is in progress.")
+	case errors.Is(err, placement.ErrComputeProfileUnavailable):
+		writeError(w, http.StatusBadRequest, "invalid_request_error", errComputeProfile.message, errComputeProfile.param)
 	case errors.Is(err, placement.ErrAdmissionClosed):
 		writeError(w, http.StatusConflict, "environment_unavailable", "The environment is no longer available for new input.")
 	case errors.Is(err, placement.ErrPublicURLUnreachable):
 		writeError(w, http.StatusConflict, "sandbox_configuration_error", err.Error())
 	case errors.Is(err, deployment.ErrNodeAddressMismatch):
 		writeError(w, http.StatusConflict, "sandbox_node_address_mismatch", "This node uses a different Core address than the installation public URL. Generate a new command on the Nodes page and run it on the host.")
+	case errors.Is(err, deployment.ErrNodeHostUnmeasured):
+		writeError(w, http.StatusConflict, "sandbox_node_host_unmeasured", "This node reported no host measurements, so Core cannot derive its limits. Set both limits when you generate the command.")
 	case errors.Is(err, deployment.ErrSpecificationMismatch):
-		writeError(w, http.StatusConflict, "sandbox_specification_mismatch", "The node resource limits or Runtime release do not match the active deployment. Restore its installed configuration or remove and enroll the node again after a drained deployment change.")
+		writeError(w, http.StatusConflict, "sandbox_specification_mismatch", "The node resource limits do not match the active deployment. Restore its installed configuration or remove and enroll the node again after a drained deployment change.")
 	case errors.Is(err, deployment.ErrNodeExists):
 		writeError(w, http.StatusConflict, "idempotency_conflict", "This idempotency key was used with different input.")
 	case errors.Is(err, deployment.ErrConflict):
diff --git a/services/core/internal/api/errors_files.go b/services/core/internal/api/errors_files.go
index 0b8d1ab9b..f5de3795c 100644
--- a/services/core/internal/api/errors_files.go
+++ b/services/core/internal/api/errors_files.go
@@ -5,7 +5,6 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/files"
 )
 
@@ -28,8 +27,6 @@ func writeFilesError(w http.ResponseWriter, r *http.Request, err error, notFound
 	case errors.Is(err, files.ErrInvalidInput):
 		writeError(w, http.StatusBadRequest, "invalid_request", "Invalid resource identifier or request limits.")
 	default:
-		// Storage failures can include submitted values; do not log the error.
-		log.Ctx(r.Context()).Error("oac-core persistence operation failed")
-		writeError(w, http.StatusInternalServerError, "internal_error", "The operation could not be completed.")
+		writeInternalError(w, r)
 	}
 }
diff --git a/services/core/internal/api/errors_sessions.go b/services/core/internal/api/errors_sessions.go
index 32a2328a2..6cf86d9c1 100644
--- a/services/core/internal/api/errors_sessions.go
+++ b/services/core/internal/api/errors_sessions.go
@@ -49,6 +49,8 @@ func writeSessionsError(w http.ResponseWriter, r *http.Request, err error) {
 		writeError(w, http.StatusConflict, "environment_input_cancelled", "The environment input was cancelled before admission.")
 	case errors.Is(err, execution.ErrWhitespaceOnlyText):
 		writeError(w, http.StatusBadRequest, "unsupported_or_invalid_configuration", "This Session's harness does not accept a message whose text is only whitespace. Include non-whitespace text or an image, or use a harness that supports whitespace-only text.")
+	case errors.Is(err, sessions.ErrRetainedHistoryUnsupported):
+		writeError(w, http.StatusBadRequest, "unsupported_or_invalid_configuration", "This Session's harness does not retain its native history, which the sandbox provider's workspace storage requires. Use a harness that supports retained_native_history, or a sandbox provider with its own disk.")
 	case errors.Is(err, execution.ErrExecutionUnavailable):
 		writeError(w, http.StatusServiceUnavailable, "execution_unavailable", "Execution is not available on this service.")
 	case errors.As(err, &cursor):
diff --git a/services/core/internal/api/errors_test.go b/services/core/internal/api/errors_test.go
index 9ade94cb3..521a2d5f6 100644
--- a/services/core/internal/api/errors_test.go
+++ b/services/core/internal/api/errors_test.go
@@ -1,6 +1,7 @@
 package api
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -14,6 +15,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/execution"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/files"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/textvalue"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/writeaudit"
@@ -137,6 +139,7 @@ func TestConflictErrorsUseConflictType(t *testing.T) {
 	for err, code := range map[error]string{
 		deployment.ErrConflict:                 "sandbox_deployment_conflict",
 		deployment.ErrNodeInUse:                "runtime_node_in_use",
+		sandbox.ErrWorkspaceRequired:           "workspace_storage_required",
 		deployment.ErrNodeAddressMismatch:      "sandbox_node_address_mismatch",
 		sessions.ErrEnvironmentUnavailable:     "environment_unavailable",
 		execution.ErrEnvironmentInputExpired:   "environment_input_expired",
@@ -195,3 +198,14 @@ func TestSharedPersistenceErrors(t *testing.T) {
 		}
 	}
 }
+
+// A client that has gone gets no error report: its ended context is the failure.
+func TestInternalErrorAfterClientAbort(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	response := httptest.NewRecorder()
+	writeAgentsError(response, httptest.NewRequest(http.MethodGet, "/v1/agents", nil).WithContext(ctx), context.Canceled)
+	if response.Body.Len() != 0 {
+		t.Fatal(response.Body)
+	}
+}
diff --git a/services/core/internal/api/fakes_test.go b/services/core/internal/api/fakes_test.go
index e15b70f2c..19d994198 100644
--- a/services/core/internal/api/fakes_test.go
+++ b/services/core/internal/api/fakes_test.go
@@ -188,7 +188,7 @@ type fakeDeployment struct {
 	nodeDetail          func(context.Context, string, string) (deployment.NodeDetail, error)
 	updateNode          func(context.Context, string, deployment.NodeUpdate) error
 	removeNode          func(context.Context, string) error
-	createEnrollment    func(context.Context, deployment.Capacity) (deployment.EnrollmentToken, error)
+	createEnrollment    func(context.Context, deployment.EnrollmentLimits) (deployment.EnrollmentToken, error)
 	enroll              func(context.Context, string, deployment.Enrollment) (deployment.NodeIdentity, error)
 	nodeConfiguration   func(context.Context, string, string, uint64) (deployment.NodeConfiguration, error)
 	nodeStatus          func(context.Context, string, string) (deployment.NodeStatus, error)
@@ -230,7 +230,7 @@ func (f *fakeDeployment) RemoveNode(a0 context.Context, a1 string) error {
 	return f.removeNode(a0, a1)
 }
 
-func (f *fakeDeployment) CreateEnrollment(a0 context.Context, a1 deployment.Capacity) (deployment.EnrollmentToken, error) {
+func (f *fakeDeployment) CreateEnrollment(a0 context.Context, a1 deployment.EnrollmentLimits) (deployment.EnrollmentToken, error) {
 	if f.createEnrollment == nil {
 		unexpectedCall(f.t, "CreateEnrollment")
 	}
diff --git a/services/core/internal/api/function_configuration.go b/services/core/internal/api/function_configuration.go
index 0674a43f5..106c87148 100644
--- a/services/core/internal/api/function_configuration.go
+++ b/services/core/internal/api/function_configuration.go
@@ -10,13 +10,10 @@ import (
 
 func resolveFunctions(input []v1.FunctionToolInput) ([]json.RawMessage, error) {
 	tools := make([]json.RawMessage, 0, len(input))
-	if len(input) > 64 {
-		return nil, errors.New("This service supports at most 64 function tools.")
-	}
 	names := make(map[string]bool, len(input))
 	for _, tool := range input {
-		if strings.TrimSpace(tool.Name) == "" || len(tool.Name) > 512 || names[tool.Name] {
-			return nil, errors.New("Function names must be nonempty, unique and at most 512 bytes.")
+		if strings.TrimSpace(tool.Name) == "" || names[tool.Name] {
+			return nil, errors.New("Function names must be nonempty and unique.")
 		}
 		value, err := resolveFunction(tool)
 		if err != nil {
diff --git a/services/core/internal/api/function_configuration_test.go b/services/core/internal/api/function_configuration_test.go
index 33bb9c3a7..2a612aa16 100644
--- a/services/core/internal/api/function_configuration_test.go
+++ b/services/core/internal/api/function_configuration_test.go
@@ -44,7 +44,7 @@ func TestPublicFunctionConfiguration(t *testing.T) {
 func TestPublicFunctionConfigurationRejectsInvalidOrUnsupported(t *testing.T) {
 	base := `"type":"function","name":"lookup","description":"","parameters":{}`
 	for _, raw := range []string{
-		`[null]`, `[{}]`, `[{"type":"web_search"}]`, `[{"type":"function","name":"lookup","parameters":{}}]`,
+		`[null]`, `[{}]`, `[{"type":"function","name":"lookup","parameters":{}}]`,
 		`[{"type":"function","name":null,"description":"","parameters":{}}]`,
 		`[{"type":"function","name":"lookup","description":null,"parameters":{}}]`,
 		`[{"type":"function","name":"lookup","description":""}]`,
diff --git a/services/core/internal/api/harness_model_providers.go b/services/core/internal/api/harness_model_providers.go
index 582047bee..387829215 100644
--- a/services/core/internal/api/harness_model_providers.go
+++ b/services/core/internal/api/harness_model_providers.go
@@ -3,12 +3,10 @@ package api
 import (
 	"context"
 	"net/http"
-	"slices"
 	"time"
 
 	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/modelconfiguration"
 	"github.com/go-chi/chi/v5"
 )
@@ -74,7 +72,7 @@ func (h *Handler) registerHarnessRoutes(r chi.Router) {
 // knownHarness reports the path harness, writing 404 for one this build lacks.
 func knownHarness(w http.ResponseWriter, r *http.Request) (string, bool) {
 	harness := chi.URLParam(r, "harness")
-	if !slices.Contains((engine.Catalog{}).Kinds(), harness) {
+	if !builtin.Contains(harness) {
 		writeError(w, http.StatusNotFound, "not_found", "This harness does not exist.")
 		return "", false
 	}
@@ -96,12 +94,11 @@ func (h *Handler) listHarnesses(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	list := CoreHarnessList{Object: "list", Data: []CoreHarness{}}
-	for _, kind := range (engine.Catalog{}).Kinds() {
+	for _, kind := range builtin.Kinds() {
 		declaration, _ := builtin.Registry().Lookup(kind)
-		support := v1.ModelConfigurationSupport{Protocols: []string{}, AcceptsHarnessConfig: declaration.AcceptsHarnessConfig()}
+		support := v1.ModelConfigurationSupport{Protocols: []string{}, AcceptsHarnessConfig: declaration.AcceptsHarnessConfig(), AcceptsMaxOutputTokens: declaration.MaxOutputTokens}
 		for _, provider := range declaration.Providers {
 			support.Protocols = append(support.Protocols, provider.Protocol)
-			support.TokenLimitsRequired = support.TokenLimitsRequired || provider.RequiresTokenLimits
 		}
 		harness := CoreHarness{ModelConfigurationSupport: support, Object: "core.harness", ID: kind, Enabled: kind == h.Engine || h.harnesses[kind], Default: kind == h.Engine}
 		for _, provider := range providers {
diff --git a/services/core/internal/api/hosted_structured_test.go b/services/core/internal/api/hosted_structured_test.go
deleted file mode 100644
index 16fe09fed..000000000
--- a/services/core/internal/api/hosted_structured_test.go
+++ /dev/null
@@ -1,61 +0,0 @@
-package api
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/execution"
-)
-
-func TestHostedStructuredConfigurationQualification(t *testing.T) {
-	format := `"text":{"format":{"type":"json_schema","schema":{"type":"object"}}}`
-	for _, fields := range []string{
-		`"skills":[` + string(skillInput(t, "Use native tools.")) + `]`,
-		`"plugins":[` + string(pluginInput(t)) + `]`,
-		`"capability_directories":["/workspace/capabilities"]`,
-	} {
-		template, err := decodeTemplateInput(json.RawMessage(`{` + fields + `}`))
-		if err != nil {
-			t.Fatal(err)
-		}
-		lookup := &templateLookup{network: "enabled", skills: template.Setup.Skills,
-			plugins: template.Setup.Plugins, directories: template.Setup.CapabilityDirectories}
-		for _, environment := range []string{
-			`{"type":"openai_hosted",` + fields + `}`,
-			`{"type":"openai_hosted","environment_template_id":"saved"}`,
-			`{"type":"openai_hosted","environment_template_id":"saved","skills":[],"plugins":[],"capability_directories":[]}`,
-		} {
-			var decoded decodedSessionRequest
-			if err := json.Unmarshal([]byte(`{"agent":{"model":"model",`+format+`},"environment":`+environment+`}`), &decoded); err != nil {
-				t.Fatal(err)
-			}
-			input, err := decoded.validated()
-			if err != nil {
-				t.Fatal(err)
-			}
-			if input.templateID != "" {
-				if err := applyTemplateEnvironment(&input, lookup.resolved()); err != nil {
-					t.Fatal(err)
-				}
-			}
-			configuration, err := resolve(input, "tenant", "key", nil)
-			if err != nil {
-				t.Fatal(err)
-			}
-			wantAccepted := len(input.Environment.Skills)+len(input.Environment.Plugins)+len(input.Environment.CapabilityDirectories) == 0
-			if err := (execution.Policy{}).ValidateSessionConfiguration("claude_sdk", configuration); (err == nil) != wantAccepted {
-				t.Fatal("incorrect inline/template qualification", environment, err)
-			}
-			if !wantAccepted {
-				input.Agent.Text.Format = json.RawMessage(`{"type":"text"}`)
-				configuration, err = resolve(input, "tenant", "key", nil)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if err := (execution.Policy{}).ValidateSessionConfiguration("claude_sdk", configuration); err != nil {
-					t.Fatal("ordinary workspace profile changed", err)
-				}
-			}
-		}
-	}
-}
diff --git a/services/core/internal/api/inputs.go b/services/core/internal/api/inputs.go
index 8d300e5ed..8f38a4404 100644
--- a/services/core/internal/api/inputs.go
+++ b/services/core/internal/api/inputs.go
@@ -110,7 +110,7 @@ func executionInputs(events []json.RawMessage) ([]sessions.Input, error) {
 				for _, content := range message.Content {
 					converted[0].Content = append(converted[0].Content, proto.InputContent{Type: content.Type, Text: content.Text, ImageURL: content.ImageURL})
 				}
-				if converted.Validate() != nil || converted.ValidateInlineImages() != nil {
+				if converted.Validate() != nil {
 					return nil, sessions.ErrInvalidInput
 				}
 			}
diff --git a/services/core/internal/api/inputs_test.go b/services/core/internal/api/inputs_test.go
index f6cb61e63..2706d5df2 100644
--- a/services/core/internal/api/inputs_test.go
+++ b/services/core/internal/api/inputs_test.go
@@ -62,7 +62,7 @@ func TestPublicInputRejectsUnsupportedOrMalformedBatch(t *testing.T) {
 		`{"events":[{"type":"agent.session.input.message","input":[{"type":null,"role":"user","content":[{"type":"input_text","text":"x"}]}]}]}`,
 		`null`, `{}`, `{"events":null}`, `{"events":[{"type":"agent.session.input.tool_result","call_id":"x"}]}`,
 		`{"events":[{"type":"agent.session.input.message","input":[{"role":"assistant","content":[{"type":"input_text","text":"x"}]}]}]}`,
-		`{"events":[{"type":"agent.session.input.message","input":[{"role":"user","content":[{"type":"input_image","image_url":"https://example.com/a.png"}]}]}]}`,
+		`{"events":[{"type":"agent.session.input.message","input":[{"role":"user","content":[{"type":"input_image","image_url":" "}]}]}]}`,
 		`{"events":[{"type":"agent.session.input.cancel","input":[]}]}`,
 		`{"events":[{"type":"agent.session.input.message","input":[{"role":"user","content":[{"type":"input_text","text":""}]}]}]}`,
 		`{"events":[{"type":"agent.session.input.cancel"}]} {}`,
diff --git a/services/core/internal/api/mcp_configuration.go b/services/core/internal/api/mcp_configuration.go
index 6af603b52..cc9927111 100644
--- a/services/core/internal/api/mcp_configuration.go
+++ b/services/core/internal/api/mcp_configuration.go
@@ -7,12 +7,12 @@ import (
 	"strings"
 
 	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentplugin"
 )
 
-const mcpHTTPOnly = "MCP currently supports HTTP transport only."
-
 // resolveMCPTool canonicalizes a declaration whose pinned shape was checked at
-// decode. Core executes HTTP servers only and keeps its local limits.
+// decode. Core keeps its local limits.
 func resolveMCPTool(raw json.RawMessage, saved bool) (json.RawMessage, error) {
 	var input v1.MCPToolInput
 	var transport struct {
@@ -20,6 +20,11 @@ func resolveMCPTool(raw json.RawMessage, saved bool) (json.RawMessage, error) {
 		ServerURL     string            `json:"server_url"`
 		Authorization *string           `json:"authorization"`
 		Headers       map[string]string `json:"headers"`
+		Command       string            `json:"command"`
+		Args          []string          `json:"args"`
+		Cwd           string            `json:"cwd"`
+		EnvVars       []string          `json:"env_vars"`
+		Env           map[string]string `json:"env"`
 	}
 	if err := errors.Join(json.Unmarshal(raw, &input), json.Unmarshal(input.Transport, &transport)); err != nil {
 		return nil, &storedDataError{err}
@@ -27,32 +32,27 @@ func resolveMCPTool(raw json.RawMessage, saved bool) (json.RawMessage, error) {
 	if strings.TrimSpace(input.ServerLabel) == "" {
 		return nil, errors.New("MCP tools require type=mcp and a nonempty server_label.")
 	}
-	if transport.Type != "http" {
-		return nil, errors.New(mcpHTTPOnly)
-	}
+	stdio := transport.Type == "stdio"
 	// The official service saves an omitted or null origin on an HTTP server as
 	// "service" (MV-01). Defaulting it here makes the stored and frozen
-	// configuration identical to an explicit declaration.
+	// configuration identical to an explicit declaration. A stdio server runs
+	// in the Environment, so "environment" is its default and only origin.
 	origin := "service"
+	if stdio {
+		origin = "environment"
+	}
 	if input.ConnectionOrigin != nil {
 		origin = *input.ConnectionOrigin
 	}
-	if input.CredentialID != nil && *input.CredentialID == "" {
-		return nil, errors.New("MCP credential_id must be null or a nonempty string.")
+	if stdio && origin != "environment" {
+		return nil, errors.New("MCP stdio servers run in the Environment; connection_origin must be environment.")
+	}
+	if input.CredentialID != nil && (*input.CredentialID == "" || stdio) {
+		return nil, errors.New("MCP credential_id must be null or a nonempty string, and stdio servers take none.")
 	}
 	if len(input.RequestMetadata) != 0 {
 		return nil, errors.New("Nonempty MCP request_metadata is not supported yet.")
 	}
-	u, err := url.Parse(transport.ServerURL)
-	if err != nil || u.Hostname() == "" || (u.Scheme != "http" && u.Scheme != "https") || u.User != nil || u.Fragment != "" || u.RawQuery != "" || u.ForceQuery {
-		return nil, errors.New("MCP server_url must be an absolute HTTP(S) URL without credentials, query or fragment.")
-	}
-	if transport.Authorization != nil {
-		return nil, errors.New("Inline MCP authorization is not supported yet.")
-	}
-	if len(transport.Headers) != 0 {
-		return nil, errors.New("Nonempty MCP headers are not supported yet.")
-	}
 	var allowed *[]string
 	if input.AllowedTools != nil {
 		for _, name := range input.AllowedTools {
@@ -62,12 +62,42 @@ func resolveMCPTool(raw json.RawMessage, saved bool) (json.RawMessage, error) {
 		}
 		allowed = &input.AllowedTools
 	}
-	tool := v1.MCPTool{Type: "mcp", ServerLabel: input.ServerLabel,
-		Transport:    v1.MCPHTTPTransport{Type: "http", ServerURL: transport.ServerURL},
-		AllowedTools: allowed, Required: input.Required != nil && *input.Required, ConnectionOrigin: origin, CredentialID: input.CredentialID, RequestMetadata: map[string]json.RawMessage{}}
-	if saved {
-		headers := map[string]string{}
-		tool.Transport.Headers = &headers
+	tool := v1.MCPTool{Type: "mcp", ServerLabel: input.ServerLabel, AllowedTools: allowed, Required: input.Required != nil && *input.Required,
+		ConnectionOrigin: origin, CredentialID: input.CredentialID, RequestMetadata: map[string]json.RawMessage{}}
+	if stdio {
+		if len(transport.Env) != 0 {
+			return nil, errors.New("Inline MCP env is not supported; declare env_vars and set the values in the Environment.")
+		}
+		args, envVars := append([]string{}, transport.Args...), append([]string{}, transport.EnvVars...)
+		if !(proto.MCPStdio{Command: transport.Command, Args: args, Cwd: transport.Cwd, EnvVars: envVars}).Valid() {
+			return nil, errors.New("MCP stdio servers require a nonempty command, an absolute cwd, variable names in env_vars and no NUL characters.")
+		}
+		tool.Transport = v1.MCPTransport{Type: "stdio", Command: transport.Command, Args: &args, Cwd: transport.Cwd, EnvVars: &envVars}
+		return json.Marshal(tool)
+	}
+	if transport.Type != "http" {
+		return nil, errors.New("MCP supports the http and stdio transports only.")
+	}
+	u, err := url.Parse(transport.ServerURL)
+	if err != nil || u.Hostname() == "" || (u.Scheme != "http" && u.Scheme != "https") || u.User != nil || u.Fragment != "" {
+		return nil, errors.New("MCP server_url must be an absolute HTTP(S) URL without credentials or fragment.")
+	}
+	if transport.Authorization != nil {
+		return nil, errors.New("Inline MCP authorization is not supported; use credential_id.")
+	}
+	for name := range transport.Headers {
+		if strings.EqualFold(name, "Authorization") {
+			return nil, errors.New("MCP headers cannot carry Authorization; use credential_id.")
+		}
+	}
+	if !agentplugin.ValidHTTPHeaders(transport.Headers) {
+		return nil, errors.New("MCP headers require valid HTTP names and values, with names unique ignoring case.")
+	}
+	tool.Transport = v1.MCPTransport{Type: "http", ServerURL: transport.ServerURL}
+	if len(transport.Headers) != 0 {
+		tool.Transport.Headers = &transport.Headers
+	} else if saved {
+		tool.Transport.Headers = &map[string]string{}
 	}
 	return json.Marshal(tool)
 }
diff --git a/services/core/internal/api/mcp_configuration_test.go b/services/core/internal/api/mcp_configuration_test.go
index f0013cafb..9314cf0a0 100644
--- a/services/core/internal/api/mcp_configuration_test.go
+++ b/services/core/internal/api/mcp_configuration_test.go
@@ -1,7 +1,10 @@
 package api
 
 import (
+	"fmt"
+
 	"encoding/json"
+	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
 	"reflect"
 	"strings"
 	"testing"
@@ -68,11 +71,42 @@ func TestMCPOmittedOriginIsService(t *testing.T) {
 			}
 		}
 	}
-	// Other transports report the transport restriction with any origin.
-	for _, origin := range []string{"", `,"connection_origin":null`, `,"connection_origin":"service"`} {
-		input := `{"type":"mcp","server_label":"records"` + origin + `,"transport":{"type":"stdio","command":"run","cwd":"/"}}`
-		if _, err := resolveMCPTool(json.RawMessage(input), true); err == nil || err.Error() != "MCP currently supports HTTP transport only." {
-			t.Fatalf("stdio origin %q: %v", origin, err)
+}
+
+// A stdio server runs in the Environment: the origin defaults to it, an inline
+// env is rejected, and the saved and effective forms match the pinned resource.
+func TestMCPStdioDeclaration(t *testing.T) {
+	const stdio = `{"type":"stdio","command":"run","args":["-x"],"cwd":"/work","env_vars":["TOKEN"]`
+	input := func(origin, transport string) json.RawMessage {
+		return json.RawMessage(`{"type":"mcp","server_label":"records"` + origin + `,"transport":` + transport + `}`)
+	}
+	for _, saved := range []bool{false, true} {
+		for _, origin := range []string{"", `,"connection_origin":null`, `,"connection_origin":"environment"`} {
+			raw, err := resolveMCPTool(input(origin, stdio+`,"env":{}}`), saved)
+			var tool map[string]any
+			if err != nil || json.Unmarshal(raw, &tool) != nil || tool["connection_origin"] != "environment" ||
+				!reflect.DeepEqual(tool["transport"], map[string]any{"type": "stdio", "command": "run", "args": []any{"-x"}, "cwd": "/work", "env_vars": []any{"TOKEN"}}) {
+				t.Fatalf("saved=%v origin %q: %s, %v", saved, origin, raw, err)
+			}
+		}
+	}
+	raw, err := resolveMCPTool(input("", `{"type":"stdio","command":"run","args":null,"cwd":"/","env_vars":null}`), true)
+	if err != nil || !strings.Contains(string(raw), `"args":[]`) || !strings.Contains(string(raw), `"env_vars":[]`) {
+		t.Fatalf("null lists: %s, %v", raw, err)
+	}
+	for message, raw := range map[string]json.RawMessage{
+		"Inline MCP env is not supported; declare env_vars and set the values in the Environment.": input("", stdio+`,"env":{"TOKEN":"private-marker"}}`),
+		"MCP stdio servers run in the Environment; connection_origin must be environment.":         input(`,"connection_origin":"service"`, stdio+`}`),
+	} {
+		if _, err := resolveMCPTool(raw, false); err == nil || err.Error() != message {
+			t.Fatalf("want %q, got %v", message, err)
+		}
+	}
+	const invalid = "MCP stdio servers require a nonempty command, an absolute cwd, variable names in env_vars and no NUL characters."
+	for _, transport := range []string{`{"type":"stdio","command":" ","cwd":"/"}`, `{"type":"stdio","command":"run","cwd":"work"}`,
+		`{"type":"stdio","command":"run","cwd":"/","env_vars":["A-B"]}`, `{"type":"stdio","command":"run","args":["\u0000"],"cwd":"/"}`} {
+		if _, err := resolveMCPTool(input("", transport), true); err == nil || err.Error() != invalid {
+			t.Fatalf("%s: %v", transport, err)
 		}
 	}
 }
@@ -101,15 +135,14 @@ func TestMCPAllowedToolsAndOptionalFields(t *testing.T) {
 // The pinned shape is checked at decode; these inputs match it.
 func TestMCPUnsupportedInputsAreSecretSafe(t *testing.T) {
 	for name, replacement := range map[string]map[string]json.RawMessage{
-		"stdio origin missing": {"connection_origin": nil, "transport": json.RawMessage(`{"type":"stdio","command":"private-marker","cwd":"/"}`)},
-		"stdio origin null":    {"connection_origin": json.RawMessage("null"), "transport": json.RawMessage(`{"type":"stdio","command":"private-marker","cwd":"/"}`)},
 		"empty credential":     {"credential_id": json.RawMessage(`""`)},
 		"metadata":             {"request_metadata": json.RawMessage(`{"private-marker":"value"}`)},
 		"inline authorization": {"transport": json.RawMessage(`{"type":"http","server_url":"https://mcp.example.test","authorization":"private-marker"}`)},
 		"headers":              {"transport": json.RawMessage(`{"type":"http","server_url":"https://mcp.example.test","headers":{"Authorization":"private-marker"}}`)},
 		"URL credentials":      {"transport": json.RawMessage(`{"type":"http","server_url":"https://private-marker@mcp.example.test"}`)},
-		"URL query":            {"transport": json.RawMessage(`{"type":"http","server_url":"https://mcp.example.test/?token=private-marker"}`)},
-		"stdio":                {"transport": json.RawMessage(`{"type":"stdio","command":"private-marker","cwd":"/"}`)},
+		"header name":          {"transport": json.RawMessage(`{"type":"http","server_url":"https://mcp.example.test","headers":{"X Tenant":"private-marker"}}`)},
+		"duplicate headers":    {"transport": json.RawMessage(`{"type":"http","server_url":"https://mcp.example.test","headers":{"X-A":"private-marker","x-a":"b"}}`)},
+		"stdio credential":     {"credential_id": json.RawMessage(`"private-marker"`), "transport": json.RawMessage(`{"type":"stdio","command":"run","cwd":"/"}`)},
 	} {
 		t.Run(name, func(t *testing.T) {
 			var input map[string]json.RawMessage
@@ -131,6 +164,19 @@ func TestMCPUnsupportedInputsAreSecretSafe(t *testing.T) {
 	}
 }
 
+func TestMCPHeadersAreStoredAsGiven(t *testing.T) {
+	for _, saved := range []bool{false, true} {
+		input := `{"type":"mcp","server_label":"records","transport":{"type":"http","server_url":"https://mcp.example.test","headers":{"X-Tenant":"a"}}}`
+		raw, err := resolveMCPTool(json.RawMessage(input), saved)
+		if err != nil || !strings.Contains(string(raw), `"headers":{"X-Tenant":"a"}`) {
+			t.Fatalf("saved=%v: %s, %v", saved, raw, err)
+		}
+		if _, err := resolveMCPTool(json.RawMessage(strings.Replace(input, "X-Tenant", "authorization", 1)), saved); err == nil {
+			t.Fatal("Authorization header accepted")
+		}
+	}
+}
+
 func TestSessionMCPKeepsToolOrderAndStripsSavedHeaders(t *testing.T) {
 	saved, err := resolveMCPTool(json.RawMessage(publicMCP), true)
 	if err != nil {
@@ -164,3 +210,25 @@ func TestPublicEnvironmentMCPPreservesDeclaration(t *testing.T) {
 		}
 	}
 }
+
+func TestMCPServerURLKeepsQuery(t *testing.T) {
+	const serverURL = "https://mcp.example.test/tools?tenant=a%20b"
+	saved, err := resolveMCPTool(json.RawMessage(strings.Replace(publicMCP, "https://mcp.example.test/tools", serverURL, 1)), true)
+	if err != nil || !strings.Contains(string(saved), serverURL) {
+		t.Fatalf("query URL was rejected or changed: %s, %v", saved, err)
+	}
+}
+
+func TestFunctionsHaveNoCountOrNameLengthLimit(t *testing.T) {
+	var input []v1.FunctionToolInput
+	for i := 0; i < 65; i++ {
+		name := fmt.Sprintf("f%d", i)
+		if i == 0 {
+			name = strings.Repeat("n", 600)
+		}
+		input = append(input, v1.FunctionToolInput{Name: name, Parameters: json.RawMessage(`{"type":"object"}`)})
+	}
+	if tools, err := resolveFunctions(input); err != nil || len(tools) != 65 {
+		t.Fatal(len(tools), err)
+	}
+}
diff --git a/services/core/internal/api/model_configuration_route_test.go b/services/core/internal/api/model_configuration_route_test.go
index 882032148..69603c144 100644
--- a/services/core/internal/api/model_configuration_route_test.go
+++ b/services/core/internal/api/model_configuration_route_test.go
@@ -12,7 +12,7 @@ func TestModelConfigurationRouteAdmission(t *testing.T) {
 		{"invalid model", "responses", "{}", "", "model_configuration_model_invalid", "model"},
 		{"reserved parameter", "responses", `{"api_key":"native-secret"}`, "model", "harness_config_invalid", "harness_config"},
 		{"unknown parameter", "responses", `{"unknown":"native-secret"}`, "model", "harness_config_invalid", "harness_config"},
-		{"non native route", "anthropic", `{"model_reasoning_effort":"high"}`, "model", "model_provider_protocol_unsupported", "protocol"},
+		{"non native route", "anthropic", `{}`, "model", "model_provider_protocol_unsupported", "protocol"},
 		{"null", "responses", "null", "model", "invalid_model_provider", ""},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
diff --git a/services/core/internal/api/routing_test.go b/services/core/internal/api/routing_test.go
index 49568645a..526ab5cc6 100644
--- a/services/core/internal/api/routing_test.go
+++ b/services/core/internal/api/routing_test.go
@@ -563,9 +563,9 @@ func TestHeadRequests(t *testing.T) {
 	}
 }
 
-// Retired Core extensions are unknown /v1 paths; the administrator reads stay
+// Core extensions are unknown /v1 paths; the administrator reads stay
 // under /core/v1.
-func TestRetiredV1ExtensionsAreNotFound(t *testing.T) {
+func TestV1ExtensionsAreNotFound(t *testing.T) {
 	handler, _, _ := routingFixture(t)
 	session := "/v1/agents/sessions/" + uuid.NewString()
 	unknown := serve(handler, http.MethodGet, session+"/unknown", "", withHeaders(project, beta))
diff --git a/services/core/internal/api/sandbox_deployment_setup.go b/services/core/internal/api/sandbox_deployment_setup.go
index 030fb8251..07f38a57f 100644
--- a/services/core/internal/api/sandbox_deployment_setup.go
+++ b/services/core/internal/api/sandbox_deployment_setup.go
@@ -12,15 +12,20 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
+type SandboxComputeProfileInput struct {
+	Resources     sandbox.Resources `json:"resources"`
+	Configuration json.RawMessage   `json:"configuration" swaggertype:"object"`
+}
+
 type SandboxDeploymentInput struct {
-	ExpectedGeneration *uint64 `json:"expected_generation" binding:"required"`
+	ComputeProfiles    map[string]SandboxComputeProfileInput `json:"compute_profiles,omitempty"`
+	ExpectedGeneration *uint64                               `json:"expected_generation" binding:"required"`
 	// Per-sandbox limits, required for Docker and microsandbox. E2B may omit
 	// them; Core then uses the validated template build's cpus and memory_mib.
-	Resources     sandbox.Resources       `json:"resources"`
-	Runtime       *sandbox.RuntimeRelease `json:"runtime,omitempty"`
-	Provider      string                  `json:"provider"`
-	Configuration json.RawMessage         `json:"configuration" swaggertype:"object"`
-	Credential    json.RawMessage         `json:"credential,omitempty" swaggertype:"object"`
+	Resources     sandbox.Resources `json:"resources"`
+	Provider      string            `json:"provider"`
+	Configuration json.RawMessage   `json:"configuration" swaggertype:"object"`
+	Credential    json.RawMessage   `json:"credential,omitempty" swaggertype:"object"`
 }
 
 type SandboxDeploymentChangeInput struct {
@@ -33,7 +38,18 @@ func (h *Handler) selection(v SandboxDeploymentInput) (sandbox.Selection, error)
 	if err != nil {
 		return sandbox.Selection{}, err
 	}
-	return sandbox.Selection{ExpectedGeneration: *v.ExpectedGeneration, Provider: v.Provider, DeploymentSpec: sandbox.DeploymentSpec{Resources: v.Resources, Runtime: v.Runtime}, Configuration: c}, nil
+	profiles := make(map[string]sandbox.ComputeProfile, len(v.ComputeProfiles))
+	for name, p := range v.ComputeProfiles {
+		if !sandbox.ValidComputeProfile(name) {
+			return sandbox.Selection{}, sandbox.ErrInvalid
+		}
+		config, err := h.Sandboxes.Deployment.DecodeConfiguration(v.Provider, p.Configuration, nil)
+		if err != nil {
+			return sandbox.Selection{}, err
+		}
+		profiles[name] = sandbox.ComputeProfile{Resources: p.Resources, Configuration: config}
+	}
+	return sandbox.Selection{ComputeProfiles: profiles, ExpectedGeneration: *v.ExpectedGeneration, Provider: v.Provider, DeploymentSpec: sandbox.DeploymentSpec{Resources: v.Resources}, Configuration: c}, nil
 }
 
 // DeploymentChanges sets up and updates the sandbox deployment through the
@@ -51,7 +67,7 @@ type DeploymentReset interface {
 }
 
 // @Summary Initialize the deployment sandbox provider
-// @Description Selects a provider, enforced resource limits and pinned Runtime release. Core derives the deployment's core_url from the installation public URL and rejects a core_url member with 400. E2B returns 409 sandbox_configuration_error while the public URL is loopback. E2B credentials are write-only. E2B may omit resources to adopt the validated template build's CPU and memory, returned in specification.resources. Requires explicit expected_generation, including zero at first setup. Stale retries reject before provider validation. An identical selection at the current generation is a no-op; a differing selection rejects. This does not create compute or execute work.
+// @Description Selects a provider and its enforced resource limits. Core derives the deployment's core_url from the installation public URL and rejects a core_url member with 400. E2B returns 409 sandbox_configuration_error while the public URL is loopback. E2B credentials are write-only. E2B may omit resources to adopt the validated template build's CPU and memory, returned in specification.resources. Requires explicit expected_generation, including zero at first setup. Stale retries reject before provider validation. An identical selection at the current generation is a no-op; a differing selection rejects. This does not create compute or execute work.
 // @Tags Sandbox Manager
 // @Produce json
 // @Security DeploymentAdminAuth
@@ -66,7 +82,7 @@ func (h *Handler) initializeSandboxDeployment(w http.ResponseWriter, r *http.Req
 		return
 	}
 	var input SandboxDeploymentInput
-	if decodeInputObject(raw, &input, "provider", "configuration", "credential", "resources", "runtime", "expected_generation") != nil || input.ExpectedGeneration == nil {
+	if decodeInputObject(raw, &input, "provider", "configuration", "credential", "resources", "expected_generation", "compute_profiles") != nil || input.ExpectedGeneration == nil {
 		writeDeploymentError(w, r, deployment.ErrInvalidInput)
 		return
 	}
@@ -99,7 +115,7 @@ func (h *Handler) updateSandboxDeployment(w http.ResponseWriter, r *http.Request
 		return
 	}
 	var input SandboxDeploymentChangeInput
-	if decodeInputObject(raw, &input, "provider", "configuration", "credential", "resources", "runtime", "expected_generation") != nil || input.ExpectedGeneration == nil {
+	if decodeInputObject(raw, &input, "provider", "configuration", "credential", "resources", "expected_generation", "compute_profiles") != nil || input.ExpectedGeneration == nil {
 		writeDeploymentError(w, r, deployment.ErrInvalidInput)
 		return
 	}
diff --git a/services/core/internal/api/sandbox_manager.go b/services/core/internal/api/sandbox_manager.go
index 3ce2491ce..dba990413 100644
--- a/services/core/internal/api/sandbox_manager.go
+++ b/services/core/internal/api/sandbox_manager.go
@@ -29,6 +29,7 @@ type SandboxMutationResponse struct {
 	Updated bool   `json:"updated,omitempty"`
 }
 type SandboxEnrollmentTokenRequest struct {
+	// An omitted limit is derived from the node's host when it enrolls.
 	MaxActive *int `json:"max_active,omitempty"`
 	// Docker never suspends, so Core replaces this with max_active; microsandbox uses both limits.
 	MaxRetained *int `json:"max_retained,omitempty"`
@@ -43,7 +44,7 @@ type Deployment interface {
 	NodeDetail(ctx context.Context, id, window string) (deployment.NodeDetail, error)
 	UpdateNode(ctx context.Context, id string, update deployment.NodeUpdate) error
 	RemoveNode(ctx context.Context, id string) error
-	CreateEnrollment(ctx context.Context, capacity deployment.Capacity) (deployment.EnrollmentToken, error)
+	CreateEnrollment(ctx context.Context, limits deployment.EnrollmentLimits) (deployment.EnrollmentToken, error)
 	Enroll(ctx context.Context, token string, input deployment.Enrollment) (deployment.NodeIdentity, error)
 	NodeConfiguration(ctx context.Context, nodeID, token string, generation uint64) (deployment.NodeConfiguration, error)
 	NodeStatus(ctx context.Context, nodeID, credential string) (deployment.NodeStatus, error)
@@ -202,14 +203,7 @@ func (h *Handler) createSandboxEnrollment(w http.ResponseWriter, r *http.Request
 		writeDeploymentError(w, r, deployment.ErrInvalidInput)
 		return
 	}
-	capacity := deployment.Capacity{MaxActive: 2, MaxRetained: 8}
-	if input.MaxActive != nil {
-		capacity.MaxActive = *input.MaxActive
-	}
-	if input.MaxRetained != nil {
-		capacity.MaxRetained = *input.MaxRetained
-	}
-	enrollment, err := h.Sandboxes.Deployment.CreateEnrollment(r.Context(), capacity)
+	enrollment, err := h.Sandboxes.Deployment.CreateEnrollment(r.Context(), deployment.EnrollmentLimits{MaxActive: input.MaxActive, MaxRetained: input.MaxRetained})
 	if err != nil {
 		writeDeploymentError(w, r, err)
 		return
@@ -238,7 +232,7 @@ func (h *Handler) enrollSandboxNode(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	var input deployment.Enrollment
-	if decodeInputObject(raw, &input, "node_id", "credential", "name", "provider", "backend_fingerprint", "deployment_generation", "specification_digest", "core_url") != nil {
+	if decodeInputObject(raw, &input, "node_id", "credential", "name", "provider", "backend_fingerprint", "deployment_generation", "specification_digest", "core_url", "cpu_count", "effective_cpu_cores", "total_memory_bytes", "available_disk_bytes") != nil {
 		writeDeploymentError(w, r, deployment.ErrInvalidInput)
 		return
 	}
diff --git a/services/core/internal/api/sandbox_manager_test.go b/services/core/internal/api/sandbox_manager_test.go
index aff6e084b..d9f3fbe71 100644
--- a/services/core/internal/api/sandbox_manager_test.go
+++ b/services/core/internal/api/sandbox_manager_test.go
@@ -79,8 +79,8 @@ func nodeCapacity(active int) error {
 
 func TestSandboxEnrollmentCapacityIsAdministratorOnly(t *testing.T) {
 	deps, fakes := sandboxFakes(t)
-	fakes.deployment.createEnrollment = func(_ context.Context, capacity deployment.Capacity) (deployment.EnrollmentToken, error) {
-		return deployment.EnrollmentToken{}, nodeCapacity(capacity.MaxActive)
+	fakes.deployment.createEnrollment = func(_ context.Context, limits deployment.EnrollmentLimits) (deployment.EnrollmentToken, error) {
+		return deployment.EnrollmentToken{}, nodeCapacity(*limits.MaxActive)
 	}
 	h := newTestHandler(t, deps)
 	for _, test := range []struct{ path, token, body string }{
@@ -96,7 +96,7 @@ func TestSandboxEnrollmentCapacityIsAdministratorOnly(t *testing.T) {
 			t.Fatal(test.path, response.Code, response.Body.String())
 		}
 	}
-	// Node routes moved to /api/v1/sandbox-node; the old /core paths are gone.
+	// Node routes are served under /api/v1/sandbox-node, never under /core.
 	for _, test := range []struct{ method, path string }{{"POST", "/core/v1/sandbox/enroll"}, {"GET", "/core/v1/sandbox/node/identity"}, {"GET", "/core/v1/sandbox/node/configuration"}} {
 		request := httptest.NewRequest(test.method, test.path, nil)
 		request.Header.Set("Authorization", "Bearer administrator")
diff --git a/services/core/internal/api/sandbox_node_detail_test.go b/services/core/internal/api/sandbox_node_detail_test.go
index e43f73eab..19beab019 100644
--- a/services/core/internal/api/sandbox_node_detail_test.go
+++ b/services/core/internal/api/sandbox_node_detail_test.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	"context"
+	"strings"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
@@ -29,3 +30,19 @@ func TestSandboxNodeDetailValidationAndAuthentication(t *testing.T) {
 		t.Fatal(w.Code)
 	}
 }
+
+func TestSandboxNodeResponsesCarryRecommendedCapacity(t *testing.T) {
+	deps, fakes := sandboxFakes(t)
+	node := deployment.Node{RecommendedCapacity: &deployment.Capacity{MaxActive: 3, MaxRetained: 14}}
+	fakes.deployment.listNodes = func(context.Context) ([]deployment.Node, error) { return []deployment.Node{node}, nil }
+	fakes.deployment.nodeDetail = func(context.Context, string, string) (deployment.NodeDetail, error) {
+		return deployment.NodeDetail{Node: node}, nil
+	}
+	h := newTestHandler(t, deps)
+	for _, path := range []string{"/core/v1/sandbox/nodes", "/core/v1/sandbox/nodes/11111111-1111-4111-8111-111111111111"} {
+		w := projectKeyHTTP(h, "GET", path, "administrator", "")
+		if w.Code != 200 || !strings.Contains(w.Body.String(), `"recommended_capacity":{"max_active":3,"max_retained":14}`) {
+			t.Fatal(path, w.Code, w.Body.String())
+		}
+	}
+}
diff --git a/services/core/internal/api/saved_provider_test.go b/services/core/internal/api/saved_provider_test.go
index 9c8a9bc0a..bce769af2 100644
--- a/services/core/internal/api/saved_provider_test.go
+++ b/services/core/internal/api/saved_provider_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/google/uuid"
 )
 
-const savedProviderFixture = `{"protocol":"responses","base_url":"https://example.test/v1","api_key":"saved-provider-secret","context_window":100000,"max_output_tokens":8000}`
+const savedProviderFixture = `{"protocol":"responses","base_url":"https://example.test/v1","api_key":"saved-provider-secret","context_window":100000}`
 
 type savedProviderStore struct {
 	saved    agents.Agent
@@ -139,7 +139,7 @@ func TestSavedProviderInvalidInput(t *testing.T) {
 		`{"model_provider":{"protocol":"responses","base_url":"https://example.test","api_key":"saved-provider-secret","API_KEY":"secret"}}`,
 		`{"model_provider":{"protocol":"responses","base_url":"https://example.test","api_key":"saved-provider-secret","api_key":"other"}}`,
 		`{"harness":"claude_sdk","model_provider":` + strings.Replace(savedProviderFixture, `"responses"`, `"unknown"`, 1) + `}`,
-		`{"model_provider":` + strings.Replace(savedProviderFixture, `"max_output_tokens":8000`, `"max_output_tokens":100001`, 1) + `}`,
+		`{"model_provider":` + strings.Replace(savedProviderFixture, `"context_window":100000`, `"context_window":-1`, 1) + `}`,
 	} {
 		for _, path := range []string{"/v1/agents", "/v1/agents/" + uuid.NewString()} {
 			h, s := validationHandler(t)
diff --git a/services/core/internal/api/saved_tools.go b/services/core/internal/api/saved_tools.go
index e15a41c7e..6cb301e03 100644
--- a/services/core/internal/api/saved_tools.go
+++ b/services/core/internal/api/saved_tools.go
@@ -34,7 +34,7 @@ func resolveSavedTools(input []json.RawMessage) ([]json.RawMessage, error) {
 		case "tool_search":
 			value, _ = json.Marshal(kind)
 		case "programmatic_tool_calling":
-			resolved, _, err := resolveProgrammaticTool(raw)
+			resolved, err := resolveProgrammaticTool(raw)
 			if err != nil {
 				return nil, err
 			}
@@ -46,7 +46,7 @@ func resolveSavedTools(input []json.RawMessage) ([]json.RawMessage, error) {
 			}
 			value = resolved
 		case "web_search":
-			resolved, err := resolveSavedWebSearch(raw)
+			resolved, err := resolveWebSearch(raw)
 			if err != nil {
 				return nil, err
 			}
diff --git a/services/core/internal/api/saved_web_search_test.go b/services/core/internal/api/saved_web_search_test.go
index d377e2378..0b3d7c3b3 100644
--- a/services/core/internal/api/saved_web_search_test.go
+++ b/services/core/internal/api/saved_web_search_test.go
@@ -8,10 +8,8 @@ import (
 	"github.com/google/uuid"
 )
 
-const onlyDisabledSearch = "Only disabled web_search is qualified for execution."
-
 // TV-05 W1/W2: saved web_search keeps every pinned mode with the official
-// projection, while Session execution still qualifies only the disabled form.
+// projection, and Session admission resolves it to the same bytes.
 func TestSavedWebSearchProjection(t *testing.T) {
 	const defaults = `"context_size":"medium","allowed_domains":null,"location":null}`
 	live := `{"type":"web_search","mode":"live",` + defaults
@@ -38,14 +36,8 @@ func TestSavedWebSearchProjection(t *testing.T) {
 			t.Fatalf("%s: resaved %s %v", tc.input, again, err)
 		}
 		executed, err := resolveSessionTools(saved)
-		var mode struct{ Mode string }
-		_ = json.Unmarshal(saved[0], &mode)
-		if mode.Mode == "disabled" {
-			if err != nil || string(executed[0]) != tc.want {
-				t.Fatalf("%s: disabled execution changed: %s %v", tc.input, executed, err)
-			}
-		} else if err == nil || err.Error() != onlyDisabledSearch {
-			t.Fatalf("%s: enabled search admitted: %v", tc.input, err)
+		if err != nil || string(executed[0]) != tc.want {
+			t.Fatalf("%s: Session resolution changed the saved tool: %s %v", tc.input, executed, err)
 		}
 	}
 }
@@ -64,74 +56,36 @@ func TestSavedWebSearchAgentCreate(t *testing.T) {
 	}
 }
 
-// TV-05 W4-W7: a saved Agent with enabled search cannot reach execution through
-// any creation mode; a Session tools replacement or disabled search is admitted.
+// TV-05 W4-W7: a Session keeps the saved search mode, an inline omitted mode
+// resolves to live, and a per-Session tools replacement wins.
 func TestSavedWebSearchSessionAdmission(t *testing.T) {
 	saved := func(tool string) string {
 		return `{"model":"m","multi_agent":{"enabled":false,"max_concurrent_subagents":null},"reasoning":{},"service_tier":"auto","text":{"format":{"type":"text"},"verbosity":"medium"},"tools":[` + tool + `]}`
 	}
-	enabled := map[string]string{}
-	for _, mode := range []string{"live", "cached"} {
-		enabled[uuid.NewString()] = saved(`{"type":"web_search","mode":"` + mode + `","context_size":"medium","allowed_domains":null,"location":null}`)
-	}
-	disabled := uuid.NewString()
-	agents := map[string]string{disabled: saved(`{"type":"web_search","mode":"disabled","context_size":"medium","allowed_domains":[],"location":null}`)}
-	for id, configuration := range enabled {
-		agents[id] = configuration
-	}
-	h, s := configurationHandler(t, agents)
-	for id := range enabled {
-		for _, suffix := range []string{
-			`"environment":{"type":"none"},"input":"x"}`,
-			`"environment":{"type":"none"},"input":"x","stream":true}`,
-			`"environment":{"type":"self_hosted","workspace_directory":"/workspace"},"input":"x"}`,
-			`"environment":{"type":"self_hosted","workspace_directory":"/workspace"}}`,
-			`"environment":{"type":"openai_hosted"}}`,
-			// Replacing another field keeps the saved tools.
-			`"agent":{"instructions":"x"},"environment":{"type":"none"},"input":"x"}`,
-		} {
-			w := credentialRequest(h, http.MethodPost, "/v1/agents/sessions", `{"agent_id":"`+id+`",`+suffix)
-			assertConfigurationError(t, w, "unsupported_or_invalid_configuration", nil, onlyDisabledSearch)
+	const cached = `{"type":"web_search","mode":"cached","context_size":"medium","allowed_domains":[],"location":null}`
+	id := uuid.NewString()
+	h, _ := configurationHandler(t, map[string]string{id: saved(cached)})
+	for _, tc := range []struct{ body, want string }{
+		{`{"agent_id":"` + id + `","environment":{"type":"none"},"input":"x"}`, cached},
+		{`{"agent_id":"` + id + `","agent":{"instructions":"x"},"environment":{"type":"none"},"input":"x"}`, cached},
+		{`{"agent_id":"` + id + `","agent":{"tools":[{"type":"web_search"}]},"environment":{"type":"none"},"input":"x"}`, `{"type":"web_search","mode":"live","context_size":"medium","allowed_domains":null,"location":null}`},
+		{`{"agent":{"model":"m","tools":[{"type":"web_search","mode":null}]},"environment":{"type":"none"},"input":"x"}`, `{"type":"web_search","mode":"live","context_size":"medium","allowed_domains":null,"location":null}`},
+	} {
+		w := credentialRequest(h, http.MethodPost, "/v1/agents/sessions", tc.body)
+		var session struct {
+			Agent struct{ Tools []json.RawMessage }
 		}
-		// C4: the input requirement still precedes execution admission.
-		w := credentialRequest(h, http.MethodPost, "/v1/agents/sessions", `{"agent_id":"`+id+`","environment":{"type":"none"}}`)
-		assertConfigurationError(t, w, "invalid_request_error", nil, "conversation-only sessions currently require initial input")
-	}
-	// W6: inline enabled or omitted-mode search, also as a saved-Agent override.
-	for _, tool := range []string{`{"type":"web_search"}`, `{"type":"web_search","mode":null}`, `{"type":"web_search","mode":"live"}`, `{"type":"web_search","mode":"cached"}`} {
-		for _, body := range []string{
-			`{"agent":{"model":"m","tools":[` + tool + `]},"environment":{"type":"none"},"input":"x"}`,
-			`{"agent_id":"` + disabled + `","agent":{"tools":[` + tool + `]},"environment":{"type":"none"},"input":"x"}`,
-		} {
-			assertConfigurationError(t, credentialRequest(h, http.MethodPost, "/v1/agents/sessions", body), "unsupported_or_invalid_configuration", nil, onlyDisabledSearch)
+		if w.Code != http.StatusCreated || json.Unmarshal(w.Body.Bytes(), &session) != nil || len(session.Agent.Tools) != 1 || string(session.Agent.Tools[0]) != tc.want {
+			t.Fatal(tc.body, w.Code, w.Body)
 		}
 	}
-	if s.writes != 0 {
-		t.Fatal("rejected configuration reached storage")
-	}
-	// W5 and W7: a per-Session tools replacement and saved disabled search are admitted.
-	for id := range enabled {
-		for _, tools := range []string{`[]`, `null`, `[{"type":"web_search","mode":"disabled"}]`} {
-			w := credentialRequest(h, http.MethodPost, "/v1/agents/sessions", `{"agent_id":"`+id+`","agent":{"tools":`+tools+`},"environment":{"type":"none"},"input":"x"}`)
-			var session struct {
-				Agent struct{ Tools []json.RawMessage }
-			}
-			if w.Code != http.StatusCreated || json.Unmarshal(w.Body.Bytes(), &session) != nil {
-				t.Fatal(tools, w.Code, w.Body)
-			}
-			for _, tool := range session.Agent.Tools {
-				if string(tool) != `{"type":"web_search","mode":"disabled","context_size":"medium","allowed_domains":null,"location":null}` {
-					t.Fatalf("saved search leaked into the Session: %s", w.Body)
-				}
-			}
+	for _, tools := range []string{`[]`, `null`} {
+		w := credentialRequest(h, http.MethodPost, "/v1/agents/sessions", `{"agent_id":"`+id+`","agent":{"tools":`+tools+`},"environment":{"type":"none"},"input":"x"}`)
+		var session struct {
+			Agent struct{ Tools []json.RawMessage }
+		}
+		if w.Code != http.StatusCreated || json.Unmarshal(w.Body.Bytes(), &session) != nil || len(session.Agent.Tools) != 0 {
+			t.Fatal(tools, w.Code, w.Body)
 		}
-	}
-	w := credentialRequest(h, http.MethodPost, "/v1/agents/sessions", `{"agent_id":"`+disabled+`","environment":{"type":"none"},"input":"x"}`)
-	var session struct {
-		Agent struct{ Tools []json.RawMessage }
-	}
-	if w.Code != http.StatusCreated || json.Unmarshal(w.Body.Bytes(), &session) != nil || len(session.Agent.Tools) != 1 ||
-		string(session.Agent.Tools[0]) != `{"type":"web_search","mode":"disabled","context_size":"medium","allowed_domains":[],"location":null}` {
-		t.Fatal(w.Code, w.Body)
 	}
 }
diff --git a/services/core/internal/api/session_agent.go b/services/core/internal/api/session_agent.go
index 279a25894..aa81f7400 100644
--- a/services/core/internal/api/session_agent.go
+++ b/services/core/internal/api/session_agent.go
@@ -71,19 +71,9 @@ func resolveSessionAgent(input sessionRequest, saved *v1.SavedAgent) (v1.Agent,
 }
 
 func admitSessionAgent(cfg v1.SavedAgentConfiguration) (v1.Agent, error) {
-	// Protocol conflicts precede execution limits, including in saved records.
-	if err := configurationConflict(cfg.Tools, cfg.Text.Format.Type, cfg.Text.Format.Schema); err != nil {
-		return v1.Agent{}, err
-	}
 	if strings.TrimSpace(cfg.Model) == "" {
 		return v1.Agent{}, errors.New("Execution currently requires a nonempty model.")
 	}
-	if cfg.Reasoning.Effort != nil || cfg.Reasoning.Summary != nil {
-		return v1.Agent{}, errors.New("Explicit reasoning execution options are not supported by this service yet.")
-	}
-	if cfg.ServiceTier != "auto" {
-		return v1.Agent{}, errors.New("Execution currently supports service_tier=auto only.")
-	}
 	tools, err := resolveSessionTools(cfg.Tools)
 	if err != nil {
 		return v1.Agent{}, err
diff --git a/services/core/internal/api/session_credentials_test.go b/services/core/internal/api/session_credentials_test.go
index 7401b5d1f..d291f6a6f 100644
--- a/services/core/internal/api/session_credentials_test.go
+++ b/services/core/internal/api/session_credentials_test.go
@@ -67,7 +67,7 @@ func TestSessionVaultTypesAndCreationIntent(t *testing.T) {
 func TestSessionProjectionShowsSelectedMCPCredential(t *testing.T) {
 	vault, credential := uuid.NewString(), uuid.NewString()
 	tool := func(label, credentialID string) json.RawMessage {
-		value := v1.MCPTool{Type: "mcp", ServerLabel: label, Transport: v1.MCPHTTPTransport{Type: "http", ServerURL: "https://mcp.example.test/" + label},
+		value := v1.MCPTool{Type: "mcp", ServerLabel: label, Transport: v1.MCPTransport{Type: "http", ServerURL: "https://mcp.example.test/" + label},
 			ConnectionOrigin: "service", RequestMetadata: map[string]json.RawMessage{}}
 		if credentialID != "" {
 			value.CredentialID = &credentialID
diff --git a/services/core/internal/api/session_model_configuration.go b/services/core/internal/api/session_model_configuration.go
index c40c82c18..3abbcd9ba 100644
--- a/services/core/internal/api/session_model_configuration.go
+++ b/services/core/internal/api/session_model_configuration.go
@@ -74,7 +74,7 @@ func (h *Handler) prepareSessionModelConfiguration(ctx context.Context, input *s
 		source = v1.ExecutionSourceSession
 	} else if saved != nil {
 		source = v1.ExecutionSourceAgent
-		// Changing the harness also discards the former adapter's parameters.
+		// Changing the harness also discards the previous adapter's parameters.
 		if _, overridden := input.agentFields["x_agents_core"]; !overridden && saved.XAgentsCore != nil {
 			raw = v1.ResolvedHarnessConfig(saved.XAgentsCore.HarnessConfig)
 		}
diff --git a/services/core/internal/api/session_model_configuration_test.go b/services/core/internal/api/session_model_configuration_test.go
index d3e378cd4..511d412c9 100644
--- a/services/core/internal/api/session_model_configuration_test.go
+++ b/services/core/internal/api/session_model_configuration_test.go
@@ -10,22 +10,22 @@ import (
 )
 
 func TestSessionNativeConfigurationSources(t *testing.T) {
-	provider := fixtureModelProvider("codex")
-	saved := &v1.SavedAgent{SavedAgentConfiguration: v1.SavedAgentConfiguration{Model: "saved-model", XAgentsCore: &v1.SavedAgentCore{Harness: "codex", HarnessConfig: json.RawMessage(`{"model_reasoning_effort":"low"}`)}}}
+	provider := fixtureModelProvider("claude_sdk")
+	saved := &v1.SavedAgent{SavedAgentConfiguration: v1.SavedAgentConfiguration{Model: "saved-model", XAgentsCore: &v1.SavedAgentCore{Harness: "claude_sdk", HarnessConfig: json.RawMessage(`{"thinking":{"type":"enabled","budgetTokens":1000}}`)}}}
 	for _, tc := range []struct {
 		name, body            string
 		saved                 *v1.SavedAgent
 		model, native, source string
 		wantError             bool
 	}{
-		{"deployment", `{"agent":{},"environment":{"type":"openai_hosted"}}`, nil, "deployment-model", `{"model_reasoning_effort":"high"}`, "deployment", false},
-		{"none deployment", `{"agent":{},"environment":{"type":"none"}}`, nil, "deployment-model", `{"model_reasoning_effort":"high"}`, "deployment", false},
-		{"saved", `{"agent_id":"a","environment":{"type":"openai_hosted"}}`, saved, "saved-model", `{"model_reasoning_effort":"low"}`, "agent", false},
+		{"deployment", `{"agent":{},"environment":{"type":"openai_hosted"}}`, nil, "deployment-model", `{"thinking":{"type":"enabled","budgetTokens":3000}}`, "deployment", false},
+		{"none deployment", `{"agent":{},"environment":{"type":"none"}}`, nil, "deployment-model", `{"thinking":{"type":"enabled","budgetTokens":3000}}`, "deployment", false},
+		{"saved", `{"agent_id":"a","environment":{"type":"openai_hosted"}}`, saved, "saved-model", `{"thinking":{"type":"enabled","budgetTokens":1000}}`, "agent", false},
 		{"model override discards", `{"agent_id":"a","agent":{"model":"other"},"environment":{"type":"openai_hosted"}}`, saved, "other", `{}`, "session", false},
 		{"explicit model discards deployment", `{"agent":{"model":"other"},"environment":{"type":"openai_hosted"}}`, nil, "other", `{}`, "session", false},
 		{"explicit clear", `{"agent_id":"a","environment":{"type":"openai_hosted"},"x_agents_core":{"harness_config":{}}}`, saved, "saved-model", `{}`, "session", false},
-		{"inline native", `{"agent":{"model":"other","x_agents_core":{"harness_config":{"model_reasoning_effort":"medium"}}},"environment":{"type":"openai_hosted"}}`, nil, "other", `{"model_reasoning_effort":"medium"}`, "session", false},
-		{"session beats inline", `{"agent":{"model":"other","x_agents_core":{"harness_config":{"model_reasoning_effort":"medium"}}},"environment":{"type":"openai_hosted"},"x_agents_core":{"harness_config":{}}}`, nil, "other", `{}`, "session", false},
+		{"inline native", `{"agent":{"model":"other","x_agents_core":{"harness_config":{"thinking":{"type":"enabled","budgetTokens":2000}}}},"environment":{"type":"openai_hosted"}}`, nil, "other", `{"thinking":{"type":"enabled","budgetTokens":2000}}`, "session", false},
+		{"session beats inline", `{"agent":{"model":"other","x_agents_core":{"harness_config":{"thinking":{"type":"enabled","budgetTokens":2000}}}},"environment":{"type":"openai_hosted"},"x_agents_core":{"harness_config":{}}}`, nil, "other", `{}`, "session", false},
 		{"null rejects", `{"agent":{"model":"other"},"environment":{"type":"openai_hosted"},"x_agents_core":{"harness_config":null}}`, nil, "", "", "", true},
 		{"reserved rejects", `{"agent":{"model":"other"},"environment":{"type":"openai_hosted"},"x_agents_core":{"harness_config":{"api_key":"secret"}}}`, nil, "", "", "", true},
 		{"self hosted never defaults", `{"agent":{},"environment":{"type":"self_hosted","workspace_directory":"/tmp/work"}}`, nil, "", "", "", true},
@@ -41,9 +41,10 @@ func TestSessionNativeConfigurationSources(t *testing.T) {
 			}
 			calls := 0
 			deps, fakes := testDependencies(t)
+			deps.Engine = "claude_sdk"
 			fakes.modelProviders.resolve = func(context.Context, string) (*modelconfiguration.Snapshot, error) {
 				calls++
-				return &modelconfiguration.Snapshot{Provider: provider, Model: "deployment-model", HarnessConfig: json.RawMessage(`{"model_reasoning_effort":"high"}`)}, nil
+				return &modelconfiguration.Snapshot{Provider: provider, Model: "deployment-model", HarnessConfig: json.RawMessage(`{"thinking":{"type":"enabled","budgetTokens":3000}}`)}, nil
 			}
 			h := &Handler{Dependencies: deps}
 			err = h.prepareSessionModelConfiguration(t.Context(), &input, tc.saved, nil)
@@ -72,11 +73,12 @@ func TestSessionNativeConfigurationSources(t *testing.T) {
 }
 
 func TestProviderReplacementDiscardsNativeConfiguration(t *testing.T) {
-	provider := fixtureModelProvider("codex")
+	provider := fixtureModelProvider("claude_sdk")
 	model := "saved-model"
 	input := sessionRequest{CreateSessionRequest: v1.CreateSessionRequest{Agent: &v1.InlineAgent{Model: nil}, Environment: &v1.Environment{Type: "self_hosted"}, XAgentsCore: &v1.SessionExecutionInput{ModelProvider: provider}}}
-	saved := &v1.SavedAgent{SavedAgentConfiguration: v1.SavedAgentConfiguration{Model: model, XAgentsCore: &v1.SavedAgentCore{Harness: "codex", HarnessConfig: json.RawMessage(`{"model_reasoning_effort":"high"}`)}}}
+	saved := &v1.SavedAgent{SavedAgentConfiguration: v1.SavedAgentConfiguration{Model: model, XAgentsCore: &v1.SavedAgentCore{Harness: "claude_sdk", HarnessConfig: json.RawMessage(`{"thinking":{"type":"enabled","budgetTokens":3000}}`)}}}
 	deps, _ := testDependencies(t)
+	deps.Engine = "claude_sdk"
 	h := &Handler{Dependencies: deps}
 	if err := h.prepareSessionModelConfiguration(t.Context(), &input, saved, provider); err != nil {
 		t.Fatal(err)
diff --git a/services/core/internal/api/session_request.go b/services/core/internal/api/session_request.go
index b4e091ee8..e82699911 100644
--- a/services/core/internal/api/session_request.go
+++ b/services/core/internal/api/session_request.go
@@ -25,6 +25,7 @@ type decodedSessionRequest struct {
 }
 
 type sessionRequest struct {
+	computeProfile        string
 	initialFiles          []environmentconfig.InitialFile
 	initialization        environmentconfig.Setup
 	originalEnvironment   json.RawMessage
@@ -65,6 +66,13 @@ func (request decodedSessionRequest) validated() (sessionRequest, error) {
 	if err != nil {
 		return input, err
 	}
+	if input.XAgentsCore != nil && len(input.XAgentsCore.Environment) > 0 {
+		var ext struct {
+			ComputeProfile string `json:"compute_profile"`
+		}
+		_ = json.Unmarshal(input.XAgentsCore.Environment, &ext)
+		input.computeProfile = ext.ComputeProfile
+	}
 	input.originalEnvironment = request.Environment
 	var environmentFields map[string]json.RawMessage
 	if json.Unmarshal(canonicalEnvironment, &environmentFields) != nil {
diff --git a/services/core/internal/api/session_template.go b/services/core/internal/api/session_template.go
index 4333b7f36..54e505ef5 100644
--- a/services/core/internal/api/session_template.go
+++ b/services/core/internal/api/session_template.go
@@ -57,9 +57,6 @@ func applyTemplateEnvironment(input *sessionRequest, resolved environmenttemplat
 	if json.Unmarshal(input.templateEnvironment, &fields) != nil {
 		return sessions.ErrInvalidInput
 	}
-	if input.Environment.Type == "self_hosted" && template.NetworkAccess != "enabled" {
-		return &fieldError{param: "x_agents_core.environment.environment_template_id", message: "This template requires a managed network policy; user-managed machines do not enforce it."}
-	}
 	if !templateFieldOverride(fields, "network") {
 		input.Environment.Network = &v1.EnvironmentNetworkInput{Access: template.NetworkAccess, AllowedDomains: append([]string{}, template.AllowedDomains...)}
 	}
diff --git a/services/core/internal/api/session_tools.go b/services/core/internal/api/session_tools.go
index c66888e99..f2f02d0da 100644
--- a/services/core/internal/api/session_tools.go
+++ b/services/core/internal/api/session_tools.go
@@ -27,17 +27,11 @@ func resolveSessionTools(input []json.RawMessage) ([]json.RawMessage, error) {
 				return nil, errors.New("Execution requires distinct tool controls.")
 			}
 			controls[kind.Type] = true
-			var resolved json.RawMessage
-			var err error
+			resolve := resolveProgrammaticTool
 			if kind.Type == "web_search" {
-				resolved, err = resolveDisabledWebSearch(raw)
-			} else {
-				var enabled bool
-				resolved, enabled, err = resolveProgrammaticTool(raw)
-				if err == nil && enabled {
-					err = errors.New("Programmatic tool calling is not qualified for execution.")
-				}
+				resolve = resolveWebSearch
 			}
+			resolved, err := resolve(raw)
 			if err != nil {
 				return nil, err
 			}
@@ -70,7 +64,7 @@ func resolveSessionTools(input []json.RawMessage) ([]json.RawMessage, error) {
 			functions = append(functions, function)
 			positions = append(positions, i)
 		default:
-			return nil, errors.New("Unsupported execution tool; supported tools include functions, qualified tool_search, qualified HTTP MCP and explicit disabled controls.")
+			return nil, errors.New("Unsupported execution tool; supported tools include functions, qualified tool_search, qualified HTTP MCP and execution controls.")
 		}
 	}
 	resolved, err := resolveFunctions(functions)
diff --git a/services/core/internal/api/testdata/core-errors.json b/services/core/internal/api/testdata/core-errors.json
index e349a2882..000b5d351 100644
--- a/services/core/internal/api/testdata/core-errors.json
+++ b/services/core/internal/api/testdata/core-errors.json
@@ -45,5 +45,6 @@
   "workspace_operation_unsupported",
   "workspace_storage_conflict",
   "workspace_storage_not_found",
+  "workspace_storage_required",
   "workspace_storage_unavailable"
 ]
diff --git a/services/core/internal/api/text_configuration_test.go b/services/core/internal/api/text_configuration_test.go
index 7b2eff4a7..5565a7c11 100644
--- a/services/core/internal/api/text_configuration_test.go
+++ b/services/core/internal/api/text_configuration_test.go
@@ -43,7 +43,7 @@ func TestTextConfigurationHTTP(t *testing.T) {
 			}
 		})
 	}
-	for _, invalid := range []string{`{"verbosity":""}`, `{"verbosity":"verbose"}`, `{"verbosity":4}`, `{"format":{}}`, `{"format":{"type":"json_schema","schema":{}}}`, `{"format":{"type":"text","extra":true}}`, `{"unknown":true}`} {
+	for _, invalid := range []string{`{"verbosity":""}`, `{"verbosity":"verbose"}`, `{"verbosity":4}`, `{"format":{}}`, `{"format":{"type":"json_schema","schema":{"type":"string"}}}`, `{"format":{"type":"text","extra":true}}`, `{"unknown":true}`} {
 		h, s, _ := testHandler(t)
 		req := httptest.NewRequest(http.MethodPost, "/v1/agents/sessions", strings.NewReader(`{"agent":{"model":"example","text":`+invalid+`},"environment":{"type":"none"},"input":"Describe the configured response format."}`))
 		req.Header.Set("Authorization", "Bearer test-api-key")
diff --git a/services/core/internal/api/disabled_tools.go b/services/core/internal/api/tool_controls.go
similarity index 60%
rename from services/core/internal/api/disabled_tools.go
rename to services/core/internal/api/tool_controls.go
index 884f8092d..e7006f120 100644
--- a/services/core/internal/api/disabled_tools.go
+++ b/services/core/internal/api/tool_controls.go
@@ -1,23 +1,19 @@
 package api
 
-import (
-	"encoding/json"
-	"errors"
-)
+import "encoding/json"
 
 // Tool resolvers read tools whose pinned shape was checked at the /v1 boundary:
 // request tools, or a saved Agent's tools that resolveSavedTools stored. A
 // decode failure is Core's own fault and is reported as a service error.
-func resolveProgrammaticTool(raw json.RawMessage) (json.RawMessage, bool, error) {
+func resolveProgrammaticTool(raw json.RawMessage) (json.RawMessage, error) {
 	input := struct {
 		Type    string `json:"type"`
 		Enabled bool   `json:"enabled"`
 	}{Enabled: true}
 	if err := json.Unmarshal(raw, &input); err != nil {
-		return nil, false, &storedDataError{err}
+		return nil, &storedDataError{err}
 	}
-	value, err := json.Marshal(input)
-	return value, input.Enabled, err
+	return json.Marshal(input)
 }
 
 // webSearchTool is the resolved web_search projection. A present location
@@ -35,7 +31,7 @@ type webSearchTool struct {
 	} `json:"location"`
 }
 
-// Optional settings are resource data in every mode; they never enable execution.
+// Optional settings are resource data in every mode.
 func (tool webSearchTool) resolveSettings() (json.RawMessage, error) {
 	if tool.ContextSize == nil {
 		value := "medium"
@@ -44,10 +40,10 @@ func (tool webSearchTool) resolveSettings() (json.RawMessage, error) {
 	return json.Marshal(tool)
 }
 
-// Saved Agents keep every pinned mode, as the official service does; an omitted
-// or null mode is saved as live. Session admission still qualifies only disabled
-// search (resolveDisabledWebSearch), so saving never enables execution.
-func resolveSavedWebSearch(raw json.RawMessage) (json.RawMessage, error) {
+// An omitted or null mode resolves to live, as the official service does. The
+// Session keeps every pinned mode; the selected Harness's declaration decides
+// whether it can run.
+func resolveWebSearch(raw json.RawMessage) (json.RawMessage, error) {
 	var tool webSearchTool
 	if err := json.Unmarshal(raw, &tool); err != nil {
 		return nil, &storedDataError{err}
@@ -58,15 +54,3 @@ func resolveSavedWebSearch(raw json.RawMessage) (json.RawMessage, error) {
 	}
 	return tool.resolveSettings()
 }
-
-// Only disabled search is qualified for execution.
-func resolveDisabledWebSearch(raw json.RawMessage) (json.RawMessage, error) {
-	var tool webSearchTool
-	if err := json.Unmarshal(raw, &tool); err != nil {
-		return nil, &storedDataError{err}
-	}
-	if tool.Mode == nil || *tool.Mode != "disabled" {
-		return nil, errors.New("Only disabled web_search is qualified for execution.")
-	}
-	return tool.resolveSettings()
-}
diff --git a/services/core/internal/api/disabled_tools_test.go b/services/core/internal/api/tool_controls_test.go
similarity index 88%
rename from services/core/internal/api/disabled_tools_test.go
rename to services/core/internal/api/tool_controls_test.go
index 0f8004f2e..4dca0e74b 100644
--- a/services/core/internal/api/disabled_tools_test.go
+++ b/services/core/internal/api/tool_controls_test.go
@@ -8,10 +8,13 @@ import (
 	"testing"
 )
 
-func TestDisabledToolConfigurationRoundTrip(t *testing.T) {
+func TestToolControlConfigurationRoundTrip(t *testing.T) {
 	for _, raw := range []string{
 		`{"type":"programmatic_tool_calling","enabled":false}`,
+		`{"type":"programmatic_tool_calling","enabled":true}`,
 		`{"type":"web_search","mode":"disabled"}`,
+		`{"type":"web_search","mode":"live","context_size":"low"}`,
+		`{"type":"web_search","mode":"cached"}`,
 		`{"type":"web_search","mode":"disabled","context_size":"high","allowed_domains":[],"location":{"city":"Paris","country":null}}`,
 		`{"type":"web_search","mode":"disabled","context_size":null,"allowed_domains":["example.com"],"location":null}`,
 	} {
@@ -36,16 +39,12 @@ func TestDisabledToolConfigurationRoundTrip(t *testing.T) {
 	}
 }
 
-func TestDisabledToolAdmissionPrecedesPersistence(t *testing.T) {
+func TestMalformedToolControlsAreRejectedBeforePersistence(t *testing.T) {
 	for _, tools := range []string{
-		`[{"type":"programmatic_tool_calling"}]`,
-		`[{"type":"programmatic_tool_calling","enabled":true}]`,
 		`[{"type":"programmatic_tool_calling","enabled":null}]`,
 		`[{"type":"programmatic_tool_calling","enabled":"false"}]`,
 		`[{"type":"programmatic_tool_calling","enabled":false,"extra":true}]`,
 		`[{"type":"programmatic_tool_calling","enabled":false},{"type":"programmatic_tool_calling","enabled":false}]`,
-		`[{"type":"web_search","mode":"live"}]`,
-		`[{"type":"web_search","mode":"cached"}]`,
 		`[{"type":"web_search","mode":"disabled","allowed_domains":[null]}]`,
 		`[{"type":"web_search","mode":"disabled","context_size":"enormous"}]`,
 		`[{"type":"web_search","mode":"disabled","location":{"extra":true}}]`,
diff --git a/services/core/internal/credentialcrypto/agent_model_execution.go b/services/core/internal/credentialcrypto/agent_model_execution.go
index 05ab2ac7f..2f8e2fad7 100644
--- a/services/core/internal/credentialcrypto/agent_model_execution.go
+++ b/services/core/internal/credentialcrypto/agent_model_execution.go
@@ -9,7 +9,7 @@ func agentModelExecutionData(tenantID, agentID string) ([]byte, error) {
 	if tenantID == "" || agentID == "" || !utf8.ValidString(tenantID) || !utf8.ValidString(agentID) {
 		return nil, errInvalidBinding
 	}
-	return json.Marshal([]string{"parsar.agents-api.agent-model-execution.v1", tenantID, agentID})
+	return json.Marshal([]string{"oac.agent-model-execution.v1", tenantID, agentID})
 }
 
 func (c *Cipher) SealAgentModelExecution(plaintext []byte, tenantID, agentID string) ([]byte, error) {
diff --git a/services/core/internal/credentialcrypto/cipher.go b/services/core/internal/credentialcrypto/cipher.go
index 8a9136545..e1cbc40ce 100644
--- a/services/core/internal/credentialcrypto/cipher.go
+++ b/services/core/internal/credentialcrypto/cipher.go
@@ -15,7 +15,7 @@ import (
 
 const (
 	formatVersion byte = 1
-	bindingDomain      = "parsar.agents-api.credential"
+	bindingDomain      = "oac.credential"
 )
 
 var (
@@ -55,7 +55,7 @@ func New(key []byte) (*Cipher, error) {
 		return nil, errUnavailable
 	}
 	derive := hmac.New(sha256.New, key)
-	derive.Write([]byte("parsar.agents-api.credential-fingerprint.v1"))
+	derive.Write([]byte("oac.credential-fingerprint.v1"))
 	return &Cipher{aead: aead, fingerprint: derive.Sum(nil)}, nil
 }
 
diff --git a/services/core/internal/credentialcrypto/deployment_model_provider.go b/services/core/internal/credentialcrypto/deployment_model_provider.go
index 07db34fc9..8c5dd8e49 100644
--- a/services/core/internal/credentialcrypto/deployment_model_provider.go
+++ b/services/core/internal/credentialcrypto/deployment_model_provider.go
@@ -12,7 +12,7 @@ func deploymentModelProviderData(harness string) ([]byte, error) {
 	if harness == "" || !utf8.ValidString(harness) {
 		return nil, errInvalidBinding
 	}
-	return json.Marshal([]string{"parsar.agents-api.deployment-model-provider.v1", harness})
+	return json.Marshal([]string{"oac.deployment-model-provider.v1", harness})
 }
 
 func (c *Cipher) SealDeploymentModelProvider(plaintext []byte, harness string) ([]byte, error) {
diff --git a/services/core/internal/credentialcrypto/environment_file.go b/services/core/internal/credentialcrypto/environment_file.go
index cb079b959..779ed5e87 100644
--- a/services/core/internal/credentialcrypto/environment_file.go
+++ b/services/core/internal/credentialcrypto/environment_file.go
@@ -42,5 +42,5 @@ func environmentFileData(binding EnvironmentFileBinding) ([]byte, error) {
 		Domain  string                 `json:"domain"`
 		Version byte                   `json:"version"`
 		Binding EnvironmentFileBinding `json:"binding"`
-	}{"parsar.agents-api.environment-file", formatVersion, binding})
+	}{"oac.environment-file", formatVersion, binding})
 }
diff --git a/services/core/internal/credentialcrypto/environment_setup.go b/services/core/internal/credentialcrypto/environment_setup.go
index 8955d3394..7a452bc4b 100644
--- a/services/core/internal/credentialcrypto/environment_setup.go
+++ b/services/core/internal/credentialcrypto/environment_setup.go
@@ -42,5 +42,5 @@ func environmentSetupData(binding EnvironmentSetupBinding) ([]byte, error) {
 		Domain  string                  `json:"domain"`
 		Version byte                    `json:"version"`
 		Binding EnvironmentSetupBinding `json:"binding"`
-	}{"parsar.agents-api.environment-setup", formatVersion, binding})
+	}{"oac.environment-setup", formatVersion, binding})
 }
diff --git a/services/core/internal/credentialcrypto/model_execution.go b/services/core/internal/credentialcrypto/model_execution.go
index 61dc204c3..3a681d3a4 100644
--- a/services/core/internal/credentialcrypto/model_execution.go
+++ b/services/core/internal/credentialcrypto/model_execution.go
@@ -9,7 +9,7 @@ func modelExecutionData(tenantID, sessionID string) ([]byte, error) {
 	if tenantID == "" || sessionID == "" || !utf8.ValidString(tenantID) || !utf8.ValidString(sessionID) {
 		return nil, errInvalidBinding
 	}
-	return json.Marshal([]string{"parsar.agents-api.session-model-execution.v1", tenantID, sessionID})
+	return json.Marshal([]string{"oac.session-model-execution.v1", tenantID, sessionID})
 }
 
 func (c *Cipher) SealModelExecution(plaintext []byte, tenantID, sessionID string) ([]byte, error) {
diff --git a/services/core/internal/credentialcrypto/sandbox_deployment.go b/services/core/internal/credentialcrypto/sandbox_deployment.go
index 0346f14ff..4066aed81 100644
--- a/services/core/internal/credentialcrypto/sandbox_deployment.go
+++ b/services/core/internal/credentialcrypto/sandbox_deployment.go
@@ -10,7 +10,7 @@ func sandboxDeploymentData(installation string, generation uint64) ([]byte, erro
 	if installation == "" || !utf8.ValidString(installation) || generation == 0 {
 		return nil, errInvalidBinding
 	}
-	return json.Marshal([]string{"parsar.agents-api.sandbox-deployment.v1", installation, strconv.FormatUint(generation, 10)})
+	return json.Marshal([]string{"oac.sandbox-deployment.v1", installation, strconv.FormatUint(generation, 10)})
 }
 
 func (c *Cipher) SealSandboxDeployment(plaintext []byte, installation string, generation uint64) ([]byte, error) {
diff --git a/services/core/internal/credentialcrypto/skill.go b/services/core/internal/credentialcrypto/skill.go
index e827e24c9..29d84830f 100644
--- a/services/core/internal/credentialcrypto/skill.go
+++ b/services/core/internal/credentialcrypto/skill.go
@@ -48,5 +48,5 @@ func skillData(binding SkillBinding) ([]byte, error) {
 		Domain  string       `json:"domain"`
 		Version byte         `json:"version"`
 		Binding SkillBinding `json:"binding"`
-	}{"parsar.agents-api.skill", formatVersion, binding})
+	}{"oac.skill", formatVersion, binding})
 }
diff --git a/services/core/internal/databaseurl/databaseurl_test.go b/services/core/internal/databaseurl/databaseurl_test.go
index 716067da9..942cef8b6 100644
--- a/services/core/internal/databaseurl/databaseurl_test.go
+++ b/services/core/internal/databaseurl/databaseurl_test.go
@@ -13,22 +13,22 @@ func TestPasswordComesOnlyFromTheFile(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Setenv("OAC_DATABASE_PASSWORD_FILE", file)
-	t.Setenv("OAC_DATABASE_URL", "postgres://agents_api@database:5432/agents_api?sslmode=disable")
-	if got, err := FromEnvironment(); err != nil || got != "postgres://agents_api:s3cret%2Fvalue@database:5432/agents_api?sslmode=disable" {
+	t.Setenv("OAC_DATABASE_URL", "postgres://oac@database:5432/oac?sslmode=disable")
+	if got, err := FromEnvironment(); err != nil || got != "postgres://oac:s3cret%2Fvalue@database:5432/oac?sslmode=disable" {
 		t.Fatal(got, err)
 	}
-	t.Setenv("OAC_DATABASE_URL", "postgres://agents_api:inline@database:5432/agents_api")
+	t.Setenv("OAC_DATABASE_URL", "postgres://oac:inline@database:5432/oac")
 	if _, err := FromEnvironment(); err == nil || strings.Contains(err.Error(), "inline") {
 		t.Fatal("accepted a password in two places", err)
 	}
 	t.Setenv("OAC_DATABASE_PASSWORD_FILE", filepath.Join(t.TempDir(), "missing"))
-	t.Setenv("OAC_DATABASE_URL", "postgres://agents_api@database:5432/agents_api")
+	t.Setenv("OAC_DATABASE_URL", "postgres://oac@database:5432/oac")
 	if _, err := FromEnvironment(); err == nil {
 		t.Fatal("accepted a missing password file")
 	}
 	t.Setenv("OAC_DATABASE_PASSWORD_FILE", "")
-	t.Setenv("OAC_DATABASE_URL", "postgres://agents_api:inline@database:5432/agents_api")
-	if got, err := FromEnvironment(); err != nil || got != "postgres://agents_api:inline@database:5432/agents_api" {
+	t.Setenv("OAC_DATABASE_URL", "postgres://oac:inline@database:5432/oac")
+	if got, err := FromEnvironment(); err != nil || got != "postgres://oac:inline@database:5432/oac" {
 		t.Fatal("standalone URL changed", got, err)
 	}
 }
diff --git a/services/core/internal/db/queries/compute_profiles.sql b/services/core/internal/db/queries/compute_profiles.sql
new file mode 100644
index 000000000..700139284
--- /dev/null
+++ b/services/core/internal/db/queries/compute_profiles.sql
@@ -0,0 +1,17 @@
+-- name: FreezeSessionComputeGeneration :exec
+INSERT INTO session_compute_generations(session_id,profile,generation) VALUES($1,$2,$3);
+
+-- name: GetSessionComputeGeneration :one
+SELECT c.generation,g.specification,g.provider_kind FROM session_compute_generations c
+LEFT JOIN runtime_deployment_generations g ON g.generation=c.generation WHERE c.session_id=$1;
+
+-- name: SaveComputeProfileGeneration :exec
+INSERT INTO runtime_deployment_generations(generation,provider_kind,specification,provider_config,provider_metadata)
+VALUES($1,$2,$3,$4,$5);
+
+-- name: ExpandComputeProfileSelections :one
+SELECT coalesce(jsonb_object_agg(p.key,jsonb_build_object(
+ 'generation',g.generation,'specification',g.specification,
+ 'configuration',g.provider_config,'metadata',g.provider_metadata)), '{}'::jsonb)::jsonb AS profiles
+FROM jsonb_each_text(sqlc.arg(profiles)::jsonb) p
+JOIN runtime_deployment_generations g ON g.generation=p.value::bigint;
diff --git a/services/core/internal/db/queries/functions.sql b/services/core/internal/db/queries/functions.sql
index 81a78b857..783d67234 100644
--- a/services/core/internal/db/queries/functions.sql
+++ b/services/core/internal/db/queries/functions.sql
@@ -14,7 +14,7 @@ WHERE s.tenant_id = $1 AND f.session_id = $2 AND f.turn_id = $3 AND f.call_id =
 
 -- name: ListPendingFunctionCalls :many
 SELECT f.* FROM function_calls f JOIN turns t ON t.session_id = f.session_id AND t.id = f.turn_id
-WHERE f.session_id = $1 AND f.turn_id = $2 AND NOT f.applied
+WHERE f.session_id = $1 AND f.turn_id = $2 AND NOT f.applied AND NOT f.withdrawn
     AND t.status IN ('in_progress', 'waiting') AND t.cancel_requested_at IS NULL
 ORDER BY f.created_at, f.call_id;
 
@@ -24,7 +24,8 @@ SELECT EXISTS (
 )::boolean AS found;
 
 -- name: MatchFunctionResult :one
-SELECT (result IS NOT NULL)::boolean AS submitted, COALESCE(result = sqlc.arg(result)::jsonb, false)::boolean AS matches
+SELECT (result IS NOT NULL)::boolean AS submitted, COALESCE(result = sqlc.arg(result)::jsonb, false)::boolean AS matches,
+    withdrawn
 FROM function_calls
 WHERE session_id = sqlc.arg(session_id) AND turn_id = sqlc.arg(turn_id) AND call_id = sqlc.arg(call_id);
 
@@ -34,6 +35,9 @@ UPDATE function_calls SET result = $4 WHERE session_id = $1 AND turn_id = $2 AND
 -- name: ApplyFunctionResult :exec
 UPDATE function_calls SET applied = true WHERE session_id = $1 AND turn_id = $2 AND call_id = $3;
 
+-- name: WithdrawFunctionCall :exec
+UPDATE function_calls SET withdrawn = true WHERE session_id = $1 AND turn_id = $2 AND call_id = $3 AND NOT applied;
+
 -- name: FunctionItemResult :one
 SELECT result FROM function_calls
 WHERE session_id = $1 AND turn_id = $2 AND call_id = $3;
diff --git a/services/core/internal/db/queries/node_generations.sql b/services/core/internal/db/queries/node_generations.sql
index 436268027..5ef5bb1fc 100644
--- a/services/core/internal/db/queries/node_generations.sql
+++ b/services/core/internal/db/queries/node_generations.sql
@@ -19,12 +19,6 @@ ON CONFLICT(node_id,generation) DO UPDATE SET specification_digest=EXCLUDED.spec
 UPDATE runtime_nodes SET ready_generation=$2 WHERE id=$1 AND removed_at IS NULL
 AND $2=(SELECT generation FROM runtime_deployment) AND (ready_generation IS NULL OR ready_generation<$2);
 
--- name: RefreshNodeServingReadiness :exec
-UPDATE runtime_nodes n SET protocol_version=$2, provider_ready=EXISTS(
- SELECT 1 FROM runtime_node_generation_status g WHERE g.node_id=n.id AND g.generation=n.ready_generation
- AND g.connection_id=n.connection_id AND g.owner_epoch=n.connected_epoch AND g.state='ready')
-WHERE n.id=$1 AND n.removed_at IS NULL;
-
 -- name: NodeGenerationReady :one
 SELECT EXISTS(SELECT 1 FROM runtime_node_generation_status g JOIN runtime_nodes n ON n.id=g.node_id CROSS JOIN runtime_deployment d
  WHERE n.id=sqlc.arg(node_id) AND g.generation=sqlc.arg(generation) AND n.removed_at IS NULL
diff --git a/services/core/internal/db/queries/runtime_nodes.sql b/services/core/internal/db/queries/runtime_nodes.sql
index 228892bf2..21b2d563e 100644
--- a/services/core/internal/db/queries/runtime_nodes.sql
+++ b/services/core/internal/db/queries/runtime_nodes.sql
@@ -10,7 +10,7 @@ SELECT * FROM runtime_nodes WHERE id=$1 AND removed_at IS NULL;
 
 -- name: ListRuntimeNodes :many
 SELECT n.*, (n.connection_id IS NOT NULL AND n.connected_epoch=d.owner_epoch AND n.last_seen_at > clock_timestamp()-interval '45 seconds')::boolean AS online,
- d.provider_kind, d.generation AS target_generation,
+ d.provider_kind,
  EXISTS(SELECT 1 FROM runtime_node_generation_status g WHERE g.node_id=n.id AND g.generation=n.ready_generation AND g.connection_id=n.connection_id AND g.owner_epoch=d.owner_epoch AND g.state='ready')::boolean AS serving_ready,
  COALESCE((SELECT g.state FROM runtime_node_generation_status g WHERE g.node_id=n.id AND g.generation=d.generation AND g.connection_id=n.connection_id AND g.owner_epoch=d.owner_epoch),'')::text AS target_state,
  COALESCE((SELECT g.diagnostic FROM runtime_node_generation_status g WHERE g.node_id=n.id AND g.generation=d.generation AND g.connection_id=n.connection_id AND g.owner_epoch=d.owner_epoch),'')::text AS target_diagnostic,
@@ -31,12 +31,12 @@ UPDATE runtime_nodes SET name=$2,max_active=$3,max_retained=$4 WHERE id=$1 AND r
 UPDATE runtime_nodes SET removed_at=clock_timestamp(),connection_id=NULL,ready_generation=NULL WHERE id=$1 AND removed_at IS NULL;
 
 -- name: ConnectRuntimeNode :execrows
-UPDATE runtime_nodes SET connection_id=$2,provider_ready=false,connected_epoch=d.owner_epoch,last_seen_at=clock_timestamp()
+UPDATE runtime_nodes SET connection_id=$2,connected_epoch=d.owner_epoch,last_seen_at=clock_timestamp()
 FROM runtime_deployment d WHERE runtime_nodes.id=$1 AND removed_at IS NULL AND runtime_nodes.installation_id=d.installation_id AND d.owner_epoch=sqlc.arg(owner_epoch)
 AND runtime_nodes.connected_epoch <= sqlc.arg(owner_epoch);
 
 -- name: HeartbeatRuntimeNode :execrows
-UPDATE runtime_nodes SET last_seen_at=clock_timestamp(),provider_ready=$3,health=sqlc.arg(health)::jsonb FROM runtime_deployment d
+UPDATE runtime_nodes SET last_seen_at=clock_timestamp(),health=sqlc.arg(health)::jsonb FROM runtime_deployment d
 WHERE runtime_nodes.id=$1 AND connection_id=$2 AND removed_at IS NULL AND connected_epoch=d.owner_epoch AND d.owner_epoch=sqlc.arg(owner_epoch);
 
 -- name: LockRuntimeNodePresence :one
diff --git a/services/core/internal/db/queries/runtime_suspension_pressure.sql b/services/core/internal/db/queries/runtime_suspension_pressure.sql
index 4c47d4caa..6cb19172a 100644
--- a/services/core/internal/db/queries/runtime_suspension_pressure.sql
+++ b/services/core/internal/db/queries/runtime_suspension_pressure.sql
@@ -5,6 +5,14 @@ WHERE a.node_id IS NOT NULL AND a.state <> 'released'
   AND (a.compute_phase IN ('quiescing', 'suspending')
        OR (a.compute_retained_until <= clock_timestamp() AND a.compute_phase <> 'disabled'));
 
+-- name: ListRuntimeStartingNodes :many
+-- A node is starting a Session while that Session's sandbox is not created or
+-- its initialization has not finished.
+SELECT DISTINCT p.node_id
+FROM runtime_placements p JOIN environments e ON e.id=p.environment_id
+LEFT JOIN runtime_allocations a ON a.environment_id=p.environment_id AND a.state <> 'released'
+WHERE p.released_at IS NULL AND (a.id IS NULL OR e.initialization IN ('pending', 'running'));
+
 -- name: ListWaitingCheckpointRestores :many
 SELECT DISTINCT a.node_id, a.deployment_generation, (a.compute_state->'retained'->'Compatibility')::jsonb AS checkpoint
 FROM runtime_allocations a JOIN environments e ON e.id=a.environment_id JOIN sessions s ON s.id=e.session_id
@@ -12,3 +20,18 @@ WHERE a.node_id IS NOT NULL AND a.state='running' AND a.compute_phase='suspended
  AND a.compute_retained_until>clock_timestamp() AND s.deleted_at IS NULL AND e.status NOT IN ('failed','expired')
  AND a.compute_state->'retained'->'Compatibility' IS NOT NULL
  AND (a.compute_wake_requested OR EXISTS(SELECT 1 FROM environment_input_reservations r WHERE r.session_id=s.id AND r.state='pending' AND r.deadline>clock_timestamp()));
+
+-- name: ListIdleRuntimeCheckpoints :many
+SELECT a.id
+FROM runtime_allocations a JOIN environments e ON e.id=a.environment_id
+WHERE a.node_id=$1 AND a.state='running' AND a.compute_phase='suspended' AND a.compute_retained_until>clock_timestamp()
+ AND NOT a.compute_wake_requested
+ AND NOT EXISTS(SELECT 1 FROM environment_input_reservations r WHERE r.session_id=e.session_id AND r.state='pending')
+ AND NOT EXISTS(SELECT 1 FROM environment_file_writes f WHERE f.environment_id=e.id AND f.state='pending')
+ORDER BY a.compute_retained_until, a.id;
+
+-- name: ExpireRuntimeCheckpoint :one
+UPDATE runtime_allocations
+SET compute_retained_until=clock_timestamp(), compute_revision=compute_revision+1
+WHERE id=$1 AND compute_revision=$2 AND state='running' AND compute_phase IN ('suspended','restoring') AND compute_retained_until>clock_timestamp()
+RETURNING *;
diff --git a/services/core/internal/db/queries/sandbox_deployment_setup.sql b/services/core/internal/db/queries/sandbox_deployment_setup.sql
index 6365c7e0f..68f021f0f 100644
--- a/services/core/internal/db/queries/sandbox_deployment_setup.sql
+++ b/services/core/internal/db/queries/sandbox_deployment_setup.sql
@@ -4,7 +4,7 @@ owner_epoch=owner_epoch+1, updated_at=clock_timestamp() WHERE singleton=true;
 
 -- name: InitializeSandboxDeployment :exec
 UPDATE runtime_deployment SET provider_kind=$1, backend_fingerprint=$2,
-generation=$3, mode=$4,
+generation=$3, mode=$4, compute_profiles=sqlc.arg(compute_profiles),
 provider_config=sqlc.arg(provider_config),provider_metadata=sqlc.arg(provider_metadata),provider_credential=sqlc.arg(provider_credential),specification=sqlc.arg(specification),
 updated_at=clock_timestamp() WHERE singleton=true;
 
@@ -13,7 +13,7 @@ UPDATE runtime_deployment SET provider_metadata=$1,updated_at=clock_timestamp()
 WHERE singleton=true AND provider_kind<>'';
 
 -- name: RetireSandboxNodes :exec
-UPDATE runtime_nodes SET removed_at=clock_timestamp(),connection_id=NULL,provider_ready=false,ready_generation=NULL WHERE removed_at IS NULL;
+UPDATE runtime_nodes SET removed_at=clock_timestamp(),connection_id=NULL,ready_generation=NULL WHERE removed_at IS NULL;
 
 -- name: RetireSandboxEnrollments :exec
 UPDATE runtime_node_enrollments SET expires_at=clock_timestamp() WHERE consumed_at IS NULL;
diff --git a/services/core/internal/db/queries/sandbox_generations.sql b/services/core/internal/db/queries/sandbox_generations.sql
index 12d86058e..c6ae67d00 100644
--- a/services/core/internal/db/queries/sandbox_generations.sql
+++ b/services/core/internal/db/queries/sandbox_generations.sql
@@ -8,6 +8,8 @@ FROM runtime_deployment d WHERE provider_kind <> '' AND (
 
 -- name: CollectSandboxGenerations :exec
 DELETE FROM runtime_deployment_generations WHERE generation IN (SELECT g.generation FROM runtime_deployment_generations g WHERE g.generation <> (SELECT generation FROM runtime_deployment)
+AND NOT EXISTS(SELECT 1 FROM runtime_deployment d, jsonb_each_text(d.compute_profiles) p WHERE p.value::bigint=g.generation)
+AND NOT EXISTS(SELECT 1 FROM session_compute_generations c JOIN sessions s ON s.id=c.session_id WHERE c.generation=g.generation AND s.deleted_at IS NULL)
 AND NOT EXISTS(SELECT 1 FROM runtime_allocations a WHERE a.state <> 'released' AND a.deployment_generation=g.generation)
 AND NOT EXISTS(SELECT 1 FROM runtime_placements p WHERE p.released_at IS NULL AND p.deployment_generation=g.generation)
 AND NOT EXISTS(SELECT 1 FROM runtime_nodes n WHERE n.removed_at IS NULL AND n.ready_generation=g.generation) ORDER BY g.generation LIMIT 32);
diff --git a/services/core/internal/db/queries/sandbox_reset.sql b/services/core/internal/db/queries/sandbox_reset.sql
index 5e5132e96..5e1880f3b 100644
--- a/services/core/internal/db/queries/sandbox_reset.sql
+++ b/services/core/internal/db/queries/sandbox_reset.sql
@@ -20,7 +20,7 @@ UPDATE runtime_deployment SET reset_clear = NULL,
 WHERE singleton = true;
 
 -- name: CompleteSandboxReset :exec
-UPDATE runtime_deployment SET provider_kind = '', backend_fingerprint = '', mode = '',
+UPDATE runtime_deployment SET compute_profiles = '{}', provider_kind = '', backend_fingerprint = '', mode = '',
     specification = '{}', provider_config = '{}'::jsonb, provider_metadata = '{}'::jsonb, provider_credential = NULL,
     generation = generation + 1, owner_epoch = owner_epoch + 1,
     reset_clear = NULL, reset_requested_at = NULL,
@@ -90,7 +90,6 @@ held AS (
 ), rollout_nodes AS (
     SELECT CASE
         WHEN n.connection_id IS NULL OR n.connected_epoch <> d.owner_epoch OR n.last_seen_at IS NULL OR n.last_seen_at <= observed.as_of - interval '45 seconds' THEN 'unknown'
-        WHEN n.protocol_version=1 AND n.deployment_generation <> d.generation THEN 'update_required'
         ELSE COALESCE(g.state,'unknown') END AS state
     FROM runtime_nodes n CROSS JOIN deployment d CROSS JOIN observed
     LEFT JOIN runtime_node_generation_status g ON g.node_id=n.id AND g.generation=d.generation AND g.connection_id=n.connection_id AND g.owner_epoch=d.owner_epoch
@@ -114,7 +113,6 @@ SELECT sqlc.embed(d),
             'ready',(SELECT count(*) FROM rollout_nodes WHERE state='ready'),
             'preparing',(SELECT count(*) FROM rollout_nodes WHERE state='preparing'),
             'failed',(SELECT count(*) FROM rollout_nodes WHERE state='failed'),
-            'update_required',(SELECT count(*) FROM rollout_nodes WHERE state='update_required'),
             'unknown',(SELECT count(*) FROM rollout_nodes WHERE state='unknown')) ELSE NULL END
     )::jsonb AS rollout
 FROM runtime_deployment d
diff --git a/services/core/internal/db/queries/scheduling.sql b/services/core/internal/db/queries/scheduling.sql
index 54da1333c..687e313c2 100644
--- a/services/core/internal/db/queries/scheduling.sql
+++ b/services/core/internal/db/queries/scheduling.sql
@@ -5,7 +5,6 @@ SELECT pg_try_advisory_lock(706172736172::bigint)::boolean;
 SELECT t.id, t.session_id, s.tenant_id, t.status
 FROM turns t JOIN sessions s ON s.id = t.session_id
 WHERE t.status = ANY(sqlc.arg(statuses)::text[]) AND t.id > sqlc.arg(after_id)::uuid
-AND (s.deleted_at IS NULL OR t.status <> 'queued')
 AND (NOT sqlc.arg(connected_only)::boolean OR EXISTS (
     SELECT 1 FROM devices d WHERE d.tenant_id = s.tenant_id AND d.revoked_at IS NULL
         AND d.id = ANY(sqlc.arg(connected_devices)::uuid[])
diff --git a/services/core/internal/db/sqlc/compute_profiles.sql.go b/services/core/internal/db/sqlc/compute_profiles.sql.go
new file mode 100644
index 000000000..c1426e59e
--- /dev/null
+++ b/services/core/internal/db/sqlc/compute_profiles.sql.go
@@ -0,0 +1,83 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.29.0
+// source: compute_profiles.sql
+
+package sqlc
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+const expandComputeProfileSelections = `-- name: ExpandComputeProfileSelections :one
+SELECT coalesce(jsonb_object_agg(p.key,jsonb_build_object(
+ 'generation',g.generation,'specification',g.specification,
+ 'configuration',g.provider_config,'metadata',g.provider_metadata)), '{}'::jsonb)::jsonb AS profiles
+FROM jsonb_each_text($1::jsonb) p
+JOIN runtime_deployment_generations g ON g.generation=p.value::bigint
+`
+
+func (q *Queries) ExpandComputeProfileSelections(ctx context.Context, profiles []byte) ([]byte, error) {
+	row := q.db.QueryRow(ctx, expandComputeProfileSelections, profiles)
+	err := row.Scan(&profiles)
+	return profiles, err
+}
+
+const freezeSessionComputeGeneration = `-- name: FreezeSessionComputeGeneration :exec
+INSERT INTO session_compute_generations(session_id,profile,generation) VALUES($1,$2,$3)
+`
+
+type FreezeSessionComputeGenerationParams struct {
+	SessionID  pgtype.UUID `json:"session_id"`
+	Profile    string      `json:"profile"`
+	Generation int64       `json:"generation"`
+}
+
+func (q *Queries) FreezeSessionComputeGeneration(ctx context.Context, arg FreezeSessionComputeGenerationParams) error {
+	_, err := q.db.Exec(ctx, freezeSessionComputeGeneration, arg.SessionID, arg.Profile, arg.Generation)
+	return err
+}
+
+const getSessionComputeGeneration = `-- name: GetSessionComputeGeneration :one
+SELECT c.generation,g.specification,g.provider_kind FROM session_compute_generations c
+LEFT JOIN runtime_deployment_generations g ON g.generation=c.generation WHERE c.session_id=$1
+`
+
+type GetSessionComputeGenerationRow struct {
+	Generation    int64       `json:"generation"`
+	Specification []byte      `json:"specification"`
+	ProviderKind  pgtype.Text `json:"provider_kind"`
+}
+
+func (q *Queries) GetSessionComputeGeneration(ctx context.Context, sessionID pgtype.UUID) (GetSessionComputeGenerationRow, error) {
+	row := q.db.QueryRow(ctx, getSessionComputeGeneration, sessionID)
+	var i GetSessionComputeGenerationRow
+	err := row.Scan(&i.Generation, &i.Specification, &i.ProviderKind)
+	return i, err
+}
+
+const saveComputeProfileGeneration = `-- name: SaveComputeProfileGeneration :exec
+INSERT INTO runtime_deployment_generations(generation,provider_kind,specification,provider_config,provider_metadata)
+VALUES($1,$2,$3,$4,$5)
+`
+
+type SaveComputeProfileGenerationParams struct {
+	Generation       int64  `json:"generation"`
+	ProviderKind     string `json:"provider_kind"`
+	Specification    []byte `json:"specification"`
+	ProviderConfig   []byte `json:"provider_config"`
+	ProviderMetadata []byte `json:"provider_metadata"`
+}
+
+func (q *Queries) SaveComputeProfileGeneration(ctx context.Context, arg SaveComputeProfileGenerationParams) error {
+	_, err := q.db.Exec(ctx, saveComputeProfileGeneration,
+		arg.Generation,
+		arg.ProviderKind,
+		arg.Specification,
+		arg.ProviderConfig,
+		arg.ProviderMetadata,
+	)
+	return err
+}
diff --git a/services/core/internal/db/sqlc/functions.sql.go b/services/core/internal/db/sqlc/functions.sql.go
index 4594004cb..887a84cf7 100644
--- a/services/core/internal/db/sqlc/functions.sql.go
+++ b/services/core/internal/db/sqlc/functions.sql.go
@@ -74,7 +74,7 @@ func (q *Queries) FunctionItemResult(ctx context.Context, arg FunctionItemResult
 }
 
 const getFunctionCall = `-- name: GetFunctionCall :one
-SELECT f.session_id, f.turn_id, f.call_id, f.executor_call_id, f.name, f.arguments, f.result, f.applied, f.created_at FROM function_calls f JOIN sessions s ON s.id = f.session_id
+SELECT f.session_id, f.turn_id, f.call_id, f.executor_call_id, f.name, f.arguments, f.result, f.applied, f.created_at, f.withdrawn FROM function_calls f JOIN sessions s ON s.id = f.session_id
 WHERE s.tenant_id = $1 AND f.session_id = $2 AND f.turn_id = $3 AND f.call_id = $4
 `
 
@@ -103,13 +103,14 @@ func (q *Queries) GetFunctionCall(ctx context.Context, arg GetFunctionCallParams
 		&i.Result,
 		&i.Applied,
 		&i.CreatedAt,
+		&i.Withdrawn,
 	)
 	return i, err
 }
 
 const listPendingFunctionCalls = `-- name: ListPendingFunctionCalls :many
-SELECT f.session_id, f.turn_id, f.call_id, f.executor_call_id, f.name, f.arguments, f.result, f.applied, f.created_at FROM function_calls f JOIN turns t ON t.session_id = f.session_id AND t.id = f.turn_id
-WHERE f.session_id = $1 AND f.turn_id = $2 AND NOT f.applied
+SELECT f.session_id, f.turn_id, f.call_id, f.executor_call_id, f.name, f.arguments, f.result, f.applied, f.created_at, f.withdrawn FROM function_calls f JOIN turns t ON t.session_id = f.session_id AND t.id = f.turn_id
+WHERE f.session_id = $1 AND f.turn_id = $2 AND NOT f.applied AND NOT f.withdrawn
     AND t.status IN ('in_progress', 'waiting') AND t.cancel_requested_at IS NULL
 ORDER BY f.created_at, f.call_id
 `
@@ -138,6 +139,7 @@ func (q *Queries) ListPendingFunctionCalls(ctx context.Context, arg ListPendingF
 			&i.Result,
 			&i.Applied,
 			&i.CreatedAt,
+			&i.Withdrawn,
 		); err != nil {
 			return nil, err
 		}
@@ -180,7 +182,8 @@ func (q *Queries) MatchFunctionCall(ctx context.Context, arg MatchFunctionCallPa
 }
 
 const matchFunctionResult = `-- name: MatchFunctionResult :one
-SELECT (result IS NOT NULL)::boolean AS submitted, COALESCE(result = $1::jsonb, false)::boolean AS matches
+SELECT (result IS NOT NULL)::boolean AS submitted, COALESCE(result = $1::jsonb, false)::boolean AS matches,
+    withdrawn
 FROM function_calls
 WHERE session_id = $2 AND turn_id = $3 AND call_id = $4
 `
@@ -195,6 +198,7 @@ type MatchFunctionResultParams struct {
 type MatchFunctionResultRow struct {
 	Submitted bool `json:"submitted"`
 	Matches   bool `json:"matches"`
+	Withdrawn bool `json:"withdrawn"`
 }
 
 func (q *Queries) MatchFunctionResult(ctx context.Context, arg MatchFunctionResultParams) (MatchFunctionResultRow, error) {
@@ -205,7 +209,7 @@ func (q *Queries) MatchFunctionResult(ctx context.Context, arg MatchFunctionResu
 		arg.CallID,
 	)
 	var i MatchFunctionResultRow
-	err := row.Scan(&i.Submitted, &i.Matches)
+	err := row.Scan(&i.Submitted, &i.Matches, &i.Withdrawn)
 	return i, err
 }
 
@@ -247,3 +251,18 @@ func (q *Queries) SubmitFunctionResult(ctx context.Context, arg SubmitFunctionRe
 	)
 	return err
 }
+
+const withdrawFunctionCall = `-- name: WithdrawFunctionCall :exec
+UPDATE function_calls SET withdrawn = true WHERE session_id = $1 AND turn_id = $2 AND call_id = $3 AND NOT applied
+`
+
+type WithdrawFunctionCallParams struct {
+	SessionID pgtype.UUID `json:"session_id"`
+	TurnID    pgtype.UUID `json:"turn_id"`
+	CallID    string      `json:"call_id"`
+}
+
+func (q *Queries) WithdrawFunctionCall(ctx context.Context, arg WithdrawFunctionCallParams) error {
+	_, err := q.db.Exec(ctx, withdrawFunctionCall, arg.SessionID, arg.TurnID, arg.CallID)
+	return err
+}
diff --git a/services/core/internal/db/sqlc/models.go b/services/core/internal/db/sqlc/models.go
index 178b78211..4b914b4d1 100644
--- a/services/core/internal/db/sqlc/models.go
+++ b/services/core/internal/db/sqlc/models.go
@@ -170,6 +170,7 @@ type FunctionCall struct {
 	Result         []byte             `json:"result"`
 	Applied        bool               `json:"applied"`
 	CreatedAt      pgtype.Timestamptz `json:"created_at"`
+	Withdrawn      bool               `json:"withdrawn"`
 }
 
 type InitialEnvironmentFile struct {
@@ -263,6 +264,7 @@ type RuntimeDeployment struct {
 	ProviderConfig     []byte             `json:"provider_config"`
 	ProviderMetadata   []byte             `json:"provider_metadata"`
 	IdleSeconds        int64              `json:"idle_seconds"`
+	ComputeProfiles    []byte             `json:"compute_profiles"`
 }
 
 type RuntimeDeploymentGeneration struct {
@@ -310,7 +312,6 @@ type RuntimeNode struct {
 	MaxActive            int32              `json:"max_active"`
 	MaxRetained          int32              `json:"max_retained"`
 	ConnectionID         pgtype.UUID        `json:"connection_id"`
-	ProviderReady        bool               `json:"provider_ready"`
 	Health               []byte             `json:"health"`
 	ConnectedEpoch       int64              `json:"connected_epoch"`
 	LastSeenAt           pgtype.Timestamptz `json:"last_seen_at"`
@@ -321,7 +322,6 @@ type RuntimeNode struct {
 	CoreUrl              string             `json:"core_url"`
 	EnrollmentID         pgtype.UUID        `json:"enrollment_id"`
 	ReadyGeneration      pgtype.Int8        `json:"ready_generation"`
-	ProtocolVersion      int32              `json:"protocol_version"`
 }
 
 type RuntimeNodeEnrollment struct {
@@ -330,8 +330,8 @@ type RuntimeNodeEnrollment struct {
 	ExpiresAt      pgtype.Timestamptz `json:"expires_at"`
 	ConsumedAt     pgtype.Timestamptz `json:"consumed_at"`
 	NodeID         pgtype.UUID        `json:"node_id"`
-	MaxActive      int32              `json:"max_active"`
-	MaxRetained    int32              `json:"max_retained"`
+	MaxActive      pgtype.Int4        `json:"max_active"`
+	MaxRetained    pgtype.Int4        `json:"max_retained"`
 	ID             pgtype.UUID        `json:"id"`
 }
 
@@ -390,6 +390,12 @@ type SessionArtifact struct {
 	CreatedAt     pgtype.Timestamptz `json:"created_at"`
 }
 
+type SessionComputeGeneration struct {
+	SessionID  pgtype.UUID `json:"session_id"`
+	Profile    string      `json:"profile"`
+	Generation int64       `json:"generation"`
+}
+
 type SessionDevice struct {
 	SessionID       pgtype.UUID `json:"session_id"`
 	DeviceID        pgtype.UUID `json:"device_id"`
diff --git a/services/core/internal/db/sqlc/node_generations.sql.go b/services/core/internal/db/sqlc/node_generations.sql.go
index f52041660..a26ca6842 100644
--- a/services/core/internal/db/sqlc/node_generations.sql.go
+++ b/services/core/internal/db/sqlc/node_generations.sql.go
@@ -132,23 +132,6 @@ func (q *Queries) PromoteNodeServingGeneration(ctx context.Context, arg PromoteN
 	return err
 }
 
-const refreshNodeServingReadiness = `-- name: RefreshNodeServingReadiness :exec
-UPDATE runtime_nodes n SET protocol_version=$2, provider_ready=EXISTS(
- SELECT 1 FROM runtime_node_generation_status g WHERE g.node_id=n.id AND g.generation=n.ready_generation
- AND g.connection_id=n.connection_id AND g.owner_epoch=n.connected_epoch AND g.state='ready')
-WHERE n.id=$1 AND n.removed_at IS NULL
-`
-
-type RefreshNodeServingReadinessParams struct {
-	ID              pgtype.UUID `json:"id"`
-	ProtocolVersion int32       `json:"protocol_version"`
-}
-
-func (q *Queries) RefreshNodeServingReadiness(ctx context.Context, arg RefreshNodeServingReadinessParams) error {
-	_, err := q.db.Exec(ctx, refreshNodeServingReadiness, arg.ID, arg.ProtocolVersion)
-	return err
-}
-
 const upsertNodeGenerationStatus = `-- name: UpsertNodeGenerationStatus :exec
 INSERT INTO runtime_node_generation_status(node_id,generation,specification_digest,connection_id,owner_epoch,state,diagnostic,checkpoint)
 VALUES($1,$2,$3,$4,$5,$6,$7,$8)
diff --git a/services/core/internal/db/sqlc/runtime_deployment.sql.go b/services/core/internal/db/sqlc/runtime_deployment.sql.go
index 9bc5ad9b3..8638b22e7 100644
--- a/services/core/internal/db/sqlc/runtime_deployment.sql.go
+++ b/services/core/internal/db/sqlc/runtime_deployment.sql.go
@@ -56,7 +56,7 @@ func (q *Queries) CountRuntimeDeploymentResources(ctx context.Context) (CountRun
 }
 
 const lockRuntimeDeployment = `-- name: LockRuntimeDeployment :one
-SELECT singleton, installation_id, backend_fingerprint, updated_at, provider_kind, owner_epoch, generation, mode, provider_credential, specification, reset_clear, reset_requested_at, reset_deadline_at, reset_forced_at, reset_audit, provider_config, provider_metadata, idle_seconds FROM runtime_deployment WHERE singleton = true FOR UPDATE
+SELECT singleton, installation_id, backend_fingerprint, updated_at, provider_kind, owner_epoch, generation, mode, provider_credential, specification, reset_clear, reset_requested_at, reset_deadline_at, reset_forced_at, reset_audit, provider_config, provider_metadata, idle_seconds, compute_profiles FROM runtime_deployment WHERE singleton = true FOR UPDATE
 `
 
 func (q *Queries) LockRuntimeDeployment(ctx context.Context) (RuntimeDeployment, error) {
@@ -81,6 +81,7 @@ func (q *Queries) LockRuntimeDeployment(ctx context.Context) (RuntimeDeployment,
 		&i.ProviderConfig,
 		&i.ProviderMetadata,
 		&i.IdleSeconds,
+		&i.ComputeProfiles,
 	)
 	return i, err
 }
diff --git a/services/core/internal/db/sqlc/runtime_nodes.sql.go b/services/core/internal/db/sqlc/runtime_nodes.sql.go
index 1c15829d9..c9dcdd9dd 100644
--- a/services/core/internal/db/sqlc/runtime_nodes.sql.go
+++ b/services/core/internal/db/sqlc/runtime_nodes.sql.go
@@ -12,7 +12,7 @@ import (
 )
 
 const connectRuntimeNode = `-- name: ConnectRuntimeNode :execrows
-UPDATE runtime_nodes SET connection_id=$2,provider_ready=false,connected_epoch=d.owner_epoch,last_seen_at=clock_timestamp()
+UPDATE runtime_nodes SET connection_id=$2,connected_epoch=d.owner_epoch,last_seen_at=clock_timestamp()
 FROM runtime_deployment d WHERE runtime_nodes.id=$1 AND removed_at IS NULL AND runtime_nodes.installation_id=d.installation_id AND d.owner_epoch=$3
 AND runtime_nodes.connected_epoch <= $3
 `
@@ -58,8 +58,8 @@ type CreateRuntimeEnrollmentParams struct {
 	ID             pgtype.UUID `json:"id"`
 	TokenSha256    string      `json:"token_sha256"`
 	InstallationID pgtype.UUID `json:"installation_id"`
-	MaxActive      int32       `json:"max_active"`
-	MaxRetained    int32       `json:"max_retained"`
+	MaxActive      pgtype.Int4 `json:"max_active"`
+	MaxRetained    pgtype.Int4 `json:"max_retained"`
 }
 
 func (q *Queries) CreateRuntimeEnrollment(ctx context.Context, arg CreateRuntimeEnrollmentParams) error {
@@ -119,7 +119,7 @@ func (q *Queries) DisconnectRuntimeNode(ctx context.Context, arg DisconnectRunti
 }
 
 const getRuntimeDeployment = `-- name: GetRuntimeDeployment :one
-SELECT singleton, installation_id, backend_fingerprint, updated_at, provider_kind, owner_epoch, generation, mode, provider_credential, specification, reset_clear, reset_requested_at, reset_deadline_at, reset_forced_at, reset_audit, provider_config, provider_metadata, idle_seconds FROM runtime_deployment WHERE singleton=true
+SELECT singleton, installation_id, backend_fingerprint, updated_at, provider_kind, owner_epoch, generation, mode, provider_credential, specification, reset_clear, reset_requested_at, reset_deadline_at, reset_forced_at, reset_audit, provider_config, provider_metadata, idle_seconds, compute_profiles FROM runtime_deployment WHERE singleton=true
 `
 
 func (q *Queries) GetRuntimeDeployment(ctx context.Context) (RuntimeDeployment, error) {
@@ -144,6 +144,7 @@ func (q *Queries) GetRuntimeDeployment(ctx context.Context) (RuntimeDeployment,
 		&i.ProviderConfig,
 		&i.ProviderMetadata,
 		&i.IdleSeconds,
+		&i.ComputeProfiles,
 	)
 	return i, err
 }
@@ -169,7 +170,7 @@ func (q *Queries) GetRuntimeEnrollment(ctx context.Context, tokenSha256 string)
 }
 
 const getRuntimeNode = `-- name: GetRuntimeNode :one
-SELECT id, installation_id, name, backend_fingerprint, credential_sha256, max_active, max_retained, connection_id, provider_ready, health, connected_epoch, last_seen_at, created_at, removed_at, specification_digest, deployment_generation, core_url, enrollment_id, ready_generation, protocol_version FROM runtime_nodes WHERE id=$1 AND removed_at IS NULL
+SELECT id, installation_id, name, backend_fingerprint, credential_sha256, max_active, max_retained, connection_id, health, connected_epoch, last_seen_at, created_at, removed_at, specification_digest, deployment_generation, core_url, enrollment_id, ready_generation FROM runtime_nodes WHERE id=$1 AND removed_at IS NULL
 `
 
 func (q *Queries) GetRuntimeNode(ctx context.Context, id pgtype.UUID) (RuntimeNode, error) {
@@ -184,7 +185,6 @@ func (q *Queries) GetRuntimeNode(ctx context.Context, id pgtype.UUID) (RuntimeNo
 		&i.MaxActive,
 		&i.MaxRetained,
 		&i.ConnectionID,
-		&i.ProviderReady,
 		&i.Health,
 		&i.ConnectedEpoch,
 		&i.LastSeenAt,
@@ -195,7 +195,6 @@ func (q *Queries) GetRuntimeNode(ctx context.Context, id pgtype.UUID) (RuntimeNo
 		&i.CoreUrl,
 		&i.EnrollmentID,
 		&i.ReadyGeneration,
-		&i.ProtocolVersion,
 	)
 	return i, err
 }
@@ -239,23 +238,21 @@ func (q *Queries) GetRuntimePlacement(ctx context.Context, environmentID pgtype.
 }
 
 const heartbeatRuntimeNode = `-- name: HeartbeatRuntimeNode :execrows
-UPDATE runtime_nodes SET last_seen_at=clock_timestamp(),provider_ready=$3,health=$4::jsonb FROM runtime_deployment d
-WHERE runtime_nodes.id=$1 AND connection_id=$2 AND removed_at IS NULL AND connected_epoch=d.owner_epoch AND d.owner_epoch=$5
+UPDATE runtime_nodes SET last_seen_at=clock_timestamp(),health=$3::jsonb FROM runtime_deployment d
+WHERE runtime_nodes.id=$1 AND connection_id=$2 AND removed_at IS NULL AND connected_epoch=d.owner_epoch AND d.owner_epoch=$4
 `
 
 type HeartbeatRuntimeNodeParams struct {
-	ID            pgtype.UUID `json:"id"`
-	ConnectionID  pgtype.UUID `json:"connection_id"`
-	ProviderReady bool        `json:"provider_ready"`
-	Health        []byte      `json:"health"`
-	OwnerEpoch    int64       `json:"owner_epoch"`
+	ID           pgtype.UUID `json:"id"`
+	ConnectionID pgtype.UUID `json:"connection_id"`
+	Health       []byte      `json:"health"`
+	OwnerEpoch   int64       `json:"owner_epoch"`
 }
 
 func (q *Queries) HeartbeatRuntimeNode(ctx context.Context, arg HeartbeatRuntimeNodeParams) (int64, error) {
 	result, err := q.db.Exec(ctx, heartbeatRuntimeNode,
 		arg.ID,
 		arg.ConnectionID,
-		arg.ProviderReady,
 		arg.Health,
 		arg.OwnerEpoch,
 	)
@@ -267,7 +264,7 @@ func (q *Queries) HeartbeatRuntimeNode(ctx context.Context, arg HeartbeatRuntime
 
 const insertRuntimeNode = `-- name: InsertRuntimeNode :one
 INSERT INTO runtime_nodes(id,installation_id,name,backend_fingerprint,credential_sha256,max_active,max_retained,specification_digest,deployment_generation,core_url,enrollment_id,ready_generation)
-VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$9) RETURNING id, installation_id, name, backend_fingerprint, credential_sha256, max_active, max_retained, connection_id, provider_ready, health, connected_epoch, last_seen_at, created_at, removed_at, specification_digest, deployment_generation, core_url, enrollment_id, ready_generation, protocol_version
+VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$9) RETURNING id, installation_id, name, backend_fingerprint, credential_sha256, max_active, max_retained, connection_id, health, connected_epoch, last_seen_at, created_at, removed_at, specification_digest, deployment_generation, core_url, enrollment_id, ready_generation
 `
 
 type InsertRuntimeNodeParams struct {
@@ -308,7 +305,6 @@ func (q *Queries) InsertRuntimeNode(ctx context.Context, arg InsertRuntimeNodePa
 		&i.MaxActive,
 		&i.MaxRetained,
 		&i.ConnectionID,
-		&i.ProviderReady,
 		&i.Health,
 		&i.ConnectedEpoch,
 		&i.LastSeenAt,
@@ -319,7 +315,6 @@ func (q *Queries) InsertRuntimeNode(ctx context.Context, arg InsertRuntimeNodePa
 		&i.CoreUrl,
 		&i.EnrollmentID,
 		&i.ReadyGeneration,
-		&i.ProtocolVersion,
 	)
 	return i, err
 }
@@ -379,8 +374,8 @@ func (q *Queries) ListNodeRuntimeAllocations(ctx context.Context, nodeID pgtype.
 }
 
 const listRuntimeNodes = `-- name: ListRuntimeNodes :many
-SELECT n.id, n.installation_id, n.name, n.backend_fingerprint, n.credential_sha256, n.max_active, n.max_retained, n.connection_id, n.provider_ready, n.health, n.connected_epoch, n.last_seen_at, n.created_at, n.removed_at, n.specification_digest, n.deployment_generation, n.core_url, n.enrollment_id, n.ready_generation, n.protocol_version, (n.connection_id IS NOT NULL AND n.connected_epoch=d.owner_epoch AND n.last_seen_at > clock_timestamp()-interval '45 seconds')::boolean AS online,
- d.provider_kind, d.generation AS target_generation,
+SELECT n.id, n.installation_id, n.name, n.backend_fingerprint, n.credential_sha256, n.max_active, n.max_retained, n.connection_id, n.health, n.connected_epoch, n.last_seen_at, n.created_at, n.removed_at, n.specification_digest, n.deployment_generation, n.core_url, n.enrollment_id, n.ready_generation, (n.connection_id IS NOT NULL AND n.connected_epoch=d.owner_epoch AND n.last_seen_at > clock_timestamp()-interval '45 seconds')::boolean AS online,
+ d.provider_kind,
  EXISTS(SELECT 1 FROM runtime_node_generation_status g WHERE g.node_id=n.id AND g.generation=n.ready_generation AND g.connection_id=n.connection_id AND g.owner_epoch=d.owner_epoch AND g.state='ready')::boolean AS serving_ready,
  COALESCE((SELECT g.state FROM runtime_node_generation_status g WHERE g.node_id=n.id AND g.generation=d.generation AND g.connection_id=n.connection_id AND g.owner_epoch=d.owner_epoch),'')::text AS target_state,
  COALESCE((SELECT g.diagnostic FROM runtime_node_generation_status g WHERE g.node_id=n.id AND g.generation=d.generation AND g.connection_id=n.connection_id AND g.owner_epoch=d.owner_epoch),'')::text AS target_diagnostic,
@@ -404,7 +399,6 @@ type ListRuntimeNodesRow struct {
 	MaxActive            int32              `json:"max_active"`
 	MaxRetained          int32              `json:"max_retained"`
 	ConnectionID         pgtype.UUID        `json:"connection_id"`
-	ProviderReady        bool               `json:"provider_ready"`
 	Health               []byte             `json:"health"`
 	ConnectedEpoch       int64              `json:"connected_epoch"`
 	LastSeenAt           pgtype.Timestamptz `json:"last_seen_at"`
@@ -415,10 +409,8 @@ type ListRuntimeNodesRow struct {
 	CoreUrl              string             `json:"core_url"`
 	EnrollmentID         pgtype.UUID        `json:"enrollment_id"`
 	ReadyGeneration      pgtype.Int8        `json:"ready_generation"`
-	ProtocolVersion      int32              `json:"protocol_version"`
 	Online               bool               `json:"online"`
 	ProviderKind         string             `json:"provider_kind"`
-	TargetGeneration     int64              `json:"target_generation"`
 	ServingReady         bool               `json:"serving_ready"`
 	TargetState          string             `json:"target_state"`
 	TargetDiagnostic     string             `json:"target_diagnostic"`
@@ -448,7 +440,6 @@ func (q *Queries) ListRuntimeNodes(ctx context.Context, nodeID pgtype.UUID) ([]L
 			&i.MaxActive,
 			&i.MaxRetained,
 			&i.ConnectionID,
-			&i.ProviderReady,
 			&i.Health,
 			&i.ConnectedEpoch,
 			&i.LastSeenAt,
@@ -459,10 +450,8 @@ func (q *Queries) ListRuntimeNodes(ctx context.Context, nodeID pgtype.UUID) ([]L
 			&i.CoreUrl,
 			&i.EnrollmentID,
 			&i.ReadyGeneration,
-			&i.ProtocolVersion,
 			&i.Online,
 			&i.ProviderKind,
-			&i.TargetGeneration,
 			&i.ServingReady,
 			&i.TargetState,
 			&i.TargetDiagnostic,
@@ -582,7 +571,7 @@ func (q *Queries) SetRuntimeObservation(ctx context.Context, arg SetRuntimeObser
 }
 
 const updateRuntimeNode = `-- name: UpdateRuntimeNode :one
-UPDATE runtime_nodes SET name=$2,max_active=$3,max_retained=$4 WHERE id=$1 AND removed_at IS NULL RETURNING id, installation_id, name, backend_fingerprint, credential_sha256, max_active, max_retained, connection_id, provider_ready, health, connected_epoch, last_seen_at, created_at, removed_at, specification_digest, deployment_generation, core_url, enrollment_id, ready_generation, protocol_version
+UPDATE runtime_nodes SET name=$2,max_active=$3,max_retained=$4 WHERE id=$1 AND removed_at IS NULL RETURNING id, installation_id, name, backend_fingerprint, credential_sha256, max_active, max_retained, connection_id, health, connected_epoch, last_seen_at, created_at, removed_at, specification_digest, deployment_generation, core_url, enrollment_id, ready_generation
 `
 
 type UpdateRuntimeNodeParams struct {
@@ -609,7 +598,6 @@ func (q *Queries) UpdateRuntimeNode(ctx context.Context, arg UpdateRuntimeNodePa
 		&i.MaxActive,
 		&i.MaxRetained,
 		&i.ConnectionID,
-		&i.ProviderReady,
 		&i.Health,
 		&i.ConnectedEpoch,
 		&i.LastSeenAt,
@@ -620,7 +608,6 @@ func (q *Queries) UpdateRuntimeNode(ctx context.Context, arg UpdateRuntimeNodePa
 		&i.CoreUrl,
 		&i.EnrollmentID,
 		&i.ReadyGeneration,
-		&i.ProtocolVersion,
 	)
 	return i, err
 }
diff --git a/services/core/internal/db/sqlc/runtime_suspension_pressure.sql.go b/services/core/internal/db/sqlc/runtime_suspension_pressure.sql.go
index 86b051015..d3e80522c 100644
--- a/services/core/internal/db/sqlc/runtime_suspension_pressure.sql.go
+++ b/services/core/internal/db/sqlc/runtime_suspension_pressure.sql.go
@@ -11,6 +11,103 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
+const expireRuntimeCheckpoint = `-- name: ExpireRuntimeCheckpoint :one
+UPDATE runtime_allocations
+SET compute_retained_until=clock_timestamp(), compute_revision=compute_revision+1
+WHERE id=$1 AND compute_revision=$2 AND state='running' AND compute_phase IN ('suspended','restoring') AND compute_retained_until>clock_timestamp()
+RETURNING id, environment_id, device_id, provider_key, state, create_settled, created_at, released_at, compute_phase, compute_revision, compute_state, compute_activity_at, compute_wake_requested, compute_retained_until, node_id, observation_error, compute_phase_changed_at, deployment_generation
+`
+
+type ExpireRuntimeCheckpointParams struct {
+	ID              pgtype.UUID `json:"id"`
+	ComputeRevision int64       `json:"compute_revision"`
+}
+
+func (q *Queries) ExpireRuntimeCheckpoint(ctx context.Context, arg ExpireRuntimeCheckpointParams) (RuntimeAllocation, error) {
+	row := q.db.QueryRow(ctx, expireRuntimeCheckpoint, arg.ID, arg.ComputeRevision)
+	var i RuntimeAllocation
+	err := row.Scan(
+		&i.ID,
+		&i.EnvironmentID,
+		&i.DeviceID,
+		&i.ProviderKey,
+		&i.State,
+		&i.CreateSettled,
+		&i.CreatedAt,
+		&i.ReleasedAt,
+		&i.ComputePhase,
+		&i.ComputeRevision,
+		&i.ComputeState,
+		&i.ComputeActivityAt,
+		&i.ComputeWakeRequested,
+		&i.ComputeRetainedUntil,
+		&i.NodeID,
+		&i.ObservationError,
+		&i.ComputePhaseChangedAt,
+		&i.DeploymentGeneration,
+	)
+	return i, err
+}
+
+const listIdleRuntimeCheckpoints = `-- name: ListIdleRuntimeCheckpoints :many
+SELECT a.id
+FROM runtime_allocations a JOIN environments e ON e.id=a.environment_id
+WHERE a.node_id=$1 AND a.state='running' AND a.compute_phase='suspended' AND a.compute_retained_until>clock_timestamp()
+ AND NOT a.compute_wake_requested
+ AND NOT EXISTS(SELECT 1 FROM environment_input_reservations r WHERE r.session_id=e.session_id AND r.state='pending')
+ AND NOT EXISTS(SELECT 1 FROM environment_file_writes f WHERE f.environment_id=e.id AND f.state='pending')
+ORDER BY a.compute_retained_until, a.id
+`
+
+func (q *Queries) ListIdleRuntimeCheckpoints(ctx context.Context, nodeID pgtype.UUID) ([]pgtype.UUID, error) {
+	rows, err := q.db.Query(ctx, listIdleRuntimeCheckpoints, nodeID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []pgtype.UUID{}
+	for rows.Next() {
+		var id pgtype.UUID
+		if err := rows.Scan(&id); err != nil {
+			return nil, err
+		}
+		items = append(items, id)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listRuntimeStartingNodes = `-- name: ListRuntimeStartingNodes :many
+SELECT DISTINCT p.node_id
+FROM runtime_placements p JOIN environments e ON e.id=p.environment_id
+LEFT JOIN runtime_allocations a ON a.environment_id=p.environment_id AND a.state <> 'released'
+WHERE p.released_at IS NULL AND (a.id IS NULL OR e.initialization IN ('pending', 'running'))
+`
+
+// A node is starting a Session while that Session's sandbox is not created or
+// its initialization has not finished.
+func (q *Queries) ListRuntimeStartingNodes(ctx context.Context) ([]pgtype.UUID, error) {
+	rows, err := q.db.Query(ctx, listRuntimeStartingNodes)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []pgtype.UUID{}
+	for rows.Next() {
+		var node_id pgtype.UUID
+		if err := rows.Scan(&node_id); err != nil {
+			return nil, err
+		}
+		items = append(items, node_id)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listRuntimeSuspensionInFlightNodes = `-- name: ListRuntimeSuspensionInFlightNodes :many
 SELECT DISTINCT a.node_id
 FROM runtime_allocations a
diff --git a/services/core/internal/db/sqlc/sandbox_deployment_setup.sql.go b/services/core/internal/db/sqlc/sandbox_deployment_setup.sql.go
index 9b169c9bf..8daf82a10 100644
--- a/services/core/internal/db/sqlc/sandbox_deployment_setup.sql.go
+++ b/services/core/internal/db/sqlc/sandbox_deployment_setup.sql.go
@@ -32,8 +32,8 @@ func (q *Queries) ClaimWebSandboxDeployment(ctx context.Context, installationID
 
 const initializeSandboxDeployment = `-- name: InitializeSandboxDeployment :exec
 UPDATE runtime_deployment SET provider_kind=$1, backend_fingerprint=$2,
-generation=$3, mode=$4,
-provider_config=$5,provider_metadata=$6,provider_credential=$7,specification=$8,
+generation=$3, mode=$4, compute_profiles=$5,
+provider_config=$6,provider_metadata=$7,provider_credential=$8,specification=$9,
 updated_at=clock_timestamp() WHERE singleton=true
 `
 
@@ -42,6 +42,7 @@ type InitializeSandboxDeploymentParams struct {
 	BackendFingerprint string `json:"backend_fingerprint"`
 	Generation         int64  `json:"generation"`
 	Mode               string `json:"mode"`
+	ComputeProfiles    []byte `json:"compute_profiles"`
 	ProviderConfig     []byte `json:"provider_config"`
 	ProviderMetadata   []byte `json:"provider_metadata"`
 	ProviderCredential []byte `json:"provider_credential"`
@@ -54,6 +55,7 @@ func (q *Queries) InitializeSandboxDeployment(ctx context.Context, arg Initializ
 		arg.BackendFingerprint,
 		arg.Generation,
 		arg.Mode,
+		arg.ComputeProfiles,
 		arg.ProviderConfig,
 		arg.ProviderMetadata,
 		arg.ProviderCredential,
@@ -82,7 +84,7 @@ func (q *Queries) RetireSandboxEnrollments(ctx context.Context) error {
 }
 
 const retireSandboxNodes = `-- name: RetireSandboxNodes :exec
-UPDATE runtime_nodes SET removed_at=clock_timestamp(),connection_id=NULL,provider_ready=false,ready_generation=NULL WHERE removed_at IS NULL
+UPDATE runtime_nodes SET removed_at=clock_timestamp(),connection_id=NULL,ready_generation=NULL WHERE removed_at IS NULL
 `
 
 func (q *Queries) RetireSandboxNodes(ctx context.Context) error {
diff --git a/services/core/internal/db/sqlc/sandbox_generations.sql.go b/services/core/internal/db/sqlc/sandbox_generations.sql.go
index 65b79d9df..ce73aee69 100644
--- a/services/core/internal/db/sqlc/sandbox_generations.sql.go
+++ b/services/core/internal/db/sqlc/sandbox_generations.sql.go
@@ -20,6 +20,8 @@ func (q *Queries) ClearSandboxGenerations(ctx context.Context) error {
 
 const collectSandboxGenerations = `-- name: CollectSandboxGenerations :exec
 DELETE FROM runtime_deployment_generations WHERE generation IN (SELECT g.generation FROM runtime_deployment_generations g WHERE g.generation <> (SELECT generation FROM runtime_deployment)
+AND NOT EXISTS(SELECT 1 FROM runtime_deployment d, jsonb_each_text(d.compute_profiles) p WHERE p.value::bigint=g.generation)
+AND NOT EXISTS(SELECT 1 FROM session_compute_generations c JOIN sessions s ON s.id=c.session_id WHERE c.generation=g.generation AND s.deleted_at IS NULL)
 AND NOT EXISTS(SELECT 1 FROM runtime_allocations a WHERE a.state <> 'released' AND a.deployment_generation=g.generation)
 AND NOT EXISTS(SELECT 1 FROM runtime_placements p WHERE p.released_at IS NULL AND p.deployment_generation=g.generation)
 AND NOT EXISTS(SELECT 1 FROM runtime_nodes n WHERE n.removed_at IS NULL AND n.ready_generation=g.generation) ORDER BY g.generation LIMIT 32)
diff --git a/services/core/internal/db/sqlc/sandbox_reset.sql.go b/services/core/internal/db/sqlc/sandbox_reset.sql.go
index 4b2ac0e79..73fc770bb 100644
--- a/services/core/internal/db/sqlc/sandbox_reset.sql.go
+++ b/services/core/internal/db/sqlc/sandbox_reset.sql.go
@@ -24,7 +24,7 @@ func (q *Queries) CancelSandboxReset(ctx context.Context) error {
 }
 
 const completeSandboxReset = `-- name: CompleteSandboxReset :exec
-UPDATE runtime_deployment SET provider_kind = '', backend_fingerprint = '', mode = '',
+UPDATE runtime_deployment SET compute_profiles = '{}', provider_kind = '', backend_fingerprint = '', mode = '',
     specification = '{}', provider_config = '{}'::jsonb, provider_metadata = '{}'::jsonb, provider_credential = NULL,
     generation = generation + 1, owner_epoch = owner_epoch + 1,
     reset_clear = NULL, reset_requested_at = NULL,
@@ -50,7 +50,7 @@ func (q *Queries) ForceSandboxReset(ctx context.Context) error {
 }
 
 const getSandboxDeploymentSnapshot = `-- name: GetSandboxDeploymentSnapshot :one
-WITH deployment AS MATERIALIZED (SELECT singleton, installation_id, backend_fingerprint, updated_at, provider_kind, owner_epoch, generation, mode, provider_credential, specification, reset_clear, reset_requested_at, reset_deadline_at, reset_forced_at, reset_audit, provider_config, provider_metadata, idle_seconds FROM runtime_deployment WHERE singleton = true LIMIT 1),
+WITH deployment AS MATERIALIZED (SELECT singleton, installation_id, backend_fingerprint, updated_at, provider_kind, owner_epoch, generation, mode, provider_credential, specification, reset_clear, reset_requested_at, reset_deadline_at, reset_forced_at, reset_audit, provider_config, provider_metadata, idle_seconds, compute_profiles FROM runtime_deployment WHERE singleton = true LIMIT 1),
 observed AS MATERIALIZED (SELECT clock_timestamp() AS as_of),
 held AS (
     SELECT a.deployment_generation, a.node_id, s.id AS session_id, e.id AS environment_id, false AS pending,
@@ -83,7 +83,6 @@ held AS (
 ), rollout_nodes AS (
     SELECT CASE
         WHEN n.connection_id IS NULL OR n.connected_epoch <> d.owner_epoch OR n.last_seen_at IS NULL OR n.last_seen_at <= observed.as_of - interval '45 seconds' THEN 'unknown'
-        WHEN n.protocol_version=1 AND n.deployment_generation <> d.generation THEN 'update_required'
         ELSE COALESCE(g.state,'unknown') END AS state
     FROM runtime_nodes n CROSS JOIN deployment d CROSS JOIN observed
     LEFT JOIN runtime_node_generation_status g ON g.node_id=n.id AND g.generation=d.generation AND g.connection_id=n.connection_id AND g.owner_epoch=d.owner_epoch
@@ -91,7 +90,7 @@ held AS (
 ), offline AS (
     SELECT node_id, name, count(*)::bigint AS resources FROM classified WHERE offline GROUP BY node_id, name
 )
-SELECT d.singleton, d.installation_id, d.backend_fingerprint, d.updated_at, d.provider_kind, d.owner_epoch, d.generation, d.mode, d.provider_credential, d.specification, d.reset_clear, d.reset_requested_at, d.reset_deadline_at, d.reset_forced_at, d.reset_audit, d.provider_config, d.provider_metadata, d.idle_seconds,
+SELECT d.singleton, d.installation_id, d.backend_fingerprint, d.updated_at, d.provider_kind, d.owner_epoch, d.generation, d.mode, d.provider_credential, d.specification, d.reset_clear, d.reset_requested_at, d.reset_deadline_at, d.reset_forced_at, d.reset_audit, d.provider_config, d.provider_metadata, d.idle_seconds, d.compute_profiles,
     (SELECT count(*) FROM classified WHERE NOT pending)::bigint AS allocations,
     (SELECT count(*) FROM classified WHERE pending)::bigint AS pending,
     jsonb_build_object(
@@ -107,7 +106,6 @@ SELECT d.singleton, d.installation_id, d.backend_fingerprint, d.updated_at, d.pr
             'ready',(SELECT count(*) FROM rollout_nodes WHERE state='ready'),
             'preparing',(SELECT count(*) FROM rollout_nodes WHERE state='preparing'),
             'failed',(SELECT count(*) FROM rollout_nodes WHERE state='failed'),
-            'update_required',(SELECT count(*) FROM rollout_nodes WHERE state='update_required'),
             'unknown',(SELECT count(*) FROM rollout_nodes WHERE state='unknown')) ELSE NULL END
     )::jsonb AS rollout
 FROM runtime_deployment d
@@ -145,6 +143,7 @@ func (q *Queries) GetSandboxDeploymentSnapshot(ctx context.Context) (GetSandboxD
 		&i.RuntimeDeployment.ProviderConfig,
 		&i.RuntimeDeployment.ProviderMetadata,
 		&i.RuntimeDeployment.IdleSeconds,
+		&i.RuntimeDeployment.ComputeProfiles,
 		&i.Allocations,
 		&i.Pending,
 		&i.Remaining,
diff --git a/services/core/internal/db/sqlc/scheduling.sql.go b/services/core/internal/db/sqlc/scheduling.sql.go
index 4a748867c..aef12d2c8 100644
--- a/services/core/internal/db/sqlc/scheduling.sql.go
+++ b/services/core/internal/db/sqlc/scheduling.sql.go
@@ -116,7 +116,6 @@ const listExecutionWork = `-- name: ListExecutionWork :many
 SELECT t.id, t.session_id, s.tenant_id, t.status
 FROM turns t JOIN sessions s ON s.id = t.session_id
 WHERE t.status = ANY($1::text[]) AND t.id > $2::uuid
-AND (s.deleted_at IS NULL OR t.status <> 'queued')
 AND (NOT $3::boolean OR EXISTS (
     SELECT 1 FROM devices d WHERE d.tenant_id = s.tenant_id AND d.revoked_at IS NULL
         AND d.id = ANY($4::uuid[])
diff --git a/services/core/internal/deployment/allocations.go b/services/core/internal/deployment/allocations.go
index 4fb87c787..56c53ee65 100644
--- a/services/core/internal/deployment/allocations.go
+++ b/services/core/internal/deployment/allocations.go
@@ -287,7 +287,14 @@ func (e *ExecutionOperations) SetCompute(ctx context.Context, owner Allocation,
 					if !activity.ReadyToSuspend(15*time.Second) || current.NodeID == "" {
 						return Allocation{}, ErrNotIdle
 					}
-					allowed, err := e.canSuspendForDemand(tx, current)
+					pressure, err := tx.LoadSuspensionDemand(current)
+					if err != nil {
+						return Allocation{}, err
+					}
+					allowed, err := e.canSuspendForDemand(tx, pressure, current)
+					if err == nil && !allowed && activity.ReadyToSuspend(freeSlotIdle) {
+						allowed = canKeepFreeSlot(pressure, current)
+					}
 					if err != nil {
 						return Allocation{}, err
 					}
diff --git a/services/core/internal/deployment/allocations_test.go b/services/core/internal/deployment/allocations_test.go
index bb91fe246..0f9d19cb4 100644
--- a/services/core/internal/deployment/allocations_test.go
+++ b/services/core/internal/deployment/allocations_test.go
@@ -7,7 +7,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"slices"
 	"testing"
 	"time"
@@ -126,6 +126,16 @@ func (f *fakeAllocationTx) LoadActivity(current Allocation) (Activity, error) {
 	return f.loadActivity(current)
 }
 
+func (f *fakeAllocationTx) OldestIdleCheckpoint(Allocation) (bool, error) {
+	unexpected(f.t, "OldestIdleCheckpoint")
+	return false, nil
+}
+
+func (f *fakeAllocationTx) ExpireCheckpoint(Allocation) (Allocation, error) {
+	unexpected(f.t, "ExpireCheckpoint")
+	return Allocation{}, nil
+}
+
 func (f *fakeAllocationTx) LoadSuspensionDemand(current Allocation) (SuspensionDemand, error) {
 	if f.loadSuspensionDemand == nil {
 		unexpected(f.t, "LoadSuspensionDemand")
@@ -312,7 +322,7 @@ func allocationOperations(t *testing.T, reservation *fakeReservationTx, locked s
 			return apply(allocation)
 		}
 	}
-	result, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, engine.Catalog{})
+	result, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, builtin.Registry())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -543,7 +553,7 @@ func TestCleanupRevokesSettlesTheSessionThenReleases(t *testing.T) {
 			storage := &fakeExecutionStorage{t: t, withAllocationCleanup: func(_ context.Context, _ AllocationKey, apply func(AllocationCleanupTx) error) error {
 				return apply(tx)
 			}}
-			operations, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, engine.Catalog{})
+			operations, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, builtin.Registry())
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -581,7 +591,7 @@ func TestExpiredQualifiedFilesystemCleanupPreservesSessionWork(t *testing.T) {
 			storage := &fakeExecutionStorage{t: t, withAllocationCleanup: func(_ context.Context, _ AllocationKey, apply func(AllocationCleanupTx) error) error {
 				return apply(tx)
 			}}
-			operations, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, engine.Catalog{})
+			operations, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, builtin.Registry())
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -640,7 +650,7 @@ func TestReleaseLostComputeRetainsOrChangesNothing(t *testing.T) {
 			storage := &fakeExecutionStorage{t: t, withAllocationCleanup: func(_ context.Context, _ AllocationKey, apply func(AllocationCleanupTx) error) error {
 				return apply(tx)
 			}}
-			operations, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, engine.Catalog{})
+			operations, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, builtin.Registry())
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -706,7 +716,7 @@ func TestSetComputeRechecksIdlePressureAndActivity(t *testing.T) {
 				},
 			}
 			storage := &fakeExecutionStorage{t: t, withAllocation: func(_ context.Context, _ AllocationKey, apply func(AllocationTx) error) error { return apply(tx) }}
-			operations, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, engine.Catalog{})
+			operations, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, builtin.Registry())
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -742,7 +752,7 @@ func TestBeginRestoreDirectKeepsAllocationAndRetention(t *testing.T) {
 		return current, nil
 	}}
 	storage := &fakeExecutionStorage{t: t, withAllocation: func(_ context.Context, _ AllocationKey, apply func(AllocationTx) error) error { return apply(tx) }}
-	operations, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, engine.Catalog{})
+	operations, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, builtin.Registry())
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/internal/deployment/capacity.go b/services/core/internal/deployment/capacity.go
new file mode 100644
index 000000000..11b5ce5ba
--- /dev/null
+++ b/services/core/internal/deployment/capacity.go
@@ -0,0 +1,75 @@
+package deployment
+
+import (
+	"context"
+	"math"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+)
+
+// hostReservedMiB stays for the host and the node service; memory is never overcommitted beyond it.
+const hostReservedMiB = 2048
+
+// RecommendCapacity derives a node's limits from its host measurements and the
+// size of one sandbox. It reports false when the host measurements cannot
+// establish them.
+//
+// Agent sandboxes mostly wait on the model, so CPU is committed at twice the
+// host's cores. Memory is not overcommitted, after hostReservedMiB. A provider
+// that checkpoints retains suspended sandboxes on disk, so it keeps as many
+// root disks as fit in half the free disk; one that does not retains none.
+func RecommendCapacity(host NodeHealth, resources sandbox.Resources, checkpoint bool) (Capacity, bool) {
+	cpus := host.CPUCount
+	var cores float64
+	switch {
+	case host.Host != nil && host.Host.EffectiveCPUCores != nil:
+		cores = *host.Host.EffectiveCPUCores
+	case cpus != nil:
+		cores = float64(*cpus)
+	}
+	if cores <= 0 || host.Host == nil || host.Host.TotalMemoryBytes == nil || resources.CPUs == 0 || resources.MemoryMiB == 0 {
+		return Capacity{}, false
+	}
+	memoryMiB := *host.Host.TotalMemoryBytes>>20 - hostReservedMiB
+	byCPU := int64(math.Floor(min(2*cores/float64(resources.CPUs), maxNodeCapacity)))
+	active := int(max(min(byCPU, memoryMiB/int64(resources.MemoryMiB), maxNodeCapacity), 1))
+	retained := active
+	if checkpoint && host.AvailableDiskBytes != nil && resources.RootDiskMiB > 0 {
+		retained = int(min(max(int64(active), *host.AvailableDiskBytes>>20/2/int64(resources.RootDiskMiB)), maxNodeCapacity))
+	}
+	return Capacity{MaxActive: active, MaxRetained: retained}, true
+}
+
+// recommendations returns, for the current specification, the recommendation
+// for a node's latest health: nil when there is no specification or the node
+// reported too little.
+func (s *Service) recommendations(ctx context.Context) (func(NodeHealth) *Capacity, error) {
+	// The snapshot reads the deployment without opening its sealed credential.
+	snapshot, err := s.reader.Snapshot(ctx)
+	if err != nil {
+		return nil, err
+	}
+	d := snapshot.Record
+	spec, err := s.specification(d)
+	if err != nil {
+		return func(NodeHealth) *Capacity { return nil }, nil
+	}
+	checkpoint, err := s.registry.SupportsSuspension(d.Provider)
+	if err != nil {
+		return func(NodeHealth) *Capacity { return nil }, nil
+	}
+	return func(health NodeHealth) *Capacity {
+		capacity, ok := RecommendCapacity(health, spec.Resources, checkpoint)
+		if !ok {
+			return nil
+		}
+		return &capacity
+	}, nil
+}
+
+// enrollmentHealth is the host an enrollment reports, validated like a health report.
+func enrollmentHealth(e Enrollment) (NodeHealth, error) {
+	observed := time.Now()
+	return normalizeHealth(NodeHealth{CPUCount: e.CPUCount, AvailableDiskBytes: e.AvailableDiskBytes, Host: &NodeHost{EffectiveCPUCores: e.EffectiveCPUCores, TotalMemoryBytes: e.TotalMemoryBytes, AvailableDiskBytes: e.AvailableDiskBytes, ObservedAt: &observed}})
+}
diff --git a/services/core/internal/deployment/capacity_test.go b/services/core/internal/deployment/capacity_test.go
new file mode 100644
index 000000000..c72ae41a8
--- /dev/null
+++ b/services/core/internal/deployment/capacity_test.go
@@ -0,0 +1,37 @@
+package deployment
+
+import (
+	"testing"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+)
+
+func TestRecommendCapacity(t *testing.T) {
+	const gib = int64(1) << 30
+	size := sandbox.Resources{CPUs: 2, MemoryMiB: 4096, RootDiskMiB: 8192}
+	host := func(cpus int64, cores *float64, memory, disk int64) NodeHealth {
+		now := time.Now()
+		return NodeHealth{CPUCount: &cpus, AvailableDiskBytes: &disk, Host: &NodeHost{EffectiveCPUCores: cores, TotalMemoryBytes: &memory, AvailableDiskBytes: &disk, ObservedAt: &now}}
+	}
+	limited := 1.0
+	for _, c := range []struct {
+		name       string
+		host       NodeHealth
+		checkpoint bool
+		want       Capacity
+	}{
+		{"checkpoint host", host(4, nil, 14*gib+gib*4/10, 239*gib), true, Capacity{MaxActive: 3, MaxRetained: 14}},
+		{"no checkpoint", host(4, nil, 14*gib+gib*4/10, 239*gib), false, Capacity{MaxActive: 3, MaxRetained: 3}},
+		{"just enough for one", host(1, nil, 6*gib, 1*gib), true, Capacity{MaxActive: 1, MaxRetained: 1}},
+		{"cgroup limit wins", host(64, &limited, 256*gib, 1000*gib), true, Capacity{MaxActive: 1, MaxRetained: 62}},
+		{"memory bound", host(64, nil, 10*gib, 100*gib), false, Capacity{MaxActive: 2, MaxRetained: 2}},
+	} {
+		if got, ok := RecommendCapacity(c.host, size, c.checkpoint); !ok || got != c.want {
+			t.Errorf("%s: %v %v, want %v", c.name, got, ok, c.want)
+		}
+	}
+	if _, ok := RecommendCapacity(NodeHealth{}, size, true); ok {
+		t.Error("recommended without host measurements")
+	}
+}
diff --git a/services/core/internal/deployment/compute_profiles.go b/services/core/internal/deployment/compute_profiles.go
new file mode 100644
index 000000000..ee912bc44
--- /dev/null
+++ b/services/core/internal/deployment/compute_profiles.go
@@ -0,0 +1,43 @@
+package deployment
+
+import (
+	"encoding/json"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+)
+
+// ComputeProfileRecord freezes one administrator-approved selection without credentials.
+type ComputeProfileRecord struct {
+	Generation    uint64                 `json:"generation"`
+	Specification sandbox.DeploymentSpec `json:"specification"`
+	Configuration json.RawMessage        `json:"configuration" swaggertype:"object"`
+	Metadata      json.RawMessage        `json:"metadata" swaggertype:"object"`
+}
+
+func (s *Service) profiles(d Record, base sandbox.Selection) (map[string]sandbox.ComputeProfile, error) {
+	var records map[string]ComputeProfileRecord
+	if len(d.ComputeProfiles) == 0 {
+		return nil, nil
+	}
+	if err := json.Unmarshal(d.ComputeProfiles, &records); err != nil {
+		return nil, ErrConflict
+	}
+	result := make(map[string]sandbox.ComputeProfile, len(records))
+	for name, item := range records {
+		if !sandbox.ValidComputeProfile(name) || item.Generation == 0 || item.Generation >= d.Generation {
+			return nil, ErrConflict
+		}
+		c, err := s.registry.Decode(d.Provider, sandbox.ConfigurationRecord{Public: item.Configuration, Metadata: item.Metadata})
+		if err != nil {
+			return nil, ErrConflict
+		}
+		owner := sandbox.Selection{Provider: d.Provider, DeploymentSpec: item.Specification, Configuration: c}
+		if base.HasCredential() {
+			owner, err = s.registry.WithCredential(owner, base)
+			if err != nil {
+				return nil, err
+			}
+		}
+		result[name] = sandbox.ComputeProfile{Resources: owner.Resources, Configuration: owner.Configuration}
+	}
+	return result, nil
+}
diff --git a/services/core/internal/deployment/errors.go b/services/core/internal/deployment/errors.go
index d3d30bb50..80e1f5b7f 100644
--- a/services/core/internal/deployment/errors.go
+++ b/services/core/internal/deployment/errors.go
@@ -32,6 +32,9 @@ var (
 	// ErrNodeAddressMismatch rejects an enrollment whose Core address is not
 	// the installation public URL. The token stays unconsumed.
 	ErrNodeAddressMismatch = errors.New("sandbox node Core address differs from the public URL")
+	// ErrNodeHostUnmeasured rejects an enrollment that leaves a limit unset
+	// and reports no host measurements to derive it from. The token stays unused.
+	ErrNodeHostUnmeasured = errors.New("sandbox node reported no host measurements")
 	// ErrNodeExists rejects an enrollment whose node ID is already in use.
 	ErrNodeExists = errors.New("sandbox node ID is already enrolled")
 	// ErrSandboxResetSessionBusy reports a hosted Session an automatic reset
@@ -74,8 +77,12 @@ type ConfigurationError struct {
 func (e *ConfigurationError) Error() string { return e.Message }
 func (e *ConfigurationError) Unwrap() error { return ErrInvalidInput }
 
-// configurationError wraps a provider's rejection of a selection.
-func configurationError(err error) *ConfigurationError {
+// configurationError wraps a provider's rejection of a selection. A missing
+// workspace storage selection keeps its own typed error.
+func configurationError(err error) error {
+	if errors.Is(err, sandbox.ErrWorkspaceRequired) {
+		return err
+	}
 	var validation *sandbox.ValidationError
 	errors.As(err, &validation)
 	return &ConfigurationError{Message: err.Error(), Validation: validation}
diff --git a/services/core/internal/deployment/execution.go b/services/core/internal/deployment/execution.go
index 40d420e45..a5740229b 100644
--- a/services/core/internal/deployment/execution.go
+++ b/services/core/internal/deployment/execution.go
@@ -5,8 +5,9 @@ import (
 	"encoding/json"
 	"errors"
 	"math"
+	"sort"
 
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
@@ -15,18 +16,18 @@ import (
 // execution lease and repeats its checks there; provider work runs between
 // transactions, never inside one.
 type ExecutionOperations struct {
-	service *Service
-	storage ExecutionStorage
-	engines engine.Catalog
+	service   *Service
+	storage   ExecutionStorage
+	harnesses harnessconfig.Registry
 }
 
 // NewExecutionOperations binds the deployment changes to the lease-bound
 // storage of one execution owner.
-func NewExecutionOperations(service *Service, storage ExecutionStorage, engines engine.Catalog) (*ExecutionOperations, error) {
+func NewExecutionOperations(service *Service, storage ExecutionStorage, harnesses harnessconfig.Registry) (*ExecutionOperations, error) {
 	if service == nil || storage == nil {
 		return nil, errors.New("deployment execution operations require the deployment service and execution storage")
 	}
-	return &ExecutionOperations{service: service, storage: storage, engines: engines}, nil
+	return &ExecutionOperations{service: service, storage: storage, harnesses: harnesses}, nil
 }
 
 // Claim reserves the installation for Web setup, once per execution owner
@@ -255,7 +256,7 @@ func (e *ExecutionOperations) saveSelection(tx DeploymentTx, d Record, input san
 	if err := registry.ValidateSpecification(input.Provider, input.DeploymentSpec); err != nil {
 		return configurationError(err)
 	}
-	if d.Generation >= math.MaxInt64 {
+	if d.Generation >= math.MaxInt64-uint64(len(input.ComputeProfiles)) {
 		return ErrConflict
 	}
 	description, err := registry.Describe(input.Provider, d.InstallationID)
@@ -274,8 +275,22 @@ func (e *ExecutionOperations) saveSelection(tx DeploymentTx, d Record, input san
 	if err != nil {
 		return err
 	}
-	return tx.SaveSelection(SelectionRecord{InstallationID: d.InstallationID, Provider: input.Provider, BackendFingerprint: description.BackendFingerprint, Mode: string(description.Mode),
-		Generation: d.Generation + 1, Specification: specification,
+	profiles := make(map[string]ComputeProfileRecord, len(input.ComputeProfiles))
+	names := make([]string, 0, len(input.ComputeProfiles))
+	for name := range input.ComputeProfiles {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	for i, name := range names {
+		p := input.ComputeProfiles[name]
+		record, err := registry.Encode(input.Provider, p.Configuration)
+		if err != nil {
+			return err
+		}
+		profiles[name] = ComputeProfileRecord{Generation: d.Generation + uint64(i) + 1, Specification: sandbox.DeploymentSpec{Resources: p.Resources, Workspace: input.Workspace}, Configuration: configurationJSON(record.Public), Metadata: configurationJSON(record.Metadata)}
+	}
+	return tx.SaveSelection(SelectionRecord{ComputeProfiles: profiles, InstallationID: d.InstallationID, Provider: input.Provider, BackendFingerprint: description.BackendFingerprint, Mode: string(description.Mode),
+		Generation: d.Generation + uint64(len(profiles)) + 1, Specification: specification,
 		Configuration: sandbox.ConfigurationRecord{Public: configurationJSON(record.Public), Metadata: configurationJSON(record.Metadata), Secret: record.Secret}})
 }
 
diff --git a/services/core/internal/deployment/fakes_test.go b/services/core/internal/deployment/fakes_test.go
index 366395ec7..646ef42e9 100644
--- a/services/core/internal/deployment/fakes_test.go
+++ b/services/core/internal/deployment/fakes_test.go
@@ -233,7 +233,6 @@ type fakeNodeTx struct {
 	deleteGenerationStatus      func(string, uint64) error
 	upsertGenerationStatus      func(GenerationStatusRecord) error
 	promoteServingGeneration    func(string, uint64) error
-	refreshServingReadiness     func(string, int) error
 }
 
 func (f *fakeNodeTx) LoadDeployment() (Record, error) {
@@ -341,13 +340,6 @@ func (f *fakeNodeTx) PromoteServingGeneration(nodeID string, generation uint64)
 	return f.promoteServingGeneration(nodeID, generation)
 }
 
-func (f *fakeNodeTx) RefreshServingReadiness(nodeID string, protocol int) error {
-	if f.refreshServingReadiness == nil {
-		unexpected(f.t, "RefreshServingReadiness")
-	}
-	return f.refreshServingReadiness(nodeID, protocol)
-}
-
 type fakeDeploymentTx struct {
 	hasIncompatibleComputeState func(string) (bool, error)
 	t                           testing.TB
diff --git a/services/core/internal/deployment/health.go b/services/core/internal/deployment/health.go
index 3b5c9492b..946fcc4ab 100644
--- a/services/core/internal/deployment/health.go
+++ b/services/core/internal/deployment/health.go
@@ -8,14 +8,8 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
-// normalizeHealth validates a node's reported health. A diagnostic explains
-// unreadiness only: unknown values, including arbitrary text, become
-// provider_unavailable, a ready provider has none and empty stays empty.
+// normalizeHealth validates a node's reported health.
 func normalizeHealth(health NodeHealth) (NodeHealth, error) {
-	health.Diagnostic = sandbox.NodeDiagnosticCode(sandbox.NormalizeNodeDiagnostic(string(health.Diagnostic)))
-	if health.ProviderReady {
-		health.Diagnostic = ""
-	}
 	for _, value := range []*int64{health.CPUCount, health.AvailableMemoryBytes, health.AvailableDiskBytes} {
 		if value != nil && *value < 0 {
 			return health, ErrInvalidInput
@@ -79,10 +73,6 @@ func nodeRollout(n NodeRecord) NodeRollout {
 	if !n.Online {
 		return out
 	}
-	if n.ProtocolVersion == 1 && n.DeploymentGeneration != n.TargetGeneration {
-		out.State = NodeRolloutUpdateRequired
-		return out
-	}
 	switch NodeRolloutState(n.TargetState) {
 	case NodeRolloutReady, NodeRolloutPreparing, NodeRolloutFailed:
 		out.State = NodeRolloutState(n.TargetState)
diff --git a/services/core/internal/deployment/node.go b/services/core/internal/deployment/node.go
index 0bd2e3b31..57c9d9439 100644
--- a/services/core/internal/deployment/node.go
+++ b/services/core/internal/deployment/node.go
@@ -27,8 +27,8 @@ type EnrollmentToken struct {
 }
 
 type Capacity struct {
-	MaxActive   int `json:"max_active"`
-	MaxRetained int `json:"max_retained"`
+	MaxActive   int `json:"max_active" binding:"required"`
+	MaxRetained int `json:"max_retained" binding:"required"`
 }
 
 type Enrollment struct {
@@ -41,21 +41,30 @@ type Enrollment struct {
 	BackendFingerprint   string `json:"backend_fingerprint"`
 	// The Core origin this node stores and connects to, such as https://core.example. It must equal the installation public URL; otherwise enrollment gets 409 sandbox_node_address_mismatch and the token stays unused.
 	CoreURL string `json:"core_url"`
+	// Host measurements as in the node's health reports. Core derives a limit the enrollment token leaves unset from them.
+	CPUCount           *int64   `json:"cpu_count,omitempty"`
+	EffectiveCPUCores  *float64 `json:"effective_cpu_cores,omitempty"`
+	TotalMemoryBytes   *int64   `json:"total_memory_bytes,omitempty"`
+	AvailableDiskBytes *int64   `json:"available_disk_bytes,omitempty"`
+}
+
+// EnrollmentLimits are the limits an enrollment token approves. A nil limit is unset.
+type EnrollmentLimits struct {
+	MaxActive, MaxRetained *int
 }
 
 type NodeHealth struct {
-	Host *NodeHost `json:"-"`
-	// Fixed reason for the last reported unreadiness; absent while the provider is ready. Clients treat an unknown value as provider_unavailable.
-	Diagnostic           sandbox.NodeDiagnosticCode `json:"diagnostic,omitempty"`
-	ProviderReady        bool                       `json:"provider_ready" binding:"required"`
-	CPUCount             *int64                     `json:"cpu_count" extensions:"x-nullable" binding:"required"`
-	AvailableMemoryBytes *int64                     `json:"available_memory_bytes" extensions:"x-nullable" binding:"required"`
-	AvailableDiskBytes   *int64                     `json:"available_disk_bytes" extensions:"x-nullable" binding:"required"`
+	Host                 *NodeHost `json:"-"`
+	CPUCount             *int64    `json:"cpu_count" extensions:"x-nullable" binding:"required"`
+	AvailableMemoryBytes *int64    `json:"available_memory_bytes" extensions:"x-nullable" binding:"required"`
+	AvailableDiskBytes   *int64    `json:"available_disk_bytes" extensions:"x-nullable" binding:"required"`
 }
 
 type Node struct {
 	Rollout NodeRollout `json:"rollout" binding:"required"`
 	NodeHealth
+	// True while the node is online and its serving generation is ready.
+	ProviderReady  bool       `json:"provider_ready" binding:"required"`
 	Running        int64      `json:"running" binding:"required"`
 	Snapshots      int64      `json:"snapshots" binding:"required"`
 	ID             string     `json:"id" binding:"required"`
@@ -70,6 +79,8 @@ type Node struct {
 	Retained       int64      `json:"retained" binding:"required"`
 	CleanupPending int64      `json:"cleanup_pending" binding:"required"`
 	CreatedAt      time.Time  `json:"created_at" binding:"required"`
+	// The limits Core recommends for the node's latest host measurements and the current specification; null before the node reports them.
+	RecommendedCapacity *Capacity `json:"recommended_capacity" extensions:"x-nullable" binding:"required"`
 	// The Core address this node enrolled with. A node whose address differs
 	// from the installation public URL receives no new sandboxes; re-add it.
 	CoreURL string `json:"core_url" binding:"required"`
@@ -92,8 +103,6 @@ type NodeStatus struct {
 }
 
 type NodeConfiguration struct {
-	MaxActive           int                    `json:"max_active"`
-	MaxRetained         int                    `json:"max_retained"`
 	InstallationID      string                 `json:"installation_id"`
 	Provider            string                 `json:"provider"`
 	CoreURL             string                 `json:"core_url"`
diff --git a/services/core/internal/deployment/nodes.go b/services/core/internal/deployment/nodes.go
index 94c281f5b..2e9ac2e46 100644
--- a/services/core/internal/deployment/nodes.go
+++ b/services/core/internal/deployment/nodes.go
@@ -22,26 +22,21 @@ func (s *Service) ListNodes(ctx context.Context) ([]Node, error) {
 	if err != nil {
 		return nil, err
 	}
+	recommend, err := s.recommendations(ctx)
+	if err != nil {
+		return nil, err
+	}
 	out := make([]Node, 0, len(records))
 	for _, n := range records {
-		value, err := s.node(n)
-		if err != nil {
-			return nil, err
-		}
-		out = append(out, value)
+		out = append(out, nodeView(n, recommend))
 	}
 	return out, nil
 }
 
-func (s *Service) node(n NodeRecord) (Node, error) {
-	retained, err := s.registry.RetainedLimit(n.Provider, n.MaxActive, n.MaxRetained)
-	if err != nil {
-		return Node{}, err
-	}
+func nodeView(n NodeRecord, recommend func(NodeHealth) *Capacity) Node {
 	health := n.Health
 	health.Host = nil
-	health.ProviderReady = n.Online && n.ServingReady
-	return Node{Rollout: nodeRollout(n), NodeHealth: health, Running: n.Running, Snapshots: n.Snapshots, ID: n.ID, Name: n.Name, CoreURL: n.CoreURL, EnrollmentID: n.EnrollmentID, Provider: n.Provider, Online: n.Online, LastSeenAt: n.LastSeenAt, MaxActive: n.MaxActive, MaxRetained: retained, Active: n.Active, Reserved: n.Reserved, Retained: n.Retained, CleanupPending: n.CleanupPending, CreatedAt: n.CreatedAt}, nil
+	return Node{Rollout: nodeRollout(n), NodeHealth: health, ProviderReady: n.Online && n.ServingReady, Running: n.Running, Snapshots: n.Snapshots, ID: n.ID, Name: n.Name, CoreURL: n.CoreURL, EnrollmentID: n.EnrollmentID, Provider: n.Provider, Online: n.Online, LastSeenAt: n.LastSeenAt, MaxActive: n.MaxActive, MaxRetained: n.MaxRetained, Active: n.Active, Reserved: n.Reserved, Retained: n.Retained, CleanupPending: n.CleanupPending, CreatedAt: n.CreatedAt, RecommendedCapacity: recommend(n.Health)}
 }
 
 // NodeDetail returns one node with its last host observation and its host
@@ -62,11 +57,11 @@ func (s *Service) NodeDetail(ctx context.Context, id, window string) (NodeDetail
 	if err != nil {
 		return NodeDetail{}, err
 	}
-	node, err := s.node(record)
+	recommend, err := s.recommendations(ctx)
 	if err != nil {
 		return NodeDetail{}, err
 	}
-	result := NodeDetail{Node: node, History: HostHistory{ResolutionSeconds: span.ResolutionSeconds, Points: historyPoints(span, samples)}}
+	result := NodeDetail{Node: nodeView(record, recommend), History: HostHistory{ResolutionSeconds: span.ResolutionSeconds, Points: historyPoints(span, samples)}}
 	if record.Health.Host != nil {
 		result.Host = *record.Health.Host
 	}
@@ -142,10 +137,13 @@ func (s *Service) RemoveNode(ctx context.Context, id string) error {
 
 // CreateEnrollment issues a one-use enrollment token. Its ID is a public,
 // non-secret handle: the node the token registers reports it as enrollment_id.
-func (s *Service) CreateEnrollment(ctx context.Context, capacity Capacity) (EnrollmentToken, error) {
+// A limit left unset is derived from the node's host when it enrolls.
+func (s *Service) CreateEnrollment(ctx context.Context, limits EnrollmentLimits) (EnrollmentToken, error) {
 	// The retained limit depends on the provider, so the transaction checks it.
-	if err := validateNode("enrollment", capacity.MaxActive, capacity.MaxActive); err != nil {
-		return EnrollmentToken{}, err
+	if limits.MaxActive != nil {
+		if err := validateNode("enrollment", *limits.MaxActive, *limits.MaxActive); err != nil {
+			return EnrollmentToken{}, err
+		}
 	}
 	var bytes [32]byte
 	if _, err := rand.Read(bytes[:]); err != nil {
@@ -153,12 +151,23 @@ func (s *Service) CreateEnrollment(ctx context.Context, capacity Capacity) (Enro
 	}
 	result := EnrollmentToken{Token: hex.EncodeToString(bytes[:]), ID: uuid.NewString()}
 	err := s.withManager(ctx, func(tx NodeTx, d Record) error {
-		retained, err := s.registry.RetainedLimit(d.Provider, capacity.MaxActive, capacity.MaxRetained)
-		if err != nil {
-			return err
-		}
-		if err := validateNode("enrollment", capacity.MaxActive, retained); err != nil {
-			return err
+		// A provider without checkpoints keeps no retained limit, so the token ignores it.
+		if limits.MaxRetained != nil {
+			checkpoint, err := s.registry.SupportsSuspension(d.Provider)
+			if err != nil {
+				return err
+			}
+			if !checkpoint {
+				limits.MaxRetained = nil
+			} else {
+				active := 1
+				if limits.MaxActive != nil {
+					active = *limits.MaxActive
+				}
+				if err := validateNode("enrollment", active, *limits.MaxRetained); err != nil {
+					return err
+				}
+			}
 		}
 		if d.Reset != nil {
 			return ErrResetInProgress
@@ -169,7 +178,8 @@ func (s *Service) CreateEnrollment(ctx context.Context, capacity Capacity) (Enro
 		if _, err := s.specification(d); err != nil {
 			return ErrConflict
 		}
-		result.ExpiresAt, err = tx.CreateEnrollment(NewEnrollment{ID: result.ID, TokenDigest: tokenDigest(result.Token), InstallationID: d.InstallationID, MaxActive: capacity.MaxActive, MaxRetained: retained})
+		var err error
+		result.ExpiresAt, err = tx.CreateEnrollment(NewEnrollment{ID: result.ID, TokenDigest: tokenDigest(result.Token), InstallationID: d.InstallationID, MaxActive: limits.MaxActive, MaxRetained: limits.MaxRetained})
 		return err
 	})
 	if err != nil {
@@ -187,6 +197,10 @@ func (s *Service) Enroll(ctx context.Context, token string, input Enrollment) (N
 	if err := validateNode(input.Name, 1, 1); err != nil {
 		return NodeIdentity{}, err
 	}
+	host, err := enrollmentHealth(input)
+	if err != nil {
+		return NodeIdentity{}, err
+	}
 	var result NodeIdentity
 	err = s.storage.WithNodes(ctx, func(tx NodeTx) error {
 		d, err := tx.LoadDeployment()
@@ -225,11 +239,11 @@ func (s *Service) Enroll(ctx context.Context, token string, input Enrollment) (N
 		if input.CoreURL != s.rules.PublicURL() {
 			return ErrNodeAddressMismatch
 		}
-		retained, err := s.registry.RetainedLimit(d.Provider, receipt.MaxActive, receipt.MaxRetained)
+		capacity, err := s.enrolledCapacity(d, spec, host, receipt)
 		if err != nil {
 			return err
 		}
-		n, err := tx.InsertNode(NewNode{ID: nodeID, InstallationID: d.InstallationID, Name: input.Name, BackendFingerprint: input.BackendFingerprint, CredentialDigest: tokenDigest(input.Credential), MaxActive: receipt.MaxActive, MaxRetained: retained, SpecificationDigest: input.SpecificationDigest, DeploymentGeneration: input.DeploymentGeneration, CoreURL: input.CoreURL, EnrollmentID: receipt.ID})
+		n, err := tx.InsertNode(NewNode{ID: nodeID, InstallationID: d.InstallationID, Name: input.Name, BackendFingerprint: input.BackendFingerprint, CredentialDigest: tokenDigest(input.Credential), MaxActive: capacity.MaxActive, MaxRetained: capacity.MaxRetained, SpecificationDigest: input.SpecificationDigest, DeploymentGeneration: input.DeploymentGeneration, CoreURL: input.CoreURL, EnrollmentID: receipt.ID})
 		if err != nil {
 			return err
 		}
@@ -240,8 +254,8 @@ func (s *Service) Enroll(ctx context.Context, token string, input Enrollment) (N
 		if !consumed {
 			return ErrNodeCredential
 		}
-		result, err = s.identity(n, d.Provider)
-		return err
+		result = identity(n, d.Provider)
+		return nil
 	})
 	if err != nil {
 		return NodeIdentity{}, err
@@ -249,12 +263,48 @@ func (s *Service) Enroll(ctx context.Context, token string, input Enrollment) (N
 	return result, nil
 }
 
-func (s *Service) identity(n StoredNode, provider string) (NodeIdentity, error) {
-	retained, err := s.registry.RetainedLimit(provider, n.MaxActive, n.MaxRetained)
+// enrolledCapacity completes the token's limits: each unset limit is the
+// recommendation for the node's host, and the retained limit is never below the
+// active one or beyond what the provider keeps.
+func (s *Service) enrolledCapacity(d Record, spec sandbox.DeploymentSpec, host NodeHealth, receipt EnrollmentRecord) (Capacity, error) {
+	capacity := Capacity{}
+	if receipt.MaxActive != nil {
+		capacity.MaxActive = *receipt.MaxActive
+	}
+	if receipt.MaxRetained != nil {
+		capacity.MaxRetained = *receipt.MaxRetained
+	}
+	checkpoint, err := s.registry.SupportsSuspension(d.Provider)
 	if err != nil {
-		return NodeIdentity{}, err
+		return Capacity{}, err
+	}
+	// Without checkpoints a retained limit is just the active one, which needs no host.
+	if receipt.MaxActive == nil || receipt.MaxRetained == nil && checkpoint {
+		recommended, ok := RecommendCapacity(host, spec.Resources, checkpoint)
+		if !ok {
+			return Capacity{}, ErrNodeHostUnmeasured
+		}
+		if receipt.MaxActive == nil {
+			// An explicit retained limit binds: active never exceeds it.
+			capacity.MaxActive = recommended.MaxActive
+			if receipt.MaxRetained != nil && checkpoint {
+				capacity.MaxActive = min(capacity.MaxActive, capacity.MaxRetained)
+			}
+		}
+		if receipt.MaxRetained == nil {
+			capacity.MaxRetained = recommended.MaxRetained
+		}
+	}
+	retained, err := s.registry.RetainedLimit(d.Provider, capacity.MaxActive, max(capacity.MaxRetained, capacity.MaxActive))
+	if err != nil {
+		return Capacity{}, err
 	}
-	return NodeIdentity{SpecificationDigest: n.SpecificationDigest, DeploymentGeneration: n.DeploymentGeneration, NodeID: n.ID, InstallationID: n.InstallationID, Provider: provider, BackendFingerprint: n.BackendFingerprint, MaxActive: n.MaxActive, MaxRetained: retained}, nil
+	capacity.MaxRetained = retained
+	return capacity, nil
+}
+
+func identity(n StoredNode, provider string) NodeIdentity {
+	return NodeIdentity{SpecificationDigest: n.SpecificationDigest, DeploymentGeneration: n.DeploymentGeneration, NodeID: n.ID, InstallationID: n.InstallationID, Provider: provider, BackendFingerprint: n.BackendFingerprint, MaxActive: n.MaxActive, MaxRetained: n.MaxRetained}
 }
 
 // AuthenticateNode checks a node credential and returns the node's identity.
@@ -288,8 +338,8 @@ func (s *Service) AuthenticateNode(ctx context.Context, nodeID, credential strin
 		// Reset retires nodes before another backend lineage can be selected.
 		// Enrollment generation and digest remain immutable identity history; the
 		// current target and per-generation readiness do not replace that history.
-		result, err = s.identity(n, d.Provider)
-		return err
+		result = identity(n, d.Provider)
+		return nil
 	})
 	if err != nil {
 		return NodeIdentity{}, err
@@ -369,13 +419,12 @@ func (s *Service) NodeConfiguration(ctx context.Context, nodeID, token string, g
 		}
 		var node *StoredNode
 		var installation string
-		var active, retained int
 		if nodeID == "" {
 			r, err := tx.LoadEnrollment(tokenDigest(token))
 			if err != nil || r.Consumed || !r.ExpiresAt.After(time.Now()) {
 				return ErrNodeCredential
 			}
-			installation, active, retained = r.InstallationID, r.MaxActive, r.MaxRetained
+			installation = r.InstallationID
 		} else {
 			id, err := parseID(nodeID)
 			if err != nil {
@@ -385,7 +434,7 @@ func (s *Service) NodeConfiguration(ctx context.Context, nodeID, token string, g
 			if err != nil || n.CredentialDigest != tokenDigest(token) {
 				return ErrNodeCredential
 			}
-			node, installation, active, retained = &n, n.InstallationID, n.MaxActive, n.MaxRetained
+			node, installation = &n, n.InstallationID
 		}
 		// A claimed installation rejects foreign credentials identically before
 		// and after initialization.
@@ -424,11 +473,7 @@ func (s *Service) NodeConfiguration(ctx context.Context, nodeID, token string, g
 		if err != nil {
 			return err
 		}
-		limit, err := s.registry.RetainedLimit(d.Provider, active, retained)
-		if err != nil {
-			return err
-		}
-		result = NodeConfiguration{MaxActive: active, MaxRetained: limit, InstallationID: d.InstallationID, Provider: d.Provider, CoreURL: s.rules.PublicURL(), Generation: selected, Specification: spec, SpecificationDigest: spec.Digest(d.Provider)}
+		result = NodeConfiguration{InstallationID: d.InstallationID, Provider: d.Provider, CoreURL: s.rules.PublicURL(), Generation: selected, Specification: spec, SpecificationDigest: spec.Digest(d.Provider)}
 		return nil
 	})
 	if err != nil {
@@ -515,22 +560,12 @@ func (s *Service) NodeRetention(ctx context.Context, nodeID, connectionID string
 	return deployment, grants, nil
 }
 
-// Heartbeat records a protocol 1 node's health, which reports readiness of its
-// enrollment generation only.
+// Heartbeat records a node's health and the preparation state of the
+// generations it reports.
 func (s *Service) Heartbeat(ctx context.Context, nodeID, connectionID string, epoch uint64, health NodeHealth, statuses []sandbox.GenerationStatus) error {
-	return s.heartbeat(ctx, nodeID, connectionID, epoch, health, statuses, 1)
-}
-
-// HeartbeatGenerations records a node's health and the preparation state of
-// the generations it reports.
-func (s *Service) HeartbeatGenerations(ctx context.Context, nodeID, connectionID string, epoch uint64, health NodeHealth, statuses []sandbox.GenerationStatus) error {
 	if len(statuses) > maxReportedGenerations {
 		return ErrInvalidInput
 	}
-	return s.heartbeat(ctx, nodeID, connectionID, epoch, health, statuses, 2)
-}
-
-func (s *Service) heartbeat(ctx context.Context, nodeID, connectionID string, epoch uint64, health NodeHealth, statuses []sandbox.GenerationStatus, protocol int) error {
 	id, err := parseID(nodeID)
 	if err != nil {
 		return err
@@ -559,23 +594,11 @@ func (s *Service) heartbeat(ctx context.Context, nodeID, connectionID string, ep
 		if !current {
 			return ErrNodeCredential
 		}
-		if protocol == 1 && len(statuses) > 0 {
-			if len(statuses) != 1 || statuses[0].Generation != n.DeploymentGeneration || statuses[0].SpecificationDigest != n.SpecificationDigest || (statuses[0].State == "ready") != health.ProviderReady {
-				return ErrInvalidInput
-			}
-		}
-		if protocol == 1 && len(statuses) == 0 {
-			state := "failed"
-			if health.ProviderReady {
-				state = "ready"
-			}
-			statuses = []sandbox.GenerationStatus{{Generation: n.DeploymentGeneration, SpecificationDigest: n.SpecificationDigest, State: state, Diagnostic: string(health.Diagnostic)}}
-		}
-		return s.recordGenerations(tx, d, n, statuses, protocol)
+		return s.recordGenerations(tx, d, n, statuses)
 	})
 }
 
-func (s *Service) recordGenerations(tx NodeTx, d Record, n StoredNode, statuses []sandbox.GenerationStatus, protocol int) error {
+func (s *Service) recordGenerations(tx NodeTx, d Record, n StoredNode, statuses []sandbox.GenerationStatus) error {
 	adapter, err := s.registry.Lookup(d.Provider)
 	if err != nil {
 		return err
@@ -615,7 +638,7 @@ func (s *Service) recordGenerations(tx NodeTx, d Record, n StoredNode, statuses
 			}
 		}
 	}
-	return tx.RefreshServingReadiness(n.ID, protocol)
+	return nil
 }
 
 // ConnectNode records a node connection for the owner epoch.
diff --git a/services/core/internal/deployment/placement/placement.go b/services/core/internal/deployment/placement/placement.go
index 151deea6a..4352099f4 100644
--- a/services/core/internal/deployment/placement/placement.go
+++ b/services/core/internal/deployment/placement/placement.go
@@ -16,6 +16,7 @@ import (
 )
 
 var (
+	ErrComputeProfileUnavailable = errors.New("requested compute profile is unavailable")
 	// ErrResetAdmission rejects new hosted work while a sandbox reset pauses
 	// admission.
 	ErrResetAdmission = errors.New("hosted admission is paused for a sandbox reset")
@@ -70,7 +71,13 @@ func (r *Rules) PublicURL() string { return r.publicURL }
 
 // Deployment is the deployment as placement reads it, loaded under the
 // deployment lock.
+type ComputeProfile struct {
+	Generation    uint64                 `json:"generation"`
+	Specification sandbox.DeploymentSpec `json:"specification"`
+}
+
 type Deployment struct {
+	ComputeProfiles map[string]ComputeProfile
 	// InstallationID is empty until the execution owner claims the
 	// installation at startup.
 	InstallationID string
diff --git a/services/core/internal/deployment/replacement.go b/services/core/internal/deployment/replacement.go
index d97ec2cf9..7e731f6f8 100644
--- a/services/core/internal/deployment/replacement.go
+++ b/services/core/internal/deployment/replacement.go
@@ -10,7 +10,7 @@ import (
 )
 
 // EnsurePlacement reserves first or retained demand before entering a node lifecycle.
-// The immutable engine profile and actual selected generation are validated
+// The Harness declaration and actual selected generation are validated
 // before committing its reservation.
 func (e *ExecutionOperations) EnsurePlacement(ctx context.Context, key AllocationKey, installation string) (placement.Reserved, error) {
 	key, err := key.parse()
@@ -102,7 +102,7 @@ func (e *ExecutionOperations) EnsurePlacement(ctx context.Context, key Allocatio
 // allocation admission and capacity-pressure decisions. Retained files require
 // another external-storage generation; new Sessions may select either kind.
 func (e *ExecutionOperations) eligibleNodes(d placement.Deployment, nodes []placement.Node, engineKind string, retained bool, loadGeneration func(uint64) (GenerationSpecification, error)) ([]placement.Node, error) {
-	profile, known := e.engines.Lookup(engineKind)
+	declaration, known := e.harnesses.Lookup(engineKind)
 	if !known {
 		return nil, sessions.ErrInvalidInput
 	}
@@ -129,7 +129,7 @@ func (e *ExecutionOperations) eligibleNodes(d placement.Deployment, nodes []plac
 			if err := json.Unmarshal(specification, &spec); err != nil {
 				return nil, err
 			}
-			accepts = (!retained || spec.Workspace != nil) && sessions.ValidateRetainedHistory(spec.Workspace != nil, profile.RetainedNativeHistory.IsSupported()) == nil
+			accepts = (!retained || spec.Workspace != nil) && sessions.ValidateRetainedHistory(spec.Workspace != nil, declaration.Capabilities.RetainedNativeHistory.IsSupported()) == nil
 			compatible[generation] = accepts
 		}
 		if accepts {
diff --git a/services/core/internal/deployment/rules_test.go b/services/core/internal/deployment/rules_test.go
index cddba64ee..2b5d07cd4 100644
--- a/services/core/internal/deployment/rules_test.go
+++ b/services/core/internal/deployment/rules_test.go
@@ -123,13 +123,16 @@ func TestTypedErrors(t *testing.T) {
 		t.Fatal("ResetRequiredError is not a conflict")
 	}
 	validation := &sandbox.ValidationError{Param: "resources.cpus", Message: "too many"}
-	err := configurationError(validation)
+	err := configurationError(validation).(*ConfigurationError)
 	if !errors.Is(err, ErrInvalidInput) || err.Validation != validation || err.Message != "too many" {
 		t.Fatalf("configurationError = %#v", err)
 	}
-	if plain := configurationError(errors.New("rejected")); plain.Validation != nil || plain.Error() != "rejected" {
+	if plain := configurationError(errors.New("rejected")).(*ConfigurationError); plain.Validation != nil || plain.Error() != "rejected" {
 		t.Fatalf("configurationError of a plain error = %#v", plain)
 	}
+	if err := configurationError(sandbox.ErrWorkspaceRequired); !errors.Is(err, sandbox.ErrWorkspaceRequired) {
+		t.Fatal("missing storage lost its typed error", err)
+	}
 	if got := string(configurationJSON(nil)); got != "{}" {
 		t.Fatalf("configurationJSON(nil) = %s", got)
 	}
@@ -142,23 +145,20 @@ func TestNormalizeHealth(t *testing.T) {
 	negative, zero, one := int64(-1), float64(0), float64(1)
 	now := time.Now()
 	for _, c := range []struct {
-		name       string
-		in         NodeHealth
-		diagnostic sandbox.NodeDiagnosticCode
-		invalid    bool
+		name    string
+		in      NodeHealth
+		invalid bool
 	}{
-		{"ready clears the diagnostic", NodeHealth{ProviderReady: true, Diagnostic: sandbox.NodeProviderUnavailable}, "", false},
-		{"unknown text becomes provider_unavailable", NodeHealth{Diagnostic: "disk on fire"}, sandbox.NodeProviderUnavailable, false},
-		{"empty stays empty", NodeHealth{}, "", false},
-		{"negative CPU count", NodeHealth{CPUCount: &negative}, "", true},
-		{"negative memory", NodeHealth{AvailableMemoryBytes: &negative}, "", true},
-		{"negative disk", NodeHealth{AvailableDiskBytes: &negative}, "", true},
-		{"host without observation", NodeHealth{Host: &NodeHost{CPUUtilization: &one}}, "", true},
-		{"valid host", NodeHealth{Host: &NodeHost{ObservedAt: &now, CPUUtilization: &one, EffectiveCPUCores: &one}}, "", false},
-		{"zero effective cores", NodeHealth{Host: &NodeHost{ObservedAt: &now, EffectiveCPUCores: &zero}}, "", true},
+		{"empty health", NodeHealth{}, false},
+		{"negative CPU count", NodeHealth{CPUCount: &negative}, true},
+		{"negative memory", NodeHealth{AvailableMemoryBytes: &negative}, true},
+		{"negative disk", NodeHealth{AvailableDiskBytes: &negative}, true},
+		{"host without observation", NodeHealth{Host: &NodeHost{CPUUtilization: &one}}, true},
+		{"valid host", NodeHealth{Host: &NodeHost{ObservedAt: &now, CPUUtilization: &one, EffectiveCPUCores: &one}}, false},
+		{"zero effective cores", NodeHealth{Host: &NodeHost{ObservedAt: &now, EffectiveCPUCores: &zero}}, true},
 	} {
 		got, err := normalizeHealth(c.in)
-		if c.invalid != errors.Is(err, ErrInvalidInput) || (!c.invalid && (err != nil || got.Diagnostic != c.diagnostic)) {
+		if c.invalid != errors.Is(err, ErrInvalidInput) || (!c.invalid && err != nil) {
 			t.Errorf("%s: normalizeHealth = %+v, %v", c.name, got, err)
 		}
 	}
@@ -230,15 +230,11 @@ func TestNodeRollout(t *testing.T) {
 		diagnostic sandbox.NodeDiagnosticCode
 	}{
 		{"offline", NodeRecord{TargetState: "ready", ReadyGeneration: &ready}, "unknown", ""},
-		{"protocol 1 on another generation", NodeRecord{Online: true, ProtocolVersion: 1, DeploymentGeneration: 1, TargetGeneration: 2, TargetState: "ready", ReadyGeneration: &ready}, "update_required", ""},
-		{"protocol 1 on the target", NodeRecord{Online: true, ProtocolVersion: 1, DeploymentGeneration: 2, TargetGeneration: 2, TargetState: "ready", ReadyGeneration: &ready}, "ready", ""},
-		{"preparing", NodeRecord{Online: true, ProtocolVersion: 2, TargetState: "preparing", ReadyGeneration: &ready}, "preparing", ""},
-		{"failed with an unknown diagnostic", NodeRecord{Online: true, ProtocolVersion: 2, TargetState: "failed", TargetDiagnostic: "boom", ReadyGeneration: &ready}, "failed", sandbox.NodeProviderUnavailable},
-		{"failed without diagnostic", NodeRecord{Online: true, ProtocolVersion: 2, TargetState: "failed", ReadyGeneration: &ready}, "failed", ""},
-		{"ready ignores a diagnostic", NodeRecord{Online: true, ProtocolVersion: 2, TargetState: "ready", TargetDiagnostic: "boom", ReadyGeneration: &ready}, "ready", ""},
-		{"unknown target state", NodeRecord{Online: true, ProtocolVersion: 2, TargetState: "other", ReadyGeneration: &ready}, "unknown", ""},
-		{"protocol 1 failed on the target", NodeRecord{Online: true, ProtocolVersion: 1, DeploymentGeneration: 2, TargetGeneration: 2, TargetState: "failed", TargetDiagnostic: "host_unsupported", ReadyGeneration: &ready}, "failed", "host_unsupported"},
-		{"protocol 1 without a target state", NodeRecord{Online: true, ProtocolVersion: 1, DeploymentGeneration: 2, TargetGeneration: 2, ReadyGeneration: &ready}, "unknown", ""},
+		{"preparing", NodeRecord{Online: true, TargetState: "preparing", ReadyGeneration: &ready}, "preparing", ""},
+		{"failed with an unknown diagnostic", NodeRecord{Online: true, TargetState: "failed", TargetDiagnostic: "boom", ReadyGeneration: &ready}, "failed", sandbox.NodeProviderUnavailable},
+		{"failed without diagnostic", NodeRecord{Online: true, TargetState: "failed", ReadyGeneration: &ready}, "failed", ""},
+		{"ready ignores a diagnostic", NodeRecord{Online: true, TargetState: "ready", TargetDiagnostic: "boom", ReadyGeneration: &ready}, "ready", ""},
+		{"unknown target state", NodeRecord{Online: true, TargetState: "other", ReadyGeneration: &ready}, "unknown", ""},
 	} {
 		got := nodeRollout(c.n)
 		if got.State != c.state || got.Diagnostic != c.diagnostic || got.ReadyGeneration != &ready {
diff --git a/services/core/internal/deployment/service.go b/services/core/internal/deployment/service.go
index 1d51b0f0b..dee193195 100644
--- a/services/core/internal/deployment/service.go
+++ b/services/core/internal/deployment/service.go
@@ -53,6 +53,11 @@ func (s *Service) view(snapshot Snapshot) (View, error) {
 			result.SpecificationDigest = spec.Digest(d.Provider)
 		}
 	}
+	if len(d.ComputeProfiles) > 0 {
+		if err := json.Unmarshal(d.ComputeProfiles, &result.ComputeProfiles); err != nil {
+			return View{}, ErrConflict
+		}
+	}
 	if d.Provider != "" {
 		value, err := s.registry.Decode(d.Provider, sandbox.ConfigurationRecord{Public: d.Configuration.Public, Metadata: d.Configuration.Metadata})
 		if err != nil {
@@ -108,6 +113,10 @@ func (s *Service) setup(d Record) (Setup, error) {
 	if err != nil {
 		return Setup{}, ErrConflict
 	}
+	result.ComputeProfiles, err = s.profiles(d, result.selection())
+	if err != nil {
+		return Setup{}, err
+	}
 	result, err = s.describe(result)
 	if result.Suspension != nil {
 		result.Suspension.IdleSeconds = d.IdleSeconds
@@ -250,7 +259,7 @@ func (s *Service) SetupForSelection(installationID string, input sandbox.Selecti
 	if err := s.rules.CheckPublicOrigin(input.Provider); err != nil {
 		return Setup{}, err
 	}
-	result := Setup{InstallationID: installationID, Provider: input.Provider, Mode: string(description.Mode), Specification: normalized.DeploymentSpec, Configuration: normalized.Configuration, BackendFingerprint: description.BackendFingerprint}
+	result := Setup{ComputeProfiles: normalized.ComputeProfiles, InstallationID: installationID, Provider: input.Provider, Mode: string(description.Mode), Specification: normalized.DeploymentSpec, Configuration: normalized.Configuration, BackendFingerprint: description.BackendFingerprint}
 	return s.describe(result)
 }
 
@@ -289,6 +298,19 @@ func (s *Service) selectionEqual(d Record, input sandbox.Selection) (bool, error
 	if previous.Specification.Digest(d.Provider) != normalized.DeploymentSpec.Digest(input.Provider) {
 		return false, nil
 	}
+	if len(previous.ComputeProfiles) != len(normalized.ComputeProfiles) {
+		return false, nil
+	}
+	for name, profile := range normalized.ComputeProfiles {
+		old, ok := previous.ComputeProfiles[name]
+		if !ok || old.Resources != profile.Resources {
+			return false, nil
+		}
+		equal, err := s.registry.Equal(input.Provider, old.Configuration, profile.Configuration)
+		if err != nil || !equal {
+			return equal, err
+		}
+	}
 	return s.registry.Equal(input.Provider, previous.Configuration, normalized.Configuration)
 }
 
diff --git a/services/core/internal/deployment/service_test.go b/services/core/internal/deployment/service_test.go
index ae703bb6a..51a2aca48 100644
--- a/services/core/internal/deployment/service_test.go
+++ b/services/core/internal/deployment/service_test.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"strings"
 	"testing"
 	"time"
@@ -16,6 +16,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/e2b"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/providers"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/workspacefs"
 )
 
 const testPublicURL = "https://core.example"
@@ -47,7 +48,7 @@ func operations(t *testing.T, publicURL string, tx *fakeDeploymentTx) *Execution
 	if tx != nil {
 		storage.withDeployment = func(_ context.Context, apply func(DeploymentTx) error) error { return apply(tx) }
 	}
-	result, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, publicURL), storage, engine.Catalog{})
+	result, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, publicURL), storage, builtin.Registry())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -57,10 +58,9 @@ func operations(t *testing.T, publicURL string, tx *fakeDeploymentTx) *Execution
 // testSpecification is a valid deployment specification for provider.
 func testSpecification(provider string) sandbox.DeploymentSpec {
 	s := sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048}}
-	s.Runtime = &sandbox.RuntimeRelease{SourceCommit: strings.Repeat("a", 40), ImageID: "sha256:" + strings.Repeat("b", 64), ImageManifestDigest: "sha256:" + strings.Repeat("c", 64), MicrosandboxRef: "oac-runtime@sha256:" + strings.Repeat("d", 64), RuntimeSHA256: strings.Repeat("e", 64), FirmwareSHA256: strings.Repeat("f", 64)}
 	if provider == "microsandbox" {
 		s.Resources.RootDiskMiB = 8192
-		s.Resources.EnvironmentDiskMiB = 8192
+		s.Workspace = &workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}
 	}
 	return s
 }
@@ -90,10 +90,10 @@ func TestNewServiceAndOperationsRejectNilDependencies(t *testing.T) {
 		}
 	}
 	service := newService(t, storage, reader, testPublicURL)
-	if result, err := NewExecutionOperations(nil, &fakeExecutionStorage{t: t}, engine.Catalog{}); result != nil || err == nil {
+	if result, err := NewExecutionOperations(nil, &fakeExecutionStorage{t: t}, builtin.Registry()); result != nil || err == nil {
 		t.Errorf("NewExecutionOperations without the service = %v, %v", result, err)
 	}
-	if result, err := NewExecutionOperations(service, nil, engine.Catalog{}); result != nil || err == nil {
+	if result, err := NewExecutionOperations(service, nil, builtin.Registry()); result != nil || err == nil {
 		t.Errorf("NewExecutionOperations without storage = %v, %v", result, err)
 	}
 }
@@ -151,22 +151,14 @@ func TestSandboxValidationWrapperPreservesClassification(t *testing.T) {
 	if errors.Is(err, sandbox.ErrInvalid) {
 		t.Fatal("wrapper changed sentinel identity")
 	}
-	_, err = service.SetupForSelection(installation, sandbox.Selection{Provider: "e2b", DeploymentSpec: sandbox.DeploymentSpec{Runtime: &sandbox.RuntimeRelease{}}})
-	if !errors.As(err, &configuration) || configuration.Validation == nil || configuration.Validation.Param != "runtime" || err.Error() != "invalid sandbox configuration: E2B Runtime is selected by its immutable template build" {
-		t.Fatal("pending E2B validation order changed", err)
-	}
 }
 
-// A stored provider the registry no longer holds fails every read and change
-// that consults it.
+// A stored provider the registry no longer holds fails every read that consults it.
 func TestRegistryLookupFailuresPropagate(t *testing.T) {
 	stored := webDeployment(t, uuid.NewString(), "retired", 1)
 	reader := &fakeReader{t: t,
 		snapshot:   func(context.Context) (Snapshot, error) { return Snapshot{Record: stored}, nil },
 		deployment: func(context.Context) (Record, error) { return stored, nil },
-		nodes: func(context.Context) ([]NodeRecord, error) {
-			return []NodeRecord{{ID: uuid.NewString(), Provider: "retired", MaxActive: 1, MaxRetained: 1}}, nil
-		},
 	}
 	service := newService(t, &fakeStorage{t: t}, reader, testPublicURL)
 	// View decodes the stored configuration first, and reports that failure as a conflict.
@@ -176,9 +168,6 @@ func TestRegistryLookupFailuresPropagate(t *testing.T) {
 	if _, err := service.Setup(t.Context()); !errors.Is(err, providers.ErrUnknownProvider) {
 		t.Errorf("Setup = %v", err)
 	}
-	if _, err := service.ListNodes(t.Context()); !errors.Is(err, providers.ErrUnknownProvider) {
-		t.Errorf("ListNodes = %v", err)
-	}
 }
 
 // Setup carries the mode and operations the provider declares. A stored
@@ -198,17 +187,6 @@ func TestSetupReportsDeclarationsAndStoredConfigurationConflicts(t *testing.T) {
 	}
 }
 
-// Docker never suspends, so its nodes retain at most their active capacity.
-func TestListNodesAppliesTheRetainedLimit(t *testing.T) {
-	reader := &fakeReader{t: t, nodes: func(context.Context) ([]NodeRecord, error) {
-		return []NodeRecord{{Provider: "docker", MaxActive: 2, MaxRetained: 5}, {Provider: "microsandbox", MaxActive: 2, MaxRetained: 5}}, nil
-	}}
-	nodes, err := newService(t, &fakeStorage{t: t}, reader, testPublicURL).ListNodes(t.Context())
-	if err != nil || len(nodes) != 2 || nodes[0].MaxRetained != 2 || nodes[1].MaxRetained != 5 {
-		t.Fatalf("ListNodes = %+v, %v", nodes, err)
-	}
-}
-
 func TestSetupChangeDecisions(t *testing.T) {
 	installation := uuid.NewString()
 	stored := webDeployment(t, installation, "docker", 2)
@@ -269,7 +247,7 @@ func TestEnrollChecksTheTokenBeforeTheDeployment(t *testing.T) {
 	current := webDeployment(t, installation, "docker", 1)
 	valid := Enrollment{NodeID: uuid.NewString(), Name: "node", Credential: strings.Repeat("n", 64), Provider: "docker", BackendFingerprint: strings.Repeat("b", 64),
 		DeploymentGeneration: 1, SpecificationDigest: testSpecification("docker").Digest("docker"), CoreURL: testPublicURL}
-	receipt := EnrollmentRecord{ID: uuid.NewString(), InstallationID: installation, ExpiresAt: time.Now().Add(10 * time.Minute), MaxActive: 1, MaxRetained: 1}
+	receipt := EnrollmentRecord{ID: uuid.NewString(), InstallationID: installation, ExpiresAt: time.Now().Add(10 * time.Minute), MaxActive: new(1), MaxRetained: new(1)}
 	resetting := current
 	resetting.Reset = &ResetState{Clear: "sandboxes", RequestedAt: time.Now()}
 	unselected := current
diff --git a/services/core/internal/deployment/session_archive_test.go b/services/core/internal/deployment/session_archive_test.go
index 781905129..981a5acf6 100644
--- a/services/core/internal/deployment/session_archive_test.go
+++ b/services/core/internal/deployment/session_archive_test.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"slices"
 	"strings"
 	"testing"
@@ -217,7 +217,7 @@ func archiveOperations(t *testing.T, tx *fakeArchiveTx, locked sessions.LockedSe
 		}
 		return apply(ctx, locked, tx)
 	}}
-	operations, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, engine.Catalog{})
+	operations, err := NewExecutionOperations(newService(t, &fakeStorage{t: t}, &fakeReader{t: t}, testPublicURL), storage, builtin.Registry())
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/internal/deployment/setup.go b/services/core/internal/deployment/setup.go
index dae24b6c7..a2797976c 100644
--- a/services/core/internal/deployment/setup.go
+++ b/services/core/internal/deployment/setup.go
@@ -11,6 +11,7 @@ import (
 // generation of it. An empty Provider means that Web setup has not yet selected
 // an adapter.
 type Setup struct {
+	ComputeProfiles                              map[string]sandbox.ComputeProfile
 	Specification                                sandbox.DeploymentSpec
 	InstallationID, Provider, BackendFingerprint string
 	Generation                                   uint64
@@ -31,7 +32,7 @@ type Setup struct {
 
 // selection is the provider selection a Setup describes.
 func (s Setup) selection() sandbox.Selection {
-	return sandbox.Selection{Provider: s.Provider, DeploymentSpec: s.Specification, Configuration: s.Configuration}
+	return sandbox.Selection{ComputeProfiles: s.ComputeProfiles, Provider: s.Provider, DeploymentSpec: s.Specification, Configuration: s.Configuration}
 }
 
 // configurationJSON reports an absent configuration object as {}.
diff --git a/services/core/internal/deployment/storage.go b/services/core/internal/deployment/storage.go
index 4f17f3afd..95da9e266 100644
--- a/services/core/internal/deployment/storage.go
+++ b/services/core/internal/deployment/storage.go
@@ -127,6 +127,11 @@ type AllocationTx interface {
 	LoadActivity(current Allocation) (Activity, error)
 	// LoadSuspensionDemand locks the deployment and reads demand and capacity.
 	LoadSuspensionDemand(current Allocation) (SuspensionDemand, error)
+	// OldestIdleCheckpoint reports whether current has the earliest retention
+	// deadline among its node's idle suspended allocations that can be retained.
+	OldestIdleCheckpoint(current Allocation) (bool, error)
+	// ExpireCheckpoint ends the retention of a suspended or restoring allocation now.
+	ExpireCheckpoint(current Allocation) (Allocation, error)
 	// PlacementDemand reads one qualified page; next advances past all inspected
 	// rows, including ineligible receipts. An empty next.EnvironmentID ends the scan.
 	PlacementDemand(after PlacementDemandCursor) ([]PlacementDemand, PlacementDemandCursor, error)
@@ -325,7 +330,6 @@ type NodeTx interface {
 	DeleteGenerationStatus(nodeID string, generation uint64) error
 	UpsertGenerationStatus(status GenerationStatusRecord) error
 	PromoteServingGeneration(nodeID string, generation uint64) error
-	RefreshServingReadiness(nodeID string, protocol int) error
 }
 
 // DeploymentTx is one leased deployment change.
@@ -372,7 +376,8 @@ type DeploymentTx interface {
 
 // Record is the stored deployment.
 type Record struct {
-	IdleSeconds int64
+	ComputeProfiles json.RawMessage
+	IdleSeconds     int64
 	// InstallationID is empty until Web setup claims an installation.
 	InstallationID     string
 	Provider           string
@@ -411,6 +416,7 @@ type Snapshot struct {
 
 // SelectionRecord is one generation of the selection to store.
 type SelectionRecord struct {
+	ComputeProfiles                                    map[string]ComputeProfileRecord
 	InstallationID, Provider, BackendFingerprint, Mode string
 	Generation                                         uint64
 	Specification                                      json.RawMessage
@@ -466,9 +472,6 @@ type NodeRecord struct {
 	LastSeenAt                  *time.Time
 	Health                      NodeHealth
 	Online, ServingReady        bool
-	ProtocolVersion             int
-	DeploymentGeneration        uint64
-	TargetGeneration            uint64
 	ReadyGeneration             *uint64
 	TargetState                 string
 	TargetDiagnostic            string
@@ -501,13 +504,14 @@ type EnrollmentRecord struct {
 	ID, InstallationID     string
 	ExpiresAt              time.Time
 	Consumed               bool
-	MaxActive, MaxRetained int
+	MaxActive, MaxRetained *int
 }
 
 // NewEnrollment is an enrollment token to store, by digest.
 type NewEnrollment struct {
 	ID, TokenDigest, InstallationID string
-	MaxActive, MaxRetained          int
+	// A nil limit is unset: Core derives it from the host when the node enrolls.
+	MaxActive, MaxRetained *int
 }
 
 // Heartbeat is a node's health for one connection.
diff --git a/services/core/internal/deployment/suspension_pressure.go b/services/core/internal/deployment/suspension_pressure.go
index d8ae4c173..7e5920e7c 100644
--- a/services/core/internal/deployment/suspension_pressure.go
+++ b/services/core/internal/deployment/suspension_pressure.go
@@ -1,19 +1,26 @@
 package deployment
 
 import (
+	"context"
 	"errors"
 	"slices"
+	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment/placement"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
+// freeSlotIdle is how long an allocation on a full node stays idle before
+// Core may suspend it without waiting demand.
+const freeSlotIdle = 2 * time.Minute
+
 // SuspensionDemand is a transaction-bound capacity observation. It is not a
 // reservation: only a confirmed suspension frees an active slot.
 type SuspensionDemand struct {
 	Deployment         placement.Deployment
 	Nodes              []placement.Node
 	InFlightNodes      []string
+	StartingNodes      []string
 	CheckpointRestores []CheckpointRestoreDemand
 }
 
@@ -24,22 +31,36 @@ type CheckpointRestoreDemand struct {
 	Nodes         []placement.CheckpointNode
 }
 
-func (e *ExecutionOperations) canSuspendForDemand(tx AllocationTx, owner Allocation) (bool, error) {
-	pressure, err := tx.LoadSuspensionDemand(owner)
-	if err != nil {
-		return false, err
-	}
+// fullNode returns the owner's node when it is online and has no free active
+// slot, in a nodes deployment that is not resetting and belongs to the owner's
+// installation.
+func fullNode(pressure SuspensionDemand, owner Allocation) *placement.Node {
 	if pressure.Deployment.Resetting || pressure.Deployment.Mode != string(sandbox.DeploymentNodes) || pressure.Deployment.InstallationID != owner.ProviderKey {
-		return false, nil
+		return nil
 	}
-	var source *placement.Node
 	for i := range pressure.Nodes {
-		if pressure.Nodes[i].ID == owner.NodeID {
-			source = &pressure.Nodes[i]
-			break
+		if n := &pressure.Nodes[i]; n.ID == owner.NodeID && n.Online && n.Active >= int64(n.MaxActive) {
+			return n
 		}
 	}
-	if source == nil || !source.Online || source.Active < int64(source.MaxActive) {
+	return nil
+}
+
+// canKeepFreeSlot allows suspending an allocation that stayed idle for
+// freeSlotIdle on a full node with no reclamation in flight. The node must
+// also have a free retained slot, or the freed active slot admits no Session,
+// and no Session still starting on it: the node runs one operation at a time,
+// so that Session's create and preparation would wait for this suspension.
+func canKeepFreeSlot(pressure SuspensionDemand, owner Allocation) bool {
+	n := fullNode(pressure, owner)
+	return n != nil && n.Retained < int64(n.MaxRetained) && !slices.Contains(pressure.InFlightNodes, owner.NodeID) && !slices.Contains(pressure.StartingNodes, owner.NodeID)
+}
+
+// canSuspendForDemand reports whether compatible waiting demand would place on
+// the owner's full node once the owner is suspended.
+func (e *ExecutionOperations) canSuspendForDemand(tx AllocationTx, pressure SuspensionDemand, owner Allocation) (bool, error) {
+	source := fullNode(pressure, owner)
+	if source == nil {
 		return false, nil
 	}
 	for _, demand := range pressure.CheckpointRestores {
@@ -73,16 +94,94 @@ func (e *ExecutionOperations) canSuspendForDemand(tx AllocationTx, owner Allocat
 			return false, err
 		}
 	}
+	release := func(n *placement.Node) { n.Active-- }
 	if source.Retained >= int64(source.MaxRetained) {
-		return false, nil
+		// A full node frees a retained slot only by releasing a checkpoint
+		// after this suspension, so the owner must itself be releasable.
+		if retain, err := tx.CanRetainEnvironment(owner); err != nil || !retain {
+			return false, err
+		}
+		release = func(n *placement.Node) { n.Active--; n.Retained-- }
 	}
-	return e.placementNeedsCapacity(tx, pressure, owner.NodeID)
+	return e.placementNeedsCapacity(tx, pressure, owner.NodeID, release)
+}
+
+// ExpireCheckpointForDemand ends the retention of an idle suspended
+// allocation, exactly as if its deadline had passed, when compatible waiting
+// demand is blocked only by the node's retained slots. It acts only on the
+// node's oldest allocation whose Session can continue on new compute, so the
+// ordinary expiry cleanup keeps files and native history. A refusal is
+// ErrNotIdle.
+func (e *ExecutionOperations) ExpireCheckpointForDemand(ctx context.Context, owner Allocation) error {
+	_, err := e.change(ctx, owner, true, func(tx AllocationTx, current Allocation) (Allocation, error) {
+		if current.State != "running" || current.ComputePhase != "suspended" || current.Expired || current.ComputeRevision != owner.ComputeRevision || current.NodeID == "" {
+			return Allocation{}, ErrAllocationConflict
+		}
+		activity, err := tx.LoadActivity(current)
+		if err != nil {
+			return Allocation{}, err
+		}
+		if activity.Busy || activity.WakeRequested {
+			return Allocation{}, ErrNotIdle
+		}
+		retain, err := tx.CanRetainEnvironment(current)
+		if err != nil {
+			return Allocation{}, err
+		}
+		if !retain {
+			return Allocation{}, ErrNotIdle
+		}
+		oldest, err := tx.OldestIdleCheckpoint(current)
+		if err != nil {
+			return Allocation{}, err
+		}
+		if !oldest {
+			return Allocation{}, ErrNotIdle
+		}
+		pressure, err := tx.LoadSuspensionDemand(current)
+		if err != nil {
+			return Allocation{}, err
+		}
+		var source *placement.Node
+		for i := range pressure.Nodes {
+			if pressure.Nodes[i].ID == current.NodeID {
+				source = &pressure.Nodes[i]
+			}
+		}
+		if pressure.Deployment.Resetting || pressure.Deployment.Mode != string(sandbox.DeploymentNodes) || pressure.Deployment.InstallationID != current.ProviderKey || source == nil || !source.Online || source.Retained < int64(source.MaxRetained) {
+			return Allocation{}, ErrNotIdle
+		}
+		needed, err := e.placementNeedsCapacity(tx, pressure, current.NodeID, func(n *placement.Node) { n.Retained-- })
+		if err != nil {
+			return Allocation{}, err
+		}
+		if !needed {
+			return Allocation{}, ErrNotIdle
+		}
+		return tx.ExpireCheckpoint(current)
+	})
+	return err
+}
+
+// ExpireUnusableCheckpoint ends the retention of a restoring allocation whose
+// Provider reported its checkpoint unusable, exactly as if its deadline had
+// passed. The snapshot is never restored again; ordinary expiry cleanup deletes
+// it and any qualified Session continues on new compute.
+func (e *ExecutionOperations) ExpireUnusableCheckpoint(ctx context.Context, owner Allocation) error {
+	_, err := e.change(ctx, owner, false, func(tx AllocationTx, current Allocation) (Allocation, error) {
+		if current.State != "running" || current.ComputePhase != "restoring" || current.Expired || current.ComputeRevision != owner.ComputeRevision {
+			return Allocation{}, ErrAllocationConflict
+		}
+		return tx.ExpireCheckpoint(current)
+	})
+	return err
 }
 
 // placementNeedsCapacity scans bounded pages under the caller's deployment
-// lock and transaction deadline. Suspension must make active capacity usable
-// without releasing a retained slot; an ineligible receipt supplies no pressure.
-func (e *ExecutionOperations) placementNeedsCapacity(tx AllocationTx, pressure SuspensionDemand, nodeID string) (bool, error) {
+// lock and transaction deadline. It reports whether waiting demand would place
+// on nodeID once release frees the slot the caller may reclaim; an ineligible
+// receipt supplies no pressure.
+func (e *ExecutionOperations) placementNeedsCapacity(tx AllocationTx, pressure SuspensionDemand, nodeID string, release func(*placement.Node)) (bool, error) {
 	var after PlacementDemandCursor
 	for {
 		demands, next, err := tx.PlacementDemand(after)
@@ -109,7 +208,7 @@ func (e *ExecutionOperations) placementNeedsCapacity(tx AllocationTx, pressure S
 			}
 			for i := range nodes {
 				if nodes[i].ID == nodeID {
-					nodes[i].Active--
+					release(&nodes[i])
 				}
 			}
 			chosen, err := e.service.rules.DecidePlacement(pressure.Deployment, nodes)
diff --git a/services/core/internal/deployment/view.go b/services/core/internal/deployment/view.go
index 23bef5045..ff14d83e3 100644
--- a/services/core/internal/deployment/view.go
+++ b/services/core/internal/deployment/view.go
@@ -10,11 +10,10 @@ import (
 type NodeRolloutState string
 
 const (
-	NodeRolloutReady          NodeRolloutState = "ready"
-	NodeRolloutPreparing      NodeRolloutState = "preparing"
-	NodeRolloutFailed         NodeRolloutState = "failed"
-	NodeRolloutUpdateRequired NodeRolloutState = "update_required"
-	NodeRolloutUnknown        NodeRolloutState = "unknown"
+	NodeRolloutReady     NodeRolloutState = "ready"
+	NodeRolloutPreparing NodeRolloutState = "preparing"
+	NodeRolloutFailed    NodeRolloutState = "failed"
+	NodeRolloutUnknown   NodeRolloutState = "unknown"
 )
 
 type RolloutState string
@@ -26,15 +25,16 @@ const (
 
 // View is the sandbox deployment as administrators read it.
 type View struct {
-	Rollout              Rollout                 `json:"rollout" binding:"required"`
-	Specification        *sandbox.DeploymentSpec `json:"specification,omitempty"`
-	SpecificationDigest  string                  `json:"specification_digest,omitempty"`
-	Generation           uint64                  `json:"generation" binding:"required"`
-	Mode                 sandbox.DeploymentMode  `json:"mode" binding:"required"`
-	Resources            Resources               `json:"resources" binding:"required"`
-	Configuration        json.RawMessage         `json:"configuration,omitempty" swaggertype:"object"`
-	Metadata             json.RawMessage         `json:"metadata,omitempty" swaggertype:"object"`
-	CredentialConfigured bool                    `json:"credential_configured" binding:"required"`
+	ComputeProfiles      map[string]ComputeProfileRecord `json:"compute_profiles,omitempty"`
+	Rollout              Rollout                         `json:"rollout" binding:"required"`
+	Specification        *sandbox.DeploymentSpec         `json:"specification,omitempty"`
+	SpecificationDigest  string                          `json:"specification_digest,omitempty"`
+	Generation           uint64                          `json:"generation" binding:"required"`
+	Mode                 sandbox.DeploymentMode          `json:"mode" binding:"required"`
+	Resources            Resources                       `json:"resources" binding:"required"`
+	Configuration        json.RawMessage                 `json:"configuration,omitempty" swaggertype:"object"`
+	Metadata             json.RawMessage                 `json:"metadata,omitempty" swaggertype:"object"`
+	CredentialConfigured bool                            `json:"credential_configured" binding:"required"`
 	// Idle suspension policy; null unless the selected Provider declares checkpoint support.
 	Suspension     *Suspension `json:"suspension" extensions:"x-nullable" binding:"required"`
 	InstallationID string      `json:"installation_id" binding:"required"`
@@ -67,11 +67,10 @@ type NodeRollout struct {
 }
 
 type RolloutNodes struct {
-	Ready          int64 `json:"ready" binding:"required"`
-	Preparing      int64 `json:"preparing" binding:"required"`
-	Failed         int64 `json:"failed" binding:"required"`
-	UpdateRequired int64 `json:"update_required" binding:"required"`
-	Unknown        int64 `json:"unknown" binding:"required"`
+	Ready     int64 `json:"ready" binding:"required"`
+	Preparing int64 `json:"preparing" binding:"required"`
+	Failed    int64 `json:"failed" binding:"required"`
+	Unknown   int64 `json:"unknown" binding:"required"`
 }
 
 type Rollout struct {
diff --git a/services/core/internal/deployment/workspace_configuration_test.go b/services/core/internal/deployment/workspace_configuration_test.go
index 32c427544..27891db54 100644
--- a/services/core/internal/deployment/workspace_configuration_test.go
+++ b/services/core/internal/deployment/workspace_configuration_test.go
@@ -35,7 +35,6 @@ func TestWorkspaceConfigurationRejectsChangedExternalReceiptAndReadFailure(t *te
 	declaration := workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}
 	record := webDeployment(t, uuid.NewString(), "microsandbox", 1)
 	specification := testSpecification("microsandbox")
-	specification.Resources.EnvironmentDiskMiB = 0
 	specification.Workspace = &declaration
 	record.Specification, _ = json.Marshal(specification)
 	var readErr error
diff --git a/services/core/internal/engine/catalog_generated.go b/services/core/internal/engine/catalog_generated.go
deleted file mode 100644
index 20dab6a6f..000000000
--- a/services/core/internal/engine/catalog_generated.go
+++ /dev/null
@@ -1,8 +0,0 @@
-// Code generated by scripts/generate-harness-catalog.py; DO NOT EDIT.
-package engine
-
-var qualified = NewCatalog(map[string]Profile{
-	"claude_sdk": claudeProfile(),
-	"codex":      codexProfile(),
-	"mcode":      mcodeProfile(),
-})
diff --git a/services/core/internal/engine/claude.go b/services/core/internal/engine/claude.go
deleted file mode 100644
index b92c435af..000000000
--- a/services/core/internal/engine/claude.go
+++ /dev/null
@@ -1,107 +0,0 @@
-package engine
-
-import (
-	"encoding/json"
-	"errors"
-	"strings"
-
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-// WhitespaceOnlyText stays unqualified: the bridge and Anthropic-compatible
-// providers reject text without non-whitespace characters.
-func claudeProfile() Profile {
-	return Profile{
-		RetainedNativeHistory:          proto.CapabilitySupported,
-		ProgrammaticToolCallingDisable: proto.CapabilitySupported,
-		MCPOrigins:                     []string{"service", "environment"},
-		Placements:                     []string{"none", "openai_hosted", "self_hosted"},
-		StructuredOutput:               proto.CapabilitySupported,
-		ToolSearch:                     proto.CapabilitySupported,
-		MessageImages:                  proto.CapabilitySupported,
-		WhitespaceOnlyText:             proto.CapabilityUnsupported,
-		WebSearchControl:               proto.CapabilityUnsupported,
-		TextVerbosity:                  proto.CapabilityUnsupported,
-		MCPBearer:                      proto.CapabilitySupported,
-		ConfigurationValidation:        AdditionalValidation,
-		ToolsValidation:                AdditionalValidation,
-		FunctionResultValidation:       AdditionalValidation,
-		ValidateConfiguration:          validateClaudeConfiguration,
-		ValidateTools:                  validateClaudeTools,
-		ValidateFunctionResult: func(_ string, result proto.FunctionResultPayload) error {
-			for _, part := range result.Content {
-				if part.Type == "input_image" && !result.Success {
-					return ErrInvalidInput
-				}
-			}
-			if (proto.MessageInput{{Content: result.Content}}).ValidateInlineImages() != nil {
-				return ErrInvalidInput
-			}
-			return nil
-		},
-	}
-}
-
-func validateClaudeConfiguration(agent v1.Agent, environment *v1.Environment) error {
-	if environment == nil || (environment.Type != "none" && environment.Type != "openai_hosted" && environment.Type != "self_hosted") || strings.TrimSpace(agent.Model) == "" {
-		return ErrInvalidInput
-	}
-	if agent.Text.Verbosity != "" && agent.Text.Verbosity != "medium" {
-		return errors.New("The configured engine currently supports medium text verbosity only.")
-	}
-	if agent.Reasoning.Effort != nil || agent.Reasoning.Summary != nil || (agent.ServiceTier != "" && agent.ServiceTier != "auto") {
-		return ErrInvalidInput
-	}
-	if agent.Text.Format.Type == "json_schema" {
-		if err := proto.ValidateBinary64Schema(agent.Text.Format.Schema); err != nil {
-			return err
-		}
-		if agent.MultiAgent.Enabled {
-			return errors.New("Structured output requires a single Agent.")
-		}
-		if len(environment.Skills) != 0 || len(environment.Plugins) != 0 || len(environment.CapabilityDirectories) != 0 {
-			return errors.New("Structured output with environment Skills or Plugins is not qualified.")
-		}
-		for _, raw := range agent.Tools {
-			var tool struct {
-				Type string `json:"type"`
-			}
-			if json.Unmarshal(raw, &tool) != nil || (tool.Type != "function" && tool.Type != "web_search" && tool.Type != "programmatic_tool_calling") {
-				return ErrInvalidInput
-			}
-		}
-	} else if agent.Text.Format.Type != "" && agent.Text.Format.Type != "text" {
-		return ErrInvalidInput
-	}
-	search, otherTools := false, false
-	for _, raw := range agent.Tools {
-		var tool struct {
-			Type string `json:"type"`
-		}
-		if json.Unmarshal(raw, &tool) != nil {
-			return ErrInvalidInput
-		}
-		search = search || tool.Type == "tool_search"
-		otherTools = otherTools || (tool.Type != "function" && tool.Type != "tool_search" && tool.Type != "web_search" && tool.Type != "programmatic_tool_calling")
-	}
-	if search && (agent.MultiAgent.Enabled || otherTools || len(environment.Skills) != 0 || len(environment.Plugins) != 0 || len(environment.CapabilityDirectories) != 0 || agent.Text.Format.Type == "json_schema") {
-		return errors.New("Tool discovery requires a single-agent function profile without Skills or Plugins.")
-	}
-	return rejectSubagentTools(agent, "function", "mcp")
-}
-
-func validateClaudeTools(environment *v1.Environment, tools []proto.FunctionTool, mcp []proto.MCPHTTPServer) error {
-	if err := validateClaudeMCP(mcp); err != nil {
-		return err
-	}
-	for _, tool := range tools {
-		var schema struct {
-			Type string `json:"type"`
-		}
-		if json.Unmarshal(tool.Parameters, &schema) != nil || schema.Type != "object" {
-			return errors.New("The configured engine currently requires function schemas with root type object.")
-		}
-	}
-	return nil
-}
diff --git a/services/core/internal/engine/claude_mcp.go b/services/core/internal/engine/claude_mcp.go
deleted file mode 100644
index 29c0d84a4..000000000
--- a/services/core/internal/engine/claude_mcp.go
+++ /dev/null
@@ -1,30 +0,0 @@
-package engine
-
-import (
-	"errors"
-	"regexp"
-	"strings"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-var claudeMCPLabel = regexp.MustCompile(`^[a-zA-Z0-9_-]+$`)
-var claudeMCPTool = regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`)
-
-// These are execution limits of the packaged adapter, not saved-Agent schema rules.
-// Shared resolution still owns URL, transport and credential-binding validation.
-func validateClaudeMCP(servers []proto.MCPHTTPServer) error {
-	for _, server := range servers {
-		if !claudeMCPLabel.MatchString(server.ServerLabel) || server.ServerLabel == "functions" || strings.ContainsAny(server.ServerURL, "?#") {
-			return errors.New("The configured engine does not support this HTTP MCP declaration.")
-		}
-		if server.AllowedTools != nil {
-			for _, name := range *server.AllowedTools {
-				if !claudeMCPTool.MatchString(name) {
-					return errors.New("The configured engine does not support this MCP tool name.")
-				}
-			}
-		}
-	}
-	return nil
-}
diff --git a/services/core/internal/engine/codex.go b/services/core/internal/engine/codex.go
deleted file mode 100644
index 7ce42df97..000000000
--- a/services/core/internal/engine/codex.go
+++ /dev/null
@@ -1,28 +0,0 @@
-package engine
-
-import (
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-func codexProfile() Profile {
-	return Profile{
-		RetainedNativeHistory:          proto.CapabilitySupported,
-		ProgrammaticToolCallingDisable: proto.CapabilitySupported,
-		Placements:                     []string{"none", "self_hosted", "openai_hosted"},
-		MCPOrigins:                     []string{"service", "environment"},
-		MessageImages:                  proto.CapabilitySupported,
-		WhitespaceOnlyText:             proto.CapabilitySupported,
-		WebSearchControl:               proto.CapabilitySupported,
-		TextVerbosity:                  proto.CapabilitySupported,
-		MCPBearer:                      proto.CapabilitySupported,
-		StructuredOutput:               proto.CapabilityUnsupported,
-		ToolSearch:                     proto.CapabilityUnsupported,
-		ConfigurationValidation:        AdditionalValidation,
-		ToolsValidation:                CommonValidationOnly,
-		FunctionResultValidation:       CommonValidationOnly,
-		ValidateConfiguration: func(agent v1.Agent, _ *v1.Environment) error {
-			return rejectSubagentTools(agent, "function", "mcp")
-		},
-	}
-}
diff --git a/services/core/internal/engine/configuration_test.go b/services/core/internal/engine/configuration_test.go
deleted file mode 100644
index 23f74d9e4..000000000
--- a/services/core/internal/engine/configuration_test.go
+++ /dev/null
@@ -1,40 +0,0 @@
-package engine
-
-import (
-	"testing"
-
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/modelprovider"
-)
-
-func TestProviderDeclarationsAgreeWithAdmission(t *testing.T) {
-	for _, kind := range (Catalog{}).Kinds() {
-		t.Run(kind, func(t *testing.T) {
-			declared, ok := builtin.Registry().Lookup(kind)
-			if !ok {
-				t.Fatal("qualified harness has no provider declaration")
-			}
-			for _, protocol := range []string{"responses", "anthropic", "unknown"} {
-				provider, supported := declared.Provider(protocol)
-				input := v1.ModelProviderInput{Protocol: modelprovider.Protocol(protocol), BaseURL: "https://example.test", APIKey: "private-fixture", ContextWindow: 100, MaxOutputTokens: 20}
-				if (input.ValidateHarness(kind) == nil) != supported {
-					t.Fatalf("protocol %q disagrees with validation", protocol)
-				}
-				if !supported {
-					continue
-				}
-				input.ContextWindow, input.MaxOutputTokens = 0, 0
-				if (input.ValidateHarness(kind) != nil) != provider.RequiresTokenLimits {
-					t.Fatalf("token requirements disagree for %q", protocol)
-				}
-				if provider.RequiresTokenLimits {
-					input.ContextWindow = 100
-					if input.ValidateHarness(kind) == nil {
-						t.Fatal("missing output limit accepted")
-					}
-				}
-			}
-		})
-	}
-}
diff --git a/services/core/internal/engine/declaration_test.go b/services/core/internal/engine/declaration_test.go
deleted file mode 100644
index 237067084..000000000
--- a/services/core/internal/engine/declaration_test.go
+++ /dev/null
@@ -1,139 +0,0 @@
-package engine_test
-
-import (
-	"errors"
-	"reflect"
-	"strconv"
-	"strings"
-	"testing"
-
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine/enginetest"
-)
-
-func requireDeclarationRejection(t *testing.T, p engine.Profile) {
-	t.Helper()
-	if err := p.ValidateDeclaration(); !errors.Is(err, engine.ErrInvalidDeclaration) {
-		t.Fatalf("expected declaration error, got %v", err)
-	}
-	defer func() {
-		err, ok := recover().(error)
-		if !ok || !errors.Is(err, engine.ErrInvalidDeclaration) {
-			t.Fatalf("catalog accepted invalid declaration: %v", err)
-		}
-	}()
-	engine.NewCatalog(map[string]engine.Profile{"fixture": p})
-}
-
-func TestEveryProfileFieldRequiresAnExplicitDecision(t *testing.T) {
-	// Claude exercises all three additional validators. Zeroing any field, even
-	// a future one, must fail before the profile enters an immutable catalog.
-	original, _ := (engine.Catalog{}).Lookup("claude_sdk")
-	typ := reflect.TypeOf(original)
-	for i := 0; i < typ.NumField(); i++ {
-		t.Run(typ.Field(i).Name, func(t *testing.T) {
-			p := original
-			reflect.ValueOf(&p).Elem().Field(i).SetZero()
-			requireDeclarationRejection(t, p)
-		})
-	}
-}
-
-func TestEveryServiceCapabilityRejectsInvalidValues(t *testing.T) {
-	for _, kind := range (engine.Catalog{}).Kinds() {
-		original, _ := (engine.Catalog{}).Lookup(kind)
-		if err := original.ValidateDeclaration(); err != nil {
-			t.Fatal(kind, err)
-		}
-		typ := reflect.TypeOf(original)
-		for i := 0; i < typ.NumField(); i++ {
-			if typ.Field(i).Type != reflect.TypeOf(proto.CapabilitySupport(0)) {
-				continue
-			}
-			for _, invalid := range []proto.CapabilitySupport{proto.CapabilityUnspecified, 3, 255} {
-				t.Run(kind+"/"+typ.Field(i).Name+"/"+strconv.Itoa(int(invalid)), func(t *testing.T) {
-					p := original
-					reflect.ValueOf(&p).Elem().Field(i).Set(reflect.ValueOf(invalid))
-					requireDeclarationRejection(t, p)
-				})
-			}
-		}
-	}
-}
-
-func TestValidationPoliciesMustMatchCallbacks(t *testing.T) {
-	original, _ := (engine.Catalog{}).Lookup("claude_sdk")
-	for _, field := range []string{"ConfigurationValidation", "ToolsValidation", "FunctionResultValidation"} {
-		for _, invalid := range []engine.ValidationPolicy{engine.ValidationUnspecified, 3, engine.CommonValidationOnly} {
-			t.Run(field+"/"+strconv.Itoa(int(invalid)), func(t *testing.T) {
-				p := original
-				reflect.ValueOf(&p).Elem().FieldByName(field).Set(reflect.ValueOf(invalid))
-				requireDeclarationRejection(t, p)
-			})
-		}
-		t.Run(field+"/missing callback", func(t *testing.T) {
-			p := enginetest.Profile(nil)
-			reflect.ValueOf(&p).Elem().FieldByName(field).Set(reflect.ValueOf(engine.AdditionalValidation))
-			requireDeclarationRejection(t, p)
-		})
-	}
-	// Common validation is sufficient when explicitly chosen, with no pretend
-	// successful callbacks. An empty MCP list is an explicit refusal of all origins.
-	if err := enginetest.Profile(nil).ValidateDeclaration(); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestCatalogRejectsInvalidCombinationsBeforeCallbacks(t *testing.T) {
-	cases := map[string]func(*engine.Profile){
-		"empty placements":              func(p *engine.Profile) { p.Placements = []string{} },
-		"unknown placement":             func(p *engine.Profile) { p.Placements = []string{"private-fixture-value"} },
-		"duplicate placement":           func(p *engine.Profile) { p.Placements = []string{"none", "none"} },
-		"unknown origin":                func(p *engine.Profile) { p.MCPOrigins = []string{"private-fixture-value"} },
-		"duplicate origin":              func(p *engine.Profile) { p.MCPOrigins = []string{"service", "service"} },
-		"service without placement":     func(p *engine.Profile) { p.Placements = []string{"self_hosted"}; p.MCPOrigins = []string{"service"} },
-		"environment without placement": func(p *engine.Profile) { p.MCPOrigins = []string{"environment"} },
-		"bearer without MCP":            func(p *engine.Profile) { p.MCPBearer = proto.CapabilitySupported },
-	}
-	for name, change := range cases {
-		t.Run(name, func(t *testing.T) {
-			p := enginetest.Profile(change)
-			p.ConfigurationValidation = engine.AdditionalValidation
-			p.ValidateConfiguration = func(v1.Agent, *v1.Environment) error {
-				t.Fatal("registration invoked request validator")
-				return nil
-			}
-			if err := p.ValidateDeclaration(); err != nil && strings.Contains(err.Error(), "private-fixture-value") {
-				t.Fatal("declaration error disclosed input")
-			}
-			requireDeclarationRejection(t, p)
-		})
-	}
-}
-
-func TestCatalogRejectsEmptyProfileAndKind(t *testing.T) {
-	requireDeclarationRejection(t, engine.Profile{})
-	for _, kind := range []string{"", " ", " fixture"} {
-		t.Run("kind/"+kind, func(t *testing.T) {
-			defer func() {
-				if err, ok := recover().(error); !ok || !errors.Is(err, engine.ErrInvalidDeclaration) {
-					t.Fatal("invalid kind accepted", err)
-				}
-			}()
-			engine.NewCatalog(map[string]engine.Profile{kind: enginetest.Profile(nil)})
-		})
-	}
-	for _, profiles := range []map[string]engine.Profile{nil, {}} {
-		c := engine.NewCatalog(profiles)
-		if len(c.Kinds()) != 0 {
-			t.Fatal("empty catalog inherited builtins")
-		}
-		for _, kind := range (engine.Catalog{}).Kinds() {
-			if _, ok := c.Lookup(kind); ok {
-				t.Fatal("empty catalog authorized", kind)
-			}
-		}
-	}
-}
diff --git a/services/core/internal/engine/enginetest/profile.go b/services/core/internal/engine/enginetest/profile.go
deleted file mode 100644
index 1a5801474..000000000
--- a/services/core/internal/engine/enginetest/profile.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Package enginetest supplies explicit declarations for admission fixtures.
-// Production profiles must decide every field in their own constructors.
-package enginetest
-
-import (
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-)
-
-// Profile qualifies only common text admission by default. The literal is
-// intentionally exhaustive; new fields stay unspecified until decided here.
-func Profile(change func(*engine.Profile)) engine.Profile {
-	p := engine.Profile{
-		RetainedNativeHistory:          proto.CapabilityUnsupported,
-		ProgrammaticToolCallingDisable: proto.CapabilityUnsupported,
-		WebSearchControl:               proto.CapabilityUnsupported,
-		TextVerbosity:                  proto.CapabilityUnsupported,
-		MCPBearer:                      proto.CapabilityUnsupported,
-		StructuredOutput:               proto.CapabilityUnsupported,
-		ToolSearch:                     proto.CapabilityUnsupported,
-		MessageImages:                  proto.CapabilityUnsupported,
-		WhitespaceOnlyText:             proto.CapabilityUnsupported,
-		Placements:                     []string{"none"},
-		MCPOrigins:                     []string{},
-		ConfigurationValidation:        engine.CommonValidationOnly,
-		ToolsValidation:                engine.CommonValidationOnly,
-		FunctionResultValidation:       engine.CommonValidationOnly,
-	}
-	if change != nil {
-		change(&p)
-	}
-	return p
-}
diff --git a/services/core/internal/engine/mcode.go b/services/core/internal/engine/mcode.go
deleted file mode 100644
index eea6c9cf0..000000000
--- a/services/core/internal/engine/mcode.go
+++ /dev/null
@@ -1,45 +0,0 @@
-package engine
-
-import (
-	"errors"
-	"strings"
-
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-// WhitespaceOnlyText stays unqualified: the native runtime refuses such prompts
-// with "Local message content or attachments are required.".
-func mcodeProfile() Profile {
-	return Profile{
-		RetainedNativeHistory:          proto.CapabilityUnsupported,
-		MCPOrigins:                     []string{"environment"},
-		Placements:                     []string{"none", "openai_hosted", "self_hosted"},
-		MCPBearer:                      proto.CapabilitySupported,
-		ProgrammaticToolCallingDisable: proto.CapabilitySupported,
-		StructuredOutput:               proto.CapabilityUnsupported,
-		ToolSearch:                     proto.CapabilityUnsupported,
-		MessageImages:                  proto.CapabilityUnsupported,
-		WhitespaceOnlyText:             proto.CapabilityUnsupported,
-		WebSearchControl:               proto.CapabilityUnsupported,
-		TextVerbosity:                  proto.CapabilityUnsupported,
-		ConfigurationValidation:        AdditionalValidation,
-		ToolsValidation:                AdditionalValidation,
-		FunctionResultValidation:       CommonValidationOnly,
-		ValidateConfiguration: func(a v1.Agent, e *v1.Environment) error {
-			if e == nil || (e.Type != "none" && e.Type != "openai_hosted" && e.Type != "self_hosted") || strings.TrimSpace(a.Model) == "" || a.Reasoning.Effort != nil || a.Reasoning.Summary != nil || (a.ServiceTier != "" && a.ServiceTier != "auto") || (a.Text.Format.Type != "" && a.Text.Format.Type != "text") || (a.Text.Verbosity != "" && a.Text.Verbosity != "medium") {
-				return ErrInvalidInput
-			}
-			return rejectSubagentTools(a, "mcp")
-		}, ValidateTools: func(_ *v1.Environment, functions []proto.FunctionTool, mcp []proto.MCPHTTPServer) error {
-			if len(functions) > 0 {
-				return errors.New("The configured engine does not support public functions.")
-			}
-			for _, server := range mcp {
-				if server.ServerLabel == "oac_workspace" || server.AllowedTools != nil || server.Required {
-					return errors.New("The configured engine requires an unreserved MCP label, allowed_tools=null and required=false.")
-				}
-			}
-			return nil
-		}}
-}
diff --git a/services/core/internal/engine/mcp.go b/services/core/internal/engine/mcp.go
deleted file mode 100644
index 79be8e6fe..000000000
--- a/services/core/internal/engine/mcp.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package engine
-
-import (
-	"errors"
-	"slices"
-
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-// ValidateMCPOrigins preserves outbound authority independently of Harness names.
-// Workspace connections never stand in for service-network connections.
-func (p Profile) ValidateMCPOrigins(environment *v1.Environment, servers []proto.MCPHTTPServer) error {
-	for _, server := range servers {
-		switch server.ConnectionOrigin {
-		case "service":
-			if environment == nil || environment.Type != "none" {
-				return errors.New("Service-origin MCP requires the service-side environment:none profile.")
-			}
-		case "environment":
-			if environment == nil || (environment.Type != "openai_hosted" && environment.Type != "self_hosted") {
-				return errors.New("Environment-origin MCP requires a managed or self-hosted execution Environment.")
-			}
-		default:
-			return errors.New("MCP requires an explicit connection origin.")
-		}
-		if !slices.Contains(p.MCPOrigins, server.ConnectionOrigin) {
-			return errors.New("The configured engine does not support this MCP connection origin.")
-		}
-	}
-	return nil
-}
diff --git a/services/core/internal/engine/mcp_test.go b/services/core/internal/engine/mcp_test.go
deleted file mode 100644
index 4f6711d25..000000000
--- a/services/core/internal/engine/mcp_test.go
+++ /dev/null
@@ -1,59 +0,0 @@
-package engine_test
-
-import (
-	"testing"
-
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine/enginetest"
-)
-
-func TestMCPOriginQualification(t *testing.T) {
-	for _, kind := range []string{"codex", "claude_sdk", "mcode"} {
-		profile, ok := (engine.Catalog{}).Lookup(kind)
-		if !ok {
-			t.Fatal(kind)
-		}
-		for _, placement := range []string{"none", "self_hosted", "openai_hosted"} {
-			for _, origin := range []string{"service", "environment", "", "unknown"} {
-				servers := []proto.MCPHTTPServer{{ConnectionOrigin: origin, ServerLabel: "proof", ServerURL: "https://example.test/mcp"}}
-				allowed := origin == "environment" && placement != "none" || origin == "service" && placement == "none" && kind != "mcode"
-				if err := profile.ValidateMCPOrigins(&v1.Environment{Type: placement}, servers); (err == nil) != allowed {
-					t.Fatalf("%s/%s/%s: %v", kind, placement, origin, err)
-				}
-			}
-		}
-	}
-}
-func TestMiniMaxMCPPoliciesRejectInsteadOfDropping(t *testing.T) {
-	p, _ := (engine.Catalog{}).Lookup("mcode")
-	empty := []string{}
-	named := []string{"proof"}
-	for _, allowed := range []*[]string{nil, &empty, &named} {
-		for _, required := range []bool{false, true} {
-			server := proto.MCPHTTPServer{ConnectionOrigin: "environment", ServerLabel: "proof", ServerURL: "https://example.test", AllowedTools: allowed, Required: required}
-			err := p.ValidateTools(&v1.Environment{Type: "self_hosted"}, nil, []proto.MCPHTTPServer{server})
-			if (err == nil) != (allowed == nil && !required) {
-				t.Fatal("unsupported MCP policy accepted", err)
-			}
-		}
-	}
-}
-func TestMCPOriginCatalogIsImmutable(t *testing.T) {
-	p := enginetest.Profile(func(p *engine.Profile) {
-		p.MCPOrigins = []string{"environment"}
-		p.Placements = []string{"self_hosted"}
-	})
-	c := engine.NewCatalog(map[string]engine.Profile{"fixture": p})
-	p.MCPOrigins[0] = "service"
-	first, _ := c.Lookup("fixture")
-	if first.MCPOrigins[0] != "environment" {
-		t.Fatal("mutable source")
-	}
-	first.MCPOrigins[0] = "service"
-	second, _ := c.Lookup("fixture")
-	if second.MCPOrigins[0] != "environment" {
-		t.Fatal("mutable lookup")
-	}
-}
diff --git a/services/core/internal/engine/profile.go b/services/core/internal/engine/profile.go
deleted file mode 100644
index 501ef240c..000000000
--- a/services/core/internal/engine/profile.go
+++ /dev/null
@@ -1,166 +0,0 @@
-package engine
-
-import (
-	"errors"
-	"fmt"
-	"maps"
-	"reflect"
-	"slices"
-	"strings"
-
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-var ErrInvalidInput = errors.New("invalid engine configuration")
-
-// Profile records qualified public behavior, independently of Runtime advertisements.
-type Profile struct {
-	RetainedNativeHistory                      proto.CapabilitySupport
-	ProgrammaticToolCallingDisable             proto.CapabilitySupport
-	Placements                                 []string
-	MCPOrigins                                 []string
-	WebSearchControl, TextVerbosity, MCPBearer proto.CapabilitySupport
-	StructuredOutput                           proto.CapabilitySupport
-	ToolSearch                                 proto.CapabilitySupport
-	MessageImages                              proto.CapabilitySupport
-	ConfigurationValidation                    ValidationPolicy
-	ToolsValidation                            ValidationPolicy
-	FunctionResultValidation                   ValidationPolicy
-	ValidateConfiguration                      func(agent v1.Agent, environment *v1.Environment) error
-	ValidateTools                              func(environment *v1.Environment, functions []proto.FunctionTool, mcp []proto.MCPHTTPServer) error
-	ValidateFunctionResult                     func(placement string, result proto.FunctionResultPayload) error
-	// WhitespaceOnlyText qualifies messages without an image or non-whitespace
-	// text. Unqualified harnesses reject them at admission; Core never trims or
-	// pads model input to fit a harness.
-	WhitespaceOnlyText proto.CapabilitySupport
-}
-
-func (p Profile) Accepts(placement string) bool {
-	return slices.Contains(p.Placements, placement)
-}
-
-// Catalog is immutable after construction. Its zero value selects built-in profiles.
-// NewCatalog with an empty map explicitly qualifies no engines.
-type Catalog struct {
-	profiles map[string]Profile
-}
-
-// NewCatalog rejects invalid static registrations with ErrInvalidDeclaration.
-// Nil and empty maps both explicitly authorize no engines.
-func NewCatalog(profiles map[string]Profile) Catalog {
-	c := Catalog{profiles: make(map[string]Profile, len(profiles))}
-	for kind, profile := range profiles {
-		if kind == "" || kind != strings.TrimSpace(kind) {
-			panic(ErrInvalidDeclaration)
-		}
-		if err := profile.ValidateDeclaration(); err != nil {
-			panic(err)
-		}
-		profile.Placements = slices.Clone(profile.Placements)
-		profile.MCPOrigins = slices.Clone(profile.MCPOrigins)
-		c.profiles[kind] = profile
-	}
-	return c
-}
-
-func (c Catalog) Lookup(kind string) (Profile, bool) {
-	if c.profiles == nil {
-		c = qualified
-	}
-	profile, ok := c.profiles[kind]
-	profile.Placements = slices.Clone(profile.Placements)
-	profile.MCPOrigins = slices.Clone(profile.MCPOrigins)
-	return profile, ok
-}
-
-// Kinds returns a stable snapshot of harnesses qualified by this build.
-func (c Catalog) Kinds() []string {
-	if c.profiles == nil {
-		c = qualified
-	}
-	kinds := slices.Collect(maps.Keys(c.profiles))
-	slices.Sort(kinds)
-	return kinds
-}
-
-var ErrInvalidDeclaration = errors.New("invalid engine profile declaration")
-
-// ValidationPolicy distinguishes an explicit reliance on common validation from
-// additional pure Harness restrictions. Neither is an execution implementation.
-type ValidationPolicy uint8
-
-const (
-	ValidationUnspecified ValidationPolicy = iota
-	CommonValidationOnly
-	AdditionalValidation
-)
-
-// ValidateDeclaration runs before a Catalog can authorize any operation. Every
-// future field must be classified here; no field receives an inferred default.
-func (p Profile) ValidateDeclaration() error {
-	v := reflect.ValueOf(p)
-	for i := 0; i < v.NumField(); i++ {
-		field := v.Type().Field(i).Name
-		if support, ok := v.Field(i).Interface().(proto.CapabilitySupport); ok {
-			if support != proto.CapabilitySupported && support != proto.CapabilityUnsupported {
-				return declarationError(field)
-			}
-			continue
-		}
-		switch field {
-		case "Placements", "MCPOrigins":
-			if v.Field(i).IsNil() {
-				return declarationError(field)
-			}
-		case "ConfigurationValidation", "ToolsValidation", "FunctionResultValidation":
-			policy, ok := v.Field(i).Interface().(ValidationPolicy)
-			if !ok || (policy != CommonValidationOnly && policy != AdditionalValidation) {
-				return declarationError(field)
-			}
-		case "ValidateConfiguration", "ValidateTools", "ValidateFunctionResult":
-			// Paired with the explicit policy below, including legitimate nil.
-		default:
-			return declarationError(field)
-		}
-	}
-	for _, strategy := range []struct {
-		field  string
-		policy ValidationPolicy
-		custom bool
-	}{
-		{"ConfigurationValidation", p.ConfigurationValidation, p.ValidateConfiguration != nil},
-		{"ToolsValidation", p.ToolsValidation, p.ValidateTools != nil},
-		{"FunctionResultValidation", p.FunctionResultValidation, p.ValidateFunctionResult != nil},
-	} {
-		if (strategy.policy == AdditionalValidation) != strategy.custom {
-			return declarationError(strategy.field)
-		}
-	}
-	if len(p.Placements) == 0 || !validChoices(p.Placements, "none", "openai_hosted", "self_hosted") {
-		return declarationError("Placements")
-	}
-	if !validChoices(p.MCPOrigins, "service", "environment") ||
-		(slices.Contains(p.MCPOrigins, "service") && !p.Accepts("none")) ||
-		(slices.Contains(p.MCPOrigins, "environment") && !p.Accepts("openai_hosted") && !p.Accepts("self_hosted")) ||
-		(p.MCPBearer.IsSupported() && len(p.MCPOrigins) == 0) {
-		return declarationError("MCPOrigins")
-	}
-	return nil
-}
-
-func declarationError(field string) error {
-	// Only authored field names are exposed, never declaration values.
-	return fmt.Errorf("%w: %s", ErrInvalidDeclaration, field)
-}
-
-func validChoices(values []string, allowed ...string) bool {
-	seen := make(map[string]bool, len(values))
-	for _, value := range values {
-		if !slices.Contains(allowed, value) || seen[value] {
-			return false
-		}
-		seen[value] = true
-	}
-	return true
-}
diff --git a/services/core/internal/engine/profile_test.go b/services/core/internal/engine/profile_test.go
deleted file mode 100644
index 8cc844ca3..000000000
--- a/services/core/internal/engine/profile_test.go
+++ /dev/null
@@ -1,58 +0,0 @@
-package engine_test
-
-import (
-	"reflect"
-	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine/enginetest"
-)
-
-func TestCatalogOwnsQualification(t *testing.T) {
-	placements := []string{"none"}
-	profiles := map[string]engine.Profile{"fixture": enginetest.Profile(func(p *engine.Profile) { p.Placements = placements })}
-	catalog := engine.NewCatalog(profiles)
-	placements[0] = "openai_hosted"
-	profiles["fixture"] = engine.Profile{MCPBearer: proto.CapabilitySupported}
-	profiles["unqualified"] = enginetest.Profile(nil)
-	profile, ok := catalog.Lookup("fixture")
-	if !ok || !profile.Accepts("none") || profile.Accepts("openai_hosted") || profile.MCPBearer.IsSupported() {
-		t.Fatal("caller changed catalog qualification")
-	}
-	profile.Placements[0] = "self_hosted"
-	profile.MCPBearer = proto.CapabilitySupported
-	again, _ := catalog.Lookup("fixture")
-	if !again.Accepts("none") || again.MCPBearer.IsSupported() {
-		t.Fatal("lookup exposed mutable qualification")
-	}
-	if _, ok := catalog.Lookup("unqualified"); ok {
-		t.Fatal("caller registered an engine after catalog construction")
-	}
-	if _, ok := (engine.Catalog{}).Lookup("fixture"); ok {
-		t.Fatal("fixture widened the service catalog")
-	}
-}
-
-func TestCatalogKindsAreStableAndDefensive(t *testing.T) {
-	catalog := engine.NewCatalog(map[string]engine.Profile{"zeta": enginetest.Profile(nil), "alpha": enginetest.Profile(nil)})
-	got := catalog.Kinds()
-	if !reflect.DeepEqual(got, []string{"alpha", "zeta"}) {
-		t.Fatalf("Kinds = %#v", got)
-	}
-	got[0] = "changed"
-	if again := catalog.Kinds(); !reflect.DeepEqual(again, []string{"alpha", "zeta"}) {
-		t.Fatalf("caller mutated catalog kinds: %#v", again)
-	}
-}
-
-func TestExplicitCatalogDoesNotInheritBuiltins(t *testing.T) {
-	for _, catalog := range []engine.Catalog{engine.NewCatalog(nil), engine.NewCatalog(map[string]engine.Profile{"fixture": enginetest.Profile(nil)})} {
-		if _, ok := catalog.Lookup("codex"); ok {
-			t.Fatal("explicit catalog inherited built-in qualification")
-		}
-	}
-	if _, ok := (engine.Catalog{}).Lookup("codex"); !ok {
-		t.Fatal("zero-value catalog lost built-in qualification")
-	}
-}
diff --git a/services/core/internal/engine/subagents.go b/services/core/internal/engine/subagents.go
deleted file mode 100644
index 882acb90a..000000000
--- a/services/core/internal/engine/subagents.go
+++ /dev/null
@@ -1,28 +0,0 @@
-package engine
-
-import (
-	"encoding/json"
-	"errors"
-	"slices"
-
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-)
-
-// rejectSubagentTools keeps unqualified native combinations in adapter profiles.
-func rejectSubagentTools(agent v1.Agent, unsupported ...string) error {
-	if !agent.MultiAgent.Enabled {
-		return nil
-	}
-	for _, raw := range agent.Tools {
-		var tool struct {
-			Type string `json:"type"`
-		}
-		if json.Unmarshal(raw, &tool) != nil {
-			return ErrInvalidInput
-		}
-		if slices.Contains(unsupported, tool.Type) {
-			return errors.New("The configured Subagent profile does not support this tool combination.")
-		}
-	}
-	return nil
-}
diff --git a/services/core/internal/engine/subagents_test.go b/services/core/internal/engine/subagents_test.go
deleted file mode 100644
index 2788edcb0..000000000
--- a/services/core/internal/engine/subagents_test.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package engine
-
-import (
-	"encoding/json"
-	"testing"
-
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-)
-
-func TestSubagentProfilesPreserveQualifiedOperationBoundaries(t *testing.T) {
-	for _, kind := range []string{"codex", "claude_sdk", "mcode"} {
-		t.Run(kind, func(t *testing.T) {
-			profile, ok := (Catalog{}).Lookup(kind)
-			if !ok {
-				t.Fatal("profile missing")
-			}
-			agent := v1.Agent{Model: "real-model"}
-			agent.MultiAgent.Enabled = true
-			for _, placement := range []string{"none", "openai_hosted", "self_hosted"} {
-				if err := profile.ValidateConfiguration(agent, &v1.Environment{Type: placement}); err != nil {
-					t.Fatal(placement, err)
-				}
-			}
-			// Public functions and MCP remain independently qualified capabilities; new
-			// child observation support does not automatically admit their combinations.
-			if kind == "mcode" {
-				return
-			} // Its existing tool profile rejects both for every Session.
-			for _, tool := range []string{`{"type":"function","name":"f"}`, `{"type":"mcp","server_label":"s"}`} {
-				agent.Tools = []json.RawMessage{json.RawMessage(tool)}
-				if err := profile.ValidateConfiguration(agent, &v1.Environment{Type: "none"}); err == nil {
-					t.Fatal("unqualified multi-agent combination accepted", tool)
-				}
-				agent.MultiAgent.Enabled = false
-				if err := profile.ValidateConfiguration(agent, &v1.Environment{Type: "none"}); err != nil {
-					t.Fatal("single-agent profile changed", err)
-				}
-				agent.MultiAgent.Enabled = true
-			}
-		})
-	}
-}
diff --git a/services/core/internal/execution/artifact_workspace_observation_test.go b/services/core/internal/execution/artifact_workspace_observation_test.go
index 6c6bb1915..d8d9204cf 100644
--- a/services/core/internal/execution/artifact_workspace_observation_test.go
+++ b/services/core/internal/execution/artifact_workspace_observation_test.go
@@ -60,7 +60,7 @@ func TestArtifactWorkspaceScopePreservesPreparationAndRelease(t *testing.T) {
 		t.Run(mode, func(t *testing.T) {
 			logs := captureExecutionLogs(t)
 			conn := &artifactWorkspaceConn{executionTraceConn: &executionTraceConn{closed: make(chan struct{})}, replies: make(chan []byte, 4), failed: mode == "prepare_failure"}
-			peer := runtimegateway.NewSessionWithOwner(conn, "device", "tenant", "test", runtimegateway.NewRegistry(), func(string, ...any) {}, nil)
+			peer := runtimegateway.NewSession(conn, "device", "tenant", "test", runtimegateway.NewRegistry(), func(string, ...any) {})
 			peer.Start()
 			defer peer.Close("test")
 			session := sessions.Session{ID: "session", TenantID: "tenant", Engine: "codex"}
diff --git a/services/core/internal/execution/artifacts_timeout_test.go b/services/core/internal/execution/artifacts_timeout_test.go
index 57a1eb458..1dae9945e 100644
--- a/services/core/internal/execution/artifacts_timeout_test.go
+++ b/services/core/internal/execution/artifacts_timeout_test.go
@@ -92,7 +92,7 @@ func TestReadOnlyReleaseAcceptsExpiredCleanupAfterLongExport(t *testing.T) {
 			synctest.Test(t, func(t *testing.T) {
 				// No transport goroutines are needed: Send queues the release and the
 				// correlated typed terminal receipt is already available to the caller.
-				peer := runtimegateway.NewSessionWithOwner(nil, "device", "tenant", "test", nil, nil, nil)
+				peer := runtimegateway.NewSession(nil, "device", "tenant", "test", nil, nil)
 				replies := make(chan proto.Envelope, 1)
 				env, err := proto.NewEnvelope(proto.TypePreparationStatus, "prepare", proto.PreparationStatusPayload{Handle: test.handle, Revision: 3, State: test.state, RunID: test.run, ErrorCode: test.code})
 				if err != nil {
@@ -152,7 +152,7 @@ func TestPreparedWorkspaceRetainsConsumeResultAfterExpiredCleanup(t *testing.T)
 		t.Run(fmt.Sprint(failed), func(t *testing.T) {
 			synctest.Test(t, func(t *testing.T) {
 				conn := &expiredPreparationConn{inbound: make(chan []byte, 4), closed: make(chan struct{})}
-				peer := runtimegateway.NewSessionWithOwner(conn, "device", "tenant", "test", runtimegateway.NewRegistry(), func(string, ...any) {}, nil)
+				peer := runtimegateway.NewSession(conn, "device", "tenant", "test", runtimegateway.NewRegistry(), func(string, ...any) {})
 				peer.Start()
 				defer peer.Close("test")
 				sentinel := errors.New("capture failed")
diff --git a/services/core/internal/execution/blank_text_test.go b/services/core/internal/execution/blank_text_test.go
deleted file mode 100644
index 05587b054..000000000
--- a/services/core/internal/execution/blank_text_test.go
+++ /dev/null
@@ -1,69 +0,0 @@
-package execution
-
-import (
-	"encoding/json"
-	"errors"
-	"os"
-	"strconv"
-	"strings"
-	"testing"
-	"unicode"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-)
-
-// The Claude bridge test reads the same table, so both sides must agree on
-// every member and non-member.
-func TestBlankTextMatchesClaudeBridgeTable(t *testing.T) {
-	raw, err := os.ReadFile("../../../../packages/claude-sdk-adapter/tests/blank-text.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var table struct {
-		Members    []string `json:"members"`
-		NonMembers []string `json:"non_members"`
-	}
-	if err := json.Unmarshal(raw, &table); err != nil {
-		t.Fatal(err)
-	}
-	parse := func(values []string) map[rune]bool {
-		set := map[rune]bool{}
-		for _, value := range values {
-			code, err := strconv.ParseUint(strings.TrimPrefix(value, "U+"), 16, 32)
-			if err != nil {
-				t.Fatal(value, err)
-			}
-			set[rune(code)] = true
-		}
-		return set
-	}
-	members, nonMembers := parse(table.Members), parse(table.NonMembers)
-	if len(members) != 26 || !members['\ufeff'] || !members['\u0085'] || !nonMembers['\u200b'] || !nonMembers['\u180e'] {
-		t.Fatalf("unexpected table: %v %v", members, nonMembers)
-	}
-	for r := rune(0); r <= unicode.MaxRune; r++ {
-		if blankTextRune(r) != members[r] {
-			t.Fatalf("U+%04X: predicate %v, table %v", r, blankTextRune(r), members[r])
-		}
-		if unicode.IsSpace(r) && !members[r] {
-			t.Fatalf("U+%04X is Go whitespace but not in the table", r)
-		}
-	}
-	claude, _ := (engine.Catalog{}).Lookup("claude_sdk")
-	var all strings.Builder
-	for r := range members {
-		all.WriteRune(r)
-		if !errors.Is(validateMessageTextProfile(claude, proto.TextInput(string(r))), ErrWhitespaceOnlyText) {
-			t.Fatalf("U+%04X admitted", r)
-		}
-	}
-	if !errors.Is(validateMessageTextProfile(claude, proto.TextInput(all.String())), ErrWhitespaceOnlyText) {
-		t.Fatal("all members admitted")
-	}
-	for r := range nonMembers {
-		if err := validateMessageTextProfile(claude, proto.TextInput(" "+string(r)+"\ufeff")); err != nil {
-			t.Fatalf("U+%04X rejected: %v", r, err)
-		}
-	}
-}
diff --git a/services/core/internal/execution/boundary_delivery_qa_test.go b/services/core/internal/execution/boundary_delivery_qa_test.go
index 4d4ad0cf2..21e5a0f74 100644
--- a/services/core/internal/execution/boundary_delivery_qa_test.go
+++ b/services/core/internal/execution/boundary_delivery_qa_test.go
@@ -59,7 +59,7 @@ func TestQAActualDeliveryFourFlushTriggers(t *testing.T) {
 			receipt := f.start(t)
 			f.dispatcher.SessionsReader = sessionpg.New(pgunit.NewPool(f.pool), nil)
 			conn := &qaBoundaryConn{artifactWorkspaceConn: &artifactWorkspaceConn{executionTraceConn: &executionTraceConn{closed: make(chan struct{})}, replies: make(chan []byte, 100)}, trigger: trigger}
-			peer := runtimegateway.NewSessionWithOwner(conn, "device", f.tenant, "test", runtimegateway.NewRegistry(), func(string, ...any) {}, nil)
+			peer := runtimegateway.NewSession(conn, "device", f.tenant, "test", runtimegateway.NewRegistry(), func(string, ...any) {})
 			peer.Start()
 			defer peer.Close("test")
 			ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
diff --git a/services/core/internal/execution/controls.go b/services/core/internal/execution/controls.go
new file mode 100644
index 000000000..b9ebf371a
--- /dev/null
+++ b/services/core/internal/execution/controls.go
@@ -0,0 +1,31 @@
+package execution
+
+import (
+	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+)
+
+// executionControls assembles the official execution options for the Runtime.
+// It carries a value only when the Session sets it or the official API defines
+// a default (text verbosity medium, web_search context_size medium); everything
+// else is absent and follows the Harness's native default. Auto service tier
+// means unset.
+func executionControls(agent v1.Agent, tools executionToolSet) *proto.ExecutionControls {
+	controls := &proto.ExecutionControls{WebSearch: tools.WebSearch, ProgrammaticToolCalling: tools.ProgrammaticToolCalling, TextVerbosity: agent.Text.Verbosity}
+	if controls.TextVerbosity == "" {
+		controls.TextVerbosity = "medium"
+	}
+	if agent.Reasoning.Effort != nil {
+		controls.ReasoningEffort = *agent.Reasoning.Effort
+	}
+	if agent.Reasoning.Summary != nil {
+		controls.ReasoningSummary = *agent.Reasoning.Summary
+	}
+	if agent.ServiceTier != "auto" {
+		controls.ServiceTier = agent.ServiceTier
+	}
+	if agent.Text.Format.Type == "json_schema" {
+		controls.OutputFormat = &proto.OutputFormat{Type: "json_schema", Schema: agent.Text.Format.Schema}
+	}
+	return controls
+}
diff --git a/services/core/internal/execution/controls_test.go b/services/core/internal/execution/controls_test.go
new file mode 100644
index 000000000..7bfc57455
--- /dev/null
+++ b/services/core/internal/execution/controls_test.go
@@ -0,0 +1,99 @@
+package execution
+
+import (
+	"encoding/json"
+	"reflect"
+	"strings"
+	"testing"
+
+	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/harnesstest"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimedevice"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
+)
+
+func sessionConfiguration(agent string) json.RawMessage {
+	return json.RawMessage(`{"agent":` + agent + `,"environment":{"type":"none"}}`)
+}
+
+// Admission asks the Harness declaration alone: Core holds no per-Harness rule.
+func TestAdmissionValidatesOfficialOptionsAgainstTheDeclaration(t *testing.T) {
+	declared := harnesstest.Declaration("declared", func(d *harnessconfig.Declaration) {
+		d.Execution = harnessconfig.ExecutionOptions{
+			WebSearchModes: []string{"live"}, WebSearchSettings: true, ReasoningEfforts: []string{"high"}, ReasoningSummaries: []string{"auto"},
+			ServiceTiers: []string{"flex"}, ProgrammaticToolCalling: []bool{true}, TextVerbosities: []string{"medium", "high"},
+		}
+	})
+	bare := harnesstest.Declaration("bare", nil)
+	policy := Policy{Declarations: harnessconfig.NewRegistry(declared, bare)}
+	for _, tc := range []struct {
+		agent        string
+		declared, ok bool
+		field        string
+	}{
+		{`{"model":"m"}`, true, true, ""},
+		{`{"model":"m"}`, false, true, ""},
+		{`{"model":"m","tools":[{"type":"web_search","mode":"live","context_size":"high","allowed_domains":["a.example"],"location":{"city":"Paris"}}]}`, true, true, ""},
+		{`{"model":"m","tools":[{"type":"web_search","mode":"live","context_size":"medium","allowed_domains":null,"location":null}]}`, false, false, "web_search.mode"},
+		{`{"model":"m","tools":[{"type":"web_search","mode":"cached","context_size":"medium","allowed_domains":null,"location":null}]}`, true, false, "web_search.mode"},
+		{`{"model":"m","tools":[{"type":"programmatic_tool_calling","enabled":true}]}`, true, true, ""},
+		{`{"model":"m","tools":[{"type":"programmatic_tool_calling","enabled":false}]}`, true, false, "programmatic_tool_calling"},
+		{`{"model":"m","tools":[{"type":"programmatic_tool_calling","enabled":true}]}`, false, false, "programmatic_tool_calling"},
+		{`{"model":"m","reasoning":{"effort":"high","summary":"auto"},"service_tier":"flex","text":{"verbosity":"high"}}`, true, true, ""},
+		{`{"model":"m","reasoning":{"effort":"max"}}`, true, false, "reasoning.effort"},
+		{`{"model":"m","reasoning":{"summary":"concise"}}`, true, false, "reasoning.summary"},
+		{`{"model":"m","service_tier":"priority"}`, true, false, "service_tier"},
+		{`{"model":"m","service_tier":"auto"}`, false, true, ""},
+		{`{"model":"m","service_tier":"flex"}`, false, false, "service_tier"},
+		{`{"model":"m","text":{"verbosity":"low"}}`, true, false, "text.verbosity"},
+	} {
+		kind := "bare"
+		if tc.declared {
+			kind = "declared"
+		}
+		err := policy.ValidateSessionConfiguration(kind, sessionConfiguration(tc.agent))
+		if (err == nil) != tc.ok || (err != nil && !strings.Contains(err.Error(), tc.field)) {
+			t.Fatalf("%s %s: %v", kind, tc.agent, err)
+		}
+	}
+}
+
+func TestExecutionControlsCarryOnlyOfficialValues(t *testing.T) {
+	enabled, disabled := true, false
+	effort, summary := "max", "detailed"
+	for _, tc := range []struct {
+		name  string
+		agent v1.Agent
+		want  proto.ExecutionControls
+	}{
+		{"nothing set", v1.Agent{Model: "m", ServiceTier: "auto"}, proto.ExecutionControls{TextVerbosity: "medium"}},
+		{"unset tier from an empty snapshot", v1.Agent{Model: "m"}, proto.ExecutionControls{TextVerbosity: "medium"}},
+		{"set values", v1.Agent{Model: "m", ServiceTier: "flex", Reasoning: v1.Reasoning{Effort: &effort, Summary: &summary}, Text: v1.TextConfig{Verbosity: "low"}},
+			proto.ExecutionControls{TextVerbosity: "low", ServiceTier: "flex", ReasoningEffort: "max", ReasoningSummary: "detailed"}},
+		{"tools", v1.Agent{Model: "m", Tools: []json.RawMessage{
+			json.RawMessage(`{"type":"web_search","mode":"cached","context_size":"high","allowed_domains":[],"location":{"city":"Paris","country":null,"region":null,"timezone":null}}`),
+			json.RawMessage(`{"type":"programmatic_tool_calling","enabled":false}`)}},
+			proto.ExecutionControls{TextVerbosity: "medium", ProgrammaticToolCalling: &disabled, WebSearch: &proto.WebSearchControl{Mode: "cached", ContextSize: "high", AllowedDomains: []string{},
+				Location: &proto.SearchLocation{City: func() *string { s := "Paris"; return &s }()}}}},
+		{"empty location is absent", v1.Agent{Model: "m", Tools: []json.RawMessage{
+			json.RawMessage(`{"type":"web_search","mode":"live","context_size":"medium","allowed_domains":null,"location":{"city":null,"country":null,"region":null,"timezone":null}}`),
+			json.RawMessage(`{"type":"programmatic_tool_calling","enabled":true}`)}},
+			proto.ExecutionControls{TextVerbosity: "medium", ProgrammaticToolCalling: &enabled, WebSearch: &proto.WebSearchControl{Mode: "live", ContextSize: "medium"}}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			snapshot := Snapshot{Agent: tc.agent}
+			before, _ := json.Marshal(snapshot)
+			for _, nativeID := range []string{"", "native-session"} {
+				request, err := (&Dispatcher{}).executionRequest(t.Context(), sessions.Session{ID: "session"}, snapshot, runtimedevice.KindCapabilities{}, sessions.ExecutionBinding{NativeSessionID: nativeID})
+				if err != nil || !reflect.DeepEqual(*request.ExecutionControls, tc.want) || request.AgentSessionID != nativeID {
+					t.Fatalf("%+v %v", request.ExecutionControls, err)
+				}
+			}
+			if after, _ := json.Marshal(snapshot); string(before) != string(after) {
+				t.Fatal("snapshot mutated")
+			}
+		})
+	}
+}
diff --git a/services/core/internal/execution/delivery.go b/services/core/internal/execution/delivery.go
index d9c8aa18f..2de10d1e5 100644
--- a/services/core/internal/execution/delivery.go
+++ b/services/core/internal/execution/delivery.go
@@ -126,7 +126,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 	var pending *pendingInput
 	var cancelSent time.Time
 	var cancelReply <-chan cancellationResult
-	functions := &functionExchange{kind: request.AgentKind, turns: d.SessionsReader, sessions: d.sessionExecution, tenant: tenantID, session: sessionID, turn: runID, tools: request.FunctionTools}
+	functions := &functionExchange{kind: request.AgentKind, turns: d.SessionsReader, sessions: d.sessionExecution, tenant: tenantID, session: sessionID, turn: runID, tools: request.FunctionTools, abandoned: map[string]bool{}}
 	done := false
 	cancelCtx, stopCancellation := context.WithCancel(ctx)
 	defer stopCancellation()
@@ -254,12 +254,16 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 			case proto.TypeDone:
 				// Done closes the event subscription; application receipts have a separate waiter.
 				done, upstream = true, nil
-			case proto.TypeFunctionCall:
+			case proto.TypeFunctionCall, proto.TypeFunctionCallWithdrawn:
 				if err := journal.flushObserved(ctx, "function_call"); err != nil {
 					result.ErrorCode = "event_persistence_failed"
 					return
 				}
-				if err := functions.record(ctx, env); err != nil {
+				settle := functions.record
+				if env.Type == proto.TypeFunctionCallWithdrawn {
+					settle = functions.withdraw
+				}
+				if err := settle(ctx, env); err != nil {
 					result.ErrorCode = "function_call_invalid"
 					return
 				}
@@ -366,7 +370,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 					result.ErrorCode = "message_input_unsupported"
 					return
 				}
-				if send(ctx, peer, proto.TypePromptSteer, runID, proto.PromptSteerPayload{InputID: strconv.FormatInt(pending.sequence, 10), Input: pending.input, DurableReceipt: true}) != nil {
+				if send(ctx, peer, proto.TypePromptSteer, runID, proto.PromptSteerPayload{InputID: strconv.FormatInt(pending.sequence, 10), Input: pending.input}) != nil {
 					result.ErrorCode = "input_outcome_unknown"
 					return
 				}
diff --git a/services/core/internal/execution/delivery_terminal_observation_test.go b/services/core/internal/execution/delivery_terminal_observation_test.go
index fe272e813..69f3b33b9 100644
--- a/services/core/internal/execution/delivery_terminal_observation_test.go
+++ b/services/core/internal/execution/delivery_terminal_observation_test.go
@@ -58,7 +58,7 @@ func TestDeliveryTerminalActualPath(t *testing.T) {
 			receipt := f.start(t)
 			f.dispatcher.SessionsReader = sessionpg.New(pgunit.NewPool(f.pool), nil)
 			conn := &terminalDeliveryConn{artifactWorkspaceConn: &artifactWorkspaceConn{executionTraceConn: &executionTraceConn{closed: make(chan struct{})}, replies: make(chan []byte, 8)}, mode: mode}
-			peer := runtimegateway.NewSessionWithOwner(conn, "device", f.tenant, "test", runtimegateway.NewRegistry(), func(string, ...any) {}, nil)
+			peer := runtimegateway.NewSession(conn, "device", f.tenant, "test", runtimegateway.NewRegistry(), func(string, ...any) {})
 			peer.Start()
 			defer peer.Close("test")
 			ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
@@ -112,7 +112,7 @@ func TestDeliveryTerminalActualPath(t *testing.T) {
 				t.Fatalf("boundaries=%s want=%s", gotJSON, wantJSON)
 			}
 			if mode != "start_failure" {
-				ended, err := f.dispatcher.finishRun(f.tenant, f.session.ID, receipt.TurnID, "fixture", result, status)
+				ended, err := f.dispatcher.finishRun(f.tenant, f.session.ID, receipt.TurnID, result, status)
 				if err != nil || ended.Status != sessions.TurnCompleted {
 					t.Fatal("delivery journal cannot settle", err)
 				}
diff --git a/services/core/internal/execution/deployment_fixture_test.go b/services/core/internal/execution/deployment_fixture_test.go
index 0aa389d13..e6c9da6d8 100644
--- a/services/core/internal/execution/deployment_fixture_test.go
+++ b/services/core/internal/execution/deployment_fixture_test.go
@@ -3,7 +3,7 @@ package execution
 import (
 	"context"
 	"errors"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"testing"
 	"time"
 
@@ -69,7 +69,7 @@ func deploymentOperations(t *testing.T, storage deployment.Storage, reader deplo
 	if err != nil {
 		t.Fatal(err)
 	}
-	operations, err := deployment.NewExecutionOperations(service, execution, engine.Catalog{})
+	operations, err := deployment.NewExecutionOperations(service, execution, builtin.Registry())
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/internal/execution/deployment_provider_observations_test.go b/services/core/internal/execution/deployment_provider_observations_test.go
index b1240173f..1eb032221 100644
--- a/services/core/internal/execution/deployment_provider_observations_test.go
+++ b/services/core/internal/execution/deployment_provider_observations_test.go
@@ -120,7 +120,7 @@ func TestFinishRunObservesOnlyFinalCommittedOutcome(t *testing.T) {
 			if tc.invalid {
 				result.Error = strings.Repeat("x", 513*1024)
 			}
-			turn, err := f.dispatcher.finishRun(f.tenant, f.session.ID, receipt.TurnID, "fixture-model", result, tc.status)
+			turn, err := f.dispatcher.finishRun(f.tenant, f.session.ID, receipt.TurnID, result, tc.status)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -136,7 +136,7 @@ func TestFinishRunObservesOnlyFinalCommittedOutcome(t *testing.T) {
 			if _, err = f.pool.Exec(t.Context(), "UPDATE deployment_model_providers SET last_used_at=NULL,last_error_at=NULL,last_error_code=NULL,recovery_pending=false"); err != nil {
 				t.Fatal(err)
 			}
-			_, err = f.dispatcher.finishRun(f.tenant, f.session.ID, receipt.TurnID, "fixture-model", result, tc.status)
+			_, err = f.dispatcher.finishRun(f.tenant, f.session.ID, receipt.TurnID, result, tc.status)
 			if !errors.Is(err, sessions.ErrTurnConflict) {
 				t.Fatal("expected completion conflict", err)
 			}
@@ -211,7 +211,7 @@ func TestFinishRunObservationLockTimeoutAndFailureKeepLease(t *testing.T) {
 				defer cleanup()
 			}
 			started := time.Now()
-			turn, err := f.dispatcher.finishRun(f.tenant, f.session.ID, receipt.TurnID, "fixture-model", Result{AppliedThrough: receipt.Sequence}, sessions.TurnCompleted)
+			turn, err := f.dispatcher.finishRun(f.tenant, f.session.ID, receipt.TurnID, Result{AppliedThrough: receipt.Sequence}, sessions.TurnCompleted)
 			elapsed := time.Since(started)
 			if err != nil || turn.Status != sessions.TurnCompleted {
 				t.Fatal("observation changed commit result", err, turn.Status)
diff --git a/services/core/internal/execution/directory_preparation.go b/services/core/internal/execution/directory_preparation.go
index b39d62b6d..803d1ccba 100644
--- a/services/core/internal/execution/directory_preparation.go
+++ b/services/core/internal/execution/directory_preparation.go
@@ -32,7 +32,7 @@ func (d *Dispatcher) withPreparedWorkspace(owner context.Context, peer *runtimeg
 			observeArtifactWorkspace(owner, "artifact_workspace_prepare", prepareStarted, ErrExecutionUnavailable)
 		}
 	}()
-	req := proto.PromptRequestPayload{AgentKind: session.Engine, AgentStateKey: "agents-api-" + session.ID, WorkspaceReadOnly: true}
+	req := proto.PromptRequestPayload{AgentKind: session.Engine, AgentStateKey: session.ID, WorkspaceReadOnly: true}
 	if err := d.configurePreparedEnvironment(session, environment, bound, &req); err != nil {
 		return ErrExecutionUnavailable
 	}
diff --git a/services/core/internal/execution/disabled_tools_test.go b/services/core/internal/execution/disabled_tools_test.go
deleted file mode 100644
index 53aa85f46..000000000
--- a/services/core/internal/execution/disabled_tools_test.go
+++ /dev/null
@@ -1,84 +0,0 @@
-package execution
-
-import (
-	"encoding/json"
-	"testing"
-
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine/enginetest"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimedevice"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
-)
-
-func TestDisabledToolsUseCommonOperationQualification(t *testing.T) {
-	raw := json.RawMessage(`{"agent":{"model":"model","tools":[{"type":"web_search","mode":"disabled"},{"type":"programmatic_tool_calling","enabled":false}]},"environment":{"type":"none"}}`)
-	for _, kind := range []string{"codex", "claude_sdk", "mcode"} {
-		if err := (Policy{}).ValidateSessionConfiguration(kind, raw); err != nil {
-			t.Fatal(kind, err)
-		}
-	}
-	for _, qualified := range []bool{false, true} {
-		policy := Policy{Engines: engine.NewCatalog(map[string]engine.Profile{"new_harness": enginetest.Profile(func(p *engine.Profile) { p.ProgrammaticToolCallingDisable = proto.CapabilityFromBool(qualified) })})}
-		if err := policy.ValidateSessionConfiguration("new_harness", raw); (err == nil) != qualified {
-			t.Fatal("qualification differs", qualified, err)
-		}
-		if err := policy.ValidateSessionConfiguration("new_harness", json.RawMessage(`{"agent":{"model":"model"},"environment":{"type":"none"}}`)); err != nil {
-			t.Fatal("omission acquired a new prerequisite", err)
-		}
-	}
-}
-
-func TestDisabledToolRequestPreservesIntentOnResume(t *testing.T) {
-	for _, disabled := range []bool{false, true} {
-		snapshot := Snapshot{Agent: v1.Agent{Model: "model"}}
-		if disabled {
-			snapshot.Agent.Tools = []json.RawMessage{json.RawMessage(`{"type":"programmatic_tool_calling","enabled":false}`)}
-		}
-		before, _ := json.Marshal(snapshot)
-		for _, nativeID := range []string{"", "native-session"} {
-			request, err := (&Dispatcher{}).executionRequest(t.Context(), sessions.Session{ID: "session"}, snapshot, runtimedevice.KindCapabilities{}, sessions.ExecutionBinding{NativeSessionID: nativeID})
-			if err != nil || request.ExecutionControls.DisableProgrammaticToolCalling != disabled || request.ExecutionControls.WebSearch != "disabled" || request.AgentSessionID != nativeID {
-				t.Fatal(request, err)
-			}
-			if request.ValidateProgrammaticToolCallingDisable(true) != nil || (request.ValidateProgrammaticToolCallingDisable(false) != nil) != disabled {
-				t.Fatal("runtime operation qualification differs")
-			}
-		}
-		after, _ := json.Marshal(snapshot)
-		if string(before) != string(after) {
-			t.Fatal("snapshot mutated")
-		}
-	}
-}
-
-// TV-05: saved Agents store enabled and omitted-mode search, but such a snapshot
-// fails admission qualification, device selection/preclaim tool decoding and
-// dispatch request construction.
-func TestEnabledWebSearchNeverReachesDispatch(t *testing.T) {
-	for _, tool := range []string{
-		`{"type":"web_search","mode":"live","context_size":"medium","allowed_domains":null,"location":null}`,
-		`{"type":"web_search","mode":"cached","context_size":"medium","allowed_domains":null,"location":null}`,
-		`{"type":"web_search","context_size":"medium","allowed_domains":null,"location":null}`,
-		`{"type":"web_search","mode":null}`,
-	} {
-		tools := []json.RawMessage{json.RawMessage(tool)}
-		if _, err := executionTools(tools); err == nil || err.Error() != "only disabled web search is qualified for execution" {
-			t.Fatal(tool, err)
-		}
-		snapshot := Snapshot{Agent: v1.Agent{Model: "model", Tools: tools}}
-		if _, err := (&Dispatcher{}).executionRequest(t.Context(), sessions.Session{ID: "session"}, snapshot, runtimedevice.KindCapabilities{}, sessions.ExecutionBinding{}); err == nil {
-			t.Fatal("dispatch request built for", tool)
-		}
-		raw := json.RawMessage(`{"agent":{"model":"model","tools":[` + tool + `]},"environment":{"type":"none"}}`)
-		for _, kind := range []string{"codex", "claude_sdk", "mcode"} {
-			if err := (Policy{}).ValidateSessionConfiguration(kind, raw); err == nil {
-				t.Fatal(kind, "admitted", tool)
-			}
-		}
-	}
-	if _, err := executionTools([]json.RawMessage{json.RawMessage(`{"type":"web_search","mode":"disabled","context_size":"medium","allowed_domains":null,"location":null}`)}); err != nil {
-		t.Fatal(err)
-	}
-}
diff --git a/services/core/internal/execution/dispatcher.go b/services/core/internal/execution/dispatcher.go
index 8516f2b21..a7b65551c 100644
--- a/services/core/internal/execution/dispatcher.go
+++ b/services/core/internal/execution/dispatcher.go
@@ -5,7 +5,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"strings"
 	"time"
 
 	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
@@ -22,7 +21,7 @@ import (
 type Snapshot struct {
 	ModelProviderConfigured bool                          `json:"model_provider_configured,omitempty"`
 	Agent                   v1.Agent                      `json:"agent"`
-	Environment             *v1.Environment               `json:"environment"`
+	Environment             v1.Environment                `json:"environment"`
 	VaultIDs                []string                      `json:"vault_ids,omitempty"`
 	MCPCredentials          []vaults.MCPCredentialBinding `json:"mcp_credentials,omitempty"`
 }
@@ -93,7 +92,7 @@ func (d *Dispatcher) Run(ctx context.Context, tenantID, sessionID, turnID string
 		return sessions.Turn{}, err
 	}
 	var snapshot Snapshot
-	if json.Unmarshal(session.Configuration, &snapshot) != nil || strings.TrimSpace(snapshot.Agent.Model) == "" {
+	if json.Unmarshal(session.Configuration, &snapshot) != nil {
 		return sessions.Turn{}, sessions.ErrInvalidInput
 	}
 	caps, err := d.engineCapabilities(ctx, peer, session.Engine, snapshot)
@@ -125,17 +124,14 @@ func (d *Dispatcher) Run(ctx context.Context, tenantID, sessionID, turnID string
 	}
 	release, err := peer.TrackExecutionDelivery(turnID)
 	if err != nil {
-		return d.finishRun(tenantID, sessionID, turnID, snapshot.Agent.Model, Result{ErrorCode: "delivery_unknown", AppliedThrough: through}, sessions.TurnFailed)
+		return d.finishRun(tenantID, sessionID, turnID, Result{ErrorCode: "delivery_unknown", AppliedThrough: through}, sessions.TurnFailed)
 	}
 	defer release()
 	result, status := d.deliver(ctx, tenantID, sessionID, peer, req, turnID, text, through, prepared)
-	return d.finishRun(tenantID, sessionID, turnID, snapshot.Agent.Model, result, status)
+	return d.finishRun(tenantID, sessionID, turnID, result, status)
 }
 
-func (d *Dispatcher) finishRun(tenantID, sessionID, turnID, model string, result Result, status string) (sessions.Turn, error) {
-	if result.Done.Usage.Model == "" {
-		result.Done.Usage.Model = model
-	}
+func (d *Dispatcher) finishRun(tenantID, sessionID, turnID string, result Result, status string) (sessions.Turn, error) {
 	nativeID, _ := result.Done.Metadata[proto.DoneMetaAgentSessionID].(string)
 	finishCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
diff --git a/services/core/internal/execution/engine_profile.go b/services/core/internal/execution/engine_profile.go
deleted file mode 100644
index 15b60fc6c..000000000
--- a/services/core/internal/execution/engine_profile.go
+++ /dev/null
@@ -1,84 +0,0 @@
-package execution
-
-import (
-	"encoding/json"
-	"errors"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
-)
-
-func profileError(err error) error {
-	if errors.Is(err, engine.ErrInvalidInput) {
-		return sessions.ErrInvalidInput
-	}
-	return err
-}
-
-func validateProfileConfiguration(profile engine.Profile, snapshot Snapshot) error {
-	if snapshot.Agent.Text.Format.Type == "json_schema" && !profile.StructuredOutput.IsSupported() {
-		return errors.New("Structured output is not qualified for this engine.")
-	}
-	if profile.ConfigurationValidation == engine.AdditionalValidation {
-		if err := profile.ValidateConfiguration(snapshot.Agent, snapshot.Environment); err != nil {
-			return profileError(err)
-		}
-	}
-	tools, err := executionTools(snapshot.Agent.Tools)
-	// Preserve each profile's admission error precedence when tool decoding fails.
-	if profile.ConfigurationValidation == engine.AdditionalValidation && err != nil {
-		return err
-	}
-	if err == nil {
-		if err := profile.ValidateMCPOrigins(snapshot.Environment, tools.MCP); err != nil {
-			return err
-		}
-		if tools.DisableProgrammatic && !profile.ProgrammaticToolCallingDisable.IsSupported() {
-			return errors.New("Disabling programmatic tool calling is not qualified for this engine.")
-		}
-		request := proto.PromptRequestPayload{ToolSearch: tools.Search, FunctionTools: tools.Functions}
-		if err := request.ValidateToolSearch(profile.ToolSearch.IsSupported()); err != nil {
-			return err
-		}
-	}
-	if profile.ToolsValidation == engine.AdditionalValidation {
-		if validationErr := profile.ValidateTools(snapshot.Environment, tools.Functions, tools.MCP); validationErr != nil {
-			return profileError(validationErr)
-		}
-	}
-	return err
-}
-
-func validateProfileInputs(profile engine.Profile, placement string, inputs []sessions.Input) error {
-	for _, input := range inputs {
-		if input.Kind == "message" {
-			messages, err := messageInput(input.Payload)
-			if err != nil {
-				return err
-			}
-			if err := validateMessageImageProfile(profile, placement, messages); err != nil {
-				return err
-			}
-			if err := validateMessageTextProfile(profile, messages); err != nil {
-				return err
-			}
-			continue
-		}
-		if input.Kind != "tool_result" || profile.FunctionResultValidation == engine.CommonValidationOnly {
-			continue
-		}
-		var value sessions.FunctionResultInput
-		if json.Unmarshal(input.Payload, &value) != nil {
-			return sessions.ErrInvalidInput
-		}
-		result, err := functionResult(sessions.FunctionCall{CallID: value.CallID, Result: value.Result})
-		if err != nil {
-			return sessions.ErrInvalidInput
-		}
-		if err := profile.ValidateFunctionResult(placement, result); err != nil {
-			return profileError(err)
-		}
-	}
-	return nil
-}
diff --git a/services/core/internal/execution/engine_profile_test.go b/services/core/internal/execution/engine_profile_test.go
deleted file mode 100644
index 8a41be47b..000000000
--- a/services/core/internal/execution/engine_profile_test.go
+++ /dev/null
@@ -1,179 +0,0 @@
-package execution
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"testing"
-
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine/enginetest"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
-)
-
-func TestAcceptedEnginePlacements(t *testing.T) {
-	for _, engine := range []string{"codex", "claude_sdk", "mcode", "unregistered"} {
-		for _, placement := range []string{"none", "openai_hosted", "self_hosted"} {
-			raw := json.RawMessage(`{"agent":{"model":"fixture"},"environment":{"type":"` + placement + `"`)
-			if placement == "self_hosted" {
-				raw = append(raw, []byte(`,"workspace_directory":"/workspace"`)...)
-			}
-			raw = append(raw, []byte(`}}`)...)
-			want := engine != "unregistered"
-			if err := (Policy{}).ValidateSessionConfiguration(engine, raw); (err == nil) != want {
-				t.Fatalf("%s/%s: %v", engine, placement, err)
-			}
-		}
-	}
-}
-
-func TestAdditionalProfileUsesCommonAdmission(t *testing.T) {
-	configurationChecked, toolsChecked, resultChecked := false, false, false
-	profile := enginetest.Profile(nil)
-	profile.ConfigurationValidation = engine.AdditionalValidation
-	profile.ToolsValidation = engine.AdditionalValidation
-	profile.FunctionResultValidation = engine.AdditionalValidation
-	profile.ValidateConfiguration = func(agent v1.Agent, environment *v1.Environment) error {
-		configurationChecked = true
-		if agent.Model != "fixture" || environment == nil {
-			return engine.ErrInvalidInput
-		}
-		return nil
-	}
-	profile.ValidateTools = func(_ *v1.Environment, tools []proto.FunctionTool, mcp []proto.MCPHTTPServer) error {
-		toolsChecked = true
-		if len(tools) != 1 || tools[0].Name != "echo" || len(mcp) != 0 {
-			t.Fatal("common tool decoding did not reach profile")
-		}
-		return nil
-	}
-	profile.ValidateFunctionResult = func(placement string, result proto.FunctionResultPayload) error {
-		content := result.Content
-		resultChecked = true
-		if placement != "none" || !result.Success || len(content) != 1 || content[0].Text == nil || *content[0].Text != "response" {
-			t.Fatal("common result decoding did not reach profile")
-		}
-		return engine.ErrInvalidInput
-	}
-	catalog := engine.NewCatalog(map[string]engine.Profile{"fixture": profile})
-	profile, ok := catalog.Lookup("fixture")
-	if !ok || !profile.Accepts("none") || profile.Accepts("openai_hosted") {
-		t.Fatal("fixture qualification was not selected")
-	}
-	snapshot := Snapshot{Agent: v1.Agent{Model: "fixture", Tools: []json.RawMessage{json.RawMessage(`{"type":"function","name":"echo","parameters":{"type":"object"}}`)}}, Environment: &v1.Environment{Type: "none"}}
-	if err := validateProfileConfiguration(profile, snapshot); err != nil || !configurationChecked || !toolsChecked {
-		t.Fatal("additional engine admission failed", err)
-	}
-	snapshot.Agent.Model = "invalid"
-	if err := validateProfileConfiguration(profile, snapshot); !errors.Is(err, sessions.ErrInvalidInput) {
-		t.Fatal("profile configuration lost public error mapping", err)
-	}
-	inputs := []sessions.Input{{Kind: "tool_result", Payload: json.RawMessage(`{"call_id":"call","result":{"success":true,"output":"response"}}`)}}
-	if err := validateProfileInputs(profile, "none", inputs); !errors.Is(err, sessions.ErrInvalidInput) || !resultChecked {
-		t.Fatal("profile result lost public error mapping", err)
-	}
-}
-
-func TestClaudeHostedToolsRequireSeparateQualification(t *testing.T) {
-	for index, tools := range []string{`[{"type":"function","name":"f","parameters":{"type":"object"},"defer_loading":false}]`, `[{"type":"mcp","server_label":"s","transport":{"type":"http","server_url":"https://example.test/mcp"},"connection_origin":"service"}]`} {
-		for _, placement := range []string{"none", "openai_hosted"} {
-			raw := json.RawMessage(`{"agent":{"model":"fixture","tools":` + tools + `},"environment":{"type":"` + placement + `"}}`)
-			if err := (Policy{}).ValidateSessionConfiguration("claude_sdk", raw); (err == nil) != (placement == "none" || index == 0) {
-				t.Fatalf("%s: %v", placement, err)
-			}
-		}
-	}
-}
-
-func TestExplicitValidationPoliciesPreserveErrorPrecedence(t *testing.T) {
-	snapshot := Snapshot{Agent: v1.Agent{Tools: []json.RawMessage{json.RawMessage(`{"type":"unknown"}`)}}}
-	_, decodeErr := executionTools(snapshot.Agent.Tools)
-	if decodeErr == nil {
-		t.Fatal("fixture must fail common tool decoding")
-	}
-	configurationErr := errors.New("configuration restriction")
-	toolsErr := errors.New("tools restriction")
-	for _, configuration := range []engine.ValidationPolicy{engine.CommonValidationOnly, engine.AdditionalValidation} {
-		for _, rejectConfiguration := range []bool{false, true} {
-			if configuration == engine.CommonValidationOnly && rejectConfiguration {
-				continue
-			}
-			t.Run(fmt.Sprintf("configuration=%d/reject=%t", configuration, rejectConfiguration), func(t *testing.T) {
-				toolsCalled := false
-				profile := enginetest.Profile(func(p *engine.Profile) {
-					p.ConfigurationValidation = configuration
-					if configuration == engine.AdditionalValidation {
-						p.ValidateConfiguration = func(v1.Agent, *v1.Environment) error {
-							if rejectConfiguration {
-								return configurationErr
-							}
-							return nil
-						}
-					}
-					p.ToolsValidation = engine.AdditionalValidation
-					p.ValidateTools = func(*v1.Environment, []proto.FunctionTool, []proto.MCPHTTPServer) error {
-						toolsCalled = true
-						return toolsErr
-					}
-				})
-				catalog := engine.NewCatalog(map[string]engine.Profile{"fixture": profile})
-				profile, _ = catalog.Lookup("fixture")
-				err := validateProfileConfiguration(profile, snapshot)
-				switch {
-				case rejectConfiguration:
-					if !errors.Is(err, configurationErr) || toolsCalled {
-						t.Fatal("configuration lost precedence", err)
-					}
-				case configuration == engine.AdditionalValidation:
-					if err == nil || err.Error() != decodeErr.Error() || toolsCalled {
-						t.Fatal("decoding lost precedence", err)
-					}
-				default:
-					if !errors.Is(err, toolsErr) || !toolsCalled {
-						t.Fatal("common-only configuration changed tool error precedence", err)
-					}
-				}
-			})
-		}
-	}
-}
-
-func TestCommonOnlyValidationPreservesFunctionResults(t *testing.T) {
-	profile := enginetest.Profile(nil)
-	catalog := engine.NewCatalog(map[string]engine.Profile{"fixture": profile})
-	profile, _ = catalog.Lookup("fixture")
-	inputs := []sessions.Input{{Kind: "tool_result", Payload: json.RawMessage(`{"call_id":"call","result":{"success":true,"output":"response"}}`)}}
-	if err := validateProfileInputs(profile, "none", inputs); err != nil {
-		t.Fatal("common-only result acquired a native restriction", err)
-	}
-}
-
-func TestRetainedNativeHistoryDependsOnExternalWorkspace(t *testing.T) {
-	for _, required := range []bool{false, true} {
-		for _, supported := range []bool{false, true} {
-			if err := sessions.ValidateRetainedHistory(required, supported); (err == nil) != (!required || supported) {
-				t.Fatal(required, supported, err)
-			}
-		}
-	}
-	for _, qualified := range []bool{false, true} {
-		profile := enginetest.Profile(func(p *engine.Profile) {
-			p.Placements = []string{"openai_hosted"}
-			p.RetainedNativeHistory = proto.CapabilityFromBool(qualified)
-		})
-		policy := Policy{Engines: engine.NewCatalog(map[string]engine.Profile{"test_harness": profile})}
-		if err := policy.ValidateSessionConfiguration("test_harness", json.RawMessage(`{"agent":{"model":"fixture"},"environment":{"type":"openai_hosted"}}`)); err != nil {
-			t.Fatal("generic hosted configuration acquired a storage requirement", qualified, err)
-		}
-		for _, external := range []bool{false, true} {
-			for _, runtimeSupported := range []bool{false, true} {
-				err := policy.validateEnvironmentHistory("test_harness", sessions.Environment{ExternalWorkspace: external}, runtimeSupported)
-				if (err == nil) != (!external || qualified && runtimeSupported) {
-					t.Fatal(external, qualified, runtimeSupported, err)
-				}
-			}
-		}
-	}
-}
diff --git a/services/core/internal/execution/environment.go b/services/core/internal/execution/environment.go
index 42eb86f0c..d4f6815a2 100644
--- a/services/core/internal/execution/environment.go
+++ b/services/core/internal/execution/environment.go
@@ -4,5 +4,5 @@ package execution
 // admission: only environment:none Sessions do. Managed and self-hosted
 // Environments run through RunEnvironmentInput.
 func environmentNone(snapshot Snapshot) bool {
-	return snapshot.Environment != nil && snapshot.Environment.Type == "none"
+	return snapshot.Environment.Type == "none"
 }
diff --git a/services/core/internal/execution/environment_admission.go b/services/core/internal/execution/environment_admission.go
index 282dcdb64..21c3197a1 100644
--- a/services/core/internal/execution/environment_admission.go
+++ b/services/core/internal/execution/environment_admission.go
@@ -21,13 +21,13 @@ var (
 
 func preparedEnvironmentConfiguration(configuration json.RawMessage) bool {
 	var snapshot Snapshot
-	return json.Unmarshal(configuration, &snapshot) == nil && snapshot.Environment != nil &&
+	return json.Unmarshal(configuration, &snapshot) == nil &&
 		(snapshot.Environment.Type == "self_hosted" || snapshot.Environment.Type == "openai_hosted")
 }
 
 func (w *Worker) validateEnvironmentAdmission(ctx context.Context, engine string, configuration json.RawMessage) error {
 	var snapshot Snapshot
-	if json.Unmarshal(configuration, &snapshot) != nil || snapshot.Environment == nil {
+	if json.Unmarshal(configuration, &snapshot) != nil {
 		return sessions.ErrInvalidInput
 	}
 	switch snapshot.Environment.Type {
diff --git a/services/core/internal/execution/environment_capability_profiles_test.go b/services/core/internal/execution/environment_capability_profiles_test.go
index 96fef1b16..f75082574 100644
--- a/services/core/internal/execution/environment_capability_profiles_test.go
+++ b/services/core/internal/execution/environment_capability_profiles_test.go
@@ -25,8 +25,8 @@ func TestQualifiedClaudeCapabilitiesDoNotDependOnEnvironmentSource(t *testing.T)
 				}
 				agent["multi_agent"] = map[string]bool{"enabled": true}
 				raw, _ = json.Marshal(map[string]any{"agent": agent, "environment": environment})
-				if err := (Policy{}).ValidateSessionConfiguration("claude_sdk", raw); err == nil {
-					t.Fatalf("%s with Subagents accepted", feature)
+				if err := (Policy{}).ValidateSessionConfiguration("claude_sdk", raw); err != nil {
+					t.Fatalf("%s with Subagents: %v", feature, err)
 				}
 			}
 		})
diff --git a/services/core/internal/execution/environment_placement.go b/services/core/internal/execution/environment_placement.go
index fe57e0ede..148e26fc3 100644
--- a/services/core/internal/execution/environment_placement.go
+++ b/services/core/internal/execution/environment_placement.go
@@ -7,24 +7,23 @@ import (
 	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentcapabilities"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentplugin"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/environmentconfig"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 )
 
+const hostedWorkspaceDirectory = "/workspace"
+
 type environmentPlacement struct {
 	Plugins               []agentplugin.Metadata            `json:"plugins,omitempty"`
 	Skills                []environmentconfig.SkillMetadata `json:"skills,omitempty"`
 	Type                  string                            `json:"type"`
 	ToolEnvironment       bool                              `json:"initialization,omitempty"`
-	NetworkAccess         string                            `json:"-"`
-	AllowedDomains        []string                          `json:"-"`
 	WorkspaceDirectory    string                            `json:"workspace_directory"`
 	CapabilityDirectories []string                          `json:"capability_directories"`
 }
 
-// LocalWorkspaceConfiguration recognizes the qualified stored V1 profile. It
+// LocalWorkspaceConfiguration recognizes a stored V1 profile. It
 // does not provision a Runtime, validate live authority, or admit hosted creation.
 func LocalWorkspaceConfiguration(configuration json.RawMessage) bool {
 	placement, err := parseEnvironmentPlacement(configuration)
@@ -58,7 +57,7 @@ func parseEnvironmentPlacement(configuration json.RawMessage) (environmentPlacem
 		if local.WorkspaceDirectory != "" || agentcapabilities.ValidateDirectories(local.CapabilityDirectories) != nil {
 			return placement, sessions.ErrInvalidInput
 		}
-		placement.WorkspaceDirectory = "/workspace"
+		placement.WorkspaceDirectory = hostedWorkspaceDirectory
 	case "self_hosted":
 		if !validSelfHostedPlacement(placement) {
 			return placement, sessions.ErrInvalidInput
@@ -66,13 +65,6 @@ func parseEnvironmentPlacement(configuration json.RawMessage) (environmentPlacem
 	default:
 		return placement, sessions.ErrInvalidInput
 	}
-	placement.NetworkAccess = "enabled"
-	if local.Network != nil {
-		if (agentnetwork.Policy{Access: local.Network.Access, AllowedDomains: local.Network.AllowedDomains}).Validate() != nil {
-			return placement, sessions.ErrInvalidInput
-		}
-		placement.NetworkAccess, placement.AllowedDomains = local.Network.Access, append([]string(nil), local.Network.AllowedDomains...)
-	}
 	return placement, nil
 }
 
@@ -101,8 +93,6 @@ func (d *Dispatcher) configurePreparedEnvironment(session sessions.Session, envi
 		Capabilities:      len(sources.Skills)+len(sources.Plugins)+len(sources.Directories) > 0,
 		ToolEnvironment:   placement.ToolEnvironment,
 	}
-	req.LocalEnvironment.NetworkAccess = placement.NetworkAccess
-	req.LocalEnvironment.AllowedDomains = append([]string(nil), placement.AllowedDomains...)
 	return nil
 }
 
diff --git a/services/core/internal/execution/environment_placement_test.go b/services/core/internal/execution/environment_placement_test.go
index 4d980e058..2c7504418 100644
--- a/services/core/internal/execution/environment_placement_test.go
+++ b/services/core/internal/execution/environment_placement_test.go
@@ -3,7 +3,6 @@ package execution
 import (
 	"bytes"
 	"encoding/json"
-	"slices"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
@@ -34,9 +33,6 @@ func TestSkillReferenceIdentityStopsAtCoreBoundary(t *testing.T) {
 
 func TestLocalEnvironmentRequiresQualifiedProfileAndExactAuthority(t *testing.T) {
 	for _, configuration := range []string{
-		`{"type":"openai_hosted","network":{}}`,
-		`{"type":"openai_hosted","network":{"access":"restricted"}}`,
-		`{"type":"openai_hosted","network":{"access":"enabled","allowed_domains":["example.com"]}}`,
 		`{"type":"openai_hosted","network":{"access":"disabled","allow":["example.com"]}}`,
 		`{"type":"openai_hosted","network":{"access":"disabled"},"workspace_directory":"/override"}`,
 	} {
@@ -60,23 +56,6 @@ func TestLocalEnvironmentRequiresQualifiedProfileAndExactAuthority(t *testing.T)
 	}
 }
 
-func TestNetworkPolicySurvivesPreparedBinding(t *testing.T) {
-	session := sessions.Session{ID: "session", TenantID: "tenant"}
-	for _, network := range []string{`{"access":"disabled"}`, `{"access":"restricted","allowed_domains":["Example.com","api.example.com"]}`} {
-		environment := sessions.Environment{ID: "environment", SessionID: session.ID, TenantID: session.TenantID,
-			Configuration: []byte(`{"type":"openai_hosted","network":` + network + `}`)}
-		placement, err := parseEnvironmentPlacement(environment.Configuration)
-		if err != nil {
-			t.Fatal(err)
-		}
-		var req proto.PromptRequestPayload
-		err = (&Dispatcher{}).configurePreparedEnvironment(session, environment, sessions.ExecutionDevice{EnvironmentID: environment.ID}, &req)
-		if err != nil || req.LocalEnvironment == nil || req.LocalEnvironment.NetworkAccess != placement.NetworkAccess || !slices.Equal(req.LocalEnvironment.AllowedDomains, placement.AllowedDomains) {
-			t.Fatal("prepared binding lost policy", req.LocalEnvironment, err)
-		}
-	}
-}
-
 func TestToolEnvironmentRemainsInExecutionBinding(t *testing.T) {
 	session := sessions.Session{ID: "session", TenantID: "tenant"}
 	environment := sessions.Environment{ID: "environment", SessionID: session.ID, TenantID: session.TenantID, Configuration: []byte(`{"type":"openai_hosted","initialization":true,"packages":{"npm":["is-number"]}}`)}
diff --git a/services/core/internal/execution/environment_test.go b/services/core/internal/execution/environment_test.go
index a40ce75cf..8ea09b8d6 100644
--- a/services/core/internal/execution/environment_test.go
+++ b/services/core/internal/execution/environment_test.go
@@ -12,10 +12,10 @@ func TestExecutionEnvironmentDoesNotDefaultToLocal(t *testing.T) {
 		snapshot Snapshot
 		none     bool
 	}{
-		{"public none", Snapshot{Environment: &v1.Environment{Type: "none"}}, true},
+		{"public none", Snapshot{Environment: v1.Environment{Type: "none"}}, true},
 		{"missing", Snapshot{}, false},
-		{"self-hosted", Snapshot{Environment: &v1.Environment{Type: "self_hosted"}}, false},
-		{"hosted", Snapshot{Environment: &v1.Environment{Type: "openai_hosted"}}, false},
+		{"self-hosted", Snapshot{Environment: v1.Environment{Type: "self_hosted"}}, false},
+		{"hosted", Snapshot{Environment: v1.Environment{Type: "openai_hosted"}}, false},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
diff --git a/services/core/internal/execution/execution_observation_test.go b/services/core/internal/execution/execution_observation_test.go
index b4e1bbba1..a3df44342 100644
--- a/services/core/internal/execution/execution_observation_test.go
+++ b/services/core/internal/execution/execution_observation_test.go
@@ -120,7 +120,7 @@ func (c *executionTraceConn) Close() error                              { c.once
 func TestExecutionSendPreservesPayloadAndCarriesTrace(t *testing.T) {
 	for _, traced := range []bool{false, true} {
 		conn := &executionTraceConn{writes: make(chan []byte, 2), closed: make(chan struct{})}
-		peer := runtimegateway.NewSessionWithOwner(conn, "device-one", "workspace-one", "test", runtimegateway.NewRegistry(), func(string, ...any) {}, nil)
+		peer := runtimegateway.NewSession(conn, "device-one", "workspace-one", "test", runtimegateway.NewRegistry(), func(string, ...any) {})
 		peer.Start()
 		ctx := t.Context()
 		if traced {
diff --git a/services/core/internal/execution/function_images_test.go b/services/core/internal/execution/function_images_test.go
index b393598fa..abe2d7411 100644
--- a/services/core/internal/execution/function_images_test.go
+++ b/services/core/internal/execution/function_images_test.go
@@ -6,42 +6,35 @@ import (
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimegateway"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 )
 
 func TestFunctionImageAdmission(t *testing.T) {
 	image := "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aXioAAAAASUVORK5CYII="
-	profile, _ := (engine.Catalog{}).Lookup("claude_sdk")
 	for _, tc := range []struct {
-		name, url      string
-		success, valid bool
+		kind, name, url string
+		success, valid  bool
 	}{
-		{"success", image, true, true},
-		{"native error drops images", image, false, false},
-		{"remote", "https://example.test/image.png", true, false},
-		{"invalid base64", "data:image/png;base64,?", true, false},
-		{"invalid image", "data:image/png;base64,AQID", true, false},
+		{"claude_sdk", "success", image, true, true},
+		{"claude_sdk", "native error drops images", image, false, false},
+		{"claude_sdk", "remote", "https://example.test/image.png", true, false},
+		{"claude_sdk", "invalid base64", "data:image/png;base64,?", true, false},
+		{"claude_sdk", "unsupported type", "data:image/bmp;base64,AQID", true, false},
+		{"claude_sdk", "webp", "data:image/webp;base64,AQID", true, true},
+		{"codex", "inline", image, true, true},
+		{"codex", "remote", "HTTPS://example.test/image.png", true, false},
 	} {
-		t.Run(tc.name, func(t *testing.T) {
+		t.Run(tc.kind+" "+tc.name, func(t *testing.T) {
+			profile, _ := builtin.Registry().Lookup(tc.kind)
 			output := []any{map[string]any{"type": "input_text", "text": "before"}, map[string]any{"type": "input_image", "image_url": tc.url}, map[string]any{"type": "input_text", "text": "after"}}
 			raw, _ := json.Marshal(map[string]any{"call_id": "call", "result": map[string]any{"success": tc.success, "output": output}})
-			err := validateProfileInputs(profile, "none", []sessions.Input{{Kind: "tool_result", Payload: raw}})
-			if tc.valid && err != nil || !tc.valid && !errors.Is(err, sessions.ErrInvalidInput) {
+			if err := validateDeclaredInputs(profile, []sessions.Input{{Kind: "tool_result", Payload: raw}}); (err == nil) != tc.valid || (err != nil && !errors.Is(err, sessions.ErrInvalidInput)) {
 				t.Fatal(err)
 			}
 		})
 	}
-	for _, placement := range []string{"self_hosted"} {
-		url := image
-		if err := profile.ValidateFunctionResult(placement, proto.FunctionResultPayload{Success: true, Content: []proto.InputContent{{Type: "input_image", ImageURL: &url}}}); err != nil {
-			t.Fatal("qualified image rejected", placement, err)
-		}
-		if err := profile.ValidateFunctionResult(placement, proto.FunctionResultPayload{Success: true, Content: proto.TextInput("text")[0].Content}); err != nil {
-			t.Fatal("workspace text regressed", err)
-		}
-	}
 	// Readiness for image-bearing results cannot become a global function gate.
 	if err := requireFunctionResultImages(nil, "unknown", proto.FunctionResultPayload{Content: proto.TextInput("text")[0].Content}); err != nil {
 		t.Fatal(err)
diff --git a/services/core/internal/execution/functions.go b/services/core/internal/execution/functions.go
index f3804de11..19ef8d43d 100644
--- a/services/core/internal/execution/functions.go
+++ b/services/core/internal/execution/functions.go
@@ -17,9 +17,6 @@ import (
 func functionTools(raw []json.RawMessage) ([]proto.FunctionTool, error) {
 	tools := make([]proto.FunctionTool, 0, len(raw))
 	names := map[string]bool{}
-	if len(raw) > 64 {
-		return nil, errors.New("at most 64 function tools are supported")
-	}
 	for _, value := range raw {
 		var tool struct {
 			Type         string          `json:"type"`
@@ -34,7 +31,7 @@ func functionTools(raw []json.RawMessage) ([]proto.FunctionTool, error) {
 			return nil, err
 		}
 		var schema map[string]json.RawMessage
-		if tool.Type != "function" || strings.TrimSpace(tool.Name) == "" || len(tool.Name) > 512 || names[tool.Name] || json.Unmarshal(tool.Parameters, &schema) != nil || schema == nil {
+		if tool.Type != "function" || strings.TrimSpace(tool.Name) == "" || names[tool.Name] || json.Unmarshal(tool.Parameters, &schema) != nil || schema == nil {
 			return nil, errors.New("execution requires unique functions with object schemas")
 		}
 		names[tool.Name] = true
@@ -56,6 +53,9 @@ type functionExchange struct {
 	tools                 []proto.FunctionTool
 	callID                string
 	reply                 <-chan functionReply
+	// abandoned holds the calls whose result the native Harness no longer
+	// waited for. Their withdrawal, or the Turn's end, settles them.
+	abandoned map[string]bool
 }
 
 func (f *functionExchange) record(ctx context.Context, env proto.Envelope) error {
@@ -72,6 +72,19 @@ func (f *functionExchange) record(ctx context.Context, env proto.Envelope) error
 	}
 	err := f.sessions.RecordFunctionCall(ctx, f.tenant, f.session, f.turn, sessions.FunctionCall{
 		CallID: items.Identity(f.turn, "tool:"+call.CallID), ExecutorCallID: call.CallID, Name: call.Name, Arguments: call.Arguments,
+		Subagent: call.NativeID, SubagentTurn: call.TurnID,
+	})
+	return f.unlessCancelling(ctx, err)
+}
+
+func (f *functionExchange) withdraw(ctx context.Context, env proto.Envelope) error {
+	var call proto.FunctionCallWithdrawnPayload
+	if env.ID != f.turn || env.DecodePayload(&call) != nil {
+		return errors.New("invalid function withdrawal")
+	}
+	err := f.sessions.WithdrawFunctionCall(ctx, f.tenant, f.session, f.turn, sessions.FunctionCall{
+		CallID: items.Identity(f.turn, "tool:"+call.CallID), ExecutorCallID: call.CallID,
+		Subagent: call.NativeID, SubagentTurn: call.TurnID,
 	})
 	return f.unlessCancelling(ctx, err)
 }
@@ -85,7 +98,7 @@ func (f *functionExchange) start(ctx context.Context, peer *runtimegateway.Sessi
 		return err
 	}
 	for _, call := range calls {
-		if len(call.Result) == 0 {
+		if len(call.Result) == 0 || f.abandoned[call.CallID] {
 			continue
 		}
 		result, err := functionResult(call)
@@ -117,7 +130,12 @@ func (f *functionExchange) confirm(ctx context.Context, reply functionReply) err
 		return reply.err
 	}
 	if !reply.ack.Applied {
-		return fmt.Errorf("function result not applied: %s", reply.ack.ErrorCode)
+		if reply.ack.ErrorCode != "not_pending" {
+			return fmt.Errorf("function result not applied: %s", reply.ack.ErrorCode)
+		}
+		// The withdrawal can reach this loop after the acknowledgement.
+		f.abandoned[id] = true
+		return nil
 	}
 	return f.unlessCancelling(ctx, f.sessions.ConfirmFunctionResult(ctx, f.tenant, f.session, f.turn, id))
 }
diff --git a/services/core/internal/execution/functions_test.go b/services/core/internal/execution/functions_test.go
index 87ed54ee6..5940ed2a7 100644
--- a/services/core/internal/execution/functions_test.go
+++ b/services/core/internal/execution/functions_test.go
@@ -2,7 +2,9 @@ package execution
 
 import (
 	"encoding/json"
+	"fmt"
 	"reflect"
+	"strings"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
@@ -25,6 +27,20 @@ func TestFunctionDefinitionsRejectUnsupportedConfiguration(t *testing.T) {
 	}
 }
 
+func TestFunctionDefinitionsHaveNoCountOrNameLengthLimit(t *testing.T) {
+	var raw []json.RawMessage
+	for i := 0; i < 65; i++ {
+		name := fmt.Sprintf("f%d", i)
+		if i == 0 {
+			name = strings.Repeat("n", 600)
+		}
+		raw = append(raw, json.RawMessage(`{"type":"function","name":"`+name+`","description":"","parameters":{"type":"object"},"defer_loading":false}`))
+	}
+	if tools, err := functionTools(raw); err != nil || len(tools) != 65 {
+		t.Fatal(len(tools), err)
+	}
+}
+
 func TestFunctionResultPreservesCompleteContent(t *testing.T) {
 	text := func(value string) proto.InputContent {
 		return proto.InputContent{Type: "input_text", Text: &value}
diff --git a/services/core/internal/execution/harness_admission.go b/services/core/internal/execution/harness_admission.go
new file mode 100644
index 000000000..f88bca4b1
--- /dev/null
+++ b/services/core/internal/execution/harness_admission.go
@@ -0,0 +1,105 @@
+package execution
+
+import (
+	"encoding/json"
+	"errors"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
+)
+
+func admissionError(err error) error {
+	if errors.Is(err, harnessconfig.ErrInvalidInput) {
+		return sessions.ErrInvalidInput
+	}
+	return err
+}
+
+// admissionEnvironment projects the public Environment into the view Harness
+// declarations validate.
+func admissionOf(snapshot Snapshot) harnessconfig.Admission {
+	agent := snapshot.Agent
+	workspace := snapshot.Environment.WorkspaceDirectory
+	if snapshot.Environment.Type == "openai_hosted" {
+		workspace = hostedWorkspaceDirectory
+	}
+	return harnessconfig.Admission{
+		TextFormat:         agent.Text.Format.Type,
+		TextSchema:         agent.Text.Format.Schema,
+		MultiAgent:         agent.MultiAgent.Enabled,
+		Tools:              agent.Tools,
+		WorkspaceDirectory: workspace,
+	}
+}
+
+// validateDeclaredConfiguration applies the Harness declaration to a frozen
+// Session snapshot. Core adds no restriction of its own per Harness.
+func validateDeclaredConfiguration(declaration harnessconfig.Declaration, snapshot Snapshot) error {
+	if snapshot.Agent.Text.Format.Type == "json_schema" && !declaration.Capabilities.StructuredOutput.IsSupported() {
+		return errors.New("Structured output is not supported by this engine.")
+	}
+	if declaration.ValidateConfiguration != nil {
+		if err := declaration.ValidateConfiguration(admissionOf(snapshot)); err != nil {
+			return admissionError(err)
+		}
+	}
+	tools, err := executionTools(snapshot.Agent.Tools)
+	if err != nil {
+		return err
+	}
+	if err := declaration.ValidateMCPOrigins(snapshot.Environment.Type, tools.MCP); err != nil {
+		return err
+	}
+	if err := declaration.ValidateExecutionControls(executionControls(snapshot.Agent, tools)); err != nil {
+		return err
+	}
+	request := proto.PromptRequestPayload{ToolSearch: tools.Search, FunctionTools: tools.Functions}
+	if err := request.ValidateToolSearch(declaration.Capabilities.ToolSearch.IsSupported()); err != nil {
+		return err
+	}
+	if declaration.ValidateTools != nil {
+		if err := declaration.ValidateTools(tools.Functions, tools.MCP); err != nil {
+			return admissionError(err)
+		}
+	}
+	return nil
+}
+
+func validateDeclaredInputs(declaration harnessconfig.Declaration, inputs []sessions.Input) error {
+	for _, input := range inputs {
+		if input.Kind == "message" {
+			messages, err := messageInput(input.Payload)
+			if err != nil {
+				return err
+			}
+			if err := validateMessageImages(declaration, messages); err != nil {
+				return err
+			}
+			if err := validateMessageText(declaration, messages); err != nil {
+				return err
+			}
+			continue
+		}
+		if input.Kind != "tool_result" {
+			continue
+		}
+		var value sessions.FunctionResultInput
+		if json.Unmarshal(input.Payload, &value) != nil {
+			return sessions.ErrInvalidInput
+		}
+		result, err := functionResult(sessions.FunctionCall{CallID: value.CallID, Result: value.Result})
+		if err != nil {
+			return sessions.ErrInvalidInput
+		}
+		if !declaration.Capabilities.FunctionResultImages.IsSupported() && (proto.MessageInput{{Content: result.Content}}).HasImages() {
+			return sessions.ErrInvalidInput
+		}
+		if declaration.ValidateFunctionResult != nil {
+			if err := declaration.ValidateFunctionResult(result); err != nil {
+				return admissionError(err)
+			}
+		}
+	}
+	return nil
+}
diff --git a/services/core/internal/execution/harness_admission_test.go b/services/core/internal/execution/harness_admission_test.go
new file mode 100644
index 000000000..26264aea6
--- /dev/null
+++ b/services/core/internal/execution/harness_admission_test.go
@@ -0,0 +1,143 @@
+package execution
+
+import (
+	"encoding/json"
+	"errors"
+	"testing"
+
+	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/harnesstest"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
+)
+
+func TestAcceptedEnginePlacements(t *testing.T) {
+	for _, engine := range []string{"codex", "claude_sdk", "mcode", "unregistered"} {
+		for _, placement := range []string{"none", "openai_hosted", "self_hosted"} {
+			raw := json.RawMessage(`{"agent":{"model":"fixture"},"environment":{"type":"` + placement + `"`)
+			if placement == "self_hosted" {
+				raw = append(raw, []byte(`,"workspace_directory":"/workspace"`)...)
+			}
+			raw = append(raw, []byte(`}}`)...)
+			want := engine != "unregistered"
+			if err := (Policy{}).ValidateSessionConfiguration(engine, raw); (err == nil) != want {
+				t.Fatalf("%s/%s: %v", engine, placement, err)
+			}
+		}
+	}
+}
+
+func TestAdditionalDeclarationUsesCommonAdmission(t *testing.T) {
+	configurationChecked, toolsChecked, resultChecked := false, false, false
+	declaration := harnesstest.Declaration("fixture", func(d *harnessconfig.Declaration) {
+		d.ValidateConfiguration = func(admission harnessconfig.Admission) error {
+			configurationChecked = true
+			if admission.MultiAgent {
+				return harnessconfig.ErrInvalidInput
+			}
+			return nil
+		}
+		d.ValidateTools = func(tools []proto.FunctionTool, mcp []proto.MCPHTTPServer) error {
+			toolsChecked = true
+			if len(tools) != 1 || tools[0].Name != "echo" || len(mcp) != 0 {
+				t.Fatal("common tool decoding did not reach the declaration")
+			}
+			return nil
+		}
+		d.ValidateFunctionResult = func(result proto.FunctionResultPayload) error {
+			content := result.Content
+			resultChecked = true
+			if !result.Success || len(content) != 1 || content[0].Text == nil || *content[0].Text != "response" {
+				t.Fatal("common result decoding did not reach the declaration")
+			}
+			return harnessconfig.ErrInvalidInput
+		}
+	})
+	registry := harnessconfig.NewRegistry(declaration)
+	declaration, ok := registry.Lookup("fixture")
+	if !ok || !declaration.Accepts("none") || declaration.Accepts("openai_hosted") {
+		t.Fatal("fixture declaration was not selected")
+	}
+	snapshot := Snapshot{Agent: v1.Agent{Model: "fixture", Tools: []json.RawMessage{json.RawMessage(`{"type":"function","name":"echo","parameters":{"type":"object"}}`)}}, Environment: v1.Environment{Type: "none"}}
+	if err := validateDeclaredConfiguration(declaration, snapshot); err != nil || !configurationChecked || !toolsChecked {
+		t.Fatal("additional engine admission failed", err)
+	}
+	snapshot.Agent.MultiAgent.Enabled = true
+	if err := validateDeclaredConfiguration(declaration, snapshot); !errors.Is(err, sessions.ErrInvalidInput) {
+		t.Fatal("declared configuration lost public error mapping", err)
+	}
+	inputs := []sessions.Input{{Kind: "tool_result", Payload: json.RawMessage(`{"call_id":"call","result":{"success":true,"output":"response"}}`)}}
+	if err := validateDeclaredInputs(declaration, inputs); !errors.Is(err, sessions.ErrInvalidInput) || !resultChecked {
+		t.Fatal("declared result lost public error mapping", err)
+	}
+}
+
+func TestClaudeHostedToolsRequireSeparateSupport(t *testing.T) {
+	for index, tools := range []string{`[{"type":"function","name":"f","parameters":{"type":"object"},"defer_loading":false}]`, `[{"type":"mcp","server_label":"s","transport":{"type":"http","server_url":"https://example.test/mcp"},"connection_origin":"service"}]`} {
+		for _, placement := range []string{"none", "openai_hosted"} {
+			raw := json.RawMessage(`{"agent":{"model":"fixture","tools":` + tools + `},"environment":{"type":"` + placement + `"}}`)
+			if err := (Policy{}).ValidateSessionConfiguration("claude_sdk", raw); (err == nil) != (placement == "none" || index == 0) {
+				t.Fatalf("%s: %v", placement, err)
+			}
+		}
+	}
+}
+
+func TestClaudeSearchModes(t *testing.T) {
+	for _, mode := range []string{"disabled", "cached", "live"} {
+		for _, placement := range []string{"none", "openai_hosted"} {
+			raw := json.RawMessage(`{"agent":{"model":"fixture","tools":[{"type":"web_search","mode":"` + mode + `","context_size":"medium"}]},"environment":{"type":"` + placement + `"}}`)
+			want := mode == "disabled" || mode == "live"
+			if err := (Policy{}).ValidateSessionConfiguration("claude_sdk", raw); (err == nil) != want {
+				t.Fatalf("%s/%s: %v", mode, placement, err)
+			}
+		}
+	}
+}
+
+func TestCommonOnlyValidationPreservesFunctionResults(t *testing.T) {
+	declaration := harnesstest.Declaration("fixture", nil)
+	inputs := []sessions.Input{{Kind: "tool_result", Payload: json.RawMessage(`{"call_id":"call","result":{"success":true,"output":"response"}}`)}}
+	if err := validateDeclaredInputs(declaration, inputs); err != nil {
+		t.Fatal("common-only result acquired a native restriction", err)
+	}
+}
+
+func TestRetainedNativeHistoryDependsOnExternalWorkspace(t *testing.T) {
+	for _, required := range []bool{false, true} {
+		for _, supported := range []bool{false, true} {
+			if err := sessions.ValidateRetainedHistory(required, supported); (err == nil) != (!required || supported) {
+				t.Fatal(required, supported, err)
+			}
+		}
+	}
+	for _, declared := range []bool{false, true} {
+		declaration := harnesstest.Declaration("test_harness", func(d *harnessconfig.Declaration) {
+			d.Placements = []string{"openai_hosted"}
+			d.Capabilities.RetainedNativeHistory = proto.CapabilityFromBool(declared)
+		})
+		policy := Policy{Declarations: harnessconfig.NewRegistry(declaration)}
+		if err := policy.ValidateSessionConfiguration("test_harness", json.RawMessage(`{"agent":{"model":"fixture"},"environment":{"type":"openai_hosted"}}`)); err != nil {
+			t.Fatal("generic hosted configuration acquired a storage requirement", declared, err)
+		}
+		for _, external := range []bool{false, true} {
+			for _, runtimeSupported := range []bool{false, true} {
+				err := policy.validateEnvironmentHistory("test_harness", sessions.Environment{ExternalWorkspace: external}, runtimeSupported)
+				if (err == nil) != (!external || declared && runtimeSupported) {
+					t.Fatal(external, declared, runtimeSupported, err)
+				}
+			}
+		}
+	}
+}
+
+// Runtime enforces no network policy, so admission runs only enabled networking.
+func TestAdmissionRejectsUnenforcedNetworkPolicy(t *testing.T) {
+	for access, valid := range map[string]bool{"enabled": true, "disabled": false, "restricted": false} {
+		raw := json.RawMessage(`{"agent":{"model":"model"},"environment":{"type":"openai_hosted","network":{"access":"` + access + `"}}}`)
+		if err := (Policy{}).ValidateSessionConfiguration("codex", raw); (err == nil) != valid {
+			t.Fatal(access, err)
+		}
+	}
+}
diff --git a/services/core/internal/execution/initialization_wakeup_test.go b/services/core/internal/execution/initialization_wakeup_test.go
index 372425ff0..afec70d73 100644
--- a/services/core/internal/execution/initialization_wakeup_test.go
+++ b/services/core/internal/execution/initialization_wakeup_test.go
@@ -116,7 +116,7 @@ func TestInitializationCommitWakesThrottledScheduler(t *testing.T) {
 			if _, err = registry.WaitForDevice(t.Context(), "device", time.Second); err != nil {
 				t.Fatal(err)
 			}
-			heartbeat, _ := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, Preparation: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, WebSearchControl: proto.CapabilitySupported, TextVerbosity: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, LocalEnvironment: proto.CapabilitySupported, WorkspaceReadPreparation: proto.CapabilitySupported, WorkspaceOutputExport: proto.CapabilitySupported})}}})
+			heartbeat, _ := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, Preparation: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, LocalEnvironment: proto.CapabilitySupported, WorkspaceReadPreparation: proto.CapabilitySupported, WorkspaceOutputExport: proto.CapabilitySupported})}}})
 			if err = conn.WriteJSON(heartbeat); err != nil {
 				t.Fatal(err)
 			}
@@ -125,7 +125,7 @@ func TestInitializationCommitWakesThrottledScheduler(t *testing.T) {
 			case <-time.After(time.Second):
 				t.Fatal("capability hint absent")
 			}
-			worker := &Worker{dispatcher: &Dispatcher{SessionsReader: reader, Registry: registry, DeploymentReader: &strictDeploymentReader{t: t, environmentAllocation: func(context.Context, deployment.AllocationKey) (deployment.Allocation, error) {
+			worker := &Worker{runtimes: &runtimeManager{}, dispatcher: &Dispatcher{SessionsReader: reader, Registry: registry, DeploymentReader: &strictDeploymentReader{t: t, environmentAllocation: func(context.Context, deployment.AllocationKey) (deployment.Allocation, error) {
 				return deployment.Allocation{}, deployment.ErrNotFound
 			}}}, scheduleWake: make(chan struct{}, 1), concurrency: 1}
 			storage := &initializationWakeStorage{reader: reader, worker: worker}
diff --git a/services/core/internal/execution/journal.go b/services/core/internal/execution/journal.go
index d882ca26d..39123ef84 100644
--- a/services/core/internal/execution/journal.go
+++ b/services/core/internal/execution/journal.go
@@ -67,7 +67,7 @@ func (j *journal) enqueue(env proto.Envelope) error {
 		return sessions.ErrInvalidInput
 	}
 	switch env.Type {
-	case proto.TypeDelta, proto.TypeOutputMessage, proto.TypeThinking, proto.TypeToolCall, proto.TypeCommandOutput, proto.TypeUsage,
+	case proto.TypeDelta, proto.TypeOutputMessage, proto.TypeReasoning, proto.TypeToolCall, proto.TypeCommandOutput, proto.TypeUsage,
 		proto.TypeError, proto.TypeDone, proto.TypePromptSteerAck, proto.TypeSubagentIdentity, proto.TypeSubagentLifecycle, proto.TypeSubagentTurn, proto.TypeSubagentItem, proto.TypeSubagentCoordination, "cancel_receipt":
 	default:
 		return nil
diff --git a/services/core/internal/execution/journal_failure.go b/services/core/internal/execution/journal_failure.go
index 28b53d9d0..3f8882dae 100644
--- a/services/core/internal/execution/journal_failure.go
+++ b/services/core/internal/execution/journal_failure.go
@@ -17,7 +17,7 @@ func (j *journal) reportFailure(stage, kind string, size int, err error) {
 		ctx = context.Background()
 	}
 	switch kind {
-	case proto.TypeDelta, proto.TypeOutputMessage, proto.TypeThinking, proto.TypeToolCall, proto.TypeCommandOutput, proto.TypeUsage,
+	case proto.TypeDelta, proto.TypeOutputMessage, proto.TypeReasoning, proto.TypeToolCall, proto.TypeCommandOutput, proto.TypeUsage,
 		proto.TypeError, proto.TypeDone, proto.TypePromptSteerAck, proto.TypeSubagentIdentity, proto.TypeSubagentLifecycle, proto.TypeSubagentTurn, proto.TypeSubagentItem, proto.TypeSubagentCoordination, "cancel_receipt":
 	default:
 		kind = "unknown"
diff --git a/services/core/internal/execution/mcode_profile_test.go b/services/core/internal/execution/mcode_profile_test.go
index f24dbd8a5..52975c0b0 100644
--- a/services/core/internal/execution/mcode_profile_test.go
+++ b/services/core/internal/execution/mcode_profile_test.go
@@ -12,8 +12,12 @@ func TestMCodeOperationQualification(t *testing.T) {
 		{"hosted", `{"agent":{"model":"real-model"},"environment":{"type":"openai_hosted"}}`, true},
 		{"verbosity", `{"agent":{"model":"real-model","text":{"verbosity":"high"}},"environment":{"type":"none"}}`, false},
 		{"subagents", `{"agent":{"model":"real-model","multi_agent":{"enabled":true}},"environment":{"type":"none"}}`, true},
-		{"functions", `{"agent":{"model":"real-model","tools":[{"type":"function","name":"f","parameters":{"type":"object"}}]},"environment":{"type":"none"}}`, false},
-		{"mcp", `{"agent":{"model":"real-model","tools":[{"type":"mcp","server_label":"x","server_url":"https://example.invalid/mcp"}]},"environment":{"type":"none"}}`, false},
+		{"functions", `{"agent":{"model":"real-model","tools":[{"type":"function","name":"f","parameters":{"type":"object"}}]},"environment":{"type":"none"}}`, true},
+		{"functions hosted", `{"agent":{"model":"real-model","tools":[{"type":"function","name":"f","parameters":{"type":"object"}}]},"environment":{"type":"openai_hosted"}}`, true},
+		{"functions with subagents", `{"agent":{"model":"real-model","multi_agent":{"enabled":true},"tools":[{"type":"function","name":"f","parameters":{"type":"object"}}]},"environment":{"type":"none"}}`, true},
+		{"reserved label", `{"agent":{"model":"real-model","tools":[{"type":"function","name":"f","parameters":{"type":"object"}},{"type":"mcp","server_label":"functions","connection_origin":"service","transport":{"type":"http","server_url":"https://example.invalid/mcp"}}]},"environment":{"type":"none"}}`, false},
+		{"mcp", `{"agent":{"model":"real-model","tools":[{"type":"mcp","server_label":"x","connection_origin":"service","transport":{"type":"http","server_url":"https://example.invalid/mcp"}}]},"environment":{"type":"none"}}`, true},
+		{"effort", `{"agent":{"model":"real-model","reasoning":{"effort":"high"}},"environment":{"type":"none"}}`, true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			err := p.ValidateSessionConfiguration("mcode", []byte(tc.body))
diff --git a/services/core/internal/execution/mcp.go b/services/core/internal/execution/mcp.go
index a92286e25..360bb48ab 100644
--- a/services/core/internal/execution/mcp.go
+++ b/services/core/internal/execution/mcp.go
@@ -12,18 +12,20 @@ import (
 )
 
 type executionToolSet struct {
-	Functions           []proto.FunctionTool
-	MCP                 []proto.MCPHTTPServer
-	Search              bool
-	DisableProgrammatic bool
+	Functions []proto.FunctionTool
+	MCP       []proto.MCPHTTPServer
+	Search    bool
+	// WebSearch and ProgrammaticToolCalling are set only when the Session declares the tool.
+	WebSearch               *proto.WebSearchControl
+	ProgrammaticToolCalling *bool
 }
 
 func executionTools(raw []json.RawMessage) (executionToolSet, error) {
 	functions := make([]json.RawMessage, 0, len(raw))
 	var servers []proto.MCPHTTPServer
 	search := false
-	disableProgrammatic := false
-	controls := map[string]bool{}
+	var webSearch *proto.WebSearchControl
+	var programmatic *bool
 	names := map[string]bool{}
 	for _, value := range raw {
 		var kind struct {
@@ -32,30 +34,30 @@ func executionTools(raw []json.RawMessage) (executionToolSet, error) {
 		if json.Unmarshal(value, &kind) != nil {
 			return executionToolSet{}, errors.New("invalid execution tool")
 		}
-		if kind.Type == "programmatic_tool_calling" || kind.Type == "web_search" {
-			if controls[kind.Type] {
-				return executionToolSet{}, errors.New("execution requires distinct tool controls")
+		if kind.Type == "programmatic_tool_calling" {
+			var control struct {
+				Enabled *bool `json:"enabled"`
 			}
-			controls[kind.Type] = true
-			if kind.Type == "programmatic_tool_calling" {
-				var control struct {
-					Type    string `json:"type"`
-					Enabled *bool  `json:"enabled"`
-				}
-				decoder := json.NewDecoder(bytes.NewReader(value))
-				decoder.DisallowUnknownFields()
-				if decoder.Decode(&control) != nil || control.Enabled == nil || *control.Enabled {
-					return executionToolSet{}, errors.New("programmatic tool calling is not qualified for execution")
-				}
-				disableProgrammatic = true
-			} else {
-				var control struct {
-					Mode string `json:"mode"`
-				}
-				if json.Unmarshal(value, &control) != nil || control.Mode != "disabled" {
-					return executionToolSet{}, errors.New("only disabled web search is qualified for execution")
-				}
+			if json.Unmarshal(value, &control) != nil || control.Enabled == nil {
+				return executionToolSet{}, errors.New("invalid programmatic_tool_calling control")
+			}
+			programmatic = control.Enabled
+			continue
+		}
+		if kind.Type == "web_search" {
+			var control struct {
+				Mode           string                `json:"mode"`
+				ContextSize    string                `json:"context_size"`
+				AllowedDomains []string              `json:"allowed_domains"`
+				Location       *proto.SearchLocation `json:"location"`
+			}
+			if json.Unmarshal(value, &control) != nil || control.Mode == "" || control.ContextSize == "" {
+				return executionToolSet{}, errors.New("invalid web_search control")
 			}
+			if location := control.Location; location != nil && location.City == nil && location.Country == nil && location.Region == nil && location.Timezone == nil {
+				control.Location = nil
+			}
+			webSearch = &proto.WebSearchControl{Mode: control.Mode, ContextSize: control.ContextSize, AllowedDomains: control.AllowedDomains, Location: control.Location}
 			continue
 		}
 		if kind.Type == "tool_search" {
@@ -74,13 +76,9 @@ func executionTools(raw []json.RawMessage) (executionToolSet, error) {
 		var tool v1.MCPTool
 		decoder := json.NewDecoder(bytes.NewReader(value))
 		decoder.DisallowUnknownFields()
-		if decoder.Decode(&tool) != nil || strings.TrimSpace(tool.ServerLabel) == "" || names[tool.ServerLabel] || (tool.ConnectionOrigin != "service" && tool.ConnectionOrigin != "environment") || len(tool.RequestMetadata) != 0 || tool.Transport.Type != "http" || tool.Transport.Headers != nil {
+		if decoder.Decode(&tool) != nil || strings.TrimSpace(tool.ServerLabel) == "" || names[tool.ServerLabel] || (tool.ConnectionOrigin != "service" && tool.ConnectionOrigin != "environment") || len(tool.RequestMetadata) != 0 {
 			return executionToolSet{}, errors.New("unsupported execution MCP configuration")
 		}
-		u, err := url.Parse(tool.Transport.ServerURL)
-		if err != nil || u.Hostname() == "" || (u.Scheme != "http" && u.Scheme != "https") || u.User != nil || u.Fragment != "" || u.RawQuery != "" || u.ForceQuery {
-			return executionToolSet{}, errors.New("unsupported execution MCP URL")
-		}
 		if tool.AllowedTools != nil {
 			for _, name := range *tool.AllowedTools {
 				if name == "" {
@@ -88,10 +86,31 @@ func executionTools(raw []json.RawMessage) (executionToolSet, error) {
 				}
 			}
 		}
+		server := proto.MCPHTTPServer{ConnectionOrigin: tool.ConnectionOrigin, ServerLabel: tool.ServerLabel, AllowedTools: tool.AllowedTools, Required: tool.Required}
+		switch transport := tool.Transport; transport.Type {
+		case "stdio":
+			if tool.ConnectionOrigin != "environment" || transport.Args == nil || transport.EnvVars == nil || tool.CredentialID != nil {
+				return executionToolSet{}, errors.New("unsupported execution MCP configuration")
+			}
+			server.Stdio = &proto.MCPStdio{Command: transport.Command, Args: *transport.Args, Cwd: transport.Cwd, EnvVars: *transport.EnvVars}
+			if !server.Stdio.Valid() {
+				return executionToolSet{}, errors.New("unsupported execution MCP configuration")
+			}
+		case "http":
+			u, err := url.Parse(transport.ServerURL)
+			if err != nil || u.Hostname() == "" || (u.Scheme != "http" && u.Scheme != "https") || u.User != nil || u.Fragment != "" {
+				return executionToolSet{}, errors.New("unsupported execution MCP URL")
+			}
+			server.ServerURL = transport.ServerURL
+			if transport.Headers != nil {
+				server.Headers = *transport.Headers
+			}
+		default:
+			return executionToolSet{}, errors.New("unsupported execution MCP configuration")
+		}
 		names[tool.ServerLabel] = true
-		servers = append(servers, proto.MCPHTTPServer{ConnectionOrigin: tool.ConnectionOrigin, ServerLabel: tool.ServerLabel,
-			ServerURL: tool.Transport.ServerURL, AllowedTools: tool.AllowedTools, Required: tool.Required})
+		servers = append(servers, server)
 	}
 	resolved, err := functionTools(functions)
-	return executionToolSet{Functions: resolved, MCP: servers, Search: search, DisableProgrammatic: disableProgrammatic}, err
+	return executionToolSet{Functions: resolved, MCP: servers, Search: search, WebSearch: webSearch, ProgrammaticToolCalling: programmatic}, err
 }
diff --git a/services/core/internal/execution/mcp_credentials_test.go b/services/core/internal/execution/mcp_credentials_test.go
index a4cde8c93..de47480b1 100644
--- a/services/core/internal/execution/mcp_credentials_test.go
+++ b/services/core/internal/execution/mcp_credentials_test.go
@@ -14,9 +14,9 @@ func TestMCPFrozenCredentialAdmission(t *testing.T) {
 	vault, credential := uuid.NewString(), uuid.NewString()
 	for _, mode := range []string{"implicit", "explicit", "oauth implicit", "oauth explicit", "anonymous", "missing", "unattached", "wrong URL", "wrong auth", "changed selection", "HTTP", "self-hosted explicit", "self-hosted implicit", "self-hosted anonymous"} {
 		t.Run(mode, func(t *testing.T) {
-			tool := v1.MCPTool{Type: "mcp", ServerLabel: "tools", ConnectionOrigin: "service", Transport: v1.MCPHTTPTransport{Type: "http", ServerURL: "https://mcp.example/tools"}}
+			tool := v1.MCPTool{Type: "mcp", ServerLabel: "tools", ConnectionOrigin: "service", Transport: v1.MCPTransport{Type: "http", ServerURL: "https://mcp.example/tools"}}
 			binding := vaults.MCPCredentialBinding{ServerLabel: "tools", ServerURL: tool.Transport.ServerURL, VaultID: vault, CredentialID: credential, AuthType: "static_bearer"}
-			snapshot := Snapshot{Agent: v1.Agent{Model: "model"}, Environment: &v1.Environment{Type: "none"}, VaultIDs: []string{vault}}
+			snapshot := Snapshot{Agent: v1.Agent{Model: "model"}, Environment: v1.Environment{Type: "none"}, VaultIDs: []string{vault}}
 			switch mode {
 			case "explicit", "oauth explicit", "missing", "changed selection", "self-hosted explicit":
 				tool.CredentialID = &credential
@@ -35,7 +35,7 @@ func TestMCPFrozenCredentialAdmission(t *testing.T) {
 				binding.AuthType = "mcp_oauth"
 			}
 			if strings.HasPrefix(mode, "self-hosted") {
-				snapshot.Environment = &v1.Environment{Type: "self_hosted", WorkspaceDirectory: "/workspace"}
+				snapshot.Environment = v1.Environment{Type: "self_hosted", WorkspaceDirectory: "/workspace"}
 			}
 			if mode == "changed selection" {
 				binding.CredentialID = uuid.NewString()
diff --git a/services/core/internal/execution/mcp_support.go b/services/core/internal/execution/mcp_support.go
index bc36584f5..1e7910a6c 100644
--- a/services/core/internal/execution/mcp_support.go
+++ b/services/core/internal/execution/mcp_support.go
@@ -13,8 +13,8 @@ func (p Policy) mcpCredentialBindings(engine string, snapshot Snapshot) (map[str
 	if err != nil {
 		return nil, err
 	}
-	profile, qualified := p.Engines.Lookup(engine)
-	if len(selected) > 0 && (!qualified || !profile.MCPBearer.IsSupported()) {
+	declaration, known := p.Harnesses().Lookup(engine)
+	if len(selected) > 0 && (!known || !declaration.Capabilities.MCPHTTPBearerAuth.IsSupported()) {
 		return nil, errors.New("The configured engine currently supports anonymous HTTP MCP only.")
 	}
 	return selected, nil
@@ -26,8 +26,8 @@ func (p Policy) mcpExecutionCredentials(engine string, snapshot Snapshot, server
 	fail := func(message string) (map[string]vaults.MCPCredentialBinding, error) {
 		return nil, errors.New(message)
 	}
-	profile, _ := p.Engines.Lookup(engine)
-	if err := profile.ValidateMCPOrigins(snapshot.Environment, servers); err != nil {
+	declaration, _ := p.Harnesses().Lookup(engine)
+	if err := declaration.ValidateMCPOrigins(snapshot.Environment.Type, servers); err != nil {
 		return nil, err
 	}
 	if len(servers) > 0 && !caps.MCPHTTPTools {
diff --git a/services/core/internal/execution/mcp_support_test.go b/services/core/internal/execution/mcp_support_test.go
index ab3901dcf..7d3921e3a 100644
--- a/services/core/internal/execution/mcp_support_test.go
+++ b/services/core/internal/execution/mcp_support_test.go
@@ -3,6 +3,7 @@ package execution
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"reflect"
 	"testing"
 
@@ -29,7 +30,7 @@ func mcpSupportFixture(t *testing.T) (Snapshot, []proto.MCPHTTPServer, runtimede
 	t.Helper()
 	vault, credential := uuid.NewString(), uuid.NewString()
 	tool := json.RawMessage(`{"type":"mcp","server_label":"tickets","connection_origin":"service","transport":{"type":"http","server_url":"https://mcp.example/tools"}}`)
-	snapshot := Snapshot{Agent: v1.Agent{Model: "model", Tools: []json.RawMessage{tool}}, Environment: &v1.Environment{Type: "none"}, VaultIDs: []string{vault},
+	snapshot := Snapshot{Agent: v1.Agent{Model: "model", Tools: []json.RawMessage{tool}}, Environment: v1.Environment{Type: "none"}, VaultIDs: []string{vault},
 		MCPCredentials: []vaults.MCPCredentialBinding{{ServerLabel: "tickets", ServerURL: "https://mcp.example/tools", VaultID: vault, CredentialID: credential, AuthType: "static_bearer"}}}
 	tools, err := executionTools(snapshot.Agent.Tools)
 	if err != nil {
@@ -102,7 +103,7 @@ func TestMCPExecutionChecksRequireVerifiedCapabilityCombinations(t *testing.T) {
 				case "preparation":
 					caps.Preparation = false
 				case "environment":
-					snapshot.Environment = nil
+					snapshot.Environment = v1.Environment{}
 				}
 				allowed := placement == "none" && (missing == "" || missing == "preparation")
 				selected, err := (Policy{}).mcpExecutionCredentials("codex", snapshot, servers, caps)
@@ -160,3 +161,30 @@ func TestMCPAnonymousExecutionPreservesFrozenDecision(t *testing.T) {
 		}
 	}
 }
+
+// A stdio server runs in the Environment, so only workspace placements admit it,
+// and each Harness declaration applies its own limits.
+func TestMCPStdioAdmission(t *testing.T) {
+	tool := `{"type":"mcp","server_label":"local","connection_origin":"environment","allowed_tools":%s,"transport":{"type":"stdio","command":"run","args":[],"cwd":"/work","env_vars":["TOKEN"]}}`
+	for _, tc := range []struct {
+		engine, placement, allowed string
+		admitted                   bool
+	}{
+		{"codex", "self_hosted", "null", true},
+		{"codex", "openai_hosted", `["lookup"]`, true},
+		{"codex", "none", "null", false},
+		{"claude_sdk", "self_hosted", "null", true},
+		{"claude_sdk", "self_hosted", `["lookup"]`, false},
+		{"mcode", "self_hosted", "null", false},
+	} {
+		snapshot := Snapshot{Agent: v1.Agent{Model: "model", Tools: []json.RawMessage{json.RawMessage(fmt.Sprintf(tool, tc.allowed))}}, Environment: v1.Environment{Type: tc.placement}}
+		declaration, _ := (Policy{}).Harnesses().Lookup(tc.engine)
+		if err := validateDeclaredConfiguration(declaration, snapshot); (err == nil) != tc.admitted {
+			t.Fatalf("%+v: %v", tc, err)
+		}
+	}
+	servers, err := executionTools([]json.RawMessage{json.RawMessage(fmt.Sprintf(tool, "null"))})
+	if err != nil || !reflect.DeepEqual(servers.MCP[0].Stdio, &proto.MCPStdio{Command: "run", Args: []string{}, Cwd: "/work", EnvVars: []string{"TOKEN"}}) {
+		t.Fatal(err, servers.MCP)
+	}
+}
diff --git a/services/core/internal/execution/mcp_test.go b/services/core/internal/execution/mcp_test.go
index d4bd63d6c..b0fb86e2f 100644
--- a/services/core/internal/execution/mcp_test.go
+++ b/services/core/internal/execution/mcp_test.go
@@ -5,6 +5,15 @@ import (
 	"testing"
 )
 
+func TestMCPExecutionKeepsServerURLQuery(t *testing.T) {
+	const serverURL = "https://mcp.example/mcp?tenant=a%20b&x="
+	tool := json.RawMessage(`{"type":"mcp","server_label":"tickets","transport":{"type":"http","server_url":"` + serverURL + `"},"connection_origin":"service"}`)
+	tools, err := executionTools([]json.RawMessage{tool})
+	if err != nil || len(tools.MCP) != 1 || tools.MCP[0].ServerURL != serverURL {
+		t.Fatal(tools.MCP, err)
+	}
+}
+
 func TestMCPRequiresSupportedServicePlacement(t *testing.T) {
 	tool := json.RawMessage(`{"type":"mcp","server_label":"tickets","transport":{"type":"http","server_url":"https://mcp.example/mcp"},"connection_origin":"service","allowed_tools":[]}`)
 	for _, profile := range []struct {
diff --git a/services/core/internal/execution/message_images_test.go b/services/core/internal/execution/message_images_test.go
new file mode 100644
index 000000000..7f1282396
--- /dev/null
+++ b/services/core/internal/execution/message_images_test.go
@@ -0,0 +1,36 @@
+package execution
+
+import (
+	"encoding/json"
+	"errors"
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
+)
+
+// Each Harness declares its own image rule: Codex rejects remote URLs as
+// native does, Claude Code admits what its native blocks express, and a Harness
+// without image input rejects every image.
+func TestMessageImageRulesBelongToTheHarness(t *testing.T) {
+	for _, tc := range []struct {
+		kind, url string
+		want      bool
+	}{
+		{"codex", "Https://example.com/a.webp", false},
+		{"codex", "data:image/bmp;base64,AQID", true},
+		{"claude_sdk", "https://example.com/a.webp", true},
+		{"claude_sdk", "data:image/gif;base64,AQID", true},
+		{"claude_sdk", "data:image/bmp;base64,AQID", false},
+		{"claude_sdk", "ftp://example.com/a.png", true},
+		{"claude_sdk", "data:image/png;base64,?", false},
+		{"mcode", "https://example.com/a.webp", false},
+	} {
+		profile, _ := builtin.Registry().Lookup(tc.kind)
+		payload, _ := json.Marshal(map[string]any{"input": []any{map[string]any{"role": "user", "content": []any{map[string]any{"type": "input_image", "image_url": tc.url}}}}})
+		err := validateDeclaredInputs(profile, []sessions.Input{{Kind: "message", Payload: payload}})
+		if (err == nil) != tc.want || (err != nil && !errors.Is(err, sessions.ErrInvalidInput)) {
+			t.Fatalf("%s %s: %v", tc.kind, tc.url, err)
+		}
+	}
+}
diff --git a/services/core/internal/execution/message_support.go b/services/core/internal/execution/message_support.go
index 39f1a4526..631741bec 100644
--- a/services/core/internal/execution/message_support.go
+++ b/services/core/internal/execution/message_support.go
@@ -3,9 +3,10 @@ package execution
 import (
 	"errors"
 	"strings"
+	"unicode"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimegateway"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 )
@@ -14,10 +15,10 @@ import (
 // write, reservation or promotion.
 var ErrWhitespaceOnlyText = errors.New("whitespace-only message text is not supported by this harness")
 
-// validateMessageTextProfile rejects a message without an image or any
-// non-whitespace text when the harness has not qualified such input.
-func validateMessageTextProfile(profile engine.Profile, input proto.MessageInput) error {
-	if profile.WhitespaceOnlyText.IsSupported() {
+// validateMessageText rejects a message without an image or any non-whitespace
+// text when the Harness does not declare support for such input.
+func validateMessageText(declaration harnessconfig.Declaration, input proto.MessageInput) error {
+	if declaration.WhitespaceOnlyText.IsSupported() {
 		return nil
 	}
 	for _, message := range input {
@@ -35,24 +36,19 @@ func validateMessageTextProfile(profile engine.Profile, input proto.MessageInput
 	return nil
 }
 
-// blankTextRune is the explicit union of Go unicode.IsSpace and ECMAScript
-// String.prototype.trim (WhiteSpace and LineTerminator). The Claude bridge uses
-// the same set, so admission rejects every message the bridge would reject.
-func blankTextRune(r rune) bool {
-	switch r {
-	case '\t', '\n', '\v', '\f', '\r', ' ', '\u0085', '\u00a0', '\u1680', '\u2028', '\u2029', '\u202f', '\u205f', '\u3000', '\ufeff':
-		return true
-	}
-	return r >= '\u2000' && r <= '\u200a'
-}
+// blankTextRune is Go whitespace plus the byte order mark, so the byte order mark alone does not count as text.
+func blankTextRune(r rune) bool { return unicode.IsSpace(r) || r == '\ufeff' }
 
-func validateMessageImageProfile(profile engine.Profile, _ string, input proto.MessageInput) error {
+func validateMessageImages(declaration harnessconfig.Declaration, input proto.MessageInput) error {
 	if !input.HasImages() {
 		return nil
 	}
-	if !profile.MessageImages.IsSupported() || input.ValidateInlineImages() != nil {
+	if !declaration.Capabilities.MessageImages.IsSupported() {
 		return sessions.ErrInvalidInput
 	}
+	if declaration.ValidateMessageInput != nil {
+		return admissionError(declaration.ValidateMessageInput(input))
+	}
 	return nil
 }
 
@@ -61,15 +57,11 @@ func (p Policy) messageInputSupport(peer *runtimegateway.Session, kind string, s
 	if !input.HasImages() {
 		return nil
 	}
-	profile, ok := p.Engines.Lookup(kind)
+	declaration, ok := p.Harnesses().Lookup(kind)
 	if !ok {
 		return sessions.ErrInvalidInput
 	}
-	placement := ""
-	if snapshot.Environment != nil {
-		placement = snapshot.Environment.Type
-	}
-	if err := validateMessageImageProfile(profile, placement, input); err != nil {
+	if err := validateMessageImages(declaration, input); err != nil {
 		return err
 	}
 	return requireMessageImages(peer, kind, input)
diff --git a/services/core/internal/execution/message_support_test.go b/services/core/internal/execution/message_support_test.go
index edccfaa8c..4a3a8f240 100644
--- a/services/core/internal/execution/message_support_test.go
+++ b/services/core/internal/execution/message_support_test.go
@@ -6,22 +6,23 @@ import (
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine/enginetest"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/harnesstest"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 )
 
 func TestMessageImageQualificationIsOperationSpecific(t *testing.T) {
 	url := "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aXioAAAAASUVORK5CYII="
 	input := proto.MessageInput{{Content: []proto.InputContent{{Type: "input_image", ImageURL: &url}}}}
-	profile := enginetest.Profile(func(p *engine.Profile) { p.MessageImages = proto.CapabilitySupported })
-	if err := validateMessageImageProfile(profile, "none", input); err != nil {
+	profile := harnesstest.Declaration("fixture", func(d *harnessconfig.Declaration) { d.Capabilities.MessageImages = proto.CapabilitySupported })
+	if err := validateMessageImages(profile, input); err != nil {
 		t.Fatal(err)
 	}
-	if err := validateMessageImageProfile(profile, "self_hosted", input); err != nil {
+	if err := validateMessageImages(profile, input); err != nil {
 		t.Fatal("qualified user machine rejected", err)
 	}
-	if err := validateMessageImageProfile(enginetest.Profile(nil), "none", input); !errors.Is(err, sessions.ErrInvalidInput) {
+	if err := validateMessageImages(harnesstest.Declaration("fixture", nil), input); !errors.Is(err, sessions.ErrInvalidInput) {
 		t.Fatal("unqualified profile accepted", err)
 	}
 	// Text admission and dispatch must not gain an online/image requirement.
@@ -34,17 +35,16 @@ func TestMessageImageQualificationIsOperationSpecific(t *testing.T) {
 	// Message validation applies even when no function-result validator exists.
 	raw, _ := json.Marshal(map[string]any{"input": []any{map[string]any{"role": "user", "content": input[0].Content}}})
 	batch := []sessions.Input{{Kind: "message", Payload: json.RawMessage(`{"input":[{"role":"user","content":[{"type":"input_text","text":"valid first"}]}]}`)}, {Kind: "message", Payload: raw}}
-	if err := validateProfileInputs(enginetest.Profile(nil), "none", batch); !errors.Is(err, sessions.ErrInvalidInput) {
+	if err := validateDeclaredInputs(harnesstest.Declaration("fixture", nil), batch); !errors.Is(err, sessions.ErrInvalidInput) {
 		t.Fatal("image escaped profile validation", err)
 	}
-	if err := validateProfileInputs(profile, "none", batch); err != nil {
+	if err := validateDeclaredInputs(profile, batch); err != nil {
 		t.Fatal("qualified image rejected", err)
 	}
 }
 
 // Whitespace-only text is a declared per-harness qualification, not rewritten input.
 func TestWhitespaceOnlyTextQualificationUsesEngineProfiles(t *testing.T) {
-	url := "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aXioAAAAASUVORK5CYII="
 	message := func(messages ...string) sessions.Input {
 		raw, _ := json.Marshal(map[string]any{"input": func() []any {
 			var input []any
@@ -56,27 +56,36 @@ func TestWhitespaceOnlyTextQualificationUsesEngineProfiles(t *testing.T) {
 		return sessions.Input{Kind: "message", Payload: raw}
 	}
 	whitespace := []sessions.Input{message("   "), message("ok", "\n\t")}
-	codex, _ := (engine.Catalog{}).Lookup("codex")
-	for _, input := range whitespace {
-		if err := validateProfileInputs(codex, "none", []sessions.Input{input}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	for _, kind := range []string{"claude_sdk", "mcode"} {
-		profile, _ := (engine.Catalog{}).Lookup(kind)
+	for _, kind := range []string{"codex", "claude_sdk"} {
+		profile, _ := builtin.Registry().Lookup(kind)
 		for _, input := range whitespace {
-			for _, placement := range []string{"none", "openai_hosted", "self_hosted"} {
-				if err := validateProfileInputs(profile, placement, []sessions.Input{input}); !errors.Is(err, ErrWhitespaceOnlyText) {
-					t.Fatalf("%s %s %s: %v", kind, placement, input.Payload, err)
-				}
+			if err := validateDeclaredInputs(profile, []sessions.Input{input}); err != nil {
+				t.Fatal(kind, err)
 			}
 		}
 	}
-	claude, _ := (engine.Catalog{}).Lookup("claude_sdk")
+	mcode, _ := builtin.Registry().Lookup("mcode")
+	for _, input := range whitespace {
+		if err := validateDeclaredInputs(mcode, []sessions.Input{input}); !errors.Is(err, ErrWhitespaceOnlyText) {
+			t.Fatalf("mcode %s: %v", input.Payload, err)
+		}
+	}
 	mixed, _ := json.Marshal(map[string]any{"input": []any{map[string]any{"role": "user", "content": []any{
-		map[string]any{"type": "input_text", "text": " "}, map[string]any{"type": "input_text", "text": "text"}}},
-		map[string]any{"role": "user", "content": []any{map[string]any{"type": "input_text", "text": " "}, map[string]any{"type": "input_image", "image_url": url}}}}})
-	if err := validateProfileInputs(claude, "none", []sessions.Input{{Kind: "message", Payload: mixed}}); err != nil {
-		t.Fatal("non-whitespace text or image rejected", err)
+		map[string]any{"type": "input_text", "text": " "}, map[string]any{"type": "input_text", "text": "text"}}}}})
+	if err := validateDeclaredInputs(mcode, []sessions.Input{{Kind: "message", Payload: mixed}}); err != nil {
+		t.Fatal("non-whitespace text rejected", err)
+	}
+}
+
+// A Harness without function-result images rejects them before anything is stored.
+func TestFunctionResultImagesFollowTheDeclaration(t *testing.T) {
+	image := sessions.Input{Kind: "tool_result", Payload: json.RawMessage(`{"turn_id":"t","call_id":"c","result":{"success":true,"output":[{"type":"input_image","image_url":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aXioAAAAASUVORK5CYII="}]}}`)}
+	mcode, _ := builtin.Registry().Lookup("mcode")
+	if err := validateDeclaredInputs(mcode, []sessions.Input{image}); !errors.Is(err, sessions.ErrInvalidInput) {
+		t.Fatal("unsupported function-result image admitted", err)
+	}
+	codex, _ := builtin.Registry().Lookup("codex")
+	if err := validateDeclaredInputs(codex, []sessions.Input{image}); err != nil {
+		t.Fatal(err)
 	}
 }
diff --git a/services/core/internal/execution/model_execution_test.go b/services/core/internal/execution/model_execution_test.go
index cda559676..969183e81 100644
--- a/services/core/internal/execution/model_execution_test.go
+++ b/services/core/internal/execution/model_execution_test.go
@@ -24,7 +24,7 @@ func TestSessionModelExecutionNeverFallsBack(t *testing.T) {
 	// A none device without a frozen provider uses its own provider environment:
 	// Core sends only the Agent's model and instructions.
 	instructions := "Keep this instruction."
-	snapshot := Snapshot{Agent: v1.Agent{Model: "device-model", Instructions: &instructions}, Environment: &v1.Environment{Type: "none"}}
+	snapshot := Snapshot{Agent: v1.Agent{Model: "device-model", Instructions: &instructions}, Environment: v1.Environment{Type: "none"}}
 	request, err := d.executionRequest(t.Context(), sessions.Session{Engine: "codex"}, snapshot, runtimedevice.KindCapabilities{}, sessions.ExecutionBinding{})
 	if err != nil || !reflect.DeepEqual(request.AgentOptions, map[string]any{"model": "device-model", "system_prompt": &instructions}) {
 		t.Fatal("none Session received adapter options Core does not own", request.AgentOptions, err)
@@ -35,7 +35,10 @@ func TestSessionModelOptionsPreserveUpstreamBundleForEveryHarness(t *testing.T)
 	for _, engine := range []string{"codex", "claude_sdk", "mcode"} {
 		for _, protocol := range []string{"anthropic", "responses", "chat_completions"} {
 			t.Run(engine+"/"+protocol, func(t *testing.T) {
-				provider := &v1.ModelProviderInput{Protocol: modelprovider.Protocol(protocol), BaseURL: "https://example.com/v1", APIKey: "private-key", Headers: map[string]string{"X-Activity": "private-header"}, ContextWindow: 200000, MaxOutputTokens: 8000}
+				provider := &v1.ModelProviderInput{Protocol: modelprovider.Protocol(protocol), BaseURL: "https://example.com/v1", APIKey: "private-key", Headers: map[string]string{"X-Activity": "private-header"}, ContextWindow: 200000}
+				if engine != "codex" {
+					provider.MaxOutputTokens = 8000 // Codex has no native output limit.
+				}
 				got, err := resolvedSessionModelOptions(provider, engine)
 				native := engine == "mcode" || engine == "codex" && protocol == "responses" || engine == "claude_sdk" && protocol == "anthropic"
 				if !native {
@@ -62,7 +65,7 @@ func TestSessionModelOptionsPreserveUpstreamBundleForEveryHarness(t *testing.T)
 
 func TestSessionModelOptionsValidateAdmission(t *testing.T) {
 	provider := &v1.ModelProviderInput{Protocol: "responses", BaseURL: "https://example.com/v1", APIKey: "private-key"}
-	for _, engine := range []string{"mcode", "unknown", ""} {
+	for _, engine := range []string{"unknown", ""} {
 		if _, err := resolvedSessionModelOptions(provider, engine); err == nil {
 			t.Fatalf("invalid provider/harness configuration accepted for %q", engine)
 		}
diff --git a/services/core/internal/execution/policy.go b/services/core/internal/execution/policy.go
index ec3a021b5..f07b73a0e 100644
--- a/services/core/internal/execution/policy.go
+++ b/services/core/internal/execution/policy.go
@@ -1,10 +1,22 @@
 package execution
 
-import "github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+import (
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
+)
 
-// Policy supplies immutable service qualification to admission and dispatch.
-// The zero value uses built-in profiles. Custom composition must supply the same
-// policy to the HTTP handler and Dispatcher; Runtime claims never add profiles.
+// Policy supplies the Harness declarations that admission and dispatch read.
+// The zero value uses the built-in Harnesses. Custom composition must supply the
+// same policy to the HTTP handler and Dispatcher; Runtime claims never add
+// declarations.
 type Policy struct {
-	Engines engine.Catalog
+	Declarations harnessconfig.Registry
+}
+
+// Harnesses returns the declarations this policy admits against.
+func (p Policy) Harnesses() harnessconfig.Registry {
+	if p.Declarations.IsZero() {
+		return builtin.Registry()
+	}
+	return p.Declarations
 }
diff --git a/services/core/internal/execution/prepared_dispatch.go b/services/core/internal/execution/prepared_dispatch.go
index 412433be4..0b5359256 100644
--- a/services/core/internal/execution/prepared_dispatch.go
+++ b/services/core/internal/execution/prepared_dispatch.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"strings"
 	"time"
 
 	obslog "github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
@@ -47,7 +46,7 @@ func (d *Dispatcher) RunEnvironmentInput(ctx context.Context, lease Ownership, t
 		return run, err
 	}
 	var snapshot Snapshot
-	if json.Unmarshal(session.Configuration, &snapshot) != nil || strings.TrimSpace(snapshot.Agent.Model) == "" {
+	if json.Unmarshal(session.Configuration, &snapshot) != nil {
 		return run, sessions.ErrInvalidInput
 	}
 	bound, err := d.SessionsReader.GetSessionExecutionBinding(ctx, tenantID, sessionID)
@@ -138,12 +137,12 @@ func (d *Dispatcher) RunEnvironmentInput(ctx context.Context, lease Ownership, t
 	through := run.Reservation.Receipts[len(run.Reservation.Receipts)-1].Sequence
 	releaseDelivery, err := peer.TrackExecutionDelivery(turnID)
 	if err != nil {
-		run.Turn, err = d.finishRun(tenantID, sessionID, turnID, snapshot.Agent.Model, Result{ErrorCode: "delivery_unknown", AppliedThrough: through}, sessions.TurnFailed)
+		run.Turn, err = d.finishRun(tenantID, sessionID, turnID, Result{ErrorCode: "delivery_unknown", AppliedThrough: through}, sessions.TurnFailed)
 		return run, err
 	}
 	defer releaseDelivery()
 	result, status := d.deliver(owner, tenantID, sessionID, peer, req, turnID, messages, through, prepared)
 	result, status = d.captureCompletedArtifacts(owner, peer, session, environment, bound.Device, turnID, result, status)
-	run.Turn, err = d.finishRun(tenantID, sessionID, turnID, snapshot.Agent.Model, result, status)
+	run.Turn, err = d.finishRun(tenantID, sessionID, turnID, result, status)
 	return run, err
 }
diff --git a/services/core/internal/execution/provider_operations_fixture_test.go b/services/core/internal/execution/provider_operations_fixture_test.go
index c1a132c1a..a32b73768 100644
--- a/services/core/internal/execution/provider_operations_fixture_test.go
+++ b/services/core/internal/execution/provider_operations_fixture_test.go
@@ -10,22 +10,24 @@ import (
 
 func (*lifecycleOnlySandbox) ProviderOperations() providercontract.Operations {
 	return providercontract.Operations{
-		"Create":            {State: providercontract.Supported},
-		"GetInfo":           {State: providercontract.Supported},
-		"Renew":             {State: providercontract.Supported},
-		"Kill":              {State: providercontract.Supported},
-		"RunCommand":        {State: providercontract.Supported},
-		"Initial":           {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"NewCompute":        {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"RenewCompute":      {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"GetCompute":        {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"Suspend":           {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"Resume":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"KillCompute":       {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"DeleteRetained":    {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"RunCommandCompute": {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"ResumeCompute":     {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"Observe":           {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Create":             {State: providercontract.Supported},
+		"GetInfo":            {State: providercontract.Supported},
+		"Renew":              {State: providercontract.Supported},
+		"Kill":               {State: providercontract.Supported},
+		"RunCommand":         {State: providercontract.Supported},
+		"Initial":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"NewCompute":         {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"RenewCompute":       {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"GetCompute":         {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Suspend":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Resume":             {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"KillCompute":        {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"DeleteRetained":     {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"RunCommandCompute":  {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"ResumeCompute":      {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"RestorePreparation": {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"SavePreparation":    {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Observe":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
 	}
 }
 func (*lifecycleOnlySandbox) Initial(context.Context, sandbox.Reference) (sandbox.Compute, error) {
@@ -62,3 +64,9 @@ func (*lifecycleOnlySandbox) Observe(context.Context, runtimeobs.Target) (runtim
 func (*lifecycleOnlySandbox) RenewCompute(context.Context, sandbox.Reference, sandbox.Compute) (sandbox.ComputeState, error) {
 	return sandbox.ComputeState{}, &providercontract.UnsupportedError{Operation: "RenewCompute", Reason: "fixture_operation_not_supported"}
 }
+func (*lifecycleOnlySandbox) RestorePreparation(context.Context, sandbox.Reference, string) (bool, error) {
+	return false, &providercontract.UnsupportedError{Operation: "RestorePreparation", Reason: "fixture_operation_not_supported"}
+}
+func (*lifecycleOnlySandbox) SavePreparation(context.Context, sandbox.Reference, string) error {
+	return &providercontract.UnsupportedError{Operation: "SavePreparation", Reason: "fixture_operation_not_supported"}
+}
diff --git a/services/core/internal/execution/recovery_test.go b/services/core/internal/execution/recovery_test.go
index 75e798208..b50620f10 100644
--- a/services/core/internal/execution/recovery_test.go
+++ b/services/core/internal/execution/recovery_test.go
@@ -20,7 +20,7 @@ func TestExistingSessionRecoveryRequiresVerifiedCapability(t *testing.T) {
 						}
 						continue
 					}
-					if err != nil || req.RequireExistingNativeSession != wantRecovery || req.AgentSessionID != nativeID || req.AgentStateKey != "agents-api-session" {
+					if err != nil || req.RequireExistingNativeSession != wantRecovery || req.AgentSessionID != nativeID || req.AgentStateKey != "session" {
 						t.Fatalf("engine=%s started=%v id=%s capability=%v request=%+v err=%v", engine, started, nativeID, capable, req, err)
 					}
 				}
diff --git a/services/core/internal/execution/request.go b/services/core/internal/execution/request.go
index 621bc16ad..17a7e3085 100644
--- a/services/core/internal/execution/request.go
+++ b/services/core/internal/execution/request.go
@@ -35,18 +35,9 @@ func (d *Dispatcher) executionRequest(ctx context.Context, session sessions.Sess
 		}
 		options["harness_config"] = native
 	}
-	verbosity := snapshot.Agent.Text.Verbosity
-	if verbosity == "" {
-		verbosity = "medium"
-	}
-	controls := &proto.ExecutionControls{DisableProgrammaticToolCalling: tools.DisableProgrammatic, WebSearch: "disabled", TextVerbosity: verbosity}
-	if snapshot.Agent.Text.Format.Type == "json_schema" {
-		controls.OutputFormat = &proto.OutputFormat{Type: "json_schema", Schema: snapshot.Agent.Text.Format.Schema}
-	}
 	request := proto.PromptRequestPayload{AgentKind: session.Engine, FunctionTools: tools.Functions, ToolSearch: tools.Search,
-		AgentOptions: options, ExecutionControls: controls, AgentStateKey: "agents-api-" + session.ID,
+		AgentOptions: options, ExecutionControls: executionControls(snapshot.Agent, tools), AgentStateKey: session.ID,
 		AgentSessionID: bound.NativeSessionID, RequireExistingNativeSession: recoverNativeSession,
-		ObserveMessages:           caps.MessageItems,
 		ObserveSubagentIdentities: snapshot.Agent.MultiAgent.Enabled,
 		MaxConcurrentSubagents:    snapshot.Agent.MultiAgent.MaxConcurrentSubagents,
 		DisableSubagents:          !snapshot.Agent.MultiAgent.Enabled}
diff --git a/services/core/internal/execution/runtime_compute.go b/services/core/internal/execution/runtime_compute.go
index dcae59977..63bfc9b05 100644
--- a/services/core/internal/execution/runtime_compute.go
+++ b/services/core/internal/execution/runtime_compute.go
@@ -46,6 +46,12 @@ func (r *runtimeLifecycle) saveCompute(ctx context.Context, owner deployment.All
 	next, err := r.deployment.SetCompute(ctx, owner, phase, raw, until)
 	if err == nil {
 		log.Ctx(ctx).Info("Runtime compute phase saved", "allocation_id", owner.ID, "node_id", owner.NodeID, "from", owner.ComputePhase, "to", phase)
+		switch phase {
+		case "running":
+			r.computeRunning()
+		case "suspended":
+			r.freedSlot()
+		}
 	}
 	return next, err
 }
@@ -246,6 +252,7 @@ func (r *runtimeLifecycle) releaseLostCompute(ctx context.Context, p sandbox.San
 		return err
 	}
 	r.clearRuntimeState(released)
+	r.freedSlot()
 	return nil
 }
 
@@ -298,7 +305,7 @@ func (r *runtimeLifecycle) restoreIdleCompute(ctx context.Context, p sandbox.San
 		return err
 	}
 	if !activity.Busy && !activity.WakeRequested {
-		return nil
+		return r.expireForDemand(ctx, owner)
 	}
 	if err := r.computeCapacityForAllocation(ctx, owner); err != nil {
 		return err
@@ -324,6 +331,29 @@ func (r *runtimeLifecycle) restoreIdleCompute(ctx context.Context, p sandbox.San
 	}
 	return r.restoreCompute(ctx, p, next, state, false)
 }
+
+// expireForDemand lets capacity pressure end an idle checkpoint's retention
+// early. Core decides eligibility and demand; a refusal changes nothing, and
+// the expired allocation is observed and cleaned up as at its deadline.
+func (r *runtimeLifecycle) expireForDemand(ctx context.Context, owner deployment.Allocation) error {
+	return r.expire(ctx, owner, r.deployment.ExpireCheckpointForDemand)
+}
+
+func (r *runtimeLifecycle) expire(ctx context.Context, owner deployment.Allocation, end func(context.Context, deployment.Allocation) error) error {
+	err := end(ctx, owner)
+	if errors.Is(err, deployment.ErrNotIdle) || errors.Is(err, deployment.ErrAllocationConflict) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	expired, err := r.reader.EnvironmentAllocation(ctx, owner.Key())
+	if err != nil {
+		return err
+	}
+	return r.observe(ctx, expired)
+}
+
 func (r *runtimeLifecycle) restoreCompute(ctx context.Context, p sandbox.SandboxProvider, owner deployment.Allocation, state runtimeCompute, observeOnly bool) (err error) {
 	defer func() { err = withObservationOwner(owner, err) }()
 	if state.Retained == nil || state.Rollback || state.RestoreID == "" {
@@ -354,6 +384,11 @@ func (r *runtimeLifecycle) restoreCompute(ctx context.Context, p sandbox.Sandbox
 	result, err := p.Resume(ctx, sandbox.ResumeRequest{Workspace: workspace, Reference: runtimeReference(owner), OperationID: state.RestoreID, Retained: *state.Retained, Target: *state.Target, ReconcileOnly: observeOnly})
 	observeExecutionStage(ctx, "provider_resume", resumeAt, err, "allocation_id", owner.ID, "session_id", owner.SessionID, "environment_id", owner.EnvironmentID, "node_id", r.nodeID, "reconcile_only", observeOnly)
 	logComputeStep(ctx, owner, "resume", resumeAt, err)
+	if errors.Is(err, sandbox.ErrCheckpointUnusable) {
+		// The Provider closed this attempt before native dispatch. Never restore
+		// the snapshot again: expire it and continue by ordinary expiry cleanup.
+		return r.expire(ctx, owner, r.deployment.ExpireUnusableCheckpoint)
+	}
 	if err != nil {
 		return err
 	}
diff --git a/services/core/internal/execution/runtime_compute_wake.go b/services/core/internal/execution/runtime_compute_wake.go
index a691fc36d..7d6c632e1 100644
--- a/services/core/internal/execution/runtime_compute_wake.go
+++ b/services/core/internal/execution/runtime_compute_wake.go
@@ -131,6 +131,9 @@ func (r *runtimeLifecycle) cleanupCompute(ctx context.Context, p sandbox.Sandbox
 		}
 	}
 	_, err := r.deployment.ReleaseAllocation(ctx, owner)
+	if err == nil {
+		r.freedSlot()
+	}
 	return err
 }
 
diff --git a/services/core/internal/execution/runtime_initialization.go b/services/core/internal/execution/runtime_initialization.go
index cf5745860..743130953 100644
--- a/services/core/internal/execution/runtime_initialization.go
+++ b/services/core/internal/execution/runtime_initialization.go
@@ -25,6 +25,10 @@ func (w *Worker) runEnvironmentInitializations(ctx context.Context) error {
 	ctx, stop := context.WithCancel(ctx)
 	defer func() { stop(); running.Wait() }()
 	cursor := ""
+	var announced <-chan struct{}
+	if w.dispatcher.Registry != nil {
+		announced = w.dispatcher.Registry.Announced()
+	}
 	ticker := time.NewTicker(250 * time.Millisecond)
 	defer ticker.Stop()
 	for {
@@ -33,6 +37,7 @@ func (w *Worker) runEnvironmentInitializations(ctx context.Context) error {
 			return ctx.Err()
 		case id := <-done:
 			delete(active, id)
+		case <-announced:
 		case <-ticker.C:
 		}
 		rows, err := w.dispatcher.SessionsReader.ListEnvironmentInitializations(ctx, cursor)
@@ -148,8 +153,8 @@ func (w *Worker) prepareEnvironment(ctx context.Context, owner sessions.Environm
 	}
 	identity := agentcapabilities.Identity{EnvironmentID: owner.EnvironmentID, SessionID: owner.SessionID}
 	operations := setupOperations(setup)
-	for index := 0; index < len(cfg.Files)+len(operations); index++ {
-		err = w.lease.CheckOwnership(ctx)
+	step := func(index int) error {
+		err := w.lease.CheckOwnership(ctx)
 		if err == nil {
 			var currentPeer = peer
 			currentPeer, err = w.dispatcher.authorizedPeer(ctx, owner.DeviceID)
@@ -170,14 +175,30 @@ func (w *Worker) prepareEnvironment(ctx context.Context, owner sessions.Environm
 			candidate = command.provisioningFailure(0)
 			err = runRuntimeSetup(ctx, peer, identity, command)
 		}
-		if err != nil {
-			var confirmed *runtimeStepFailure
-			if errors.As(err, &confirmed) {
-				candidate.ExitCode = confirmed.exitCode
-				*failure = candidate
-			}
-			return err
+		var confirmed *runtimeStepFailure
+		if errors.As(err, &confirmed) {
+			candidate.ExitCode = confirmed.exitCode
+			*failure = candidate
 		}
+		return err
+	}
+	total := len(cfg.Files) + len(operations)
+	cache, err := w.preparationCache(ctx, owner, len(cfg.Files), operations)
+	if err != nil {
+		return err
 	}
-	return nil
+	return cache.run(ctx, func() error {
+		for index := 0; index < total; index++ {
+			if err := step(index); err != nil {
+				return err
+			}
+		}
+		return nil
+	}, func() error {
+		// Only finalize binds the restored capability installation to this Session.
+		if len(operations) > 0 && operations[len(operations)-1].Request.Action == "finalize" {
+			return step(total - 1)
+		}
+		return nil
+	})
 }
diff --git a/services/core/internal/execution/runtime_lifecycle.go b/services/core/internal/execution/runtime_lifecycle.go
index e6e0a49cb..b297bf28d 100644
--- a/services/core/internal/execution/runtime_lifecycle.go
+++ b/services/core/internal/execution/runtime_lifecycle.go
@@ -68,6 +68,8 @@ type runtimeLifecycle struct {
 	wakeHints       chan struct{}
 	pendingWake     chan struct{}
 	hintDestination func(string)
+	placementWake   chan<- struct{}
+	scheduleWake    chan<- struct{}
 }
 
 func newRuntimeManager(owner Owner, deployments *deployment.Service, deploymentReader deployment.Reader, sessionReader sessions.Reader, registry *runtimegateway.Registry, config *RuntimeProvider) (*runtimeManager, error) {
@@ -304,7 +306,7 @@ func (r *runtimeLifecycle) provision(ctx context.Context, tenant, environment, p
 	started := time.Now()
 	info, err := provider.Create(ctx, sandbox.Bootstrap{
 		Reference: runtimeReference(owner), SessionID: owner.SessionID, DeviceID: owner.DeviceID,
-		Workspace: workspace, Harness: session.Engine, CoreURL: r.config.CoreURL, Credential: token, NetworkAccess: placement.NetworkAccess, AllowedDomains: placement.AllowedDomains,
+		Workspace: workspace, Harness: session.Engine, CoreURL: r.config.CoreURL, Credential: token,
 	})
 	observeExecutionStage(ctx, "provider_create", started, err, "allocation_id", owner.ID,
 		"session_id", owner.SessionID, "environment_id", environment, "device_id", owner.DeviceID, "node_id", r.nodeID)
@@ -488,6 +490,9 @@ func (r *runtimeLifecycle) observe(ctx context.Context, owner deployment.Allocat
 			return nil // Keep scanning unknown creation; absence is not a final receipt.
 		}
 		_, err = r.deployment.ReleaseAllocation(ctx, owner)
+		if err == nil {
+			r.freedSlot()
+		}
 		return err
 	}
 	// A stopped or missing container does not authorize destroying retained
diff --git a/services/core/internal/execution/runtime_manager.go b/services/core/internal/execution/runtime_manager.go
index c0609ebc8..8223d2fe4 100644
--- a/services/core/internal/execution/runtime_manager.go
+++ b/services/core/internal/execution/runtime_manager.go
@@ -14,6 +14,17 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/workspaces"
 )
 
+// provider returns the configured Provider and its installation, or nil during
+// a deployment switch.
+func (m *runtimeManager) provider() (sandbox.SandboxProvider, string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.switching {
+		return nil, ""
+	}
+	return m.config.Provider, m.config.InstallationID
+}
+
 // runtimeManager owns node membership, not provider operations. Each registered
 // node has one serial lifecycle; slow provider work cannot occupy another node.
 var errRuntimeTransition = fmt.Errorf("%w: sandbox configuration is changing", ErrExecutionUnavailable)
@@ -23,6 +34,7 @@ type runtimeManager struct {
 	workspaceCursor     string
 	placementCursor     deployment.PlacementDemandCursor
 	placementWake       chan struct{}
+	scheduleWake        chan<- struct{}
 	workspaceGate       chan struct{}
 	sessions            sessions.Reader
 	sessionExecution    *sessions.ExecutionOperations
@@ -98,7 +110,7 @@ func (m *runtimeManager) node(id string) (*runtimeNode, error) {
 			deployment: m.deployment, deployments: m.deploymentService, reader: m.deploymentReader,
 			lease: m.lease, registry: m.registry, config: m.config, nodeID: id,
 			gate: make(chan struct{}, 1), ctx: ctx, stop: stop,
-			connections: make(map[string]*runtimeConnection), connectionWake: make(chan *runtimegateway.Session, 1), wakeHints: make(chan struct{}, 1), pendingWake: make(chan struct{}, 1), hintDestination: m.hintDestination,
+			connections: make(map[string]*runtimeConnection), connectionWake: make(chan *runtimegateway.Session, 1), wakeHints: make(chan struct{}, 1), pendingWake: make(chan struct{}, 1), hintDestination: m.hintDestination, placementWake: m.placementWake, scheduleWake: m.scheduleWake,
 		}}
 		m.nodes[id] = n
 	}
@@ -131,6 +143,24 @@ func (m *runtimeManager) hintDestination(id string) {
 	}
 }
 
+// Work waiting for this compute may start now; the scheduler ticker recovers a missed wake.
+func (r *runtimeLifecycle) computeRunning() {
+	select {
+	case r.scheduleWake <- struct{}{}:
+	default:
+	}
+}
+
+// A freed node slot may admit waiting demand; the placement ticker recovers a missed wake.
+func (r *runtimeLifecycle) freedSlot() {
+	if r.nodeID != "" {
+		select {
+		case r.placementWake <- struct{}{}:
+		default:
+		}
+	}
+}
+
 func (m *runtimeManager) hints(id string) chan<- struct{} {
 	m.mu.Lock()
 	defer m.mu.Unlock()
diff --git a/services/core/internal/execution/runtime_observation_test.go b/services/core/internal/execution/runtime_observation_test.go
index aa5aecced..9b92eea12 100644
--- a/services/core/internal/execution/runtime_observation_test.go
+++ b/services/core/internal/execution/runtime_observation_test.go
@@ -91,3 +91,34 @@ func TestComputeFailureObservationUsesCommittedReceipt(t *testing.T) {
 		})
 	}
 }
+
+func TestRunningComputeWakesScheduler(t *testing.T) {
+	fixture := workspaceSettlementFixtureWithSetup(t, &observationCaptureProvider{}, workspaceNodeSetup(t, true))
+	r, session := fixture.lifecycle, fixture.session
+	wake := make(chan struct{}, 1)
+	r.scheduleWake = wake
+	initial, err := r.provision(t.Context(), session.TenantID, session.Environment.ID, r.config.InstallationID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = fixture.pool.Exec(t.Context(), `UPDATE runtime_allocations SET compute_phase='waking',compute_revision=2,compute_retained_until=clock_timestamp()+interval '1 hour' WHERE id=$1`, initial.ID); err != nil {
+		t.Fatal(err)
+	}
+	waking, err := r.reader.EnvironmentAllocation(t.Context(), initial.Key())
+	if err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-wake:
+	default:
+	}
+	// A Turn admitted while the compute was suspended is bound only once it runs.
+	if _, err = r.saveCompute(t.Context(), waking, "running", runtimeCompute{Current: sandbox.Compute{ID: "source", Name: "source"}}, nil); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-wake:
+	default:
+		t.Fatal("running compute did not wake the scheduler")
+	}
+}
diff --git a/services/core/internal/execution/runtime_pending.go b/services/core/internal/execution/runtime_pending.go
index 457fdf76c..5e8c8b9ab 100644
--- a/services/core/internal/execution/runtime_pending.go
+++ b/services/core/internal/execution/runtime_pending.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment/placement"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
@@ -92,6 +93,7 @@ func (m *runtimeManager) reservePlacements(ctx context.Context) error {
 		m.placementCursor = deployment.PlacementDemandCursor{}
 		return nil
 	}
+	incomplete := false
 	for _, environment := range rows {
 		if operation.Err() != nil {
 			if ownership := m.lease.CheckOwnership(ctx); ownership != nil {
@@ -114,6 +116,7 @@ func (m *runtimeManager) reservePlacements(ctx context.Context) error {
 				return nil
 			}
 			log.Ctx(ctx).Warn("managed Runtime placement incomplete", "environment_id", environment.ID)
+			incomplete = incomplete || errors.Is(err, placement.ErrNodeUnavailable)
 			continue
 		}
 		node, err := m.node(reserved.NodeID)
@@ -135,6 +138,15 @@ func (m *runtimeManager) reservePlacements(ctx context.Context) error {
 	if next.EnvironmentID == "" {
 		m.placementCursor = deployment.PlacementDemandCursor{}
 	}
+	if incomplete {
+		// Demand blocked by full nodes should start suspension or expiry now, not on each lane's next tick.
+		for _, n := range m.snapshotNodes() {
+			select {
+			case n.lifecycle.wakeHints <- struct{}{}:
+			default:
+			}
+		}
+	}
 	return nil
 }
 
diff --git a/services/core/internal/execution/runtime_placement_demand_test.go b/services/core/internal/execution/runtime_placement_demand_test.go
index f4d5faa85..40255bb9c 100644
--- a/services/core/internal/execution/runtime_placement_demand_test.go
+++ b/services/core/internal/execution/runtime_placement_demand_test.go
@@ -144,3 +144,42 @@ func TestPlacementBudgetEndsBeforeAttemptPreservesCursor(t *testing.T) {
 		t.Fatal("unattempted demand advanced cursor", m.placementCursor)
 	}
 }
+
+func TestCapacityFailedPlacementHintsNodeLanes(t *testing.T) {
+	m := testRuntimeManager(t)
+	m.config.InstallationID = uuid.NewString()
+	node, err := m.node("a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	m.deploymentReader = &strictDeploymentReader{t: t, placementDemand: func(context.Context, deployment.PlacementDemandCursor) ([]deployment.PlacementDemand, deployment.PlacementDemandCursor, error) {
+		return []deployment.PlacementDemand{{UnallocatedEnvironment: deployment.UnallocatedEnvironment{ID: uuid.NewString(), TenantID: uuid.NewString()}, At: time.Now()}}, deployment.PlacementDemandCursor{}, nil
+	}}
+	_, m.deployment = deploymentOperations(t, &strictDeploymentStorage{t: t}, &strictDeploymentReader{t: t}, &strictExecutionStorage{t: t, withReservation: func(context.Context, deployment.AllocationKey, func(sessions.LockedSession, deployment.ReservationTx) error) error {
+		return placement.ErrNodeUnavailable
+	}})
+	if err := m.reservePlacements(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-node.lifecycle.wakeHints:
+	default:
+		t.Fatal("capacity-blocked demand did not hint the node lane")
+	}
+}
+
+func TestFreedSlotWakesPlacement(t *testing.T) {
+	m := testRuntimeManager(t)
+	m.placementWake = make(chan struct{}, 1)
+	node, err := m.node("a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	node.lifecycle.freedSlot()
+	node.lifecycle.freedSlot() // coalesced, never blocks
+	select {
+	case <-m.placementWake:
+	default:
+		t.Fatal("freed slot did not wake placement")
+	}
+}
diff --git a/services/core/internal/execution/runtime_preparation_cache.go b/services/core/internal/execution/runtime_preparation_cache.go
new file mode 100644
index 000000000..fb388379a
--- /dev/null
+++ b/services/core/internal/execution/runtime_preparation_cache.go
@@ -0,0 +1,94 @@
+package execution
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/providercontract"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
+)
+
+// preparationCache reuses the result of an earlier preparation with the same key
+// through a Provider that declares the operations. The Provider owns storage and
+// lifetime; Core only computes the key.
+type preparationCache struct {
+	provider  sandbox.SandboxProvider
+	reference sandbox.Reference
+	key       string
+}
+
+// preparationCache returns nil when this Environment cannot use the cache: no
+// preparation work, no declared operations or an allocation of another installation.
+func (w *Worker) preparationCache(ctx context.Context, owner sessions.EnvironmentInitialization, fileCount int, operations []runtimeSetupOperation) (*preparationCache, error) {
+	provider, installation := w.runtimes.provider()
+	if fileCount+len(operations) == 0 || provider == nil || providercontract.Require(provider, "RestorePreparation") != nil {
+		return nil, nil
+	}
+	allocation, err := w.dispatcher.DeploymentReader.EnvironmentAllocation(ctx, deployment.AllocationKey{TenantID: owner.TenantID, EnvironmentID: owner.EnvironmentID})
+	if errors.Is(err, deployment.ErrNotFound) || err == nil && (allocation.ProviderKey != installation || allocation.State != "running") {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	hash := sha256.New()
+	encoder := json.NewEncoder(hash)
+	_ = encoder.Encode(owner.TenantID)
+	for index := range fileCount {
+		metadata, body, err := w.dispatcher.SessionsReader.ReadInitialEnvironmentFile(ctx, owner.TenantID, owner.SessionID, index)
+		if err != nil {
+			return nil, err
+		}
+		digest := sha256.Sum256(body)
+		_ = encoder.Encode([]string{metadata.Path, hex.EncodeToString(digest[:])})
+	}
+	for _, operation := range operations {
+		digest := sha256.Sum256(operation.Data)
+		_ = encoder.Encode(operation.Request)
+		_ = encoder.Encode(hex.EncodeToString(digest[:]))
+	}
+	return &preparationCache{provider, runtimeReference(allocation), hex.EncodeToString(hash.Sum(nil))}, nil
+}
+
+// run restores a saved preparation and sends only finalize, which binds the
+// restored installation to this Session. Otherwise it prepares and saves the
+// result. A failed save never fails the Session.
+func (c *preparationCache) run(ctx context.Context, prepare, finalize func() error) error {
+	if c == nil {
+		return prepare()
+	}
+	started := time.Now()
+	restored, err := c.provider.RestorePreparation(ctx, c.reference, c.key)
+	c.log(ctx, "restore_preparation", restored, started, err)
+	if err != nil {
+		return err
+	}
+	if restored {
+		return finalize()
+	}
+	if err := prepare(); err != nil {
+		return err
+	}
+	started = time.Now()
+	save := ctx
+	if deadline, bounded := ctx.Deadline(); bounded {
+		// Half the remaining budget, so a slow save never takes the time completion needs.
+		var cancel context.CancelFunc
+		save, cancel = context.WithTimeout(ctx, time.Until(deadline)/2)
+		defer cancel()
+	}
+	c.log(ctx, "save_preparation", false, started, c.provider.SavePreparation(save, c.reference, c.key))
+	return nil
+}
+
+func (c *preparationCache) log(ctx context.Context, step string, hit bool, started time.Time, err error) {
+	log.Ctx(ctx).Info("Environment preparation cache", "allocation_id", c.reference.AllocationID, "step", step, "hit", hit,
+		"duration_ms", time.Since(started).Milliseconds(), "succeeded", err == nil)
+}
diff --git a/services/core/internal/execution/runtime_preparation_cache_test.go b/services/core/internal/execution/runtime_preparation_cache_test.go
new file mode 100644
index 000000000..fb2ea9d41
--- /dev/null
+++ b/services/core/internal/execution/runtime_preparation_cache_test.go
@@ -0,0 +1,48 @@
+package execution
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+)
+
+type preparationProvider struct {
+	sandbox.SandboxProvider
+	hit     bool
+	saveErr error
+	saved   []string
+}
+
+func (p *preparationProvider) RestorePreparation(context.Context, sandbox.Reference, string) (bool, error) {
+	return p.hit, nil
+}
+func (p *preparationProvider) SavePreparation(_ context.Context, _ sandbox.Reference, key string) error {
+	p.saved = append(p.saved, key)
+	return p.saveErr
+}
+
+func TestPreparationCacheHitFinalizesMissPreparesAndSaves(t *testing.T) {
+	for _, test := range []struct {
+		name                string
+		hit                 bool
+		saveErr             error
+		prepared, finalized int
+		saved               int
+	}{
+		{"hit", true, nil, 0, 1, 0},
+		{"miss", false, nil, 1, 0, 1},
+		{"failed save", false, errors.New("disk full"), 1, 0, 1},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			provider := &preparationProvider{hit: test.hit, saveErr: test.saveErr}
+			var prepared, finalized int
+			cache := &preparationCache{provider: provider, key: "key"}
+			err := cache.run(context.Background(), func() error { prepared++; return nil }, func() error { finalized++; return nil })
+			if err != nil || prepared != test.prepared || finalized != test.finalized || len(provider.saved) != test.saved {
+				t.Fatal(err, prepared, finalized, provider.saved)
+			}
+		})
+	}
+}
diff --git a/services/core/internal/execution/runtime_preparation_capacity_test.go b/services/core/internal/execution/runtime_preparation_capacity_test.go
index f1a955741..7eb0b2ebe 100644
--- a/services/core/internal/execution/runtime_preparation_capacity_test.go
+++ b/services/core/internal/execution/runtime_preparation_capacity_test.go
@@ -7,7 +7,6 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/adminaudit"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment/placement"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimedevice"
-	"strings"
 	"sync"
 	"testing"
 
@@ -183,45 +182,8 @@ func TestUnsettledFilesystemPreparationYieldsOnlyCompute(t *testing.T) {
 	if err != nil || !target.PlacementReleased || target.AllocationID != "" {
 		t.Fatal(target, err)
 	}
-	// A newer generation without external storage must not displace this
-	// unallocated Session's already-bound filesystem onto owned ephemeral disk.
-	setup, err := r.deployments.Setup(t.Context())
-	if err != nil {
-		t.Fatal(err)
-	}
-	updated := setup.Specification
-	updated.Workspace = nil
-	updated.Resources.EnvironmentDiskMiB = 8192
-	view, err := r.deployment.Update(adminaudit.WithSource(t.Context(), adminaudit.Source{CredentialID: "fixture-admin", RequestID: uuid.NewString(), TraceID: uuid.NewString()}), r.config.InstallationID, sandbox.Selection{Provider: setup.Provider, ExpectedGeneration: setup.Generation, DeploymentSpec: updated})
-	if err != nil {
-		t.Fatal(err)
-	}
-	token, err := r.deployments.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 1, MaxRetained: 2})
-	if err != nil {
-		t.Fatal(err)
-	}
-	newer := deployment.Enrollment{NodeID: uuid.NewString(), Name: "newer owned workspace", Credential: strings.Repeat("n", 64), Provider: view.Provider, BackendFingerprint: strings.Repeat("c", 64), DeploymentGeneration: view.Generation, SpecificationDigest: view.SpecificationDigest, CoreURL: fixturePublicURL}
-	if _, err := r.deployments.Enroll(t.Context(), token.Token, newer); err != nil {
-		t.Fatal(err)
-	}
-	epoch, err := r.reader.OwnerEpoch(t.Context())
-	if err != nil {
-		t.Fatal(err)
-	}
-	connection := uuid.NewString()
-	if err := r.deployments.ConnectNode(t.Context(), newer.NodeID, connection, epoch); err != nil {
-		t.Fatal(err)
-	}
-	if err := r.deployments.Heartbeat(t.Context(), newer.NodeID, connection, epoch, deployment.NodeHealth{ProviderReady: true}, []sandbox.GenerationStatus{{Generation: view.Generation, SpecificationDigest: view.SpecificationDigest, State: "ready", Checkpoint: &sandbox.CheckpointCompatibility{ArtifactDomain: "fixture-store", ExecutionClass: "fixture-runtime"}}}); err != nil {
-		t.Fatal(err)
-	}
-	demands, _, err := r.reader.PlacementDemand(t.Context(), deployment.PlacementDemandCursor{})
-	if err != nil || len(demands) != 1 || !demands[0].Retained {
-		t.Fatal("bound FS omitted from pressure eligibility", demands, err)
-	}
-	selected, err := r.deployment.EnsurePlacement(t.Context(), key, r.config.InstallationID)
-	if err != nil || selected.NodeID != r.nodeID || selected.Generation != setup.Generation {
-		t.Fatal("selected generation cannot attach retained filesystem", selected, err)
+	if selected, err := r.deployment.EnsurePlacement(t.Context(), key, r.config.InstallationID); err != nil || selected.NodeID != r.nodeID {
+		t.Fatal("released placement was not offered again", selected, err)
 	}
 	if _, err := r.provision(t.Context(), s.TenantID, s.Environment.ID, r.config.InstallationID); err != nil {
 		t.Fatal(err)
diff --git a/services/core/internal/execution/runtime_replacement_test.go b/services/core/internal/execution/runtime_replacement_test.go
index 6e5aa3212..2da39259a 100644
--- a/services/core/internal/execution/runtime_replacement_test.go
+++ b/services/core/internal/execution/runtime_replacement_test.go
@@ -14,7 +14,6 @@ import (
 	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/adminaudit"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment/placement"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/identity"
@@ -54,7 +53,7 @@ func (p *retentionProvider) DeleteRetained(context.Context, sandbox.Reference, s
 	return nil
 }
 
-func TestCapacityPressurePreservesSuspendedSnapshot(t *testing.T) {
+func TestCapacityPressureReleasesIdleSuspendedSnapshot(t *testing.T) {
 	provider := &retentionProvider{}
 	fixture := newWorkspaceSettlementFixture(t, provider)
 	r, session := fixture.lifecycle, fixture.session
@@ -87,25 +86,26 @@ func TestCapacityPressurePreservesSuspendedSnapshot(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	for range 3 {
-		if err := r.observeCompute(t.Context(), owner); err != nil {
-			t.Fatal(err)
-		}
-		current, err := r.reader.EnvironmentAllocation(t.Context(), owner.Key())
-		if err != nil || current.Expired || current.ComputePhase != "suspended" || current.ComputeRevision != owner.ComputeRevision || current.ComputeRetainedUntil == nil || !current.ComputeRetainedUntil.Equal(*owner.ComputeRetainedUntil) {
-			t.Fatal("pressure changed retained snapshot", current, err)
-		}
-		if _, err := r.deployment.EnsurePlacement(t.Context(), deployment.AllocationKey{TenantID: session.TenantID, EnvironmentID: waiting.Session.Environment.ID}, r.config.InstallationID); !errors.Is(err, placement.ErrNodeUnavailable) {
-			t.Fatal("released retained capacity without cleanup", err)
-		}
+	if _, err := r.deployment.EnsurePlacement(t.Context(), deployment.AllocationKey{TenantID: session.TenantID, EnvironmentID: waiting.Session.Environment.ID}, r.config.InstallationID); !errors.Is(err, placement.ErrNodeUnavailable) {
+		t.Fatal("placed despite full retained slots", err)
+	}
+	// The blocked demand releases the idle checkpoint as if its deadline passed.
+	if err := r.observeCompute(t.Context(), owner); err != nil {
+		t.Fatal(err)
+	}
+	current, err := r.reader.EnvironmentAllocation(t.Context(), owner.Key())
+	if err != nil || current.State != "released" {
+		t.Fatal("pressure did not release the checkpoint", current, err)
+	}
+	if _, err := r.deployment.EnsurePlacement(t.Context(), deployment.AllocationKey{TenantID: session.TenantID, EnvironmentID: waiting.Session.Environment.ID}, r.config.InstallationID); err != nil {
+		t.Fatal("released slot was not usable", err)
 	}
 	pending, err := r.sessions.GetEnvironmentInputReservation(t.Context(), session.TenantID, waiting.Session.ID, input.ID)
 	if err != nil || pending.State != sessions.EnvironmentInputPending || !pending.Deadline.Equal(input.Deadline) {
 		t.Fatal("pressure changed input deadline", pending, err)
 	}
-
-	if provider.kills != 0 || provider.snapshots != 0 || provider.creates != 1 {
-		t.Fatal("pressure changed native resources", provider)
+	if provider.kills != 0 || provider.snapshots != 1 {
+		t.Fatal("pressure did not delete exactly the snapshot", provider)
 	}
 }
 
@@ -323,22 +323,27 @@ func TestRetainedEnvironmentDemandRecreatesCompute(t *testing.T) {
 	}
 }
 
+// workspaceNodeSetup deploys microsandbox, which runs every Environment on external storage, or, without storage, docker.
 func workspaceNodeSetup(t *testing.T, external bool) func(Owner, *deployment.Service, deployment.Reader) (string, string) {
 	return func(owner Owner, service *deployment.Service, reader deployment.Reader) (string, string) {
 		installation := uuid.NewString()
 		if err := owner.Deployment.Claim(t.Context(), installation); err != nil {
 			t.Fatal(err)
 		}
-		specification := sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048, RootDiskMiB: 8192}, Workspace: &workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}, Runtime: &sandbox.RuntimeRelease{SourceCommit: strings.Repeat("a", 40), ImageID: "sha256:" + strings.Repeat("b", 64), ImageManifestDigest: "sha256:" + strings.Repeat("c", 64), MicrosandboxRef: "oac-runtime@sha256:" + strings.Repeat("d", 64), RuntimeSHA256: strings.Repeat("e", 64), FirmwareSHA256: strings.Repeat("f", 64)}}
+		specification := sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048, RootDiskMiB: 8192}, Workspace: &workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}}
+		provider := "microsandbox"
 		if !external {
-			specification.Workspace = nil
-			specification.Resources.EnvironmentDiskMiB = 8192
+			provider, specification = "docker", sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048}}
 		}
-		view, err := owner.Deployment.Initialize(t.Context(), installation, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: specification})
+		view, err := owner.Deployment.Initialize(t.Context(), installation, sandbox.Selection{Provider: provider, DeploymentSpec: specification})
 		if err != nil {
 			t.Fatal(err)
 		}
-		token, err := service.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 1, MaxRetained: 2})
+		retained, checkpoint := 2, &sandbox.CheckpointCompatibility{ArtifactDomain: "fixture-store", ExecutionClass: "fixture-runtime"}
+		if !external {
+			retained, checkpoint = 1, nil
+		}
+		token, err := service.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: &retained})
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -354,7 +359,7 @@ func workspaceNodeSetup(t *testing.T, external bool) func(Owner, *deployment.Ser
 		if err = service.ConnectNode(t.Context(), node.NodeID, connection, epoch); err != nil {
 			t.Fatal(err)
 		}
-		if err = service.Heartbeat(t.Context(), node.NodeID, connection, epoch, deployment.NodeHealth{ProviderReady: true}, []sandbox.GenerationStatus{{Generation: view.Generation, SpecificationDigest: view.SpecificationDigest, State: "ready", Checkpoint: &sandbox.CheckpointCompatibility{ArtifactDomain: "fixture-store", ExecutionClass: "fixture-runtime"}}}); err != nil {
+		if err = service.Heartbeat(t.Context(), node.NodeID, connection, epoch, deployment.NodeHealth{}, []sandbox.GenerationStatus{{Generation: view.Generation, SpecificationDigest: view.SpecificationDigest, State: "ready", Checkpoint: checkpoint}}); err != nil {
 			t.Fatal(err)
 		}
 		return installation, node.NodeID
@@ -362,48 +367,7 @@ func workspaceNodeSetup(t *testing.T, external bool) func(Owner, *deployment.Ser
 	}
 }
 
-func TestProvisionUsesReservedGenerationStorageDuringUpdate(t *testing.T) {
-	for _, external := range []bool{false, true} {
-		t.Run(map[bool]string{false: "owned_ready_external_target", true: "external_ready_owned_target"}[external], func(t *testing.T) {
-			provider := &retentionProvider{bootstraps: make(chan sandbox.Bootstrap, 1)}
-			f := workspaceSettlementFixtureWithSetup(t, provider, workspaceNodeSetup(t, external))
-			r, s := f.lifecycle, f.session
-			setup, err := r.deployments.Setup(t.Context())
-			if err != nil {
-				t.Fatal(err)
-			}
-			target := setup.Specification
-			target.Workspace = &workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}
-			target.Resources.EnvironmentDiskMiB = 0
-			if external {
-				target.Workspace = nil
-				target.Resources.EnvironmentDiskMiB = 8192
-			}
-			if _, err = r.deployment.Update(adminaudit.WithSource(t.Context(), adminaudit.Source{CredentialID: "fixture-admin", RequestID: uuid.NewString(), TraceID: uuid.NewString()}), r.config.InstallationID, sandbox.Selection{Provider: setup.Provider, ExpectedGeneration: setup.Generation, DeploymentSpec: target}); err != nil {
-				t.Fatal(err)
-			}
-			// Neither today's target nor the lane's cached storage mode selects storage.
-			r.config.Workspace = target.Workspace
-			owner, err := r.provision(t.Context(), s.TenantID, s.Environment.ID, r.config.InstallationID)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if owner.DeploymentGeneration != setup.Generation {
-				t.Fatal("lost reserved generation", owner)
-			}
-			bootstrap := <-provider.bootstraps
-			if (bootstrap.Workspace != nil) != external {
-				t.Fatal("storage mode followed target instead of reservation", external, bootstrap.Workspace)
-			}
-			environment, err := r.sessions.GetEnvironment(t.Context(), s.TenantID, s.Environment.ID)
-			if err != nil || environment.ExternalWorkspace != external {
-				t.Fatal("immutable binding projection", environment, err)
-			}
-		})
-	}
-}
-
-func TestProvisionRejectsRetainedBindingOnOwnedGeneration(t *testing.T) {
+func TestProvisionRejectsRetainedBindingOnProviderWithoutStorage(t *testing.T) {
 	provider := &retentionProvider{bootstraps: make(chan sandbox.Bootstrap, 1)}
 	f := workspaceSettlementFixtureWithSetup(t, provider, workspaceNodeSetup(t, false))
 	r, s := f.lifecycle, f.session
@@ -456,10 +420,8 @@ func TestRestoreUsesAllocationGenerationStorageInsteadOfCachedLane(t *testing.T)
 				target.Workspace = nil
 				target.Resources.EnvironmentDiskMiB = 8192
 			}
-			audit := adminaudit.WithSource(t.Context(), adminaudit.Source{CredentialID: "fixture-admin", RequestID: uuid.NewString(), TraceID: uuid.NewString()})
-			if _, err = r.deployment.Update(audit, r.config.InstallationID, sandbox.Selection{Provider: setup.Provider, ExpectedGeneration: setup.Generation, DeploymentSpec: target}); err != nil {
-				t.Fatal(err)
-			}
+			// Simulate a stale cached lane; current provider policy no longer admits
+			// switching an existing provider between owned and external storage.
 			r.config.Workspace = target.Workspace
 			r.config.Resources = target.Resources
 			state := runtimeCompute{Target: &sandbox.Compute{ID: "replacement-compute", Generation: 2}, Retained: &sandbox.RetainedState{ID: "snapshot", Data: "native-state"}, RestoreID: uuid.NewString()}
diff --git a/services/core/internal/execution/runtime_restore_attempt_test.go b/services/core/internal/execution/runtime_restore_attempt_test.go
index 86feedce4..12a321125 100644
--- a/services/core/internal/execution/runtime_restore_attempt_test.go
+++ b/services/core/internal/execution/runtime_restore_attempt_test.go
@@ -26,6 +26,9 @@ func (p *restoreAttemptProvider) NewCompute(_ context.Context, _ sandbox.Referen
 }
 func (p *restoreAttemptProvider) Resume(_ context.Context, q sandbox.ResumeRequest) (sandbox.ComputeState, error) {
 	p.requests = append(p.requests, q)
+	if p.outcome == "unusable" {
+		return sandbox.ComputeState{}, sandbox.ErrCheckpointUnusable
+	}
 	if !q.ReconcileOnly {
 		return sandbox.ComputeState{}, p.stop
 	}
@@ -101,6 +104,36 @@ func TestRestoreAttemptRecoveryUsesExactClosedEvidence(t *testing.T) {
 	}
 }
 
+func TestUnusableCheckpointEndsRetentionAndIsNeverRestoredAgain(t *testing.T) {
+	provider := &restoreAttemptProvider{outcome: "unusable"}
+	f := workspaceSettlementFixtureWithSetup(t, provider, workspaceNodeSetup(t, true))
+	r, session := f.lifecycle, f.session
+	owner, err := r.provision(t.Context(), session.TenantID, session.Environment.ID, r.config.InstallationID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	snapshot := &sandbox.RetainedState{ID: "snapshot", Compatibility: sandbox.CheckpointCompatibility{ArtifactDomain: "fixture-store", ExecutionClass: "fixture-runtime"}}
+	state := runtimeCompute{Version: sandbox.SuspensionStateVersion, Current: sandbox.Compute{ID: "source", Name: "source", Generation: 1}, Retained: snapshot, RestoreID: uuid.NewString(), Target: &sandbox.Compute{Name: "target", Generation: 2, RestoredFrom: snapshot}}
+	raw, err := json.Marshal(state)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = f.pool.Exec(t.Context(), `UPDATE runtime_allocations SET compute_phase='restoring',compute_revision=4,compute_retained_until=clock_timestamp()+interval '1 hour',compute_state=$2 WHERE id=$1`, owner.ID, raw); err != nil {
+		t.Fatal(err)
+	}
+	owner, err = r.reader.EnvironmentAllocation(t.Context(), owner.Key())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = r.observe(t.Context(), owner); err != nil {
+		t.Fatal(err)
+	}
+	released, err := r.reader.EnvironmentAllocation(t.Context(), owner.Key())
+	if err != nil || released.State != "released" || provider.kills != 1 || provider.snapshots != 1 || len(provider.requests) != 1 {
+		t.Fatalf("unusable checkpoint was not cleaned up once: %v %#v kills=%d snapshots=%d requests=%d", err, released, provider.kills, provider.snapshots, len(provider.requests))
+	}
+}
+
 func TestCheckpointTransferRoutesBeforeTargetIO(t *testing.T) {
 	for _, operation := range []string{"wake", "expiry"} {
 		t.Run(operation, func(t *testing.T) {
@@ -116,7 +149,7 @@ func TestCheckpointTransferRoutesBeforeTargetIO(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			token, err := r.deployments.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 1, MaxRetained: 2})
+			token, err := r.deployments.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: new(2)})
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -130,7 +163,7 @@ func TestCheckpointTransferRoutesBeforeTargetIO(t *testing.T) {
 				t.Fatal(err)
 			}
 			compat := sandbox.CheckpointCompatibility{ArtifactDomain: "fixture-store", ExecutionClass: "fixture-runtime"}
-			if err = r.deployments.Heartbeat(t.Context(), targetNode, connection, view.OwnerEpoch, deployment.NodeHealth{ProviderReady: true}, []sandbox.GenerationStatus{{Generation: view.Generation, SpecificationDigest: view.SpecificationDigest, State: "ready", Checkpoint: &compat}}); err != nil {
+			if err = r.deployments.Heartbeat(t.Context(), targetNode, connection, view.OwnerEpoch, deployment.NodeHealth{}, []sandbox.GenerationStatus{{Generation: view.Generation, SpecificationDigest: view.SpecificationDigest, State: "ready", Checkpoint: &compat}}); err != nil {
 				t.Fatal(err)
 			}
 			state := runtimeCompute{Version: sandbox.SuspensionStateVersion, Current: sandbox.Compute{ID: "source", Name: "source", Generation: 1}, Retained: &sandbox.RetainedState{ID: "snapshot", Compatibility: compat}}
diff --git a/services/core/internal/execution/sandbox_generations_test.go b/services/core/internal/execution/sandbox_generations_test.go
index 733d28f82..0f4b12432 100644
--- a/services/core/internal/execution/sandbox_generations_test.go
+++ b/services/core/internal/execution/sandbox_generations_test.go
@@ -67,7 +67,7 @@ func TestE2BReplacementVerifiesTwiceAndNeverPublishesFailedCommit(t *testing.T)
 	request := input
 	request.ExpectedGeneration = 1
 	audit := adminaudit.WithSource(t.Context(), adminaudit.Source{CredentialID: "test", RequestID: "test", TraceID: "test"})
-	for _, failure := range []string{"preliminary", "final", "unanchored legacy or revoked committed key", "unknown ownership", "commit"} {
+	for _, failure := range []string{"preliminary", "final", "revoked committed key", "unknown ownership", "commit"} {
 		verifyCalls = 0
 		rejectAt = 0
 		ctx := audit
@@ -76,7 +76,7 @@ func TestE2BReplacementVerifiesTwiceAndNeverPublishesFailedCommit(t *testing.T)
 			rejectAt = 1
 		case "final":
 			rejectAt = 2
-		case "unanchored legacy or revoked committed key":
+		case "revoked committed key":
 			rejectAt = 1
 			rejection = &deployment.ResetRequiredError{CurrentProvider: "e2b", RequestedProvider: "e2b"}
 		case "unknown ownership":
diff --git a/services/core/internal/execution/scheduling_independent_qa_test.go b/services/core/internal/execution/scheduling_independent_qa_test.go
index 114fab98f..d45e203d7 100644
--- a/services/core/internal/execution/scheduling_independent_qa_test.go
+++ b/services/core/internal/execution/scheduling_independent_qa_test.go
@@ -249,7 +249,7 @@ func TestQASchedulerActualReadinessHintsAndPollFallback(t *testing.T) {
 	if len(scan(true)) != 0 || scope.times[5].IsZero() {
 		t.Fatal("unknown capabilities did not block/classify")
 	}
-	heartbeat, _ := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, Preparation: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, WebSearchControl: proto.CapabilitySupported, TextVerbosity: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, LocalEnvironment: proto.CapabilitySupported, WorkspaceReadPreparation: proto.CapabilitySupported, WorkspaceOutputExport: proto.CapabilitySupported})}}})
+	heartbeat, _ := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, Preparation: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, LocalEnvironment: proto.CapabilitySupported, WorkspaceReadPreparation: proto.CapabilitySupported, WorkspaceOutputExport: proto.CapabilitySupported})}}})
 	if err = conn.WriteJSON(heartbeat); err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/internal/execution/structured_output_test.go b/services/core/internal/execution/structured_output_test.go
index bff723dd3..e4a7d9414 100644
--- a/services/core/internal/execution/structured_output_test.go
+++ b/services/core/internal/execution/structured_output_test.go
@@ -7,8 +7,8 @@ import (
 
 	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine/enginetest"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/harnesstest"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimedevice"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 )
@@ -16,12 +16,14 @@ import (
 func TestStructuredOutputNeedsOperationQualification(t *testing.T) {
 	raw := json.RawMessage(`{"agent":{"model":"model","text":{"format":{"type":"json_schema","schema":{"type":"object"}}}},"environment":{"type":"none"}}`)
 	for _, kind := range []string{"codex", "claude_sdk", "mcode"} {
-		if err := (Policy{}).ValidateSessionConfiguration(kind, raw); (err == nil) != (kind == "claude_sdk") {
+		if err := (Policy{}).ValidateSessionConfiguration(kind, raw); (err == nil) != (kind != "mcode") {
 			t.Fatalf("%s: %v", kind, err)
 		}
 	}
 	for _, qualified := range []bool{false, true} {
-		policy := Policy{Engines: engine.NewCatalog(map[string]engine.Profile{"new_harness": enginetest.Profile(func(p *engine.Profile) { p.StructuredOutput = proto.CapabilityFromBool(qualified) })})}
+		policy := Policy{Declarations: harnessconfig.NewRegistry(harnesstest.Declaration("new_harness", func(d *harnessconfig.Declaration) {
+			d.Capabilities.StructuredOutput = proto.CapabilityFromBool(qualified)
+		}))}
 		if err := policy.ValidateSessionConfiguration("new_harness", raw); (err == nil) != qualified {
 			t.Fatal("new harness did not use common qualification", err)
 		}
diff --git a/services/core/internal/execution/support.go b/services/core/internal/execution/support.go
index d2c35086b..2ba5ec7e0 100644
--- a/services/core/internal/execution/support.go
+++ b/services/core/internal/execution/support.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"strings"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimedevice"
@@ -18,39 +17,32 @@ func (p Policy) ValidateSessionConfiguration(engine string, configuration json.R
 	if json.Unmarshal(configuration, &snapshot) != nil {
 		return sessions.ErrInvalidInput
 	}
-	profile, ok := p.Engines.Lookup(engine)
-	if !ok || (snapshot.Environment != nil && !profile.Accepts(snapshot.Environment.Type)) {
+	declaration, ok := p.Harnesses().Lookup(engine)
+	if !ok || !declaration.Accepts(snapshot.Environment.Type) {
 		return sessions.ErrInvalidInput
 	}
 	_, err := p.mcpCredentialBindings(engine, snapshot)
 	if err != nil {
 		return err
 	}
-	if snapshot.Environment != nil && snapshot.Environment.Type == "self_hosted" {
-		if strings.TrimSpace(snapshot.Agent.Model) == "" || !validSelfHostedPlacement(environmentPlacement{WorkspaceDirectory: snapshot.Environment.WorkspaceDirectory, CapabilityDirectories: snapshot.Environment.CapabilityDirectories}) {
-			return sessions.ErrInvalidInput
-		}
+	if snapshot.Environment.Type == "self_hosted" && !validSelfHostedPlacement(environmentPlacement{WorkspaceDirectory: snapshot.Environment.WorkspaceDirectory, CapabilityDirectories: snapshot.Environment.CapabilityDirectories}) {
+		return sessions.ErrInvalidInput
 	}
-	if snapshot.Environment != nil && snapshot.Environment.Type == "openai_hosted" {
-		// Only this placement/engine combination has current native qualification.
-		// Runtime capability checks still apply before any execution claim.
-		if strings.TrimSpace(snapshot.Agent.Model) == "" {
-			return sessions.ErrInvalidInput
-		}
+	if snapshot.Environment.Type == "openai_hosted" {
 		configuration, err := json.Marshal(snapshot.Environment)
 		if err != nil || !LocalWorkspaceConfiguration(configuration) {
 			return sessions.ErrInvalidInput
 		}
 	}
-	if snapshot.Environment != nil && snapshot.Environment.Type != "none" {
+	if snapshot.Environment.Type != "none" {
 		// Current Runtime adapters cannot execute a restricted network policy.
 		// Admission must reject it before allocating compute. Runtime itself is
-		// not an enforcement boundary; new support needs outer qualification.
+		// not an enforcement boundary; new support needs outer isolation.
 		if network := snapshot.Environment.Network; network != nil && network.Access != "enabled" {
 			return errors.New("This execution environment does not support disabled or restricted networking. Use enabled networking; Runtime does not provide network isolation.")
 		}
 	}
-	return validateProfileConfiguration(profile, snapshot)
+	return validateDeclaredConfiguration(declaration, snapshot)
 }
 
 func (p Policy) canAdmitInputs(engine string, configuration json.RawMessage) bool {
@@ -62,7 +54,7 @@ func (p Policy) canAdmitInputs(engine string, configuration json.RawMessage) boo
 }
 
 func (p Policy) validateEngineInputs(engine string, configuration json.RawMessage, inputs []sessions.Input) error {
-	profile, ok := p.Engines.Lookup(engine)
+	declaration, ok := p.Harnesses().Lookup(engine)
 	if !ok {
 		return sessions.ErrInvalidInput
 	}
@@ -70,11 +62,7 @@ func (p Policy) validateEngineInputs(engine string, configuration json.RawMessag
 	if json.Unmarshal(configuration, &snapshot) != nil {
 		return sessions.ErrInvalidInput
 	}
-	placement := ""
-	if snapshot.Environment != nil {
-		placement = snapshot.Environment.Type
-	}
-	return validateProfileInputs(profile, placement, inputs)
+	return validateDeclaredInputs(declaration, inputs)
 }
 
 // engineCapabilities is shared by device selection and the final preclaim check.
@@ -83,18 +71,18 @@ func (p Policy) engineCapabilities(ctx context.Context, peer *runtimegateway.Ses
 	fail := func(message string) (runtimedevice.KindCapabilities, error) {
 		return runtimedevice.KindCapabilities{}, errors.New(message)
 	}
-	profile, ok := p.Engines.Lookup(engine)
-	if !ok || (snapshot.Environment != nil && !profile.Accepts(snapshot.Environment.Type)) {
+	declaration, ok := p.Harnesses().Lookup(engine)
+	if !ok || !declaration.Accepts(snapshot.Environment.Type) {
 		return fail("execution engine placement is not supported")
 	}
-	if err := validateProfileConfiguration(profile, snapshot); err != nil {
+	if err := validateDeclaredConfiguration(declaration, snapshot); err != nil {
 		return runtimedevice.KindCapabilities{}, err
 	}
 	info, found, known := peer.AgentKindStatus(engine)
 	caps := info.Capabilities
-	if !known || !found || !info.Available || !caps.Streaming || !caps.Steering || !caps.DurableTurns || !caps.DurableInputReceipts {
+	if !known || !found || !info.Available || !caps.Streaming || !caps.DurableTurns || !caps.DurableInputReceipts {
 		observeSchedulingState(ctx, "capability_unavailable")
-		return fail("device must advertise streaming, steering and durable turns for this engine")
+		return fail("device must advertise streaming, durable input receipts and durable turns for this engine")
 	}
 	if !caps.Preparation {
 		observeSchedulingState(ctx, "capability_unavailable")
@@ -104,18 +92,10 @@ func (p Policy) engineCapabilities(ctx context.Context, peer *runtimegateway.Ses
 		observeSchedulingState(ctx, "capability_unavailable")
 		return fail("device must advertise execution_controls")
 	}
-	if profile.WebSearchControl.IsSupported() && !caps.WebSearchControl {
-		observeSchedulingState(ctx, "capability_unavailable")
-		return fail("device must advertise web_search_control")
-	}
 	if snapshot.Agent.Text.Format.Type == "json_schema" && (!caps.StructuredOutput || !caps.MessageItems) {
 		observeSchedulingState(ctx, "capability_unavailable")
 		return fail("device must support structured output and message observations")
 	}
-	if profile.TextVerbosity.IsSupported() && !caps.TextVerbosity {
-		observeSchedulingState(ctx, "capability_unavailable")
-		return fail("device must advertise text_verbosity")
-	}
 	if !caps.ToolObservations {
 		observeSchedulingState(ctx, "capability_unavailable")
 		return fail("device must advertise tool_observations")
@@ -135,10 +115,6 @@ func (p Policy) engineCapabilities(ctx context.Context, peer *runtimegateway.Ses
 	if err := (proto.PromptRequestPayload{ToolSearch: tools.Search, FunctionTools: tools.Functions}).ValidateToolSearch(caps.ToolSearch); err != nil {
 		return fail(err.Error())
 	}
-	if tools.DisableProgrammatic && !caps.ProgrammaticToolCallingDisable {
-		observeSchedulingState(ctx, "capability_unavailable")
-		return fail("device must support disabling programmatic tool calling")
-	}
 	if len(tools.Functions) > 0 && !caps.FunctionTools {
 		observeSchedulingState(ctx, "capability_unavailable")
 		return fail("device must advertise function_tools")
@@ -146,7 +122,7 @@ func (p Policy) engineCapabilities(ctx context.Context, peer *runtimegateway.Ses
 	if _, err := p.mcpExecutionCredentials(engine, snapshot, tools.MCP, caps); err != nil {
 		return runtimedevice.KindCapabilities{}, err
 	}
-	if snapshot.Environment != nil && (snapshot.Environment.Type == "openai_hosted" || snapshot.Environment.Type == "self_hosted") {
+	if snapshot.Environment.Type == "openai_hosted" || snapshot.Environment.Type == "self_hosted" {
 		if !caps.Preparation || !caps.LocalEnvironment || !caps.WorkspaceReadPreparation || !caps.WorkspaceOutputExport {
 			observeSchedulingState(ctx, "capability_unavailable")
 			return fail("device must advertise local preparation, workspace reads and output export")
@@ -167,7 +143,7 @@ func (d *Dispatcher) sessionCapabilities(ctx context.Context, peer *runtimegatew
 	if err != nil {
 		return caps, err
 	}
-	if snapshot.Environment == nil || snapshot.Environment.Type != "openai_hosted" {
+	if snapshot.Environment.Type != "openai_hosted" {
 		return caps, nil
 	}
 	environment, err := d.SessionsReader.GetSessionEnvironment(ctx, session.TenantID, session.ID)
@@ -181,9 +157,9 @@ func (d *Dispatcher) sessionCapabilities(ctx context.Context, peer *runtimegatew
 }
 
 func (p Policy) validateEnvironmentHistory(engine string, environment sessions.Environment, supported bool) error {
-	profile, found := p.Engines.Lookup(engine)
+	declaration, found := p.Harnesses().Lookup(engine)
 	if !found {
 		return sessions.ErrInvalidInput
 	}
-	return sessions.ValidateRetainedHistory(environment.ExternalWorkspace, supported && profile.RetainedNativeHistory.IsSupported())
+	return sessions.ValidateRetainedHistory(environment.ExternalWorkspace, supported && declaration.Capabilities.RetainedNativeHistory.IsSupported())
 }
diff --git a/services/core/internal/execution/terminal_observation_test.go b/services/core/internal/execution/terminal_observation_test.go
index 2a893f7bf..d95d2820a 100644
--- a/services/core/internal/execution/terminal_observation_test.go
+++ b/services/core/internal/execution/terminal_observation_test.go
@@ -74,7 +74,7 @@ func TestTerminalRealCommitUnknownRollbackAndStatus(t *testing.T) {
 			if mode == "unknown" || mode == "rollback" {
 				status = sessions.TurnCompleted
 			}
-			ended, err := d.finishRun(tenant, session, turn, "fixture", Result{}, status)
+			ended, err := d.finishRun(tenant, session, turn, Result{}, status)
 			uncertain := mode == "unknown" || mode == "rollback"
 			if (err != nil) != uncertain {
 				t.Fatal(err)
@@ -109,7 +109,7 @@ func TestTerminalRealCommitUnknownRollbackAndStatus(t *testing.T) {
 				t.Fatal(ended.Status, rows)
 			}
 			if uncertain {
-				_, retryErr := d.finishRun(tenant, session, turn, "fixture", Result{}, status)
+				_, retryErr := d.finishRun(tenant, session, turn, Result{}, status)
 				rows = terminalRows(t, logs.Bytes())
 				if len(rows) != 2 {
 					t.Fatal(rows)
@@ -148,7 +148,7 @@ func TestTerminalUnappliedFallbackUsesSeparateAttempts(t *testing.T) {
 	logs := captureExecutionLogs(t)
 	f := newFinishObservationFixture(t, 0)
 	receipt := f.start(t)
-	ended, err := f.dispatcher.finishRun(f.tenant, f.session.ID, receipt.TurnID, "fixture", Result{}, sessions.TurnCompleted)
+	ended, err := f.dispatcher.finishRun(f.tenant, f.session.ID, receipt.TurnID, Result{}, sessions.TurnCompleted)
 	if err != nil || ended.Status != sessions.TurnFailed {
 		t.Fatal(err, ended.Status)
 	}
diff --git a/services/core/internal/execution/tool_search_test.go b/services/core/internal/execution/tool_search_test.go
index 314098b0f..4d543bc82 100644
--- a/services/core/internal/execution/tool_search_test.go
+++ b/services/core/internal/execution/tool_search_test.go
@@ -6,25 +6,25 @@ import (
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine/enginetest"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/harnesstest"
 )
 
 const discoveryConfiguration = `{"agent":{"model":"model","tools":[{"type":"tool_search"},{"type":"function","name":"lookup","description":"Lookup","parameters":{"type":"object"},"defer_loading":true},{"type":"function","name":"clock","description":"Clock","parameters":{"type":"object"}}]},"environment":{"type":"none"}}`
 
 func TestDiscoveryUsesSharedOperationQualification(t *testing.T) {
 	for _, qualified := range []bool{false, true} {
-		policy := Policy{Engines: engine.NewCatalog(map[string]engine.Profile{"new_harness": enginetest.Profile(func(p *engine.Profile) { p.ToolSearch = proto.CapabilityFromBool(qualified) })})}
+		policy := Policy{Declarations: harnessconfig.NewRegistry(harnesstest.Declaration("new_harness", func(d *harnessconfig.Declaration) { d.Capabilities.ToolSearch = proto.CapabilityFromBool(qualified) }))}
 		if err := policy.ValidateSessionConfiguration("new_harness", json.RawMessage(discoveryConfiguration)); (err == nil) != qualified {
 			t.Fatal("common operation qualification was not applied", qualified, err)
 		}
 	}
 	workspace := strings.Replace(discoveryConfiguration, `"type":"none"`, `"type":"openai_hosted"`, 1)
-	policy := Policy{Engines: engine.NewCatalog(map[string]engine.Profile{"new_harness": enginetest.Profile(func(p *engine.Profile) {
-		p.Placements = []string{"openai_hosted"}
-		p.RetainedNativeHistory = proto.CapabilitySupported
-		p.ToolSearch = proto.CapabilitySupported
-	})})}
+	policy := Policy{Declarations: harnessconfig.NewRegistry(harnesstest.Declaration("new_harness", func(d *harnessconfig.Declaration) {
+		d.Placements = []string{"openai_hosted"}
+		d.Capabilities.RetainedNativeHistory = proto.CapabilitySupported
+		d.Capabilities.ToolSearch = proto.CapabilitySupported
+	}))}
 	if err := policy.ValidateSessionConfiguration("new_harness", json.RawMessage(workspace)); err != nil {
 		t.Fatal("Core imposed another adapter's placement restriction", err)
 	}
diff --git a/services/core/internal/execution/worker.go b/services/core/internal/execution/worker.go
index 78d00f92f..d3cb990c1 100644
--- a/services/core/internal/execution/worker.go
+++ b/services/core/internal/execution/worker.go
@@ -90,6 +90,7 @@ func StartWorker(ctx context.Context, dispatcher *Dispatcher, owner Owner) (_ *W
 	if err != nil {
 		return nil, err
 	}
+	worker.runtimes.scheduleWake = worker.scheduleWake
 	defer func() {
 		if err != nil {
 			worker.runtimes.stop()
@@ -156,11 +157,11 @@ func (w *Worker) CreateSession(ctx context.Context, tenant string, input session
 	if err := w.validateCreation(ctx, input); err != nil {
 		return sessions.Creation{}, err
 	}
-	profile, ok := w.dispatcher.Engines.Lookup(input.Engine)
+	declaration, ok := w.dispatcher.Harnesses().Lookup(input.Engine)
 	if !ok {
 		return sessions.Creation{}, sessions.ErrInvalidInput
 	}
-	input.SupportsRetainedNativeHistory = profile.RetainedNativeHistory.IsSupported()
+	input.SupportsRetainedNativeHistory = declaration.Capabilities.RetainedNativeHistory.IsSupported()
 	creation, err := w.dispatcher.Sessions.CreateSession(ctx, tenant, input)
 	if err == nil {
 		w.hintRuntimeWake(ctx, creation.Session)
diff --git a/services/core/internal/execution/worker_device.go b/services/core/internal/execution/worker_device.go
index bb73bde4f..3e0a93884 100644
--- a/services/core/internal/execution/worker_device.go
+++ b/services/core/internal/execution/worker_device.go
@@ -78,7 +78,7 @@ func (w *Worker) bindSessionDevice(ctx context.Context, session sessions.Session
 		observeSchedulingState(ctx, "unknown")
 		return false, sessions.ErrInvalidInput
 	}
-	if snapshot.Environment != nil && (snapshot.Environment.Type == "openai_hosted" || snapshot.Environment.Type == "self_hosted") {
+	if snapshot.Environment.Type == "openai_hosted" || snapshot.Environment.Type == "self_hosted" {
 		environment, err := w.dispatcher.SessionsReader.GetSessionEnvironment(ctx, session.TenantID, session.ID)
 		if err != nil {
 			observeSchedulingState(ctx, "unknown")
diff --git a/services/core/internal/execution/workspace_images_test.go b/services/core/internal/execution/workspace_images_test.go
deleted file mode 100644
index 1132490e9..000000000
--- a/services/core/internal/execution/workspace_images_test.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package execution
-
-import (
-	"encoding/json"
-	"errors"
-	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
-)
-
-func TestImageQualificationIsIndependentOfEnvironmentSource(t *testing.T) {
-	image := "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aXioAAAAASUVORK5CYII="
-	message := sessions.Input{Kind: "message", Payload: json.RawMessage(`{"input":[{"role":"user","content":[{"type":"input_text","text":"inspect"},{"type":"input_image","image_url":"` + image + `"}]}]}`)}
-	result := sessions.Input{Kind: "tool_result", Payload: json.RawMessage(`{"call_id":"call","result":{"success":true,"output":[{"type":"input_image","image_url":"` + image + `"}]}}`)}
-	for _, kind := range []string{"codex", "claude_sdk", "mcode"} {
-		profile, _ := (engine.Catalog{}).Lookup(kind)
-		for _, placement := range []string{"none", "openai_hosted", "self_hosted"} {
-			err := validateProfileInputs(profile, placement, []sessions.Input{message})
-			want := kind != "mcode"
-			if (err == nil) != want {
-				t.Fatalf("%s/%s: %v", kind, placement, err)
-			}
-		}
-	}
-	profile, _ := (engine.Catalog{}).Lookup("claude_sdk")
-	if err := validateProfileInputs(profile, "openai_hosted", []sessions.Input{result}); err != nil {
-		t.Fatal(err)
-	}
-	result.Payload = json.RawMessage(`{"call_id":"call","result":{"success":false,"output":[{"type":"input_image","image_url":"` + image + `"}]}}`)
-	if err := validateProfileInputs(profile, "openai_hosted", []sessions.Input{result}); !errors.Is(err, sessions.ErrInvalidInput) {
-		t.Fatal("native failed image admitted", err)
-	}
-}
diff --git a/services/core/internal/items/changes.go b/services/core/internal/items/changes.go
index adf6c6fc1..f4b5c8e13 100644
--- a/services/core/internal/items/changes.go
+++ b/services/core/internal/items/changes.go
@@ -33,9 +33,9 @@ type Change struct {
 }
 
 // NeedsNativeMessage reports whether Observe reads Stored.NativeMessage for u:
-// a legacy aggregate applies only when the Turn recorded no native message.
+// an aggregate answer applies only when the Turn recorded no native message.
 func (u Update) NeedsNativeMessage() bool {
-	return u.LegacyFinal
+	return u.AggregateFinal
 }
 
 // ResultCall returns the call whose saved result Observe reads for u, a
@@ -48,7 +48,7 @@ func (u Update) ResultCall() (string, bool) {
 // its stored Item. It reports false when the Update is superseded and writes
 // nothing.
 func Observe(kind string, update Update, stored Stored) (Change, bool, error) {
-	if update.LegacyFinal && stored.NativeMessage {
+	if update.AggregateFinal && stored.NativeMessage {
 		return Change{}, false, nil
 	}
 	item, err := Merge(update, stored.Item)
diff --git a/services/core/internal/items/changes_test.go b/services/core/internal/items/changes_test.go
index 96f98766a..92c6915f0 100644
--- a/services/core/internal/items/changes_test.go
+++ b/services/core/internal/items/changes_test.go
@@ -28,11 +28,11 @@ func TestObserveDecidesItemChanges(t *testing.T) {
 		check  func(Change) bool
 	}{
 		{
-			name: "a legacy aggregate yields to a native message", kind: "execution_completed",
+			name: "an aggregate answer yields to a native message", kind: "execution_completed",
 			update: project("execution_completed", `{"done":{"content":"final"}}`), stored: Stored{NativeMessage: true}, skip: true,
 		},
 		{
-			name: "a legacy aggregate applies without a native message", kind: "execution_completed",
+			name: "an aggregate answer applies without a native message", kind: "execution_completed",
 			update: project("execution_completed", `{"done":{"content":"final"}}`),
 			check:  func(c Change) bool { return c.Item.Status == "completed" && c.Output && c.Delta == nil },
 		},
@@ -74,15 +74,15 @@ func TestObserveDecidesItemChanges(t *testing.T) {
 }
 
 func TestUpdatesDeclareTheFactsObserveReads(t *testing.T) {
-	legacy := Update{Item: v1.Item{Type: "message"}, LegacyFinal: true}
+	aggregate := Update{Item: v1.Item{Type: "message"}, AggregateFinal: true}
 	result := Update{Item: v1.Item{Type: "function_call_output", CallID: "call"}}
-	if !legacy.NeedsNativeMessage() || result.NeedsNativeMessage() {
+	if !aggregate.NeedsNativeMessage() || result.NeedsNativeMessage() {
 		t.Fatal("native message need")
 	}
 	if call, ok := result.ResultCall(); !ok || call != "call" {
 		t.Fatal("result call", call, ok)
 	}
-	if _, ok := legacy.ResultCall(); ok {
+	if _, ok := aggregate.ResultCall(); ok {
 		t.Fatal("message asked for a function result")
 	}
 }
diff --git a/services/core/internal/items/events.go b/services/core/internal/items/events.go
index db27391e0..463dd6a6e 100644
--- a/services/core/internal/items/events.go
+++ b/services/core/internal/items/events.go
@@ -2,6 +2,7 @@ package items
 
 import (
 	"reflect"
+	"strings"
 
 	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
 )
@@ -31,6 +32,10 @@ func Events(change Change, outputIndex *int32) []v1.SessionEvent {
 	textMessage := item.Type == "message" && item.Role == "assistant" && len(item.Content) == 1 && item.Content[0].Text != nil
 	if previous.ID == "" {
 		initial := item
+		if item.Type == "reasoning" {
+			// Reasoning text arrives only through summary events.
+			initial.Status, initial.Summary = "in_progress", []v1.SummaryText{}
+		}
 		if textMessage {
 			// Assistant text is added empty and in progress; its text arrives
 			// only through deltas, as in official streams (EVT-10).
@@ -55,6 +60,50 @@ func Events(change Change, outputIndex *int32) []v1.SessionEvent {
 	if outputIndex == nil {
 		return events
 	}
+	if item.Type == "reasoning" {
+		// Each summary part is framed like assistant text. A part is done once
+		// a later part starts or the Item ends.
+		done := func(summary []v1.SummaryText, status string) int {
+			if status == "in_progress" && len(summary) > 0 {
+				return len(summary) - 1
+			}
+			return len(summary)
+		}
+		closed := 0
+		if previous.ID != "" {
+			closed = done(previous.Summary, previous.Status)
+		}
+		for i, part := range item.Summary {
+			index, before := int64(i), ""
+			event := base
+			event.ItemID, event.SummaryIndex = item.ID, &index
+			if i < len(previous.Summary) {
+				before = previous.Summary[i].Text
+			} else {
+				empty := ""
+				event.Part = &v1.ItemContent{Type: "summary_text", Text: &empty}
+				emit("reasoning_summary_part.added", event)
+				event.Part = nil
+			}
+			// A child snapshot that rewrote earlier text reports it only when done.
+			if fragment, ok := strings.CutPrefix(part.Text, before); ok && fragment != "" {
+				event.Delta = &fragment
+				emit("reasoning_summary_text.delta", event)
+				event.Delta = nil
+			}
+			if i >= closed && i < done(item.Summary, item.Status) {
+				text := part.Text
+				event.Text = &text
+				emit("reasoning_summary_text.done", event)
+				event.Text, event.Part = nil, &v1.ItemContent{Type: "summary_text", Text: &text}
+				if item.Status == "incomplete" {
+					status := "incomplete"
+					event.Status = &status
+				}
+				emit("reasoning_summary_part.done", event)
+			}
+		}
+	}
 	if item.Type == "command_execution" && delta != nil {
 		event := base
 		event.Type = "agent.output.command_execution_output.delta"
diff --git a/services/core/internal/items/events_test.go b/services/core/internal/items/events_test.go
index 2053d739e..9232ba6ab 100644
--- a/services/core/internal/items/events_test.go
+++ b/services/core/internal/items/events_test.go
@@ -2,10 +2,12 @@ package items
 
 import (
 	"encoding/json"
+	"fmt"
 	"reflect"
 	"testing"
 
 	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
 func assistantText(status, text string) v1.Item {
@@ -113,3 +115,63 @@ func TestEventsAddAssistantTextEmptyAndInProgress(t *testing.T) {
 		t.Fatalf("added %+v, part %+v", added, events[1].Part)
 	}
 }
+
+func TestReasoningPartsBecomeOneItemWithOfficialEvents(t *testing.T) {
+	index := int32(0)
+	var stored v1.Item
+	var kinds, deltas []string
+	for _, frame := range []proto.ReasoningPayload{
+		{ID: "r1", Status: "in_progress", Delta: "think "},
+		{ID: "r1", Status: "in_progress", Delta: "hard"},
+		{ID: "r1", Status: "in_progress", Index: 1, Delta: "then act"},
+		{ID: "r1", Status: "completed"},
+	} {
+		raw, _ := json.Marshal(frame)
+		updates, err := Project(testTurn, proto.TypeReasoning, 1, raw)
+		if err != nil || len(updates) != 1 {
+			t.Fatalf("project %+v: %v %v", frame, updates, err)
+		}
+		change, ok, err := Observe(proto.TypeReasoning, updates[0], Stored{Item: stored})
+		if err != nil || !ok {
+			t.Fatalf("observe %+v: %v %v", frame, ok, err)
+		}
+		for _, event := range Events(change, &index) {
+			kind := event.Type[len("agent.session.turn."):]
+			if event.SummaryIndex != nil {
+				kind += fmt.Sprint(*event.SummaryIndex)
+			}
+			kinds = append(kinds, kind)
+			if event.Delta != nil {
+				deltas = append(deltas, *event.Delta)
+			}
+		}
+		stored = change.Item
+	}
+	wantKinds := []string{"item.added", "reasoning_summary_part.added0", "reasoning_summary_text.delta0", "reasoning_summary_text.delta0",
+		"reasoning_summary_text.done0", "reasoning_summary_part.done0", "reasoning_summary_part.added1", "reasoning_summary_text.delta1",
+		"reasoning_summary_text.done1", "reasoning_summary_part.done1", "item.done"}
+	if !reflect.DeepEqual(kinds, wantKinds) || !reflect.DeepEqual(deltas, []string{"think ", "hard", "then act"}) {
+		t.Fatalf("events %q deltas %q", kinds, deltas)
+	}
+	want := []v1.SummaryText{{Type: "summary_text", Text: "think hard"}, {Type: "summary_text", Text: "then act"}}
+	if stored.Type != "reasoning" || stored.Status != "completed" || !reflect.DeepEqual(stored.Summary, want) {
+		t.Fatalf("item %+v", stored)
+	}
+}
+
+func TestOpenReasoningEndsIncompleteWithItsText(t *testing.T) {
+	open := v1.Item{ID: "item", TurnID: testTurn, Type: "reasoning", Status: "in_progress", Summary: []v1.SummaryText{{Type: "summary_text", Text: "partial"}}}
+	ended := open
+	ended.Status = "incomplete"
+	index := int32(0)
+	var kinds []string
+	for _, event := range Events(Change{Previous: open, Item: ended}, &index) {
+		kinds = append(kinds, event.Type[len("agent.session.turn."):])
+		if event.Type == "agent.session.turn.reasoning_summary_part.done" && (event.Status == nil || *event.Status != "incomplete" || *event.Part.Text != "partial") {
+			t.Fatalf("part done %+v", event)
+		}
+	}
+	if want := []string{"reasoning_summary_text.done", "reasoning_summary_part.done", "item.done"}; !reflect.DeepEqual(kinds, want) {
+		t.Fatalf("events %q, want %q", kinds, want)
+	}
+}
diff --git a/services/core/internal/items/messages.go b/services/core/internal/items/messages.go
index 50c439f45..586c9b228 100644
--- a/services/core/internal/items/messages.go
+++ b/services/core/internal/items/messages.go
@@ -14,8 +14,10 @@ type Update struct {
 	Item               v1.Item
 	AppendText         bool
 	CommandOutputDelta *string
-	// A legacy aggregate is used only when no native message identity was recorded.
-	LegacyFinal bool
+	// SummaryIndex is the reasoning summary part an appended fragment extends.
+	SummaryIndex int
+	// An aggregate answer is used only when no native message identity was recorded.
+	AggregateFinal bool
 }
 
 func Identity(turn, key string) string {
@@ -42,7 +44,7 @@ func Project(turn, kind string, sequence int64, raw json.RawMessage) ([]Update,
 		}
 		key := "message:" + p.ItemID
 		if p.ItemID == "" {
-			key = "legacy-message"
+			key = "aggregate-message"
 		}
 		return []Update{{Item: message(turn, key, "assistant", p.Delta, "in_progress"), AppendText: true}}, nil
 	case proto.TypeOutputMessage:
@@ -62,8 +64,21 @@ func Project(turn, kind string, sequence int64, raw json.RawMessage) ([]Update,
 			item.Phase = p.Phase
 		}
 		return []Update{{Item: item, AppendText: p.Text == nil}}, nil
+	case proto.TypeReasoning:
+		var p proto.ReasoningPayload
+		if err := json.Unmarshal(raw, &p); err != nil {
+			return nil, err
+		}
+		if !p.Valid() {
+			return nil, errors.New("invalid reasoning observation")
+		}
+		item := v1.Item{ID: Identity(turn, "reasoning:"+p.ID), TurnID: turn, Type: "reasoning", Status: p.Status}
+		if p.Delta != "" {
+			item.Summary = []v1.SummaryText{{Type: "summary_text", Text: p.Delta}}
+		}
+		return []Update{{Item: item, AppendText: true, SummaryIndex: p.Index}}, nil
 	case proto.TypeDone, "execution_failed":
-		// Legacy Done may contain adapter diagnostics. Only a successful Turn
+		// Done may contain adapter diagnostics. Only a successful Turn
 		// confirms aggregate answer text; failures retain observed message deltas.
 		return nil, nil
 	case "cancel_receipt", "execution_completed", "execution_cancelled":
@@ -89,7 +104,7 @@ func Project(turn, kind string, sequence int64, raw json.RawMessage) ([]Update,
 		if kind == "execution_completed" {
 			status = "completed"
 		}
-		return []Update{{Item: message(turn, "legacy-message", "assistant", final.Content, status), LegacyFinal: true}}, nil
+		return []Update{{Item: message(turn, "aggregate-message", "assistant", final.Content, status), AggregateFinal: true}}, nil
 	case proto.TypeToolCall:
 		return projectTool(turn, raw)
 	case proto.TypeCommandOutput:
@@ -99,15 +114,22 @@ func Project(turn, kind string, sequence int64, raw json.RawMessage) ([]Update,
 	}
 }
 
+// Reasoning parts advance in order: a fragment extends the current part or
+// starts the next one.
+var errReasoningPart = errors.New("reasoning part out of order")
+
 func Merge(update Update, previous v1.Item) (v1.Item, error) {
 	if update.CommandOutputDelta != nil {
 		return mergeCommandOutput(update, previous)
 	}
 	item := update.Item
 	if previous.ID == "" {
+		if update.SummaryIndex != 0 {
+			return previous, errReasoningPart
+		}
 		return item, nil
 	}
-	if previous.Status != "in_progress" && !(update.LegacyFinal && previous.Status == "incomplete") {
+	if previous.Status != "in_progress" && !(update.AggregateFinal && previous.Status == "incomplete") {
 		return previous, nil
 	}
 	if (item.Type == "function_call") && (item.Arguments == nil || string(encoded(item.Arguments)) == "null") {
@@ -117,8 +139,19 @@ func Merge(update Update, previous v1.Item) (v1.Item, error) {
 		item.Output = previous.Output
 	}
 	if update.AppendText {
-		if previous.Status != "in_progress" {
-			return previous, nil
+		if item.Type == "reasoning" {
+			parts, index := slices.Clone(previous.Summary), update.SummaryIndex
+			switch {
+			case len(item.Summary) == 0:
+			case index == len(parts):
+				parts = append(parts, item.Summary[0])
+			case index == len(parts)-1:
+				parts[index].Text += item.Summary[0].Text
+			default:
+				return previous, errReasoningPart
+			}
+			item.Summary = parts
+			return item, nil
 		}
 		text := *previous.Content[0].Text + *item.Content[0].Text
 		item.Content = slices.Clone(item.Content)
diff --git a/services/core/internal/items/messages_test.go b/services/core/internal/items/messages_test.go
index eb6e8acf2..d7946d4ef 100644
--- a/services/core/internal/items/messages_test.go
+++ b/services/core/internal/items/messages_test.go
@@ -34,7 +34,7 @@ func TestMessageSnapshotsReplaceDeltasAndDoNotRegress(t *testing.T) {
 	}
 }
 
-func TestLegacyDoneDoesNotConfirmSuccessfulAnswer(t *testing.T) {
+func TestDoneDoesNotConfirmSuccessfulAnswer(t *testing.T) {
 	var previous v1.Item
 	for _, event := range []struct{ kind, body string }{
 		{"delta", `{"delta":"partial answer"}`},
diff --git a/services/core/internal/nativeinstaller/assets/bootstrap.ps1 b/services/core/internal/nativeinstaller/assets/bootstrap.ps1
index c04665665..ab25906f9 100644
--- a/services/core/internal/nativeinstaller/assets/bootstrap.ps1
+++ b/services/core/internal/nativeinstaller/assets/bootstrap.ps1
@@ -3,214 +3,46 @@ param(
   [Parameter(ValueFromRemainingArguments=$true)][string[]]$InstallArguments
 )
 $ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
 # Only the installer receives the grant; every other program started below runs without it.
 $grant = $env:OAC_INSTALL_GRANT
 Remove-Item Env:OAC_INSTALL_GRANT -ErrorAction SilentlyContinue
 $tar = Join-Path $env:SystemRoot 'System32\tar.exe'
 if (!(Test-Path -LiteralPath $tar -PathType Leaf)) { throw 'Windows tar.exe is required. Install the Windows archive tools, then rerun this command.' }
-Add-Type -AssemblyName System.Net.Http
-if (!("OacNativeDownloadSpace" -as [type])) {
-  Add-Type -TypeDefinition @'
-using System;
-using System.ComponentModel;
-using System.Runtime.InteropServices;
-public static class OacNativeDownloadSpace {
-  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
-  static extern bool GetDiskFreeSpaceEx(string path, out ulong available, out ulong total, out ulong free);
-  public static ulong Available(string path) {
-    ulong available, total, free;
-    if (!GetDiskFreeSpaceEx(path, out available, out total, out free)) throw new Win32Exception(Marshal.GetLastWin32Error());
-    return available;
-  }
-}
-'@
-}
 $architecture = @{x64='amd64';arm64='arm64'}[[System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString().ToLowerInvariant()]
 if (!$architecture) { throw 'Unsupported processor architecture.' }
 $root = if ($env:OAC_RUNTIME_HOME) { $env:OAC_RUNTIME_HOME } else { Join-Path $HOME '.oac' }
 if (![IO.Path]::IsPathRooted($root)) { throw 'OAC_RUNTIME_HOME must be an absolute directory.' }
-$cache = Join-Path ([IO.Path]::GetFullPath($root)) 'native-download'
-$work = Join-Path $cache 'staging'
-$lock = $null
-$client = $null
-$ownsStaging = $false
-$terminal = ![Console]::IsOutputRedirected
-$ProgressPreference = if ($terminal) { 'Continue' } else { 'SilentlyContinue' }
-function Assert-OrdinaryPath([string]$Path) {
-  if ((Test-Path -LiteralPath $Path) -and ((Get-Item -Force -LiteralPath $Path).Attributes -band [IO.FileAttributes]::ReparsePoint)) {
-    throw 'Native download paths must not be symbolic links or junctions.'
-  }
-}
-function Assert-Space([long]$Required) {
-  $available = [OacNativeDownloadSpace]::Available($cache)
-  if ($available -lt ($Required + 64MB)) { throw 'Not enough disk space for the native installer. Free space in the Runtime home and retry.' }
-}
-function Show-Bytes([string]$Label, [long]$Bytes, [long]$Total) {
-  if (!$terminal) { return }
-  $percent = if ($Total -gt 0) { [Math]::Min(100, [int](100.0 * $Bytes / $Total)) } else { -1 }
-  Write-Progress -Activity $Label -Status ("{0:N1} MiB" -f ($Bytes / 1MB)) -PercentComplete $percent
-}
-# Resume after resets and fail only when a transfer stalls, with no total time cap. A partial file is kept in the download directory for the next run.
-function Get-NativeFile([string]$Uri, [string]$Destination, [long]$Limit) {
-  for ($attempt=1; $attempt -le 5; $attempt++) {
-    $request = $null; $response = $null; $inputStream = $null; $outputStream = $null; $retryable = $true
-    try {
-      [long]$offset = 0
-      if (Test-Path -LiteralPath $Destination) { $offset = (Get-Item -LiteralPath $Destination).Length }
-      $address = [Uri]$Uri
-      for ($redirect=0; $redirect -le 5; $redirect++) {
-        $request = [Net.Http.HttpRequestMessage]::new([Net.Http.HttpMethod]::Get, $address)
-        if ($offset -gt 0) { $request.Headers.Range = [Net.Http.Headers.RangeHeaderValue]::new($offset, $null) }
-        $response = $client.SendAsync($request, [Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult()
-        $request.Dispose(); $request = $null
-        $status = [int]$response.StatusCode
-        if ($status -notin @(301,302,303,307,308)) { break }
-        if ($redirect -eq 5 -or !$response.Headers.Location) { $retryable=$false; throw 'Installer download has too many or invalid redirects.' }
-        $next = [Uri]::new($address, $response.Headers.Location)
-        if ($next.Scheme -ne 'https' -or $next.UserInfo) { $retryable=$false; throw 'Installer download redirect must use HTTPS without credentials.' }
-        $response.Dispose(); $response=$null; $address=$next
-      }
-      if ($status -eq 416) { Remove-Item -LiteralPath $Destination -Force; throw 'The server cannot resume the earlier download; starting it again.' }
-      if ($status -notin @(200,206)) {
-        $retryable = $status -in @(408,429,500,502,503,504)
-        if ($status -eq 404) { throw 'This Core has no qualified installer for this platform.' }
-        throw "Installer download failed (HTTP $status). Check Core and the download host."
-      }
-      # A 200 answer ignores the Range header, so start the file again.
-      $mode = [IO.FileMode]::Append
-      if ($status -eq 200) { $mode = [IO.FileMode]::Create; $offset = 0 }
-      $total = $response.Content.Headers.ContentLength
-      if ($null -eq $total) { $total = 0 }
-      $retryable=$false
-      if ($offset + $total -gt $Limit) { throw 'Installer download exceeds the available space or metadata size limit.' }
-      Assert-Space $total
-      $outputStream = [IO.File]::Open($Destination, $mode, [IO.FileAccess]::Write, [IO.FileShare]::None)
-      $retryable=$true
-      $inputStream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult()
-      $buffer = New-Object byte[] 65536
-      [long]$received = 0
-      $clock = [Diagnostics.Stopwatch]::StartNew()
-      [long]$lastProgress=0
-      while ($true) {
-        $cancel = [Threading.CancellationTokenSource]::new()
-        try {
-          $cancel.CancelAfter(60000)
-          $pending = $inputStream.ReadAsync($buffer, 0, $buffer.Length, $cancel.Token)
-          if (!$pending.Wait(60000)) { throw 'Installer download stalled; retry when the connection is available.' }
-          $read = $pending.GetAwaiter().GetResult()
-        } finally { $cancel.Dispose() }
-        if ($read -eq 0) { break }
-        $received += $read
-        $retryable=$false
-        if ($offset + $received -gt $Limit) { throw 'Installer download exceeds the available space or metadata size limit.' }
-        $outputStream.Write($buffer,0,$read)
-        $retryable=$true
-        if ($clock.ElapsedMilliseconds - $lastProgress -ge 200) { Show-Bytes 'Downloading installer' ($offset + $received) ($offset + $total); $lastProgress=$clock.ElapsedMilliseconds }
-      }
-      if ($total -gt 0 -and $received -ne $total) { throw 'Installer download was interrupted.' }
-      $retryable=$false
-      $outputStream.Flush($true)
-      return
-    } catch {
-      if (!$retryable) { throw }
-      if ($attempt -eq 5) { throw 'Installer download failed after five attempts. Check the network to Core and GitHub and any proxy settings, then rerun the command; downloaded data is kept and resumed.' }
-      Write-Host "Download interrupted; retrying ($attempt/4)..."
+function Get-NativeFile([string]$Uri, [string]$Destination) {
+  for ($attempt=1; $attempt -le 3; $attempt++) {
+    try { Invoke-WebRequest -UseBasicParsing -Uri $Uri -OutFile $Destination -ErrorAction Stop; return }
+    catch {
+      if ($_.Exception.Response -and [int]$_.Exception.Response.StatusCode -eq 404) { throw 'This Core has no qualified installer for this platform.' }
+      if ($attempt -eq 3) { throw 'Installer download failed. Check the network to Core and GitHub (and the Windows proxy settings), then rerun the command.' }
+      Write-Host "Download interrupted; retrying ($attempt/2)..."
       Start-Sleep -Seconds $attempt
-    } finally {
-      if ($inputStream) { $inputStream.Dispose() }
-      if ($outputStream) { $outputStream.Dispose() }
-      if ($request) { $request.Dispose() }
-      if ($response) { $response.Dispose() }
-      if ($terminal) { Write-Progress -Activity 'Downloading installer' -Completed }
     }
   }
 }
-function Get-ArchiveHash([string]$Path) { (Get-FileHash -Algorithm SHA256 -LiteralPath $Path).Hash.ToLowerInvariant() }
-# Reject a rejected grant before any large download. Only a 401 stops here; any other answer is reported by the installer.
-function Test-Grant {
-  if (!$grant) { return }
-  $rejected = $false
-  try {
-    $message = [Net.Http.HttpRequestMessage]::new([Net.Http.HttpMethod]::Post, ($Base -replace '/install/[^/]+$', '/installation'))
-    $message.Headers.Authorization = [Net.Http.Headers.AuthenticationHeaderValue]::new('Bearer', $grant)
-    $answer = $client.SendAsync($message).GetAwaiter().GetResult()
-    $rejected = [int]$answer.StatusCode -eq 401
-  } catch { } finally { if ($message) { $message.Dispose() }; if ($answer) { $answer.Dispose() } }
-  if ($rejected) { throw 'Installation authorization rejected or expired; copy a fresh command from the Session.' }
-}
+# The unpacked installer lives here; the installer also keeps unfinished component downloads in this directory.
+$cache = Join-Path ([IO.Path]::GetFullPath($root)) 'native-download'
+$work = Join-Path $cache ('bundle.' + [Guid]::NewGuid().ToString('N').Substring(0, 8))
 try {
-  Assert-OrdinaryPath $cache
-  [IO.Directory]::CreateDirectory($cache) | Out-Null
-  $lockPath = Join-Path $cache 'download.lock'
-  Assert-OrdinaryPath $lockPath
-  try { $lock = [IO.File]::Open($lockPath, [IO.FileMode]::OpenOrCreate, [IO.FileAccess]::ReadWrite, [IO.FileShare]::None) }
-  catch { throw 'Cannot lock native downloads. Another download may be running; check permissions or wait and retry.' }
-  Assert-OrdinaryPath $work
-  if (Test-Path -LiteralPath $work) {
-    # A killed PowerShell host can leave its native child alive. Do not remove its source bundle.
-    $children = Get-CimInstance Win32_Process -Filter "Name = 'tar.exe' OR Name = 'oac-daemon.exe'"
-    foreach ($child in $children) {
-      if (($child.ExecutablePath -and $child.ExecutablePath.StartsWith($work, [StringComparison]::OrdinalIgnoreCase)) -or ($child.CommandLine -and $child.CommandLine.IndexOf($work, [StringComparison]::OrdinalIgnoreCase) -ge 0)) {
-        throw 'A native installer is still using the download directory; wait for it to finish and retry.'
-      }
-    }
-    Remove-Item -LiteralPath $work -Recurse -Force
-  }
   [IO.Directory]::CreateDirectory($work) | Out-Null
-  $ownsStaging = $true
-  $handler = [Net.Http.HttpClientHandler]::new()
-  $handler.AllowAutoRedirect = $false
-  $client = [Net.Http.HttpClient]::new($handler)
-  $client.Timeout = [TimeSpan]::FromSeconds(15)
-  Test-Grant
-  Assert-Space 0
   Write-Host 'Downloading the installer matched to Core...'
-  $checksum = Join-Path $work 'checksum'
-  Get-NativeFile "$Base/windows-$architecture.sha256" $checksum 1024
-  $expected = [IO.File]::ReadAllText($checksum).Trim()
+  Get-NativeFile "$Base/windows-$architecture.sha256" (Join-Path $work 'checksum')
+  $expected = ([IO.File]::ReadAllText((Join-Path $work 'checksum'))).Trim()
   if ($expected -cnotmatch '^[0-9a-f]{64}$') { throw 'Core returned an invalid installer checksum.' }
-  # The verified archive outlives this run so a later failure, such as a wrong option, needs no new download; it is removed once the installation completes.
-  $archive = Join-Path $cache "$expected.tar.gz"
-  Get-ChildItem -LiteralPath $cache -Filter '*.tar.gz*' -File | Where-Object { $_.Name -ne "$expected.tar.gz" -and $_.Name -ne "$expected.tar.gz.part" } | Remove-Item -Force
-  if (Test-Path -LiteralPath $archive) {
-    Write-Host 'Verifying the installer archive from an earlier run...'
-    if ((Get-ArchiveHash $archive) -ne $expected) { Remove-Item -LiteralPath $archive -Force; Write-Host 'The earlier archive failed verification and was discarded.' }
-  }
-  if (!(Test-Path -LiteralPath $archive)) {
-    $part = "$archive.part"
-    if ((Test-Path -LiteralPath $part) -and (Get-Item -LiteralPath $part).Length -gt 0) { Write-Host 'Resuming the earlier download...' }
-    $available = [OacNativeDownloadSpace]::Available($cache)
-    Get-NativeFile "$Base/windows-$architecture.tar.gz" $part ($available-64MB)
-    Write-Host 'Verifying the installer archive...'
-    if ((Get-ArchiveHash $part) -ne $expected) { Remove-Item -LiteralPath $part -Force; throw 'Installer checksum mismatch; the download was discarded. Rerun the command to download it again.' }
-    Move-Item -LiteralPath $part -Destination $archive
-  }
-  Write-Host 'Checking extraction space...'
-  $file = [IO.File]::OpenRead($archive)
-  $gzip = [IO.Compression.GZipStream]::new($file,[IO.Compression.CompressionMode]::Decompress)
-  try {
-    $buffer = New-Object byte[] 65536
-    [long]$unpacked=0
-    while (($count=$gzip.Read($buffer,0,$buffer.Length)) -gt 0) { $unpacked += $count }
-    Assert-Space $unpacked
-  } finally { $gzip.Dispose(); $file.Dispose() }
-  $bundle = Join-Path $work 'bundle'
-  [IO.Directory]::CreateDirectory($bundle) | Out-Null
-  Write-Host 'Extracting the installer...'
-  & $tar -xzf $archive -C $bundle
+  $archive = Join-Path $work 'installer.tar.gz'
+  Get-NativeFile "$Base/windows-$architecture.tar.gz" $archive
+  if ((Get-FileHash -Algorithm SHA256 -LiteralPath $archive).Hash.ToLowerInvariant() -ne $expected) { throw 'Installer checksum mismatch; the download was discarded. Rerun the command to download it again.' }
+  & $tar -xzf $archive -C $work
   if ($LASTEXITCODE -ne 0) { throw 'Installer extraction failed. Check disk space, quota and filesystem permissions.' }
-  $endpoint = $Base -replace '/install/[^/]+$', '/installation'
-  Write-Host 'Starting installation...'
+  Remove-Item -LiteralPath $archive -Force
   $env:OAC_INSTALL_GRANT = $grant
-  try { & (Join-Path $bundle 'oac-daemon.exe') install --onboard-url $endpoint @InstallArguments }
+  try { & (Join-Path $work 'oac-daemon.exe') install --onboard-url ($Base -replace '/install/[^/]+$', '/installation') @InstallArguments }
   finally { Remove-Item Env:OAC_INSTALL_GRANT -ErrorAction SilentlyContinue }
   if ($LASTEXITCODE -ne 0) { throw 'Installation or connection failed; follow the installer guidance and retry.' }
-  Remove-Item -LiteralPath $archive -Force
 } finally {
-  if ($client) { $client.Dispose() }
-  if ($lock) {
-    # Only clean staging created by this invocation, after its native child returned.
-    try { if ($ownsStaging -and (Test-Path -LiteralPath $work)) { Remove-Item -LiteralPath $work -Recurse -Force } }
-    finally { $lock.Dispose() }
-  }
+  Remove-Item -LiteralPath $work -Recurse -Force -ErrorAction SilentlyContinue
 }
diff --git a/services/core/internal/nativeinstaller/assets/bootstrap.sh b/services/core/internal/nativeinstaller/assets/bootstrap.sh
index 8436104c1..f381f3f91 100644
--- a/services/core/internal/nativeinstaller/assets/bootstrap.sh
+++ b/services/core/internal/nativeinstaller/assets/bootstrap.sh
@@ -8,9 +8,8 @@ unset OAC_INSTALL_GRANT
 fail() { printf '%s\n' "$*" >&2; exit 1; }
 case "$(uname -s)" in Linux) os=linux;; Darwin) os=darwin;; *) fail 'Unsupported operating system.';; esac
 case "$(uname -m)" in x86_64) arch=amd64;; arm64|aarch64) arch=arm64;; *) fail 'Unsupported processor architecture.';; esac
-for tool in curl tar gzip df awk wc; do command -v "$tool" >/dev/null || fail "Required command missing: $tool"; done
+for tool in curl tar gzip; do command -v "$tool" >/dev/null || fail "Required command missing: $tool"; done
 if command -v sha256sum >/dev/null; then hash=(sha256sum); else hash=(shasum -a 256); command -v shasum >/dev/null || fail 'Required command missing: shasum'; fi
-if [ "$os" = darwin ]; then command -v lockf >/dev/null || fail 'Required command missing: lockf'; else command -v flock >/dev/null || fail 'Required command missing: flock (util-linux)'; fi
 umask 077
 root=${OAC_RUNTIME_HOME:-${HOME:?HOME must be set}/.oac}
 case "$root" in /*) ;; *) fail 'OAC_RUNTIME_HOME must be an absolute directory.';; esac
@@ -21,15 +20,8 @@ cache=$root/native-download
 mkdir -p "$cache"
 [ -d "$cache" ] && [ -O "$cache" ] || fail 'Native download directory must belong to the current account.'
 chmod 700 "$cache"
-lock=$cache/download.lock
-[ ! -L "$lock" ] && { [ ! -e "$lock" ] || { [ -f "$lock" ] && [ -O "$lock" ]; }; } || fail 'Invalid native download lock.'
-# Children inherit this descriptor, so killing only the shell cannot expose an active download.
-exec 9>>"$lock"
-if [ "$os" = darwin ]; then lockf -s -t 0 9; else flock -n 9; fi || fail 'Another native download is running; wait for it to finish and retry.'
-work=$cache/staging
-[ ! -L "$work" ] && { [ ! -e "$work" ] || { [ -d "$work" ] && [ -O "$work" ]; }; } || fail 'Invalid native download staging directory.'
-rm -rf "$work"
-mkdir "$work"
+# The unpacked installer lives here; the installer also keeps unfinished component downloads in this directory.
+work=$(mktemp -d "$cache/bundle.XXXXXX") || fail 'Cannot write the native download directory.'
 active=
 cleanup() { rm -rf "$work"; }
 interrupt() {
@@ -47,91 +39,38 @@ run() {
   active=
   return "$result"
 }
-space() {
-  local available
-  available=$(df -Pk "$work" | awk 'NR==2 {print $4}')
-  case "$available" in ''|*[!0-9]*) fail 'Cannot determine free disk space.';; esac
-  [ "$available" -ge "$(( ($1 + 67108864 + 1023) / 1024 ))" ] || fail 'Not enough disk space for the native installer. Free space in the Runtime home and retry.'
-}
 progress=(-sS)
 if [ -t 2 ]; then progress=(--progress-bar --show-error); fi
-# Resume after resets and fail only when a transfer stalls, with no total time cap. A partial file is kept in the download directory for the next run.
 fetch() {
-  local url=$1 destination=$2 limit=$3 status code attempt
-  for attempt in 1 2 3 4 5; do
+  local attempt code status
+  for attempt in 1 2 3; do
     code=0
-    run curl "${progress[@]}" --fail --location --proto-redir =https --connect-timeout 15 --speed-time 60 --speed-limit 1024 --continue-at - --max-filesize "$limit" --write-out '%{http_code}' "$url" -o "$destination" >"$work/http-status" || code=$?
-    status=$(cat "$work/http-status")
+    run curl "${progress[@]}" --fail --location --proto-redir =https --connect-timeout 15 --speed-time 60 --speed-limit 1024 --write-out '%{http_code}' "$1" -o "$2" >"$work/http-status" || code=$?
     [ "$code" -ne 0 ] || return 0
-    case "$status" in 404) fail 'This Core has no qualified installer for this platform.';; esac
-    case "$code" in
-      23) fail 'Cannot write the installer download. Check disk space, quota and directory permissions.';;
-      63) fail 'Installer download exceeds the available space or metadata size limit.';;
-      33) rm -f "$destination";; # The server cannot resume; start the file again.
-    esac
-    case "$code:$status" in
-      22:416) return 0;; # The partial file already holds the whole download; the checksum decides.
-      6:*|7:*|16:*|18:*|28:*|33:*|35:*|52:*|55:*|56:*|92:*|22:408|22:429|22:500|22:502|22:503|22:504)
-        if [ "$attempt" -lt 5 ]; then printf 'Download interrupted; retrying (%s/4)...\n' "$attempt" >&2; run sleep "$attempt"; continue; fi;;
-    esac
-    fail "Installer download failed (HTTP ${status:-unknown}, curl $code). Check the network to Core and GitHub (set HTTPS_PROXY if a proxy is required), then rerun the command; downloaded data is kept and resumed."
+    status=$(cat "$work/http-status")
+    [ "$status" != 404 ] || fail 'This Core has no qualified installer for this platform.'
+    [ "$code" -ne 23 ] || fail 'Cannot write the installer download. Check disk space, quota and directory permissions.'
+    [ "$attempt" -lt 3 ] || break
+    printf 'Download interrupted; retrying (%s/2)...\n' "$attempt" >&2
+    run sleep "$attempt"
   done
+  fail "Installer download failed (HTTP ${status:-unknown}, curl $code). Check the network to Core and GitHub (set HTTPS_PROXY if a proxy is required), then rerun the command."
 }
-# Reject a rejected grant before any large download. Only a 401 stops here; any other answer is reported by the installer.
-check_grant() {
-  [ -n "$grant" ] || return 0
-  local status
-  printf 'header = "Authorization: Bearer %s"\n' "$grant" | run curl -sS --config - --request POST --connect-timeout 15 --max-time 30 --write-out '%{http_code}' --output /dev/null "${base%/install/*}/installation" >"$work/http-status" 2>/dev/null || :
-  status=$(cat "$work/http-status")
-  [ "$status" != 401 ] || fail 'Installation authorization rejected or expired; copy a fresh command from the Session.'
-}
-verified() {
-  run "${hash[@]}" "$1" >"$work/digest" || return 1
-  local actual rest
-  read -r actual rest <"$work/digest"
-  [ "$actual" = "$expected" ]
-}
-space 0
-check_grant
 printf 'Downloading the installer matched to Core...\n'
-fetch "$base/$os-$arch.sha256" "$work/checksum" 1024
+fetch "$base/$os-$arch.sha256" "$work/checksum"
 expected=$(cat "$work/checksum")
 [[ "$expected" =~ ^[0-9a-f]{64}$ ]] || fail 'Core returned an invalid installer checksum.'
-# The verified archive outlives this run so a later failure, such as a wrong option, needs no new download; it is removed once the installation completes.
-archive=$cache/$expected.tar.gz
-for stale in "$cache"/*.tar.gz "$cache"/*.tar.gz.part; do
-  case "$stale" in "$archive"|"$archive.part") ;; *) rm -f "$stale";; esac
-done
-if [ -f "$archive" ]; then
-  printf 'Verifying the installer archive from an earlier run...\n'
-  verified "$archive" || { rm -f "$archive"; printf 'The earlier archive failed verification and was discarded.\n' >&2; }
-fi
-# An interrupt between the last byte and the rename leaves a complete part file; accept it without asking the server for more.
-if [ ! -f "$archive" ] && [ -s "$archive.part" ] && verified "$archive.part"; then mv "$archive.part" "$archive"; fi
-if [ ! -f "$archive" ]; then
-  [ ! -s "$archive.part" ] || printf 'Resuming the earlier download...\n'
-  available=$(df -Pk "$work" | awk 'NR==2 {print $4}')
-  fetch "$base/$os-$arch.tar.gz" "$archive.part" "$((available * 1024 - 67108864))"
-  printf 'Verifying the installer archive...\n'
-  verified "$archive.part" || { rm -f "$archive.part"; fail 'Installer checksum mismatch; the download was discarded. Rerun the command to download it again.'; }
-  mv "$archive.part" "$archive"
-fi
-printf 'Checking extraction space...\n'
-# Count the verified tar stream without storing another copy, including its headers and padding.
-run bash -o pipefail -c 'gzip -dc "$1" | wc -c' -- "$archive" >"$work/unpacked-size" || { rm -f "$archive"; fail 'Installer archive is incomplete or invalid; it was discarded. Rerun the command to download it again.'; }
-unpacked=$(cat "$work/unpacked-size")
-space "$unpacked"
-printf 'Extracting the installer...\n'
-mkdir "$work/bundle"
-run tar -xzf "$archive" -C "$work/bundle" || fail 'Installer extraction failed. Check disk space, quota and filesystem permissions.'
-[ -x "$work/bundle/oac-daemon" ] || fail 'Cannot start the native installer. Check executable permissions and use a Runtime home that permits execution.'
-if OAC_INSTALL_GRANT=$grant run "$work/bundle/oac-daemon" install --onboard-url "${base%/install/*}/installation" "$@"; then
-  rm -f "$archive"
-  exit 0
-else
-  code=$?
-  case "$code" in
-    126|127) fail 'Cannot start the native installer. Check that the Runtime home permits execution (not a noexec mount) and that this host has the required native libraries.';;
-    *) exit "$code";;
-  esac
-fi
+fetch "$base/$os-$arch.tar.gz" "$work/installer.tar.gz"
+run "${hash[@]}" "$work/installer.tar.gz" >"$work/digest"
+read -r actual rest <"$work/digest"
+[ "$actual" = "$expected" ] || fail 'Installer checksum mismatch; the download was discarded. Rerun the command to download it again.'
+run tar -xzf "$work/installer.tar.gz" -C "$work" || fail 'Installer extraction failed. Check disk space, quota and filesystem permissions.'
+rm -f "$work/installer.tar.gz"
+[ -x "$work/oac-daemon" ] || fail 'Cannot start the native installer. Check executable permissions and use a Runtime home that permits execution.'
+code=0
+OAC_INSTALL_GRANT=$grant run "$work/oac-daemon" install --onboard-url "${base%/install/*}/installation" "$@" || code=$?
+case "$code" in
+  0) ;;
+  126|127) fail 'Cannot start the native installer. Check that the Runtime home permits execution (not a noexec mount) and that this host has the required native libraries.';;
+  *) exit "$code";;
+esac
diff --git a/services/core/internal/nativeinstaller/bootstrap_interrupt_unix_test.go b/services/core/internal/nativeinstaller/bootstrap_interrupt_unix_test.go
index 7acfc6f63..9313a864d 100644
--- a/services/core/internal/nativeinstaller/bootstrap_interrupt_unix_test.go
+++ b/services/core/internal/nativeinstaller/bootstrap_interrupt_unix_test.go
@@ -18,69 +18,6 @@ import (
 	"time"
 )
 
-func TestBootstrapParentDeathKeepsActiveDownloadLocked(t *testing.T) {
-	archive := bootstrapFixtureArchive(t)
-	started := make(chan struct{})
-	release := make(chan struct{})
-	var downloads atomic.Int32
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if strings.HasSuffix(r.URL.Path, "/installation") {
-			w.WriteHeader(404)
-			return
-		}
-		if strings.HasSuffix(r.URL.Path, ".sha256") {
-			fmt.Fprintf(w, "%x\n", sha256.Sum256(archive))
-			return
-		}
-		w.Header().Set("Content-Length", fmt.Sprint(len(archive)))
-		if downloads.Add(1) == 1 {
-			w.Write(archive[:1])
-			w.(http.Flusher).Flush()
-			close(started)
-			<-release
-			return
-		}
-		http.ServeContent(w, r, "", time.Time{}, bytes.NewReader(archive))
-	}))
-	defer server.Close()
-	defer close(release)
-	home := t.TempDir()
-	command := bootstrapCommand(t, server.URL, home)
-	command.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
-	var output bytes.Buffer
-	command.Stdout = &output
-	command.Stderr = &output
-	if err := command.Start(); err != nil {
-		t.Fatal(err)
-	}
-	// Kill only this fixture's process group, even if an assertion fails.
-	defer syscall.Kill(-command.Process.Pid, syscall.SIGKILL)
-	select {
-	case <-started:
-	case <-time.After(10 * time.Second):
-		t.Fatal("download did not start")
-	}
-	if err := command.Process.Kill(); err != nil {
-		t.Fatal(err)
-	}
-	retry, err := bootstrapCommand(t, server.URL, home).CombinedOutput()
-	if err == nil || !bytes.Contains(retry, []byte("Another native download")) {
-		t.Fatalf("active download was not protected: %v %s", err, retry)
-	}
-	if _, err := os.Stat(filepath.Join(home, "native-download", fmt.Sprintf("%x.tar.gz.part", sha256.Sum256(archive)))); err != nil {
-		t.Fatal("active download removed")
-	}
-	syscall.Kill(-command.Process.Pid, syscall.SIGKILL)
-	_ = command.Wait()
-	retry, err = bootstrapCommand(t, server.URL, home).CombinedOutput()
-	if err != nil {
-		t.Fatalf("recovery failed: %v %s", err, retry)
-	}
-	if _, err := os.Stat(filepath.Join(home, "native-download", "staging")); !os.IsNotExist(err) {
-		t.Fatal("staging left after recovery")
-	}
-}
-
 func TestBootstrapCommandDiscardsTimedOutResponse(t *testing.T) {
 	curl, err := exec.LookPath("curl")
 	if err != nil {
@@ -133,7 +70,8 @@ func TestBootstrapInterruptSaysHowToContinue(t *testing.T) {
 	}))
 	defer server.Close()
 	defer close(release)
-	command := bootstrapCommand(t, server.URL, t.TempDir())
+	home := t.TempDir()
+	command := bootstrapCommand(t, server.URL, home)
 	command.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
 	var output bytes.Buffer
 	command.Stdout = &output
@@ -153,4 +91,7 @@ func TestBootstrapInterruptSaysHowToContinue(t *testing.T) {
 	if err := command.Wait(); err == nil || !strings.Contains(output.String(), "Interrupted; rerun the same command to continue.") {
 		t.Fatalf("interrupt message missing: %v %s", err, output.String())
 	}
+	if left, _ := filepath.Glob(filepath.Join(home, "native-download", "bundle.*")); len(left) != 0 {
+		t.Fatalf("interrupt left the extracted installer: %v", left)
+	}
 }
diff --git a/services/core/internal/nativeinstaller/bootstrap_recovery_test.go b/services/core/internal/nativeinstaller/bootstrap_recovery_test.go
index 04a82f2a8..48394854e 100644
--- a/services/core/internal/nativeinstaller/bootstrap_recovery_test.go
+++ b/services/core/internal/nativeinstaller/bootstrap_recovery_test.go
@@ -110,11 +110,12 @@ func TestBootstrapRecovery(t *testing.T) {
 			if scenario == "metadata-503" && metadata.Load() != 2 {
 				t.Fatalf("metadata requests=%d", metadata.Load())
 			}
-			if scenario == "archive-truncated" && downloads.Load() != 2 {
+			// PowerShell accepts a short body; the checksum catches it and a rerun downloads again.
+			if scenario == "archive-truncated" && runtime.GOOS != "windows" && downloads.Load() != 2 {
 				t.Fatalf("download requests=%d", downloads.Load())
 			}
-			if _, err := os.Stat(filepath.Join(home, "native-download", "staging")); !os.IsNotExist(err) {
-				t.Fatalf("left staging: %v", err)
+			if left, _ := filepath.Glob(filepath.Join(home, "native-download", "bundle.*")); len(left) != 0 {
+				t.Fatalf("left the extracted installer: %v", left)
 			}
 			if bytes.Contains(output, []byte("fixture-grant")) || bytes.Contains(output, []byte("\x1b")) {
 				t.Fatal("secret or terminal escape in captured output")
@@ -123,58 +124,6 @@ func TestBootstrapRecovery(t *testing.T) {
 	}
 }
 
-func TestBootstrapDiscardsStaleStagingOnly(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("POSIX executable fixture; Windows recovery is covered separately")
-	}
-	home := t.TempDir()
-	staging := filepath.Join(home, "native-download", "staging")
-	if err := os.MkdirAll(staging, 0700); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(staging, "interrupted"), []byte("partial"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	keep := filepath.Join(home, "workspace.txt")
-	if err := os.WriteFile(keep, []byte("keep"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(404) }))
-	defer server.Close()
-	if output, err := bootstrapCommand(t, server.URL, home).CombinedOutput(); err == nil {
-		t.Fatalf("unexpected success %s", output)
-	}
-	if _, err := os.Stat(staging); !os.IsNotExist(err) {
-		t.Fatal("stale staging remains")
-	}
-	if data, err := os.ReadFile(keep); err != nil || string(data) != "keep" {
-		t.Fatal("unrelated file changed")
-	}
-}
-
-func TestBootstrapRejectsLowSpaceBeforeNetwork(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("POSIX disk-space fixture")
-	}
-	home := t.TempDir()
-	bin := t.TempDir()
-	if err := os.WriteFile(filepath.Join(bin, "df"), []byte("#!/bin/sh\nprintf 'Filesystem 1024-blocks Used Available Capacity Mounted\\nfixture 100 99 1 99%% /\\n'\n"), 0700); err != nil {
-		t.Fatal(err)
-	}
-	var requests atomic.Int32
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { requests.Add(1); w.WriteHeader(500) }))
-	defer server.Close()
-	command := bootstrapCommand(t, server.URL, home)
-	command.Env = append(command.Env, "PATH="+bin+string(os.PathListSeparator)+os.Getenv("PATH"))
-	output, err := command.CombinedOutput()
-	if err == nil || !bytes.Contains(output, []byte("Not enough disk space")) || requests.Load() != 0 {
-		t.Fatalf("low-space guard: %v %s requests=%d", err, output, requests.Load())
-	}
-	if _, err = os.Stat(filepath.Join(home, "native-download", "staging")); !os.IsNotExist(err) {
-		t.Fatal("low-space failure left staging")
-	}
-}
-
 func TestBootstrapExplainsUnexecutableInstaller(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("POSIX executable permissions")
@@ -209,8 +158,42 @@ func TestBootstrapExplainsUnexecutableInstaller(t *testing.T) {
 	if err == nil || !bytes.Contains(output, []byte("Cannot start the native installer")) {
 		t.Fatalf("%v: %s", err, output)
 	}
-	if _, err := os.Stat(filepath.Join(home, "native-download", "staging")); !os.IsNotExist(err) {
-		t.Fatal("staging remains")
+	if left, _ := filepath.Glob(filepath.Join(home, "native-download", "bundle.*")); len(left) != 0 {
+		t.Fatal("extracted installer remains")
+	}
+}
+
+// Only the installer receives the grant, not curl, tar or the other tools around it.
+func TestBootstrapGivesGrantOnlyToInstaller(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX executable fixture")
+	}
+	curl, err := exec.LookPath("curl")
+	if err != nil {
+		t.Skip("curl unavailable")
+	}
+	leak := filepath.Join(t.TempDir(), "leak")
+	bin := t.TempDir()
+	wrapper := "#!/bin/sh\n[ -z \"$OAC_INSTALL_GRANT\" ] || echo curl >> " + shellQuote(leak) + "\nexec " + shellQuote(curl) + " \"$@\"\n"
+	if err = os.WriteFile(filepath.Join(bin, "curl"), []byte(wrapper), 0700); err != nil {
+		t.Fatal(err)
+	}
+	archive := bootstrapScriptArchive(t, "#!/bin/sh\n[ \"$OAC_INSTALL_GRANT\" = fixture-grant ]\n")
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, ".sha256") {
+			fmt.Fprintf(w, "%x\n", sha256.Sum256(archive))
+			return
+		}
+		w.Write(archive)
+	}))
+	defer server.Close()
+	command := bootstrapCommand(t, server.URL, t.TempDir())
+	command.Env = append(command.Env, "PATH="+bin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	if output, err := command.CombinedOutput(); err != nil {
+		t.Fatalf("the installer did not receive the grant: %v: %s", err, output)
+	}
+	if _, err = os.Stat(leak); !os.IsNotExist(err) {
+		t.Fatal("a download tool received the grant")
 	}
 }
 
diff --git a/services/core/internal/nativeinstaller/bootstrap_resume_unix_test.go b/services/core/internal/nativeinstaller/bootstrap_resume_unix_test.go
deleted file mode 100644
index 63163b051..000000000
--- a/services/core/internal/nativeinstaller/bootstrap_resume_unix_test.go
+++ /dev/null
@@ -1,188 +0,0 @@
-//go:build unix
-
-package nativeinstaller
-
-import (
-	"bytes"
-	"crypto/sha256"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
-)
-
-// resumeServer serves the installation endpoint and a ranged archive.
-type resumeServer struct {
-	*httptest.Server
-	archive            []byte
-	downloads, checks  atomic.Int32
-	ranges             chan string
-	grantStatus        int
-	stallFirstDownload bool
-}
-
-func newResumeServer(t *testing.T, archive []byte) *resumeServer {
-	t.Helper()
-	s := &resumeServer{archive: archive, ranges: make(chan string, 8), grantStatus: 200}
-	s.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case strings.HasSuffix(r.URL.Path, "/installation"):
-			s.checks.Add(1)
-			if r.Header.Get("Authorization") != "Bearer fixture-grant" {
-				t.Error("grant missing from the installation check")
-			}
-			w.WriteHeader(s.grantStatus)
-			fmt.Fprint(w, `{"harness":"codex"}`)
-		case strings.HasSuffix(r.URL.Path, ".sha256"):
-			fmt.Fprintf(w, "%s\n", sha256Hex(archive))
-		default:
-			request := s.downloads.Add(1)
-			s.ranges <- r.Header.Get("Range")
-			if s.stallFirstDownload && request == 1 {
-				w.Header().Set("Content-Length", fmt.Sprint(len(archive)))
-				w.Write(archive[:len(archive)/2])
-				w.(http.Flusher).Flush()
-				<-r.Context().Done()
-				return
-			}
-			http.ServeContent(w, r, "", time.Time{}, bytes.NewReader(archive))
-		}
-	}))
-	t.Cleanup(s.Close)
-	return s
-}
-
-func (s *resumeServer) command(t *testing.T, home string, args ...string) *exec.Cmd {
-	command := exec.Command("bash", append([]string{"assets/bootstrap.sh", s.URL + "/api/v1/agent-daemon/install/test"}, args...)...)
-	command.Env = append(os.Environ(), "OAC_RUNTIME_HOME="+home, v1.NativeInstallGrantEnv+"=fixture-grant", "NO_PROXY=127.0.0.1", "no_proxy=127.0.0.1")
-	return command
-}
-
-func TestBootstrapResumesStalledDownload(t *testing.T) {
-	curl, err := exec.LookPath("curl")
-	if err != nil {
-		t.Skip("curl unavailable")
-	}
-	archive := bootstrapFixtureArchive(t)
-	server := newResumeServer(t, archive)
-	server.stallFirstDownload = true
-	// Shorten only the stall window; the script's own retry and resume logic runs.
-	bin := t.TempDir()
-	if err = os.WriteFile(filepath.Join(bin, "curl"), []byte("#!/bin/sh\nexec "+shellQuote(curl)+" \"$@\" --speed-time 2\n"), 0700); err != nil {
-		t.Fatal(err)
-	}
-	command := server.command(t, t.TempDir())
-	command.Env = append(command.Env, "PATH="+bin+string(os.PathListSeparator)+os.Getenv("PATH"))
-	if output, err := command.CombinedOutput(); err != nil {
-		t.Fatalf("%v: %s", err, output)
-	}
-	if first, second := <-server.ranges, <-server.ranges; first != "" || !strings.HasPrefix(second, "bytes=") {
-		t.Fatalf("second request did not resume: %q then %q", first, second)
-	}
-}
-
-func TestBootstrapKeepsVerifiedArchiveUntilInstallCompletes(t *testing.T) {
-	// The first install attempt fails after the download; the rerun needs no new archive and removes it on success.
-	archive := bootstrapScriptArchive(t, "#!/bin/sh\n[ -e \"$OAC_RESUME_OK\" ]\n")
-	server := newResumeServer(t, archive)
-	home, ok := t.TempDir(), filepath.Join(t.TempDir(), "ok")
-	cached := filepath.Join(home, "native-download", sha256Hex(archive)+".tar.gz")
-	command := server.command(t, home)
-	command.Env = append(command.Env, "OAC_RESUME_OK="+ok)
-	if output, err := command.CombinedOutput(); err == nil {
-		t.Fatalf("expected the fixture install to fail: %s", output)
-	}
-	if _, err := os.Stat(cached); err != nil {
-		t.Fatal("verified archive was not kept")
-	}
-	if err := os.WriteFile(ok, nil, 0600); err != nil {
-		t.Fatal(err)
-	}
-	command = server.command(t, home)
-	command.Env = append(command.Env, "OAC_RESUME_OK="+ok)
-	if output, err := command.CombinedOutput(); err != nil {
-		t.Fatalf("%v: %s", err, output)
-	}
-	if server.downloads.Load() != 1 {
-		t.Fatalf("archive downloaded %d times", server.downloads.Load())
-	}
-	if _, err := os.Stat(cached); !os.IsNotExist(err) {
-		t.Fatal("archive kept after a completed installation")
-	}
-}
-
-// A rerun after an interrupt between the last byte and the rename finds a complete .part file; the server answers 416 and the checksum decides.
-func TestBootstrapAcceptsCompletePartialDownload(t *testing.T) {
-	archive := bootstrapFixtureArchive(t)
-	server := newResumeServer(t, archive)
-	home := t.TempDir()
-	part := filepath.Join(home, "native-download", sha256Hex(archive)+".tar.gz.part")
-	if err := os.MkdirAll(filepath.Dir(part), 0700); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(part, archive, 0600); err != nil {
-		t.Fatal(err)
-	}
-	output, err := server.command(t, home).CombinedOutput()
-	if err != nil || strings.Contains(string(output), "416") {
-		t.Fatalf("%v: %s", err, output)
-	}
-}
-
-// Only the installer receives the grant, not curl, tar or the other tools around it.
-func TestBootstrapGivesGrantOnlyToInstaller(t *testing.T) {
-	curl, err := exec.LookPath("curl")
-	if err != nil {
-		t.Skip("curl unavailable")
-	}
-	leak := filepath.Join(t.TempDir(), "leak")
-	bin := t.TempDir()
-	wrapper := "#!/bin/sh\n[ -z \"$OAC_INSTALL_GRANT\" ] || echo curl >> " + shellQuote(leak) + "\nexec " + shellQuote(curl) + " \"$@\"\n"
-	if err = os.WriteFile(filepath.Join(bin, "curl"), []byte(wrapper), 0700); err != nil {
-		t.Fatal(err)
-	}
-	server := newResumeServer(t, bootstrapScriptArchive(t, "#!/bin/sh\n[ \"$OAC_INSTALL_GRANT\" = fixture-grant ]\n"))
-	command := server.command(t, t.TempDir())
-	command.Env = append(command.Env, "PATH="+bin+string(os.PathListSeparator)+os.Getenv("PATH"))
-	if output, err := command.CombinedOutput(); err != nil {
-		t.Fatalf("the installer did not receive the grant: %v: %s", err, output)
-	}
-	if _, err = os.Stat(leak); !os.IsNotExist(err) {
-		t.Fatal("a download tool received the grant")
-	}
-}
-
-func TestBootstrapDiscardsCachedArchiveThatFailsVerification(t *testing.T) {
-	archive := bootstrapFixtureArchive(t)
-	server := newResumeServer(t, archive)
-	home := t.TempDir()
-	cached := filepath.Join(home, "native-download", sha256Hex(archive)+".tar.gz")
-	if err := os.MkdirAll(filepath.Dir(cached), 0700); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(cached, []byte("corrupt"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	if output, err := server.command(t, home).CombinedOutput(); err != nil || server.downloads.Load() != 1 {
-		t.Fatalf("%v downloads=%d: %s", err, server.downloads.Load(), output)
-	}
-}
-
-func TestBootstrapChecksGrantBeforeDownloading(t *testing.T) {
-	server := newResumeServer(t, bootstrapFixtureArchive(t))
-	server.grantStatus = 401
-	output, err := server.command(t, t.TempDir()).CombinedOutput()
-	if err == nil || !strings.Contains(string(output), "authorization rejected or expired") || server.downloads.Load() != 0 || strings.Contains(string(output), "fixture-grant") {
-		t.Fatalf("%v downloads=%d: %s", err, server.downloads.Load(), output)
-	}
-}
-
-func sha256Hex(data []byte) string { return fmt.Sprintf("%x", sha256.Sum256(data)) }
diff --git a/services/core/internal/nativeinstaller/catalog.go b/services/core/internal/nativeinstaller/catalog.go
index cba289bb0..00b3ed656 100644
--- a/services/core/internal/nativeinstaller/catalog.go
+++ b/services/core/internal/nativeinstaller/catalog.go
@@ -40,7 +40,8 @@ type Catalog struct {
 
 var checksum = regexp.MustCompile(`^[0-9a-f]{64}$`)
 
-var platformName = regexp.MustCompile(`^(linux|darwin|windows)-(amd64|arm64)$`)
+// An artifact is a platform's base archive or one named part of it.
+var artifactName = regexp.MustCompile(`^(linux|darwin|windows)-(amd64|arm64)(-[a-z]+)?$`)
 
 // Load checks the matched catalog without downloading execution payloads. Local
 // offline archives are verified once; the directory stays immutable while serving.
@@ -58,25 +59,25 @@ func Load(directory, version string) (*Catalog, error) {
 		return nil, errors.New("native installer catalog does not match this Core build and protocol")
 	}
 	c.local = make(map[string]bool)
-	for platform, artifact := range c.Artifacts {
-		if !platformName.MatchString(platform) || !checksum.MatchString(artifact.SHA256) {
-			return nil, errors.New("invalid native installer platform")
+	for name, artifact := range c.Artifacts {
+		if !artifactName.MatchString(name) || !checksum.MatchString(artifact.SHA256) {
+			return nil, errors.New("invalid native installer artifact")
 		}
 		if artifact.URL != "" {
 			u, err := url.Parse(artifact.URL)
-			filename := "oac-native-" + c.Version + "-" + platform + ".tar.gz"
+			filename := "oac-native-" + c.Version + "-" + name + ".tar.gz"
 			if err != nil || u.Scheme != "https" || u.Host == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || !strings.HasSuffix(u.Path, "/"+filename) || strings.Contains(strings.ToLower(u.Path), "/latest/") {
 				return nil, errors.New("invalid versioned native installer URL")
 			}
 		}
-		file, err := os.Open(filepath.Join(directory, platform+".tar.gz"))
+		file, err := os.Open(filepath.Join(directory, name+".tar.gz"))
 		if errors.Is(err, os.ErrNotExist) && artifact.URL != "" {
 			continue
 		}
 		if err != nil {
 			return nil, err
 		}
-		c.local[platform] = true
+		c.local[name] = true
 		hash := sha256.New()
 		_, err = io.Copy(hash, file)
 		file.Close()
@@ -104,22 +105,22 @@ func (c *Catalog) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		_, _ = w.Write(raw)
 		return
 	}
-	platform := strings.TrimSuffix(strings.TrimSuffix(name, ".sha256"), ".tar.gz")
-	artifact, ok := c.Artifacts[platform]
+	archive := strings.TrimSuffix(strings.TrimSuffix(name, ".sha256"), ".tar.gz")
+	artifact, ok := c.Artifacts[archive]
 	if !ok {
 		http.NotFound(w, r)
 		return
 	}
-	if name == platform+".sha256" {
+	if name == archive+".sha256" {
 		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		fmt.Fprintln(w, artifact.SHA256)
 		return
 	}
-	if name != platform+".tar.gz" {
+	if name != archive+".tar.gz" {
 		http.NotFound(w, r)
 		return
 	}
-	if c.local[platform] {
+	if c.local[archive] {
 		// An archive outlives the server-wide write timeout on a slow link.
 		_ = http.NewResponseController(w).SetWriteDeadline(time.Time{})
 		http.ServeFile(w, r, filepath.Join(c.directory, name))
diff --git a/services/core/internal/nativeinstaller/catalog_test.go b/services/core/internal/nativeinstaller/catalog_test.go
index 2737780a7..555180951 100644
--- a/services/core/internal/nativeinstaller/catalog_test.go
+++ b/services/core/internal/nativeinstaller/catalog_test.go
@@ -20,13 +20,15 @@ func TestCatalogRequiresMatchedImmutableArtifacts(t *testing.T) {
 	dir := t.TempDir()
 	data := []byte("archive fixture")
 	hash := sha256.Sum256(data)
-	manifest := Catalog{Version: "build", ProtocolVersion: proto.Version, Artifacts: map[string]Artifact{"linux-amd64": {SHA256: hex.EncodeToString(hash[:])}}}
+	manifest := Catalog{Version: "build", ProtocolVersion: proto.Version, Artifacts: map[string]Artifact{"linux-amd64": {SHA256: hex.EncodeToString(hash[:])}, "linux-amd64-codex": {SHA256: hex.EncodeToString(hash[:])}}}
 	raw, _ := json.Marshal(manifest)
 	if err := os.WriteFile(filepath.Join(dir, "catalog.json"), raw, 0600); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(dir, "linux-amd64.tar.gz"), data, 0600); err != nil {
-		t.Fatal(err)
+	for _, name := range []string{"linux-amd64.tar.gz", "linux-amd64-codex.tar.gz"} {
+		if err := os.WriteFile(filepath.Join(dir, name), data, 0600); err != nil {
+			t.Fatal(err)
+		}
 	}
 	if _, err := Load(dir, "wrong-build"); err == nil {
 		t.Fatal("accepted mismatched Core")
@@ -39,7 +41,7 @@ func TestCatalogRequiresMatchedImmutableArtifacts(t *testing.T) {
 		path string
 		code int
 	}{
-		{"build/linux-amd64.tar.gz", 200}, {"build/linux-amd64.sha256", 200}, {"other/linux-amd64.tar.gz", 404}, {"build/windows-arm64.tar.gz", 404}, {"build/catalog.json", 404}, {"build/../../catalog.json", 404},
+		{"build/linux-amd64.tar.gz", 200}, {"build/linux-amd64.sha256", 200}, {"build/linux-amd64-codex.tar.gz", 200}, {"build/linux-amd64-codex.sha256", 200}, {"build/linux-amd64-claude.tar.gz", 404}, {"other/linux-amd64.tar.gz", 404}, {"build/windows-arm64.tar.gz", 404}, {"build/catalog.json", 404}, {"build/../../catalog.json", 404},
 	} {
 		w := httptest.NewRecorder()
 		catalog.ServeHTTP(w, httptest.NewRequest("GET", "/api/v1/agent-daemon/install/"+request.path, nil))
diff --git a/services/core/internal/persistence/postgres/deploymentpg/allocations.go b/services/core/internal/persistence/postgres/deploymentpg/allocations.go
index cde1cff52..6bf065c78 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/allocations.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/allocations.go
@@ -221,7 +221,23 @@ func (t *reservationTx) FindAllocation() (deployment.Allocation, bool, error) {
 }
 
 func (t *reservationTx) LockDeployment() (placement.Deployment, error) {
-	return placementpg.LockDeployment(t.ctx, t.q)
+	d, err := placementpg.LockDeployment(t.ctx, t.q)
+	if err != nil {
+		return d, err
+	}
+	frozen, err := t.q.GetSessionComputeGeneration(t.ctx, t.session)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return d, nil
+	}
+	if err != nil {
+		return d, err
+	}
+	if d.Provider != frozen.ProviderKind.String || d.Mode != "direct" {
+		return d, placement.ErrAdmissionClosed
+	}
+	d.Generation = uint64(frozen.Generation)
+	d.Specification = frozen.Specification
+	return d, nil
 }
 
 func (t *reservationTx) LoadReserved() (placement.Reserved, error) {
diff --git a/services/core/internal/persistence/postgres/deploymentpg/checkpoint_transfer_test.go b/services/core/internal/persistence/postgres/deploymentpg/checkpoint_transfer_test.go
index 778dfca7d..fc0abdacf 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/checkpoint_transfer_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/checkpoint_transfer_test.go
@@ -26,7 +26,7 @@ func readyCheckpointNode(t *testing.T, f fixture, node deployment.Enrollment, vi
 	if err := f.service.ConnectNode(t.Context(), node.NodeID, connection, epoch); err != nil {
 		t.Fatal(err)
 	}
-	if err := f.service.HeartbeatGenerations(t.Context(), node.NodeID, connection, epoch, deployment.NodeHealth{}, []sandbox.GenerationStatus{{Generation: view.Generation, SpecificationDigest: view.SpecificationDigest, State: "ready", Checkpoint: &compatibility}}); err != nil {
+	if err := f.service.Heartbeat(t.Context(), node.NodeID, connection, epoch, deployment.NodeHealth{}, []sandbox.GenerationStatus{{Generation: view.Generation, SpecificationDigest: view.SpecificationDigest, State: "ready", Checkpoint: &compatibility}}); err != nil {
 		t.Fatal(err)
 	}
 }
@@ -47,7 +47,7 @@ func suspendedCheckpointOwner(t *testing.T, f fixture, changes *deployment.Execu
 func TestCheckpointTransferPreservesAllocationAndFencesOldOwner(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	source := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
 	readyCheckpointNode(t, f, source, view, checkpointClass)
 	target := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
@@ -94,7 +94,7 @@ func TestCheckpointTransferRequiresCompatibleGenerationAndCapacity(t *testing.T)
 		t.Run(obstruction, func(t *testing.T) {
 			f := newFixture(t)
 			changes, _ := f.execution(t)
-			installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+			installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 			source := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 2})
 			readyCheckpointNode(t, f, source, view, checkpointClass)
 			target := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
@@ -163,7 +163,7 @@ func TestCheckpointTransferRequiresCompatibleGenerationAndCapacity(t *testing.T)
 func TestCheckpointTransfersSerializeDestinationCapacity(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	source := f.enroll(t, view, deployment.Capacity{MaxActive: 2, MaxRetained: 2})
 	readyCheckpointNode(t, f, source, view, checkpointClass)
 	target := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
@@ -196,7 +196,7 @@ func TestCheckpointTransfersSerializeDestinationCapacity(t *testing.T) {
 func TestCheckpointCleanupRelocatesArtifactWithoutExecutionCompatibility(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	source := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
 	readyCheckpointNode(t, f, source, view, checkpointClass)
 	target := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 2})
@@ -241,7 +241,7 @@ func TestCheckpointPressureSuspendsOnlyUsableDestination(t *testing.T) {
 		t.Run(scenario, func(t *testing.T) {
 			f := newFixture(t)
 			changes, _ := f.execution(t)
-			installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+			installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 			source := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
 			readyCheckpointNode(t, f, source, view, checkpointClass)
 			suspendedCheckpointOwner(t, f, changes, installation, source, view)
@@ -279,7 +279,7 @@ func TestCheckpointPressureSuspendsOnlyUsableDestination(t *testing.T) {
 func TestCheckpointRestoreUsesRetainedSlotAndImmutableGeneration(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	source := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
 	readyCheckpointNode(t, f, source, view, checkpointClass)
 	owner := suspendedCheckpointOwner(t, f, changes, installation, source, view)
diff --git a/services/core/internal/persistence/postgres/deploymentpg/compute_profiles_test.go b/services/core/internal/persistence/postgres/deploymentpg/compute_profiles_test.go
new file mode 100644
index 000000000..7b8ea4d0c
--- /dev/null
+++ b/services/core/internal/persistence/postgres/deploymentpg/compute_profiles_test.go
@@ -0,0 +1,131 @@
+package deploymentpg_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment/placement"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/identity"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/pgunit"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/sessionpg"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/e2b"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/providers"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
+	"github.com/google/uuid"
+	"testing"
+	"time"
+)
+
+func TestComputeProfileFrozenBeforeAllocationSurvivesReconfiguration(t *testing.T) {
+	f := newFixture(t)
+	changes, _ := f.execution(t)
+	input := setupE2BSelection()
+	input.ComputeProfiles = map[string]sandbox.ComputeProfile{"memory-8g": {Resources: sandbox.Resources{CPUs: 4, MemoryMiB: 8192}, Configuration: &e2b.DeploymentConfiguration{Template: "large:" + uuid.NewString()}}}
+	installation, view := f.initialize(t, changes, input)
+	if view.Generation != 2 || view.Specification.Resources.MemoryMiB != 2048 || view.ComputeProfiles["memory-8g"].Generation != 1 {
+		t.Fatal("default or profile generation incorrect")
+	}
+	rules, err := placement.NewRules(providers.Builtin(), fixturePublicURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	service, err := sessions.NewService(sessionpg.New(pgunit.NewPool(f.pool), f.cipher), rules)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tenant := uuid.NewString()
+	create := sessions.CreateSession{Creator: identity.Subject{Kind: "service_account", ID: "compute-profile-test"}, Engine: "codex", IdempotencyKey: "profile", Configuration: json.RawMessage(`{"environment":{"type":"openai_hosted"},"compute_profile":"memory-8g"}`)}
+	type outcome struct {
+		result sessions.Creation
+		err    error
+	}
+	outcomes := make(chan outcome, 8)
+	for range 8 {
+		go func() {
+			result, err := service.CreateSession(t.Context(), tenant, create)
+			outcomes <- outcome{result, err}
+		}()
+	}
+	var first sessions.Creation
+	fresh := 0
+	for range 8 {
+		outcome := <-outcomes
+		if outcome.err != nil {
+			t.Fatal(outcome.err)
+		}
+		if first.Session.ID != "" && first.Session.ID != outcome.result.Session.ID {
+			t.Fatal("concurrent retry created another session")
+		}
+		if outcome.result.Created {
+			fresh++
+		}
+		first = outcome.result
+	}
+	if fresh != 1 {
+		t.Fatal("concurrent retry did not elect one creator", fresh)
+	}
+	if first.Session.Environment == nil {
+		t.Fatal("no environment")
+	}
+	// Remove the named choice before provisioning; a new session must fail,
+	// while the original retry and future allocation retain the immutable choice.
+	input.ComputeProfiles = nil
+	input.ExpectedGeneration = view.Generation
+	next, err := changes.Update(admin(t), installation, input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if next.Generation != 3 || next.Specification.Resources.MemoryMiB != 2048 {
+		t.Fatal("default unexpectedly changed")
+	}
+	if err = changes.CollectGenerations(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+	replay, err := service.CreateSession(t.Context(), tenant, create)
+	if err != nil || replay.Created || replay.Session.ID != first.Session.ID {
+		t.Fatal("retry lost frozen profile", err)
+	}
+	create.IdempotencyKey = "missing"
+	if _, err = service.CreateSession(t.Context(), tenant, create); !errors.Is(err, placement.ErrComputeProfileUnavailable) {
+		t.Fatal("unknown profile did not fail closed", err)
+	}
+	key := deployment.AllocationKey{TenantID: tenant, EnvironmentID: first.Session.Environment.ID}
+	allocation, err := changes.ReserveAllocation(t.Context(), key, installation, credentialHash())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if allocation.DeploymentGeneration != 1 {
+		t.Fatal("frozen allocation changed generation")
+	}
+	setup, err := f.service.AllocationSetup(t.Context(), sandbox.Reference{TenantID: tenant, EnvironmentID: key.EnvironmentID, AllocationID: allocation.ID})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if setup.Specification.Resources.MemoryMiB != 8192 || setup.Specification.Resources.CPUs != 4 {
+		t.Fatal("wrong retained resources")
+	}
+	ordinary := hostedEnvironment(t, f.pool)
+	other, err := changes.ReserveAllocation(t.Context(), ordinary, installation, credentialHash())
+	if err != nil || other.DeploymentGeneration != 3 {
+		t.Fatal("ordinary allocation did not keep default", err)
+	}
+}
+
+func TestComputeProfileDeploymentSnapshotKeepsExecutionDeadline(t *testing.T) {
+	f := newFixture(t)
+	tx, err := f.pool.Begin(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer tx.Rollback(context.Background())
+	if _, err = tx.Exec(t.Context(), "LOCK TABLE runtime_deployment IN ACCESS EXCLUSIVE MODE"); err != nil {
+		t.Fatal(err)
+	}
+	started := time.Now()
+	_, err = f.adapter.Deployment(context.Background())
+	if err == nil || time.Since(started) > pgunit.ExecutionTimeout+2*time.Second {
+		t.Fatal("deployment snapshot lost its execution deadline", err)
+	}
+}
diff --git a/services/core/internal/persistence/postgres/deploymentpg/fixture_test.go b/services/core/internal/persistence/postgres/deploymentpg/fixture_test.go
index 8032f8288..1d6def668 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/fixture_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/fixture_test.go
@@ -6,16 +6,17 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/adminaudit"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/credentialcrypto"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment/placement"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/deploymentpg"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/pgtest"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/pgunit"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/providers"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/workspacefs"
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
@@ -77,7 +78,7 @@ func (f fixture) execution(t *testing.T) (*deployment.ExecutionOperations, *pgun
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = lease.Close(context.Background()) })
-	operations, err := deployment.NewExecutionOperations(f.service, deploymentpg.NewExecution(lease, f.cipher), engine.Catalog{})
+	operations, err := deployment.NewExecutionOperations(f.service, deploymentpg.NewExecution(lease, f.cipher), builtin.Registry())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -92,13 +93,9 @@ func admin(t *testing.T) context.Context {
 // testSpecification is a valid deployment specification for provider.
 func testSpecification(provider string) sandbox.DeploymentSpec {
 	s := sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048}}
-	if provider == "e2b" {
-		return s
-	}
-	s.Runtime = &sandbox.RuntimeRelease{SourceCommit: strings.Repeat("a", 40), ImageID: "sha256:" + strings.Repeat("b", 64), ImageManifestDigest: "sha256:" + strings.Repeat("c", 64), MicrosandboxRef: "oac-runtime@sha256:" + strings.Repeat("d", 64), RuntimeSHA256: strings.Repeat("e", 64), FirmwareSHA256: strings.Repeat("f", 64)}
 	if provider == "microsandbox" {
 		s.Resources.RootDiskMiB = 8192
-		s.Resources.EnvironmentDiskMiB = 8192
+		s.Workspace = &workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}
 	}
 	return s
 }
@@ -122,7 +119,7 @@ func (f fixture) initialize(t *testing.T, changes *deployment.ExecutionOperation
 // generation with it.
 func (f fixture) enroll(t *testing.T, view deployment.View, capacity deployment.Capacity) deployment.Enrollment {
 	t.Helper()
-	token, err := f.service.CreateEnrollment(admin(t), capacity)
+	token, err := f.service.CreateEnrollment(admin(t), deployment.EnrollmentLimits{MaxActive: &capacity.MaxActive, MaxRetained: &capacity.MaxRetained})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -145,22 +142,29 @@ func (f fixture) connect(t *testing.T, nodeID string) string {
 	if err := f.service.ConnectNode(t.Context(), nodeID, connection, epoch); err != nil {
 		t.Fatal(err)
 	}
-	if err := f.heartbeat(t.Context(), nodeID, connection, epoch, deployment.NodeHealth{ProviderReady: true}, nil); err != nil {
+	if err := f.heartbeat(t.Context(), nodeID, connection, epoch, deployment.NodeHealth{}, true); err != nil {
 		t.Fatal(err)
 	}
 	return connection
 }
 
 // heartbeat reports the fixture's verified generation alongside static readiness.
-func (f fixture) heartbeat(ctx context.Context, nodeID, connection string, epoch uint64, health deployment.NodeHealth, _ []sandbox.GenerationStatus) error {
+func (f fixture) heartbeat(ctx context.Context, nodeID, connection string, epoch uint64, health deployment.NodeHealth, ready bool) error {
 	var generation uint64
 	var digest, provider string
 	if err := f.pool.QueryRow(ctx, "SELECT n.deployment_generation, n.specification_digest, d.provider_kind FROM runtime_nodes n CROSS JOIN runtime_deployment d WHERE n.id=$1", nodeID).Scan(&generation, &digest, &provider); err != nil {
 		return err
 	}
 	var statuses []sandbox.GenerationStatus
-	if health.ProviderReady && provider == "microsandbox" {
-		statuses = []sandbox.GenerationStatus{{Generation: generation, SpecificationDigest: digest, State: "ready", Checkpoint: &sandbox.CheckpointCompatibility{ArtifactDomain: "fixture-store", ExecutionClass: "fixture-runtime"}}}
+	{
+		status := sandbox.GenerationStatus{Generation: generation, SpecificationDigest: digest, State: "ready"}
+		if !ready {
+			status.State = "failed"
+		}
+		if provider == "microsandbox" && ready {
+			status.Checkpoint = &sandbox.CheckpointCompatibility{ArtifactDomain: "fixture-store", ExecutionClass: "fixture-runtime"}
+		}
+		statuses = []sandbox.GenerationStatus{status}
 	}
 	return f.service.Heartbeat(ctx, nodeID, connection, epoch, health, statuses)
 }
diff --git a/services/core/internal/persistence/postgres/deploymentpg/generations_test.go b/services/core/internal/persistence/postgres/deploymentpg/generations_test.go
index b0463ac7d..e25f7e389 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/generations_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/generations_test.go
@@ -83,11 +83,6 @@ func TestE2BChangeClassifierOmittedKeyAndExplicitSameKey(t *testing.T) {
 	if _, unchanged, err = changes.ClassifyChange(t.Context(), id, input); err != nil || unchanged {
 		t.Fatal("explicit same key skipped verification", err)
 	}
-	invalid := input
-	invalid.Runtime = &sandbox.RuntimeRelease{}
-	if _, _, err := changes.ClassifyChange(t.Context(), id, invalid); err == nil {
-		t.Fatal("omitted resources erased forbidden Runtime input")
-	}
 	input.ExpectedGeneration = 0
 	_, _, err = changes.ClassifyChange(t.Context(), id, input)
 	var stale *deployment.GenerationStaleError
diff --git a/services/core/internal/persistence/postgres/deploymentpg/host_history_test.go b/services/core/internal/persistence/postgres/deploymentpg/host_history_test.go
index 4b7c09e2a..ed92fad46 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/host_history_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/host_history_test.go
@@ -35,8 +35,8 @@ func TestNodeHostHistorySamplingAndDetail(t *testing.T) {
 	f, node, connection, epoch := hostHistoryNode(t)
 	now := time.Now().UTC()
 	host := &deployment.NodeHost{EffectiveCPUCores: hostHistoryPtr(2.0), CPUUtilization: hostHistoryPtr(0.35), TotalMemoryBytes: hostHistoryPtr(int64(4096)), AvailableMemoryBytes: hostHistoryPtr(int64(1024)), AvailableDiskBytes: hostHistoryPtr(int64(8192)), ObservedAt: &now}
-	health := deployment.NodeHealth{ProviderReady: true, Host: host}
-	if err := f.heartbeat(t.Context(), node, connection, epoch, health, nil); err != nil {
+	health := deployment.NodeHealth{Host: host}
+	if err := f.heartbeat(t.Context(), node, connection, epoch, health, true); err != nil {
 		t.Fatal(err)
 	}
 	for i, want := range []int64{1, 0} {
@@ -113,7 +113,7 @@ func TestNodeHostHistorySamplingAndDetail(t *testing.T) {
 	// A disconnected node cannot create another history row, even with a fresh last observation.
 	next := now.Add(time.Millisecond)
 	host.ObservedAt = &next
-	if err := f.heartbeat(t.Context(), node, connection, epoch, health, nil); err != nil {
+	if err := f.heartbeat(t.Context(), node, connection, epoch, health, true); err != nil {
 		t.Fatal(err)
 	}
 	if err := f.service.DisconnectNode(t.Context(), node, connection, epoch); err != nil {
@@ -136,7 +136,7 @@ func TestNodeHostHistorySamplingAndDetail(t *testing.T) {
 func TestNodeHostHistoryFencingAndUnknown(t *testing.T) {
 	f, node, conn, epoch := hostHistoryNode(t)
 	for _, at := range []time.Time{time.Now().Add(-time.Minute), time.Now().Add(time.Hour)} {
-		if err := f.heartbeat(t.Context(), node, conn, epoch, deployment.NodeHealth{Host: &deployment.NodeHost{ObservedAt: &at}}, nil); err != nil {
+		if err := f.heartbeat(t.Context(), node, conn, epoch, deployment.NodeHealth{Host: &deployment.NodeHost{ObservedAt: &at}}, true); err != nil {
 			t.Fatal(err)
 		}
 		if n, err := f.adapter.SampleHostHistory(t.Context()); err != nil || n != 0 {
@@ -145,10 +145,10 @@ func TestNodeHostHistoryFencingAndUnknown(t *testing.T) {
 	}
 	now := time.Now().UTC()
 	health := deployment.NodeHealth{Host: &deployment.NodeHost{ObservedAt: &now}}
-	if err := f.heartbeat(t.Context(), node, uuid.NewString(), epoch, health, nil); !errors.Is(err, deployment.ErrNodeCredential) {
+	if err := f.heartbeat(t.Context(), node, uuid.NewString(), epoch, health, true); !errors.Is(err, deployment.ErrNodeCredential) {
 		t.Fatal(err)
 	}
-	if err := f.heartbeat(t.Context(), node, conn, epoch, health, nil); err != nil {
+	if err := f.heartbeat(t.Context(), node, conn, epoch, health, true); err != nil {
 		t.Fatal(err)
 	}
 	if n, err := f.adapter.SampleHostHistory(t.Context()); err != nil || n != 1 {
@@ -164,7 +164,7 @@ func TestNodeHostHistoryFencingAndUnknown(t *testing.T) {
 		{ObservedAt: &now, TotalMemoryBytes: hostHistoryPtr(int64(10)), AvailableMemoryBytes: hostHistoryPtr(int64(11))},
 		{ObservedAt: &now, AvailableDiskBytes: hostHistoryPtr(int64(-1))}, {ObservedAt: &now, EffectiveCPUCores: hostHistoryPtr(0.0)}, {},
 	} {
-		if err := f.heartbeat(t.Context(), node, conn, epoch, deployment.NodeHealth{Host: host}, nil); !errors.Is(err, deployment.ErrInvalidInput) {
+		if err := f.heartbeat(t.Context(), node, conn, epoch, deployment.NodeHealth{Host: host}, true); !errors.Is(err, deployment.ErrInvalidInput) {
 			t.Fatal(host, err)
 		}
 	}
diff --git a/services/core/internal/persistence/postgres/deploymentpg/nodes_test.go b/services/core/internal/persistence/postgres/deploymentpg/nodes_test.go
index a3c75e268..09df492d9 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/nodes_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/nodes_test.go
@@ -2,17 +2,13 @@ package deploymentpg_test
 
 import (
 	"crypto/sha256"
-	"database/sql"
 	"encoding/hex"
 	"errors"
-	"os"
 	"strings"
 	"testing"
 
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5/pgxpool"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
@@ -43,19 +39,15 @@ func TestEnrollmentApprovedCapacity(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
 	_, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
-	for _, capacity := range []deployment.Capacity{{MaxActive: 0, MaxRetained: 8}, {MaxActive: 3, MaxRetained: 2}, {MaxActive: 1, MaxRetained: 1000001}} {
-		if _, err := f.service.CreateEnrollment(t.Context(), capacity); !errors.Is(err, deployment.ErrInvalidInput) {
+	for _, limits := range []deployment.EnrollmentLimits{{MaxActive: new(0), MaxRetained: new(8)}, {MaxActive: new(3), MaxRetained: new(2)}, {MaxActive: new(1), MaxRetained: new(1000001)}, {MaxRetained: new(0)}} {
+		if _, err := f.service.CreateEnrollment(t.Context(), limits); !errors.Is(err, deployment.ErrInvalidInput) {
 			t.Fatal("invalid capacity accepted", err)
 		}
 	}
-	token, err := f.service.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 1, MaxRetained: 3})
+	token, err := f.service.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: new(3)})
 	if err != nil {
 		t.Fatal(err)
 	}
-	config, err := f.service.NodeConfiguration(t.Context(), "", token.Token, 0)
-	if err != nil || config.MaxActive != 1 || config.MaxRetained != 3 {
-		t.Fatal("bootstrap lost approved capacity", config, err)
-	}
 	input := nodesEnrollment(view, "approved", "a")
 	identity, err := f.service.Enroll(t.Context(), token.Token, input)
 	if err != nil || identity.MaxActive != 1 || identity.MaxRetained != 3 {
@@ -79,19 +71,53 @@ func TestEnrollmentApprovedCapacity(t *testing.T) {
 	if err != nil || identity.MaxActive != 2 || identity.MaxRetained != 5 {
 		t.Fatal("credential read ignored admin update", identity, err)
 	}
-	config, err = f.service.NodeConfiguration(t.Context(), input.NodeID, input.Credential, 0)
-	if err != nil || config.MaxActive != 2 || config.MaxRetained != 5 {
-		t.Fatal("configuration read ignored admin update", config, err)
+}
+
+// A token that leaves a limit unset takes it from the enrolling host; an explicit limit stays.
+func TestEnrollmentDerivesUnsetLimitsFromHost(t *testing.T) {
+	f := newFixture(t)
+	changes, _ := f.execution(t)
+	_, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
+	host := func(input deployment.Enrollment) deployment.Enrollment {
+		cpus, memory, disk := int64(64), int64(256<<30), int64(8<<40)
+		input.CPUCount, input.TotalMemoryBytes, input.AvailableDiskBytes = &cpus, &memory, &disk
+		return input
+	}
+	enroll := func(limits deployment.EnrollmentLimits, input deployment.Enrollment) (deployment.NodeIdentity, error) {
+		token, err := f.service.CreateEnrollment(t.Context(), limits)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return f.service.Enroll(t.Context(), token.Token, input)
+	}
+	if _, err := enroll(deployment.EnrollmentLimits{}, nodesEnrollment(view, "blind", "b")); !errors.Is(err, deployment.ErrNodeHostUnmeasured) {
+		t.Fatal("unset limits enrolled without host measurements", err)
+	}
+	recommended, err := enroll(deployment.EnrollmentLimits{}, host(nodesEnrollment(view, "derived", "d")))
+	if err != nil || recommended.MaxActive < 2 || recommended.MaxRetained < recommended.MaxActive {
+		t.Fatal("unset limits were not derived from the host", recommended, err)
+	}
+	explicit, err := enroll(deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: new(1)}, host(nodesEnrollment(view, "explicit", "e")))
+	if err != nil || explicit.MaxActive != 1 || explicit.MaxRetained != 1 {
+		t.Fatal("explicit limits changed", explicit, err)
+	}
+	// Only retained set: it binds, and active follows the host but never above it.
+	bound, err := enroll(deployment.EnrollmentLimits{MaxRetained: new(4)}, host(nodesEnrollment(view, "bound", "r")))
+	if err != nil || bound.MaxActive > 4 || bound.MaxRetained != 4 {
+		t.Fatal("an explicit retained limit was overridden", bound, err)
+	}
+	partial, err := enroll(deployment.EnrollmentLimits{MaxActive: new(1)}, host(nodesEnrollment(view, "partial", "p")))
+	if err != nil || partial.MaxActive != 1 || partial.MaxRetained < 1 {
+		t.Fatal("an unset retained limit was not derived", partial, err)
 	}
 }
 
-// Docker never suspends a sandbox, so every read reports its retained limit as its
-// active limit, including for a token or node stored before Core applied that rule.
+// Docker never suspends a sandbox, so every write stores its retained limit as its active limit.
 func TestDockerRetainedLimitFollowsActive(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
 	_, view := f.initialize(t, changes, sandbox.Selection{Provider: "docker", DeploymentSpec: testSpecification("docker")})
-	token, err := f.service.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 3, MaxRetained: 1})
+	token, err := f.service.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(3), MaxRetained: new(1)})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -99,40 +125,12 @@ func TestDockerRetainedLimitFollowsActive(t *testing.T) {
 	if identity, err := f.service.Enroll(t.Context(), token.Token, current); err != nil || identity.MaxRetained != 3 {
 		t.Fatal("enrollment kept a separate Docker retained limit", identity, err)
 	}
-	legacyToken, err := f.service.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 2, MaxRetained: 8})
-	if err != nil {
-		t.Fatal(err)
-	}
-	nodesExec(t, f.pool, "UPDATE runtime_node_enrollments SET max_retained=8 WHERE token_sha256=$1", nodesTokenDigest(legacyToken.Token))
-	if config, err := f.service.NodeConfiguration(t.Context(), "", legacyToken.Token, 0); err != nil || config.MaxRetained != 2 {
-		t.Fatal("bootstrap reported a legacy Docker retained limit", config, err)
-	}
-	legacy := nodesEnrollment(view, "Legacy", "l")
-	if _, err := f.service.Enroll(t.Context(), legacyToken.Token, legacy); err != nil {
-		t.Fatal(err)
-	}
-	var stored int32
-	if err := f.pool.QueryRow(t.Context(), "SELECT max_retained FROM runtime_nodes WHERE id=$1", legacy.NodeID).Scan(&stored); err != nil || stored != 2 {
-		t.Fatal("enrollment stored a legacy Docker retained limit", stored, err)
-	}
-	nodesExec(t, f.pool, "UPDATE runtime_nodes SET max_retained=8 WHERE id=$1", legacy.NodeID)
-	if identity, err := f.service.AuthenticateNode(t.Context(), legacy.NodeID, legacy.Credential); err != nil || identity.MaxRetained != 2 {
-		t.Fatal("node identity reported a legacy Docker retained limit", identity, err)
-	}
-	if config, err := f.service.NodeConfiguration(t.Context(), legacy.NodeID, legacy.Credential, 0); err != nil || config.MaxRetained != 2 {
-		t.Fatal("node configuration reported a legacy Docker retained limit", config, err)
-	}
 	if err := f.service.UpdateNode(t.Context(), current.NodeID, deployment.NodeUpdate{Name: "Docker", MaxActive: 5, MaxRetained: 12}); err != nil {
 		t.Fatal(err)
 	}
 	nodes, err := f.service.ListNodes(t.Context())
-	if err != nil || len(nodes) != 2 {
-		t.Fatal(nodes, err)
-	}
-	for _, n := range nodes {
-		if n.MaxRetained != n.MaxActive || (n.ID == current.NodeID && n.MaxActive != 5) {
-			t.Fatal("node list kept a separate Docker retained limit", n)
-		}
+	if err != nil || len(nodes) != 1 || nodes[0].MaxActive != 5 || nodes[0].MaxRetained != 5 {
+		t.Fatal("node list kept a separate Docker retained limit", nodes, err)
 	}
 }
 
@@ -155,7 +153,7 @@ func TestNodeCredentialPrecedesDeploymentState(t *testing.T) {
 		t.Fatal("unknown node authenticated", err)
 	}
 	_, view := f.initialize(t, changes, sandbox.Selection{Provider: "docker", DeploymentSpec: testSpecification("docker")})
-	consumed, err := f.service.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 1, MaxRetained: 1})
+	consumed, err := f.service.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: new(1)})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -163,7 +161,7 @@ func TestNodeCredentialPrecedesDeploymentState(t *testing.T) {
 	if _, err := f.service.Enroll(t.Context(), consumed.Token, node); err != nil {
 		t.Fatal(err)
 	}
-	fresh, err := f.service.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 1, MaxRetained: 1})
+	fresh, err := f.service.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: new(1)})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -225,7 +223,7 @@ func TestEnrollmentAddressMismatchKeepsToken(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
 	_, view := f.initialize(t, changes, sandbox.Selection{Provider: "docker", DeploymentSpec: testSpecification("docker")})
-	token, err := f.service.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 1, MaxRetained: 1})
+	token, err := f.service.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: new(1)})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -266,7 +264,7 @@ func TestEnrollmentReplay(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
 	_, view := f.initialize(t, changes, sandbox.Selection{Provider: "docker", DeploymentSpec: testSpecification("docker")})
-	token, err := f.service.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 1, MaxRetained: 1})
+	token, err := f.service.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: new(1)})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -281,7 +279,7 @@ func TestEnrollmentReplay(t *testing.T) {
 	if recovered, err := f.service.AuthenticateNode(t.Context(), input.NodeID, input.Credential); err != nil || recovered != identity {
 		t.Fatal("lost response cannot recover", recovered, err)
 	}
-	second, err := f.service.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 1, MaxRetained: 1})
+	second, err := f.service.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: new(1)})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -355,109 +353,3 @@ func TestNodeUpdateBounds(t *testing.T) {
 		t.Fatal("unknown node removed", err)
 	}
 }
-
-func TestNodeGenerationDowngradePreservesServingProtocol(t *testing.T) {
-	for _, mode := range []string{"v2", "old_v1", "current_v1"} {
-		t.Run(mode, func(t *testing.T) {
-			f := newFixture(t)
-			changes, _ := f.execution(t)
-			input := sandbox.Selection{Provider: "docker", DeploymentSpec: testSpecification("docker")}
-			installation, first := f.initialize(t, changes, input)
-			node := f.enroll(t, first, deployment.Capacity{MaxActive: 4, MaxRetained: 16})
-			f.connect(t, node.NodeID)
-			switch mode {
-			case "v2":
-				connection := f.connect(t, node.NodeID)
-				if err := f.service.HeartbeatGenerations(t.Context(), node.NodeID, connection, first.OwnerEpoch, deployment.NodeHealth{}, []sandbox.GenerationStatus{{Generation: first.Generation, SpecificationDigest: first.SpecificationDigest, State: "ready"}}); err != nil {
-					t.Fatal(err)
-				}
-			case "old_v1":
-				input.Resources.CPUs++
-				input.ExpectedGeneration = first.Generation
-				next, err := changes.Update(admin(t), installation, input)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if next.Generation != first.Generation+1 || next.OwnerEpoch != first.OwnerEpoch {
-					t.Fatal("target change replaced execution ownership", next)
-				}
-			}
-			db := sql.OpenDB(stdlib.GetConnector(*f.pool.Config().ConnConfig))
-			defer db.Close()
-			migration, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../../../migrations"), goose.WithTableName("agents_api_schema_version"))
-			if err != nil {
-				t.Fatal(err)
-			}
-			_, err = migration.DownTo(t.Context(), 81)
-			if mode == "current_v1" {
-				if err != nil {
-					t.Fatal("safe v1 downgrade refused", err)
-				}
-			} else {
-				if err == nil {
-					t.Fatal("downgrade discarded required node protocol")
-				}
-				// DownTo may have removed later, reversible migrations before the
-				// node protocol migration refused the downgrade. Restore the current
-				// schema before using this version of the adapter to verify recovery.
-				if _, err = migration.Up(t.Context()); err != nil {
-					t.Fatal("refused downgrade could not restore current schema", err)
-				}
-				if _, err = f.service.NodeConfiguration(t.Context(), node.NodeID, node.Credential, 1); err != nil {
-					t.Fatal("refused downgrade damaged retained recovery", err)
-				}
-				if err = f.service.RemoveNode(t.Context(), node.NodeID); err != nil {
-					t.Fatal(err)
-				}
-				if _, err = migration.DownTo(t.Context(), 81); err != nil {
-					t.Fatal("removed node blocked downgrade", err)
-				}
-			}
-			if _, err = migration.Up(t.Context()); err != nil {
-				t.Fatal("node schema could not upgrade again", err)
-			}
-		})
-	}
-}
-
-// Stored vendor codes from before the readiness classes, including an offline
-// node's last report, are rewritten to their class.
-func TestNodeReadinessClassMigrationRewritesStoredCodes(t *testing.T) {
-	f := newFixture(t)
-	changes, _ := f.execution(t)
-	_, view := f.initialize(t, changes, sandbox.Selection{Provider: "docker", DeploymentSpec: testSpecification("docker")})
-	node := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
-	connection := f.connect(t, node.NodeID)
-	failed := []sandbox.GenerationStatus{{Generation: view.Generation, SpecificationDigest: view.SpecificationDigest, State: "failed", Diagnostic: "provider_unavailable"}}
-	if err := f.service.HeartbeatGenerations(t.Context(), node.NodeID, connection, view.OwnerEpoch, deployment.NodeHealth{Diagnostic: "provider_unavailable"}, failed); err != nil {
-		t.Fatal(err)
-	}
-	db := sql.OpenDB(stdlib.GetConnector(*f.pool.Config().ConnConfig))
-	defer db.Close()
-	migration, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var version int64
-	for _, source := range migration.ListSources() {
-		if strings.HasSuffix(source.Path, "_node_readiness_classes.sql") {
-			version = source.Version
-		}
-	}
-	if _, err := migration.DownTo(t.Context(), version-1); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := f.pool.Exec(t.Context(), `UPDATE runtime_nodes SET health=jsonb_set(health,'{diagnostic}','"kvm_unavailable"') WHERE id=$1`, node.NodeID); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := f.pool.Exec(t.Context(), "UPDATE runtime_node_generation_status SET diagnostic='microsandbox_artifacts_unavailable' WHERE node_id=$1", node.NodeID); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := migration.Up(t.Context()); err != nil {
-		t.Fatal(err)
-	}
-	detail, err := f.service.NodeDetail(t.Context(), node.NodeID, "1h")
-	if err != nil || detail.Diagnostic != "host_unsupported" || detail.Rollout.State != "failed" || detail.Rollout.Diagnostic != "artifacts_unavailable" {
-		t.Fatal(detail.Diagnostic, detail.Rollout, err)
-	}
-}
diff --git a/services/core/internal/persistence/postgres/deploymentpg/placement_demand_test.go b/services/core/internal/persistence/postgres/deploymentpg/placement_demand_test.go
index 1e2f410b6..f98086397 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/placement_demand_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/placement_demand_test.go
@@ -13,7 +13,7 @@ import (
 func TestPlacementDemandAdmitsOnlyAvailableCompute(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	node := f.enroll(t, view, deployment.Capacity{MaxActive: 3, MaxRetained: 10})
 	f.connect(t, node.NodeID)
 	keys := make([]deployment.AllocationKey, 10)
@@ -64,7 +64,7 @@ func TestPlacementDemandAdmitsOnlyAvailableCompute(t *testing.T) {
 func TestPlacementDemandPagesByOriginalDemandTime(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	at := time.Now().UTC().Add(-time.Hour).Truncate(time.Microsecond)
 	for i := 0; i < 40; i++ {
 		key := pendingHostedEnvironment(t, f)
@@ -97,7 +97,7 @@ func TestPlacementDemandPagesByOriginalDemandTime(t *testing.T) {
 func TestFirstPlacementChecksActualGenerationHistorySupport(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	node := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
 	f.connect(t, node.NodeID)
 	key := pendingHostedEnvironment(t, f)
@@ -139,7 +139,7 @@ func pendingHostedEnvironment(t *testing.T, f fixture) deployment.AllocationKey
 func TestReleasedFileWakeUsesFirstDemandAndLatestOwner(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	node := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 2})
 	f.connect(t, node.NodeID)
 	key := hostedEnvironment(t, f.pool)
@@ -185,7 +185,7 @@ func TestReleasedFileWakeUsesFirstDemandAndLatestOwner(t *testing.T) {
 func TestPlacementDemandWrapsDespiteContinuousNewArrivals(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	add := func(n int) {
 		for range n {
 			pendingHostedEnvironment(t, f)
diff --git a/services/core/internal/persistence/postgres/deploymentpg/presence_test.go b/services/core/internal/persistence/postgres/deploymentpg/presence_test.go
index 83957fb31..adba97ccd 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/presence_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/presence_test.go
@@ -246,7 +246,7 @@ func TestNodeStaleEpochCannotReplaceCurrentConnection(t *testing.T) {
 	if err := f.service.DisconnectNode(t.Context(), node.NodeID, connection, epoch); err != nil {
 		t.Fatal(err)
 	}
-	if err := f.heartbeat(t.Context(), node.NodeID, connection, epoch, deployment.NodeHealth{ProviderReady: false}, nil); !errors.Is(err, deployment.ErrNodeCredential) {
+	if err := f.heartbeat(t.Context(), node.NodeID, connection, epoch, deployment.NodeHealth{}, false); !errors.Is(err, deployment.ErrNodeCredential) {
 		t.Fatal("old Core rewrote health", err)
 	}
 	nodes, err := f.service.ListNodes(t.Context())
@@ -255,46 +255,6 @@ func TestNodeStaleEpochCannotReplaceCurrentConnection(t *testing.T) {
 	}
 }
 
-func TestNodeDiagnosticReachesListAndDetail(t *testing.T) {
-	f := newFixture(t)
-	changes, _ := f.execution(t)
-	_, view := f.initialize(t, changes, sandbox.Selection{Provider: "docker", DeploymentSpec: testSpecification("docker")})
-	node := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
-	connection := f.connect(t, node.NodeID)
-	epoch, err := f.adapter.OwnerEpoch(t.Context())
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, tc := range []struct {
-		reported, want string
-		ready          bool
-	}{
-		{reported: "host_unsupported", want: "host_unsupported"},
-		{reported: "capacity_insufficient", want: "capacity_insufficient"},
-		// Older nodes send provider_unavailable or nothing; unknown text is never stored.
-		{reported: "provider_unavailable", want: "provider_unavailable"},
-		{reported: "", want: ""},
-		{reported: "dial unix /var/run/docker.sock: permission denied", want: "provider_unavailable"},
-		{reported: "artifacts_unavailable", want: "", ready: true},
-	} {
-		if err := f.heartbeat(t.Context(), node.NodeID, connection, epoch, deployment.NodeHealth{ProviderReady: tc.ready, Diagnostic: sandbox.NodeDiagnosticCode(tc.reported)}, nil); err != nil {
-			t.Fatal(tc.reported, err)
-		}
-		list, err := f.service.ListNodes(t.Context())
-		if err != nil || len(list) != 1 || string(list[0].Diagnostic) != tc.want {
-			t.Fatal(tc.reported, list, err)
-		}
-		detail, err := f.service.NodeDetail(t.Context(), node.NodeID, "1h")
-		if err != nil || string(detail.Diagnostic) != tc.want {
-			t.Fatal(tc.reported, detail.Diagnostic, err)
-		}
-		var stored string
-		if err := f.pool.QueryRow(t.Context(), "SELECT health::text FROM runtime_nodes WHERE id=$1", node.NodeID).Scan(&stored); err != nil || strings.Contains(stored, "/var/run") {
-			t.Fatal("raw diagnostic stored", stored, err)
-		}
-	}
-}
-
 func TestNodeStatusUsesAuthenticatedFreshPresence(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
@@ -321,11 +281,11 @@ func TestNodeStatusUsesAuthenticatedFreshPresence(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := f.heartbeat(t.Context(), node.NodeID, connection, epoch, deployment.NodeHealth{ProviderReady: false}, nil); err != nil {
+	if err := f.heartbeat(t.Context(), node.NodeID, connection, epoch, deployment.NodeHealth{}, false); err != nil {
 		t.Fatal(err)
 	}
 	status(true, false)
-	if err := f.heartbeat(t.Context(), node.NodeID, connection, epoch, deployment.NodeHealth{ProviderReady: true}, nil); err != nil {
+	if err := f.heartbeat(t.Context(), node.NodeID, connection, epoch, deployment.NodeHealth{}, true); err != nil {
 		t.Fatal(err)
 	}
 	status(true, true)
diff --git a/services/core/internal/persistence/postgres/deploymentpg/records.go b/services/core/internal/persistence/postgres/deploymentpg/records.go
index 9124c05b9..c8f8815ce 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/records.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/records.go
@@ -58,7 +58,7 @@ func translate(err error) error {
 // view never needs it. A credential the key cannot open or authenticate is an
 // internal decryption error.
 func record(d sqlc.RuntimeDeployment, cipher *credentialcrypto.Cipher, open bool) deployment.Record {
-	r := deployment.Record{IdleSeconds: d.IdleSeconds, InstallationID: uuidString(d.InstallationID), Provider: d.ProviderKind, BackendFingerprint: d.BackendFingerprint,
+	r := deployment.Record{ComputeProfiles: d.ComputeProfiles, IdleSeconds: d.IdleSeconds, InstallationID: uuidString(d.InstallationID), Provider: d.ProviderKind, BackendFingerprint: d.BackendFingerprint,
 		Generation: uint64(d.Generation), OwnerEpoch: uint64(d.OwnerEpoch), Mode: d.Mode, Specification: d.Specification,
 		Configuration: sandbox.ConfigurationRecord{Public: d.ProviderConfig, Metadata: d.ProviderMetadata}, CredentialStored: len(d.ProviderCredential) > 0}
 	if r.CredentialStored && open {
@@ -111,8 +111,8 @@ func nodeRecords(rows []sqlc.ListRuntimeNodesRow) ([]deployment.NodeRecord, erro
 		}
 		health.NodeHealth.Host = health.Host
 		record := deployment.NodeRecord{ID: uuidString(n.ID), Name: n.Name, Provider: n.ProviderKind, CoreURL: n.CoreUrl, CreatedAt: n.CreatedAt.Time, LastSeenAt: timestamp(n.LastSeenAt),
-			Health: health.NodeHealth, Online: n.Online, ServingReady: n.ServingReady, ProtocolVersion: int(n.ProtocolVersion), DeploymentGeneration: uint64(n.DeploymentGeneration),
-			TargetGeneration: uint64(n.TargetGeneration), TargetState: n.TargetState, TargetDiagnostic: n.TargetDiagnostic, MaxActive: int(n.MaxActive), MaxRetained: int(n.MaxRetained),
+			Health: health.NodeHealth, Online: n.Online, ServingReady: n.ServingReady,
+			TargetState: n.TargetState, TargetDiagnostic: n.TargetDiagnostic, MaxActive: int(n.MaxActive), MaxRetained: int(n.MaxRetained),
 			Active: n.Active, Retained: n.Retained, Reserved: n.Reserved, CleanupPending: n.CleanupPending, Running: n.Running, Snapshots: n.Snapshots}
 		if n.EnrollmentID.Valid {
 			id := uuidString(n.EnrollmentID)
diff --git a/services/core/internal/persistence/postgres/deploymentpg/replacement_test.go b/services/core/internal/persistence/postgres/deploymentpg/replacement_test.go
index 8b3a3d984..dc240edea 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/replacement_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/replacement_test.go
@@ -7,9 +7,7 @@ import (
 	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment/placement"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/workspacefs"
 	"github.com/google/uuid"
 )
 
@@ -48,7 +46,7 @@ func releaseRetainedFixture(t *testing.T, f fixture, changes *deployment.Executi
 func TestReplacementKeepsSessionIdentityAndFencesPriorOwner(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	firstNode := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
 	f.connect(t, firstNode.NodeID)
 	secondNode := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
@@ -144,7 +142,7 @@ func TestReplacementKeepsSessionIdentityAndFencesPriorOwner(t *testing.T) {
 func TestReplacementRefusesUnsettledOwnershipAndUnknownHistory(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	node := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
 	f.connect(t, node.NodeID)
 	key := hostedEnvironment(t, f.pool)
@@ -185,7 +183,7 @@ func TestReplacementRefusesUnsettledOwnershipAndUnknownHistory(t *testing.T) {
 func TestTenRetainedWorkspacesShareThreeComputeSlots(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	node := f.enroll(t, view, deployment.Capacity{MaxActive: 3, MaxRetained: 3})
 	f.connect(t, node.NodeID)
 	keys := make([]deployment.AllocationKey, 10)
@@ -255,7 +253,7 @@ func TestTenRetainedWorkspacesShareThreeComputeSlots(t *testing.T) {
 func TestResetArchivesRetainedSessionBeforeClearingDeployment(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	node := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
 	f.connect(t, node.NodeID)
 	retained := make([]deployment.Allocation, 37)
@@ -345,7 +343,7 @@ func TestResetArchivesRetainedSessionBeforeClearingDeployment(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	next, err := changes.Initialize(admin(t), installation, sandbox.Selection{Provider: "microsandbox", ExpectedGeneration: committed, DeploymentSpec: retainedSpecification()})
+	next, err := changes.Initialize(admin(t), installation, sandbox.Selection{Provider: "microsandbox", ExpectedGeneration: committed, DeploymentSpec: testSpecification("microsandbox")})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -359,53 +357,3 @@ func TestResetArchivesRetainedSessionBeforeClearingDeployment(t *testing.T) {
 		t.Fatal("archive lost files or kept Session executable", status, fsState, err)
 	}
 }
-
-func retainedSpecification() sandbox.DeploymentSpec {
-	spec := testSpecification("microsandbox")
-	spec.Resources.RootDiskMiB = 8192
-	spec.Resources.EnvironmentDiskMiB = 0
-	spec.Workspace = &workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}
-	return spec
-}
-
-func TestReplacementWaitsForCompatibleReadyGenerationWithoutReservingOwnedNode(t *testing.T) {
-	f := newFixture(t)
-	changes, _ := f.execution(t)
-	installation, owned := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
-	oldNode := f.enroll(t, owned, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
-	f.connect(t, oldNode.NodeID)
-	external, err := changes.Update(admin(t), installation, sandbox.Selection{Provider: "microsandbox", ExpectedGeneration: owned.Generation, DeploymentSpec: retainedSpecification()})
-	if err != nil {
-		t.Fatal(err)
-	}
-	newNode := f.enroll(t, external, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
-	f.connect(t, newNode.NodeID)
-	key := hostedEnvironment(t, f.pool)
-	if _, err = f.pool.Exec(t.Context(), `INSERT INTO runtime_placements(environment_id,node_id,deployment_generation) VALUES($1,$2,$3)`, key.EnvironmentID, newNode.NodeID, external.Generation); err != nil {
-		t.Fatal(err)
-	}
-	owner, err := changes.ReserveAllocation(t.Context(), key, installation, credentialHash())
-	if err != nil {
-		t.Fatal(err)
-	}
-	releaseRetainedFixture(t, f, changes, owner)
-	if _, err = f.pool.Exec(t.Context(), `UPDATE runtime_nodes SET connection_id=NULL WHERE id=$1`, newNode.NodeID); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = changes.EnsurePlacement(t.Context(), key, installation); !errors.Is(err, placement.ErrNodeUnavailable) {
-		t.Fatal("owned generation admitted retained FS", err)
-	}
-	var released bool
-	if err = f.pool.QueryRow(t.Context(), `SELECT released_at IS NOT NULL FROM runtime_placements WHERE environment_id=$1`, key.EnvironmentID).Scan(&released); err != nil || !released {
-		t.Fatal("incompatible placement consumed capacity", released, err)
-	}
-	f.connect(t, newNode.NodeID)
-	reserved, err := changes.EnsurePlacement(t.Context(), key, installation)
-	if err != nil || reserved.NodeID != newNode.NodeID {
-		t.Fatal("compatible capacity did not recover demand", reserved, err)
-	}
-	fresh, err := changes.ReserveAllocation(t.Context(), key, installation, credentialHash())
-	if err != nil || fresh.ID == owner.ID || fresh.NodeID != newNode.NodeID {
-		t.Fatal(fresh, err)
-	}
-}
diff --git a/services/core/internal/persistence/postgres/deploymentpg/reset_test.go b/services/core/internal/persistence/postgres/deploymentpg/reset_test.go
index 5e242387a..fde3c15a0 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/reset_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/reset_test.go
@@ -54,7 +54,7 @@ func TestResetStartEscalateAndComplete(t *testing.T) {
 	changes, _ := f.execution(t)
 	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "docker", DeploymentSpec: testSpecification("docker")})
 	f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
-	if _, err := f.service.CreateEnrollment(admin(t), deployment.Capacity{MaxActive: 1, MaxRetained: 1}); err != nil {
+	if _, err := f.service.CreateEnrollment(admin(t), deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: new(1)}); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/services/core/internal/persistence/postgres/deploymentpg/retention_pressure_test.go b/services/core/internal/persistence/postgres/deploymentpg/retention_pressure_test.go
index 4ae9b02a5..33ab1b24c 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/retention_pressure_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/retention_pressure_test.go
@@ -35,51 +35,45 @@ func qualifyPressureRetention(t *testing.T, f fixture, owner deployment.Allocati
 	return current
 }
 
-func TestRetentionPressureKeepsHistoryUntilOrdinaryCleanupSettles(t *testing.T) {
+func TestRetentionPressureReleasesOldestRetainableCheckpoint(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	node := f.enroll(t, view, deployment.Capacity{MaxActive: 3, MaxRetained: 3})
 	f.connect(t, node.NodeID)
-	owner := qualifyPressureRetention(t, f, runningPressureOwner(t, f, changes, installation, node.NodeID, view.Generation))
-	for range 2 {
-		qualifyPressureRetention(t, f, runningPressureOwner(t, f, changes, installation, node.NodeID, view.Generation))
+	var owners []deployment.Allocation
+	for range 3 {
+		owners = append(owners, qualifyPressureRetention(t, f, runningPressureOwner(t, f, changes, installation, node.NodeID, view.Generation)))
 	}
 	waiting := pendingPressureDemand(t, f)
-	for range 6 {
-		pendingPressureDemand(t, f)
-	}
 	if _, err := changes.EnsurePlacement(t.Context(), waiting, installation); !errors.Is(err, placement.ErrNodeUnavailable) {
 		t.Fatal("reserved despite retained capacity limit")
 	}
-	current, err := f.adapter.EnvironmentAllocation(t.Context(), owner.Key())
-	if err != nil || current.Expired || !current.ComputeRetainedUntil.Equal(*owner.ComputeRetainedUntil) {
-		t.Fatal("pressure shortened retention", current, err)
+	// Only the oldest checkpoint is released, and only once per blocked demand.
+	if err := changes.ExpireCheckpointForDemand(t.Context(), owners[1]); !errors.Is(err, deployment.ErrNotIdle) {
+		t.Fatal("released a checkpoint that is not the oldest", err)
 	}
-	// Advance the fixture clock past the authored deadline, not because of demand.
-	if _, err := f.pool.Exec(t.Context(), `UPDATE runtime_allocations SET compute_retained_until=clock_timestamp()-interval '1 second' WHERE id=$1`, owner.ID); err != nil {
+	if err := changes.ExpireCheckpointForDemand(t.Context(), owners[0]); err != nil {
 		t.Fatal(err)
 	}
-	// The database deadline is only an intent. It is not a cleanup receipt.
-	nodes, err := f.adapter.Nodes(t.Context())
-	if err != nil || nodes[0].Retained != 3 || nodes[0].Active != 0 {
-		t.Fatal("released capacity before cleanup", nodes, err)
-	}
-	if _, err = changes.EnsurePlacement(t.Context(), waiting, installation); !errors.Is(err, placement.ErrNodeUnavailable) {
-		t.Fatal("reserved before cleanup")
+	if err := changes.ExpireCheckpointForDemand(t.Context(), owners[1]); !errors.Is(err, deployment.ErrNotIdle) {
+		t.Fatal("released a second checkpoint for one demand", err)
 	}
-	current, err = f.adapter.EnvironmentAllocation(t.Context(), owner.Key())
+	current, err := f.adapter.EnvironmentAllocation(t.Context(), owners[0].Key())
 	if err != nil || !current.Expired {
-		t.Fatal("database expiry", current, err)
+		t.Fatal("checkpoint not expired", current, err)
 	}
 	pending, err := changes.RequestCleanup(t.Context(), current)
 	if err != nil {
 		t.Fatal(err)
 	}
 	var status, filesystem string
-	if err = f.pool.QueryRow(t.Context(), `SELECT e.status,w.state FROM environments e JOIN environment_workspaces w ON w.environment_id=e.id WHERE e.id=$1`, owner.EnvironmentID).Scan(&status, &filesystem); err != nil || status == "expired" || status == "failed" || filesystem != "ready" {
+	if err = f.pool.QueryRow(t.Context(), `SELECT e.status,w.state FROM environments e JOIN environment_workspaces w ON w.environment_id=e.id WHERE e.id=$1`, owners[0].EnvironmentID).Scan(&status, &filesystem); err != nil || status == "expired" || status == "failed" || filesystem != "ready" {
 		t.Fatal("lost retained environment", status, filesystem, err)
 	}
+	if _, err = changes.EnsurePlacement(t.Context(), waiting, installation); !errors.Is(err, placement.ErrNodeUnavailable) {
+		t.Fatal("reserved before cleanup")
+	}
 	// This fixture supplies the native cleanup completion that a real lifecycle
 	// must obtain before invoking ReleaseAllocation.
 	if _, err = changes.ReleaseAllocation(t.Context(), pending); err != nil {
@@ -90,23 +84,78 @@ func TestRetentionPressureKeepsHistoryUntilOrdinaryCleanupSettles(t *testing.T)
 	}
 }
 
-func TestPressurePreservesRetainableOwnerWhenRetainedSlotsAreFull(t *testing.T) {
-	f := newFixture(t)
-	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
-	node := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
-	f.connect(t, node.NodeID)
-	owner := qualifyPressureRetention(t, f, runningPressureOwner(t, f, changes, installation, node.NodeID, view.Generation))
-	if _, err := f.pool.Exec(t.Context(), `UPDATE runtime_allocations SET compute_phase='running',compute_retained_until=NULL WHERE id=$1`, owner.ID); err != nil {
-		t.Fatal(err)
-	}
-	owner, err := f.adapter.EnvironmentAllocation(t.Context(), owner.Key())
-	if err != nil {
-		t.Fatal(err)
+func TestRetentionPressureKeepsIneligibleCheckpoints(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		demand bool
+		damage string
+	}{
+		{"no demand", false, ""},
+		{"wake requested", true, `UPDATE runtime_allocations SET compute_wake_requested=true WHERE id=$1`},
+		{"owned workspace storage", true, `DELETE FROM environment_workspaces WHERE environment_id=(SELECT environment_id FROM runtime_allocations WHERE id=$1)`},
+		{"no retained native history", true, `UPDATE devices SET supported_agent_kinds='[]' WHERE id=(SELECT device_id FROM runtime_allocations WHERE id=$1)`},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			f := newFixture(t)
+			changes, _ := f.execution(t)
+			installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
+			node := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
+			f.connect(t, node.NodeID)
+			owner := qualifyPressureRetention(t, f, runningPressureOwner(t, f, changes, installation, node.NodeID, view.Generation))
+			if test.damage != "" {
+				if _, err := f.pool.Exec(t.Context(), test.damage, owner.ID); err != nil {
+					t.Fatal(err)
+				}
+			}
+			if test.demand {
+				pendingPressureDemand(t, f)
+			}
+			if err := changes.ExpireCheckpointForDemand(t.Context(), owner); !errors.Is(err, deployment.ErrNotIdle) {
+				t.Fatal("released early", err)
+			}
+			current, err := f.adapter.EnvironmentAllocation(t.Context(), owner.Key())
+			if err != nil || current.Expired || !current.ComputeRetainedUntil.Equal(*owner.ComputeRetainedUntil) {
+				t.Fatal("retention shortened", current, err)
+			}
+		})
 	}
-	pendingPressureDemand(t, f)
-	until := time.Now().Add(24 * time.Hour)
-	if _, err = changes.SetCompute(t.Context(), owner, "quiescing", json.RawMessage(`{}`), &until); !errors.Is(err, deployment.ErrNotIdle) {
-		t.Fatal("suspended without usable capacity", err)
+}
+
+// A full node suspends only an owner whose checkpoint can then be released.
+func TestPressureSuspendsReleasableOwnerWhenRetainedSlotsAreFull(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		damage  string
+		suspend bool
+	}{
+		{"releasable", "", true},
+		{"no retained native history", `UPDATE devices SET supported_agent_kinds='[]' WHERE id=(SELECT device_id FROM runtime_allocations WHERE id=$1)`, false},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			f := newFixture(t)
+			changes, _ := f.execution(t)
+			installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
+			node := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 1})
+			f.connect(t, node.NodeID)
+			owner := qualifyPressureRetention(t, f, runningPressureOwner(t, f, changes, installation, node.NodeID, view.Generation))
+			if _, err := f.pool.Exec(t.Context(), `UPDATE runtime_allocations SET compute_phase='running',compute_retained_until=NULL WHERE id=$1`, owner.ID); err != nil {
+				t.Fatal(err)
+			}
+			if test.damage != "" {
+				if _, err := f.pool.Exec(t.Context(), test.damage, owner.ID); err != nil {
+					t.Fatal(err)
+				}
+			}
+			owner, err := f.adapter.EnvironmentAllocation(t.Context(), owner.Key())
+			if err != nil {
+				t.Fatal(err)
+			}
+			pendingPressureDemand(t, f)
+			until := time.Now().Add(24 * time.Hour)
+			_, err = changes.SetCompute(t.Context(), owner, "quiescing", json.RawMessage(`{}`), &until)
+			if test.suspend != (err == nil) || (err != nil && !errors.Is(err, deployment.ErrNotIdle)) {
+				t.Fatal("unexpected suspension decision", err)
+			}
+		})
 	}
 }
diff --git a/services/core/internal/persistence/postgres/deploymentpg/setup_test.go b/services/core/internal/persistence/postgres/deploymentpg/setup_test.go
index 972395dd1..aa0ac7d53 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/setup_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/setup_test.go
@@ -6,7 +6,7 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"sync"
 	"testing"
 
@@ -57,7 +57,7 @@ func setupClosedExecution(t *testing.T, f fixture) *deployment.ExecutionOperatio
 		t.Fatal(err)
 	}
 	awaitRelease()
-	operations, err := deployment.NewExecutionOperations(f.service, deploymentpg.NewExecution(lease, f.cipher), engine.Catalog{})
+	operations, err := deployment.NewExecutionOperations(f.service, deploymentpg.NewExecution(lease, f.cipher), builtin.Registry())
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/internal/persistence/postgres/deploymentpg/specification_test.go b/services/core/internal/persistence/postgres/deploymentpg/specification_test.go
index 30531a86d..101753e7e 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/specification_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/specification_test.go
@@ -76,7 +76,7 @@ func TestEnrollmentRecordsItsIDAndRefusesAnotherAddress(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
 	_, view := f.initialize(t, changes, sandbox.Selection{Provider: "docker", DeploymentSpec: testSpecification("docker")})
-	issued, err := f.service.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 2, MaxRetained: 2})
+	issued, err := f.service.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(2), MaxRetained: new(2)})
 	if err != nil || uuid.Validate(issued.ID) != nil || issued.Token == "" {
 		t.Fatal(issued.ID, err)
 	}
@@ -90,7 +90,7 @@ func TestEnrollmentRecordsItsIDAndRefusesAnotherAddress(t *testing.T) {
 		t.Fatal("the refused enrollment consumed its token", err)
 	}
 	earlier := strings.Repeat("e", 64)
-	if _, err := f.pool.Exec(t.Context(), "INSERT INTO runtime_node_enrollments(token_sha256,installation_id,expires_at) VALUES($1,$2,clock_timestamp()+interval '10 minutes')",
+	if _, err := f.pool.Exec(t.Context(), "INSERT INTO runtime_node_enrollments(token_sha256,installation_id,expires_at,max_active,max_retained) VALUES($1,$2,clock_timestamp()+interval '10 minutes',2,2)",
 		setupDigest(earlier), view.InstallationID); err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/internal/persistence/postgres/deploymentpg/store.go b/services/core/internal/persistence/postgres/deploymentpg/store.go
index e4aee9e74..d7e662635 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/store.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/store.go
@@ -15,6 +15,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/db/sqlc"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/pgunit"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/placementpg"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
@@ -81,19 +82,38 @@ func (s *Store) ReadNodes(ctx context.Context, apply func(deployment.NodeReads)
 func (s *Store) Deployment(ctx context.Context) (deployment.Record, error) {
 	ctx, cancel := context.WithTimeout(ctx, pgunit.ExecutionTimeout)
 	defer cancel()
-	d, err := s.pool.Queries().GetRuntimeDeployment(ctx)
-	if err != nil {
-		return deployment.Record{}, err
-	}
-	return record(d, s.cipher, true), nil
+	var result deployment.Record
+	err := s.pool.Snapshot(ctx, func(ctx context.Context, tx pgx.Tx) error {
+		q := sqlc.New(tx)
+		d, err := q.GetRuntimeDeployment(ctx)
+		if err != nil {
+			return err
+		}
+		d.ComputeProfiles, err = placementpg.ExpandComputeProfiles(ctx, q, d.ComputeProfiles)
+		if err != nil {
+			return err
+		}
+		result = record(d, s.cipher, true)
+		return nil
+	})
+	return result, err
 }
-
 func (s *Store) Snapshot(ctx context.Context) (deployment.Snapshot, error) {
-	row, err := s.pool.Queries().GetSandboxDeploymentSnapshot(ctx)
-	if err != nil {
-		return deployment.Snapshot{}, err
-	}
-	return snapshot(row)
+	var result deployment.Snapshot
+	err := s.pool.Snapshot(ctx, func(ctx context.Context, tx pgx.Tx) error {
+		q := sqlc.New(tx)
+		row, err := q.GetSandboxDeploymentSnapshot(ctx)
+		if err != nil {
+			return err
+		}
+		row.RuntimeDeployment.ComputeProfiles, err = placementpg.ExpandComputeProfiles(ctx, q, row.RuntimeDeployment.ComputeProfiles)
+		if err != nil {
+			return err
+		}
+		result, err = snapshot(row)
+		return err
+	})
+	return result, err
 }
 
 func (s *Store) OwnerEpoch(ctx context.Context) (uint64, error) {
@@ -128,6 +148,10 @@ func (s *Store) Allocation(ctx context.Context, ref sandbox.Reference) (deployme
 		if err != nil {
 			return err
 		}
+		d.ComputeProfiles, err = placementpg.ExpandComputeProfiles(ctx, q, d.ComputeProfiles)
+		if err != nil {
+			return err
+		}
 		result = deployment.AllocationRecord{ID: uuidString(a.ID), Released: a.State == "released", InstallationID: uuidString(a.ProviderKey), Deployment: record(d, s.cipher, true)}
 		if !a.DeploymentGeneration.Valid {
 			return nil
diff --git a/services/core/internal/persistence/postgres/deploymentpg/suspension_pressure.go b/services/core/internal/persistence/postgres/deploymentpg/suspension_pressure.go
index aa1d7f0fd..c47d30825 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/suspension_pressure.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/suspension_pressure.go
@@ -31,6 +31,13 @@ func (t *allocationTx) LoadSuspensionDemand(current deployment.Allocation) (depl
 	for _, node := range inFlight {
 		result.InFlightNodes = append(result.InFlightNodes, uuidString(node))
 	}
+	starting, err := t.q.ListRuntimeStartingNodes(t.ctx)
+	if err != nil {
+		return result, err
+	}
+	for _, node := range starting {
+		result.StartingNodes = append(result.StartingNodes, uuidString(node))
+	}
 	result.Nodes, err = placementpg.LoadNodes(t.ctx, t.q)
 	if err != nil {
 		return result, err
@@ -61,6 +68,34 @@ func (t *allocationTx) LoadSuspensionDemand(current deployment.Allocation) (depl
 	return result, nil
 }
 
+func (t *allocationTx) OldestIdleCheckpoint(current deployment.Allocation) (bool, error) {
+	node, err := parseID(current.NodeID)
+	if err != nil {
+		return false, err
+	}
+	ids, err := t.q.ListIdleRuntimeCheckpoints(t.ctx, node)
+	if err != nil {
+		return false, err
+	}
+	for _, id := range ids {
+		if uuidString(id) == current.ID {
+			return true, nil
+		}
+		// An older peer that can be retained is released first. Its own Session
+		// lock rechecks this when it is chosen.
+		if retained, err := t.q.CanRetainRuntimeEnvironment(t.ctx, id); err != nil || retained {
+			return false, err
+		}
+	}
+	return false, nil
+}
+
+func (t *allocationTx) ExpireCheckpoint(current deployment.Allocation) (deployment.Allocation, error) {
+	return t.change(current, func(ctx context.Context, id pgtype.UUID) (sqlc.RuntimeAllocation, error) {
+		return t.q.ExpireRuntimeCheckpoint(ctx, sqlc.ExpireRuntimeCheckpointParams{ID: id, ComputeRevision: current.ComputeRevision})
+	})
+}
+
 func (t *allocationTx) PlacementDemand(after deployment.PlacementDemandCursor) ([]deployment.PlacementDemand, deployment.PlacementDemandCursor, error) {
 	rows, next, err := loadPlacementDemand(t.ctx, t.q, after)
 	if err != nil {
diff --git a/services/core/internal/persistence/postgres/deploymentpg/suspension_pressure_test.go b/services/core/internal/persistence/postgres/deploymentpg/suspension_pressure_test.go
index 2bf766c12..6249b5217 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/suspension_pressure_test.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/suspension_pressure_test.go
@@ -12,7 +12,11 @@ import (
 	"github.com/google/uuid"
 )
 
-func runningPressureOwner(t *testing.T, f fixture, changes *deployment.ExecutionOperations, installation, node string, generation uint64) deployment.Allocation {
+func runningPressureOwner(t *testing.T, f fixture, changes *deployment.ExecutionOperations, installation, node string, generation uint64, idle ...string) deployment.Allocation {
+	idleFor := "1 minute"
+	if len(idle) > 0 {
+		idleFor = idle[0]
+	}
 	t.Helper()
 	key := hostedEnvironment(t, f.pool)
 	if _, err := f.pool.Exec(t.Context(), `INSERT INTO runtime_placements(environment_id,node_id,deployment_generation) VALUES($1,$2,$3)`, key.EnvironmentID, node, generation); err != nil {
@@ -25,7 +29,7 @@ func runningPressureOwner(t *testing.T, f fixture, changes *deployment.Execution
 	if _, err = f.pool.Exec(t.Context(), `UPDATE environments SET initialization='complete' WHERE id=$1`, key.EnvironmentID); err != nil {
 		t.Fatal(err)
 	}
-	if _, err = f.pool.Exec(t.Context(), `UPDATE runtime_allocations SET state='running',create_settled=true,compute_phase='running',compute_activity_at=clock_timestamp()-interval '1 minute',compute_phase_changed_at=clock_timestamp()-interval '1 minute' WHERE id=$1`, owner.ID); err != nil {
+	if _, err = f.pool.Exec(t.Context(), `UPDATE runtime_allocations SET state='running',create_settled=true,compute_phase='running',compute_activity_at=clock_timestamp()-$2::interval,compute_phase_changed_at=clock_timestamp()-$2::interval WHERE id=$1`, owner.ID, idleFor); err != nil {
 		t.Fatal(err)
 	}
 	owner, err = f.adapter.EnvironmentAllocation(t.Context(), key)
@@ -39,21 +43,26 @@ func TestPressureSuspensionRequiresUsefulCapacity(t *testing.T) {
 	for _, test := range []struct {
 		name             string
 		retained         int
+		idle             string
+		maxActive        int
 		demand, freeNode bool
 		want             error
 	}{
-		{"no demand", 3, false, false, deployment.ErrNotIdle},
-		{"retained full", 1, true, false, deployment.ErrNotIdle},
-		{"other node free", 3, true, true, deployment.ErrNotIdle},
-		{"waiting first session", 3, true, false, nil},
+		{"no demand", 3, "1 minute", 1, false, false, deployment.ErrNotIdle},
+		{"retained full", 1, "1 minute", 1, true, false, deployment.ErrNotIdle},
+		{"other node free", 3, "1 minute", 1, true, true, deployment.ErrNotIdle},
+		{"waiting first session", 3, "1 minute", 1, true, false, nil},
+		{"full node idle past two minutes", 3, "3 minutes", 1, false, false, nil},
+		{"node with a free slot", 3, "3 minutes", 2, false, false, deployment.ErrNotIdle},
+		{"retained full idle past two minutes", 1, "3 minutes", 1, false, false, deployment.ErrNotIdle},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			f := newFixture(t)
 			changes, _ := f.execution(t)
 			installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
-			node := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: test.retained})
+			node := f.enroll(t, view, deployment.Capacity{MaxActive: test.maxActive, MaxRetained: test.retained})
 			f.connect(t, node.NodeID)
-			owner := runningPressureOwner(t, f, changes, installation, node.NodeID, view.Generation)
+			owner := runningPressureOwner(t, f, changes, installation, node.NodeID, view.Generation, test.idle)
 			if test.demand {
 				pendingPressureDemand(t, f)
 			}
@@ -79,6 +88,39 @@ func TestPressureSuspensionRequiresUsefulCapacity(t *testing.T) {
 	}
 }
 
+func TestFreeSlotWaitsForStartingSession(t *testing.T) {
+	for _, created := range []bool{false, true} {
+		t.Run(map[bool]string{false: "waiting for its sandbox", true: "initializing"}[created], func(t *testing.T) {
+			f := newFixture(t)
+			changes, _ := f.execution(t)
+			installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
+			node := f.enroll(t, view, deployment.Capacity{MaxActive: 2, MaxRetained: 3})
+			f.connect(t, node.NodeID)
+			owner := runningPressureOwner(t, f, changes, installation, node.NodeID, view.Generation, "3 minutes")
+			placed := hostedEnvironment(t, f.pool)
+			if _, err := f.pool.Exec(t.Context(), `INSERT INTO runtime_placements(environment_id,node_id,deployment_generation) VALUES($1,$2,$3)`, placed.EnvironmentID, node.NodeID, view.Generation); err != nil {
+				t.Fatal(err)
+			}
+			if created {
+				starting, err := changes.ReserveAllocation(t.Context(), placed, installation, credentialHash())
+				if err != nil {
+					t.Fatal(err)
+				}
+				if _, err = f.pool.Exec(t.Context(), `UPDATE runtime_allocations SET state='running',create_settled=true WHERE id=$1`, starting.ID); err != nil {
+					t.Fatal(err)
+				}
+				if _, err = f.pool.Exec(t.Context(), `UPDATE environments SET initialization='running' WHERE id=$1`, placed.EnvironmentID); err != nil {
+					t.Fatal(err)
+				}
+			}
+			until := time.Now().Add(time.Hour)
+			if _, err := changes.SetCompute(t.Context(), owner, "quiescing", json.RawMessage(`{}`), &until); !errors.Is(err, deployment.ErrNotIdle) {
+				t.Fatalf("quiesce: %v, want %v", err, deployment.ErrNotIdle)
+			}
+		})
+	}
+}
+
 func TestPressureSuspensionSerializesAcrossNodes(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
@@ -155,7 +197,7 @@ func TestPressureSuspensionServesRestoreOnItsOriginalNode(t *testing.T) {
 func TestPressureDemandScansPastIncompatiblePage(t *testing.T) {
 	f := newFixture(t)
 	changes, _ := f.execution(t)
-	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+	installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 	capacity := deployment.Capacity{MaxActive: 1, MaxRetained: 2}
 	node := f.enroll(t, view, capacity)
 	f.connect(t, node.NodeID)
@@ -182,7 +224,7 @@ func TestPressureDemandRejectsUnqualifiedRetainedReceipt(t *testing.T) {
 		t.Run(badReceipt, func(t *testing.T) {
 			f := newFixture(t)
 			changes, _ := f.execution(t)
-			installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: retainedSpecification()})
+			installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 			node := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 2})
 			f.connect(t, node.NodeID)
 			count := 1
@@ -219,15 +261,11 @@ func TestPressureDemandRejectsUnqualifiedRetainedReceipt(t *testing.T) {
 }
 
 func TestPressureReclamationIgnoresUnavailableNodeReceipts(t *testing.T) {
-	for _, obstruction := range []string{"offline expired", "offline quiescing", "offline suspending", "different address", "incompatible generation"} {
+	for _, obstruction := range []string{"offline expired", "offline quiescing", "offline suspending", "different address"} {
 		t.Run(obstruction, func(t *testing.T) {
 			f := newFixture(t)
 			changes, _ := f.execution(t)
-			spec := retainedSpecification()
-			if obstruction == "incompatible generation" {
-				spec = testSpecification("microsandbox")
-			}
-			installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: spec})
+			installation, view := f.initialize(t, changes, sandbox.Selection{Provider: "microsandbox", DeploymentSpec: testSpecification("microsandbox")})
 			badNode := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 2})
 			f.connect(t, badNode.NodeID)
 			stuck := runningPressureOwner(t, f, changes, installation, badNode.NodeID, view.Generation)
@@ -252,22 +290,10 @@ func TestPressureReclamationIgnoresUnavailableNodeReceipts(t *testing.T) {
 				if _, err := f.pool.Exec(t.Context(), `UPDATE runtime_nodes SET core_url='https://other.example' WHERE id=$1`, badNode.NodeID); err != nil {
 					t.Fatal(err)
 				}
-			case "incompatible generation":
-				var err error
-				view, err = changes.Update(admin(t), installation, sandbox.Selection{Provider: "microsandbox", ExpectedGeneration: view.Generation, DeploymentSpec: retainedSpecification()})
-				if err != nil {
-					t.Fatal(err)
-				}
 			}
 			node := f.enroll(t, view, deployment.Capacity{MaxActive: 1, MaxRetained: 2})
 			f.connect(t, node.NodeID)
-			var waiting deployment.AllocationKey
-			if obstruction == "incompatible generation" {
-				old := releaseRetainedFixture(t, f, changes, runningPressureOwner(t, f, changes, installation, node.NodeID, view.Generation))
-				waiting = old.Key()
-			} else {
-				waiting = pendingPressureDemand(t, f)
-			}
+			waiting := pendingPressureDemand(t, f)
 			// A real pending reservation supplies demand and retains its original deadline.
 			if _, err := f.pool.Exec(t.Context(), `INSERT INTO environment_input_reservations(id,session_id,idempotency_key,batch,created_at,deadline) SELECT $1,session_id,'pressure','[{}]',clock_timestamp(),clock_timestamp()+interval '5 minutes' FROM environments WHERE id=$2`, uuid.NewString(), waiting.EnvironmentID); err != nil {
 				t.Fatal(err)
diff --git a/services/core/internal/persistence/postgres/deploymentpg/tx.go b/services/core/internal/persistence/postgres/deploymentpg/tx.go
index 01f09b21f..2c712dfe0 100644
--- a/services/core/internal/persistence/postgres/deploymentpg/tx.go
+++ b/services/core/internal/persistence/postgres/deploymentpg/tx.go
@@ -16,6 +16,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/db/sqlc"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/auditpg"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/placementpg"
 )
 
 // unit is one transaction or snapshot. locked reports that the transaction
@@ -35,6 +36,10 @@ func (u unit) LoadDeployment() (deployment.Record, error) {
 	if err != nil {
 		return deployment.Record{}, err
 	}
+	d.ComputeProfiles, err = placementpg.ExpandComputeProfiles(u.ctx, u.q, d.ComputeProfiles)
+	if err != nil {
+		return deployment.Record{}, err
+	}
 	return record(d, nil, false), nil
 }
 
@@ -85,7 +90,7 @@ func (u unit) LoadEnrollment(tokenDigest string) (deployment.EnrollmentRecord, e
 	if err != nil {
 		return deployment.EnrollmentRecord{}, err
 	}
-	return deployment.EnrollmentRecord{ID: uuidString(r.ID), InstallationID: uuidString(r.InstallationID), ExpiresAt: r.ExpiresAt.Time, Consumed: r.ConsumedAt.Valid, MaxActive: int(r.MaxActive), MaxRetained: int(r.MaxRetained)}, nil
+	return deployment.EnrollmentRecord{ID: uuidString(r.ID), InstallationID: uuidString(r.InstallationID), ExpiresAt: r.ExpiresAt.Time, Consumed: r.ConsumedAt.Valid, MaxActive: optionalInt(r.MaxActive), MaxRetained: optionalInt(r.MaxRetained)}, nil
 }
 
 func (u unit) LoadGenerationSpecification(generation uint64) (deployment.GenerationSpecification, error) {
@@ -175,6 +180,21 @@ func (t *nodeTx) RemoveNode(id string) error {
 	return t.q.RemoveRuntimeNode(t.ctx, nodeID)
 }
 
+func optionalInt4(v *int) pgtype.Int4 {
+	if v == nil {
+		return pgtype.Int4{}
+	}
+	return pgtype.Int4{Int32: int32(*v), Valid: true}
+}
+
+func optionalInt(v pgtype.Int4) *int {
+	if !v.Valid {
+		return nil
+	}
+	n := int(v.Int32)
+	return &n
+}
+
 func (t *nodeTx) CreateEnrollment(enrollment deployment.NewEnrollment) (time.Time, error) {
 	id, err := parseID(enrollment.ID)
 	if err != nil {
@@ -184,7 +204,7 @@ func (t *nodeTx) CreateEnrollment(enrollment deployment.NewEnrollment) (time.Tim
 	if err != nil {
 		return time.Time{}, err
 	}
-	if err := t.q.CreateRuntimeEnrollment(t.ctx, sqlc.CreateRuntimeEnrollmentParams{ID: id, TokenSha256: enrollment.TokenDigest, InstallationID: installation, MaxActive: int32(enrollment.MaxActive), MaxRetained: int32(enrollment.MaxRetained)}); err != nil {
+	if err := t.q.CreateRuntimeEnrollment(t.ctx, sqlc.CreateRuntimeEnrollmentParams{ID: id, TokenSha256: enrollment.TokenDigest, InstallationID: installation, MaxActive: optionalInt4(enrollment.MaxActive), MaxRetained: optionalInt4(enrollment.MaxRetained)}); err != nil {
 		return time.Time{}, err
 	}
 	row, err := t.q.GetRuntimeEnrollment(t.ctx, enrollment.TokenDigest)
@@ -216,7 +236,7 @@ func (t *nodeTx) HeartbeatNode(heartbeat deployment.Heartbeat) (bool, error) {
 	if err != nil {
 		return false, err
 	}
-	changed, err := t.q.HeartbeatRuntimeNode(t.ctx, sqlc.HeartbeatRuntimeNodeParams{ID: id, ConnectionID: connection, OwnerEpoch: int64(heartbeat.Epoch), ProviderReady: heartbeat.Health.ProviderReady, Health: raw})
+	changed, err := t.q.HeartbeatRuntimeNode(t.ctx, sqlc.HeartbeatRuntimeNodeParams{ID: id, ConnectionID: connection, OwnerEpoch: int64(heartbeat.Epoch), Health: raw})
 	return changed == 1, translate(err)
 }
 
@@ -255,14 +275,6 @@ func (t *nodeTx) PromoteServingGeneration(nodeID string, generation uint64) erro
 	return t.q.PromoteNodeServingGeneration(t.ctx, sqlc.PromoteNodeServingGenerationParams{ID: id, ReadyGeneration: pgtype.Int8{Int64: int64(generation), Valid: true}})
 }
 
-func (t *nodeTx) RefreshServingReadiness(nodeID string, protocol int) error {
-	id, err := parseID(nodeID)
-	if err != nil {
-		return err
-	}
-	return t.q.RefreshNodeServingReadiness(t.ctx, sqlc.RefreshNodeServingReadinessParams{ID: id, ProtocolVersion: int32(protocol)})
-}
-
 // deploymentTx is one leased deployment change.
 type deploymentTx struct {
 	unit
@@ -277,6 +289,10 @@ func (t *deploymentTx) LoadDeployment() (deployment.Record, error) {
 	if err != nil {
 		return deployment.Record{}, err
 	}
+	d.ComputeProfiles, err = placementpg.ExpandComputeProfiles(t.ctx, t.q, d.ComputeProfiles)
+	if err != nil {
+		return deployment.Record{}, err
+	}
 	return record(d, t.cipher, true), nil
 }
 
@@ -285,6 +301,10 @@ func (t *deploymentTx) LoadSnapshot() (deployment.Snapshot, error) {
 	if err != nil {
 		return deployment.Snapshot{}, err
 	}
+	row.RuntimeDeployment.ComputeProfiles, err = placementpg.ExpandComputeProfiles(t.ctx, t.q, row.RuntimeDeployment.ComputeProfiles)
+	if err != nil {
+		return deployment.Snapshot{}, err
+	}
 	return snapshot(row)
 }
 
@@ -308,7 +328,24 @@ func (t *deploymentTx) SaveSelection(selection deployment.SelectionRecord) error
 	if selection.Generation > math.MaxInt64 {
 		return deployment.ErrInvalidInput
 	}
-	params := sqlc.InitializeSandboxDeploymentParams{ProviderKind: selection.Provider, BackendFingerprint: selection.BackendFingerprint, Generation: int64(selection.Generation), Mode: selection.Mode, ProviderConfig: selection.Configuration.Public, ProviderMetadata: selection.Configuration.Metadata, Specification: selection.Specification}
+	references := make(map[string]uint64, len(selection.ComputeProfiles))
+	for name, p := range selection.ComputeProfiles {
+		references[name] = p.Generation
+	}
+	profiles, err := json.Marshal(references)
+	if err != nil {
+		return err
+	}
+	for _, p := range selection.ComputeProfiles {
+		spec, err := json.Marshal(p.Specification)
+		if err != nil {
+			return err
+		}
+		if err := t.q.SaveComputeProfileGeneration(t.ctx, sqlc.SaveComputeProfileGenerationParams{Generation: int64(p.Generation), ProviderKind: selection.Provider, Specification: spec, ProviderConfig: p.Configuration, ProviderMetadata: p.Metadata}); err != nil {
+			return err
+		}
+	}
+	params := sqlc.InitializeSandboxDeploymentParams{ComputeProfiles: profiles, ProviderKind: selection.Provider, BackendFingerprint: selection.BackendFingerprint, Generation: int64(selection.Generation), Mode: selection.Mode, ProviderConfig: selection.Configuration.Public, ProviderMetadata: selection.Configuration.Metadata, Specification: selection.Specification}
 	if len(selection.Configuration.Secret) > 0 {
 		sealed, err := t.cipher.SealSandboxDeployment(selection.Configuration.Secret, selection.InstallationID, selection.Generation)
 		if err != nil {
diff --git a/services/core/internal/persistence/postgres/modelconfigurationpg/observation_test.go b/services/core/internal/persistence/postgres/modelconfigurationpg/observation_test.go
index 2c59b8c1b..80c29ba11 100644
--- a/services/core/internal/persistence/postgres/modelconfigurationpg/observation_test.go
+++ b/services/core/internal/persistence/postgres/modelconfigurationpg/observation_test.go
@@ -354,39 +354,3 @@ func TestReplacementWaitsForAWinningObservationAndClearsIt(t *testing.T) {
 	}
 	o.observe(t, turn, 0)
 }
-
-func TestObservationMigrationRoundTrip(t *testing.T) {
-	o := newObserved(t)
-	old := o.resolve(t).Revision
-	var secret, sessionBundle []byte
-	if err := o.pool.QueryRow(t.Context(), "SELECT (SELECT encrypted_config FROM deployment_model_providers), (SELECT encrypted_config FROM session_model_execution WHERE session_id=$1)", o.session.ID).Scan(&secret, &sessionBundle); err != nil {
-		t.Fatal(err)
-	}
-	raw, err := os.ReadFile("../../../../migrations/000084_deployment_provider_observations.sql")
-	if err != nil {
-		t.Fatal(err)
-	}
-	parts := strings.Split(string(raw), "-- +goose Down")
-	if _, err = o.pool.Exec(t.Context(), parts[1]); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = o.pool.Exec(t.Context(), parts[0]); err != nil {
-		t.Fatal(err)
-	}
-	var revision uuid.UUID
-	var frozen pgtype.UUID
-	var preserved, preservedSession []byte
-	if err = o.pool.QueryRow(t.Context(), "SELECT revision, encrypted_config FROM deployment_model_providers").Scan(&revision, &preserved); err != nil {
-		t.Fatal(err)
-	}
-	if err = o.pool.QueryRow(t.Context(), "SELECT c.deployment_provider_revision, e.encrypted_config FROM session_execution_configuration c JOIN session_model_execution e USING (session_id) WHERE c.session_id=$1", o.session.ID).Scan(&frozen, &preservedSession); err != nil {
-		t.Fatal(err)
-	}
-	if revision == old || frozen.Valid || string(secret) != string(preserved) {
-		t.Fatal("migration recreated historical identity or changed ciphertext")
-	}
-	if string(sessionBundle) != string(preservedSession) {
-		t.Fatal("migration changed the Session bundle")
-	}
-	o.observe(t, o.terminal(t, o.session.ID, "completed", "", ""), 0)
-}
diff --git a/services/core/internal/persistence/postgres/pgtest/pgtest_test.go b/services/core/internal/persistence/postgres/pgtest/pgtest_test.go
index 0a9190930..01ebbc3c5 100644
--- a/services/core/internal/persistence/postgres/pgtest/pgtest_test.go
+++ b/services/core/internal/persistence/postgres/pgtest/pgtest_test.go
@@ -4,9 +4,9 @@ import "testing"
 
 func TestDatabaseGuardUsesEffectiveDatabase(t *testing.T) {
 	for _, dsn := range []string{
-		"postgres://localhost/oac_local_tests?dbname=agents_api",
-		"host=localhost dbname=agents_api",
-		"postgres://localhost/agents_api",
+		"postgres://localhost/oac_local_tests?dbname=oac",
+		"host=localhost dbname=oac",
+		"postgres://localhost/oac",
 	} {
 		if _, err := databaseConfig(dsn); err == nil {
 			t.Fatalf("unsafe database accepted: %s", dsn)
diff --git a/services/core/internal/persistence/postgres/placementpg/placementpg.go b/services/core/internal/persistence/postgres/placementpg/placementpg.go
index ad5abde8a..ae46dd819 100644
--- a/services/core/internal/persistence/postgres/placementpg/placementpg.go
+++ b/services/core/internal/persistence/postgres/placementpg/placementpg.go
@@ -25,7 +25,15 @@ func LockDeployment(ctx context.Context, q *sqlc.Queries) (placement.Deployment,
 	if err != nil {
 		return placement.Deployment{}, err
 	}
-	return placement.Deployment{
+	expanded, err := ExpandComputeProfiles(ctx, q, d.ComputeProfiles)
+	if err != nil {
+		return placement.Deployment{}, err
+	}
+	var profiles map[string]placement.ComputeProfile
+	if len(d.ComputeProfiles) > 0 && json.Unmarshal(expanded, &profiles) != nil {
+		return placement.Deployment{}, sandbox.ErrInvalid
+	}
+	return placement.Deployment{ComputeProfiles: profiles,
 		InstallationID: uuidString(d.InstallationID), Provider: d.ProviderKind, Mode: d.Mode,
 		Generation: uint64(d.Generation), Resetting: d.ResetClear.Valid, Specification: d.Specification,
 	}, nil
@@ -121,3 +129,24 @@ func uuidString(id pgtype.UUID) string {
 	}
 	return uuid.UUID(id.Bytes).String()
 }
+
+// ExpandComputeProfiles projects immutable generation records for a deployment
+// snapshot. Callers hold the deployment lock or a repeatable-read snapshot.
+func ExpandComputeProfiles(ctx context.Context, q *sqlc.Queries, raw json.RawMessage) (json.RawMessage, error) {
+	var refs map[string]uint64
+	if json.Unmarshal(raw, &refs) != nil {
+		return nil, sandbox.ErrInvalid
+	}
+	if len(refs) == 0 {
+		return json.RawMessage(`{}`), nil
+	}
+	expanded, err := q.ExpandComputeProfileSelections(ctx, raw)
+	if err != nil {
+		return nil, err
+	}
+	var records map[string]json.RawMessage
+	if json.Unmarshal(expanded, &records) != nil || len(records) != len(refs) {
+		return nil, sandbox.ErrInvalid
+	}
+	return expanded, nil
+}
diff --git a/services/core/internal/persistence/postgres/runtimehistorypg/reader_test.go b/services/core/internal/persistence/postgres/runtimehistorypg/reader_test.go
index 85bc4c916..a6fa64433 100644
--- a/services/core/internal/persistence/postgres/runtimehistorypg/reader_test.go
+++ b/services/core/internal/persistence/postgres/runtimehistorypg/reader_test.go
@@ -21,7 +21,7 @@ const (
 func testCapabilities() runtimehistory.Capabilities {
 	return runtimehistory.Capabilities{
 		SampleInterval: 30 * time.Second,
-		Retention: 7 * 24 * time.Hour, MinimumStep: 30 * time.Second, MaximumRange: 24 * time.Hour,
+		Retention:      7 * 24 * time.Hour, MinimumStep: 30 * time.Second, MaximumRange: 24 * time.Hour,
 		MaximumPoints: 1_000, MaximumSeries: 64, MaximumTotalPoints: 10_000,
 		Metrics: []runtimehistory.Metric{runtimehistory.MetricCPU, runtimehistory.MetricMemory},
 	}
diff --git a/services/core/internal/persistence/postgres/sessionpg/creation.go b/services/core/internal/persistence/postgres/sessionpg/creation.go
index 127fe6752..0cce6e145 100644
--- a/services/core/internal/persistence/postgres/sessionpg/creation.go
+++ b/services/core/internal/persistence/postgres/sessionpg/creation.go
@@ -27,7 +27,7 @@ import (
 
 // modelProviderKeyPurpose keys the provider-key fingerprint in creation
 // identities. Changing it changes every stored identity.
-const modelProviderKeyPurpose = "parsar.agents-api.model-provider-api-key.v1"
+const modelProviderKeyPurpose = "oac.model-provider-api-key.v1"
 
 var _ sessions.CreationTx = (*creationTx)(nil)
 
@@ -233,3 +233,7 @@ func (t *creationTx) LoadSession(ctx context.Context) (sessions.Session, error)
 	}
 	return session, err
 }
+
+func (t *creationTx) FreezeComputeProfile(ctx context.Context, profile string, generation uint64) error {
+	return t.q.FreezeSessionComputeGeneration(ctx, sqlc.FreezeSessionComputeGenerationParams{SessionID: t.session, Profile: profile, Generation: int64(generation)})
+}
diff --git a/services/core/internal/persistence/postgres/sessionpg/creation_test.go b/services/core/internal/persistence/postgres/sessionpg/creation_test.go
index bc2b5326b..6467210b3 100644
--- a/services/core/internal/persistence/postgres/sessionpg/creation_test.go
+++ b/services/core/internal/persistence/postgres/sessionpg/creation_test.go
@@ -472,9 +472,7 @@ func TestHostedCreationAdmitsUnderDeploymentLockAndLeavesComputeUnreserved(t *te
 	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
 	defer cancel()
 	tenant := uuid.NewString()
-	nodes, err := json.Marshal(sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048}, Runtime: &sandbox.RuntimeRelease{SourceCommit: strings.Repeat("a", 40),
-		ImageID: "sha256:" + strings.Repeat("b", 64), ImageManifestDigest: "sha256:" + strings.Repeat("c", 64), MicrosandboxRef: "oac-runtime@sha256:" + strings.Repeat("d", 64),
-		RuntimeSHA256: strings.Repeat("e", 64), FirmwareSHA256: strings.Repeat("f", 64)}})
+	nodes, err := json.Marshal(sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048}})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/internal/persistence/postgres/sessionpg/execution_journal_test.go b/services/core/internal/persistence/postgres/sessionpg/execution_journal_test.go
index a7a1ffe7a..4c2e082b8 100644
--- a/services/core/internal/persistence/postgres/sessionpg/execution_journal_test.go
+++ b/services/core/internal/persistence/postgres/sessionpg/execution_journal_test.go
@@ -114,6 +114,32 @@ func TestTurnJournalRecordsReplaysAndRollsBack(t *testing.T) {
 	}
 }
 
+func TestTurnJournalStoresNULInObservedTextAsReplacementCharacter(t *testing.T) {
+	pool, _, operations := leasedJournal(t)
+	tenant, session, turn := newTurn(t, pool, sessions.TurnInProgress)
+	batch := []sessions.ExecutionEvent{
+		observation("tool_call", `{"id":"c","stage":"before","observation":{"status":"in_progress","kind":"command","command":"printf"}}`),
+		observation("command_output", `{"id":"c","delta":"before\u0000after"}`),
+		observation("tool_call", `{"id":"c","stage":"after","observation":{"status":"completed","kind":"command","command":"printf","output":"before\u0000after"}}`),
+	}
+	if err := operations.AppendTurnEvents(t.Context(), text(tenant), text(session), text(turn), 1, batch); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := operations.CompleteExecution(t.Context(), text(tenant), text(session), text(turn), sessions.TurnFailed, json.RawMessage(`{"error":"native\u0000"}`), "", 0); err != nil {
+		t.Fatal(err)
+	}
+	var delta, output, failure string
+	if err := pool.QueryRow(t.Context(), `SELECT
+		(SELECT payload->>'delta' FROM turn_events WHERE turn_id = $1 AND ordinal = 2),
+		(SELECT payload#>>'{observation,output}' FROM turn_events WHERE turn_id = $1 AND ordinal = 3),
+		outcome->>'error' FROM turns WHERE id = $1`, turn).Scan(&delta, &output, &failure); err != nil {
+		t.Fatal(err)
+	}
+	if delta != "before\uFFFDafter" || output != "before\uFFFDafter" || failure != "native\uFFFD" {
+		t.Fatalf("stored %q, %q and %q", delta, output, failure)
+	}
+}
+
 func TestSubagentProjectionStoresTheSessionRows(t *testing.T) {
 	pool, _, operations := leasedJournal(t)
 	tenant, session, turn, device := uuid.New(), uuid.New(), uuid.New(), uuid.New()
diff --git a/services/core/internal/persistence/postgres/sessionpg/functions.go b/services/core/internal/persistence/postgres/sessionpg/functions.go
index 8f82b4fdb..3ee5cb2d8 100644
--- a/services/core/internal/persistence/postgres/sessionpg/functions.go
+++ b/services/core/internal/persistence/postgres/sessionpg/functions.go
@@ -53,7 +53,7 @@ func loadPendingFunctionCalls(ctx context.Context, q *sqlc.Queries, session pgty
 }
 
 func functionCallFromRow(row sqlc.FunctionCall) sessions.FunctionCall {
-	return sessions.FunctionCall{CallID: row.CallID, ExecutorCallID: row.ExecutorCallID, Name: row.Name, Arguments: row.Arguments, Result: row.Result, Applied: row.Applied}
+	return sessions.FunctionCall{CallID: row.CallID, ExecutorCallID: row.ExecutorCallID, Name: row.Name, Arguments: row.Arguments, Result: row.Result, Applied: row.Applied, Withdrawn: row.Withdrawn}
 }
 
 func (t *SessionTx) LoadPendingFunctionCalls(ctx context.Context, turn string) ([]sessions.FunctionCall, error) {
@@ -83,7 +83,7 @@ func (t *SessionTx) MatchFunctionResult(ctx context.Context, turn, call string,
 	if err != nil {
 		return sessions.FunctionResultMatch{}, err
 	}
-	return sessions.FunctionResultMatch{Recorded: true, Submitted: row.Submitted, Matches: row.Matches}, nil
+	return sessions.FunctionResultMatch{Recorded: true, Submitted: row.Submitted, Matches: row.Matches, Withdrawn: row.Withdrawn}, nil
 }
 
 func (t *SessionTx) SubmitFunctionResult(ctx context.Context, turn, call string, result json.RawMessage) error {
@@ -150,3 +150,11 @@ func (t *SessionTx) ApplyFunctionResult(ctx context.Context, turn, call string)
 	}
 	return t.q.ApplyFunctionResult(ctx, sqlc.ApplyFunctionResultParams{SessionID: t.session, TurnID: id, CallID: call})
 }
+
+func (t *SessionTx) WithdrawFunctionCall(ctx context.Context, turn, call string) error {
+	id, err := parseID(turn)
+	if err != nil {
+		return err
+	}
+	return t.q.WithdrawFunctionCall(ctx, sqlc.WithdrawFunctionCallParams{SessionID: t.session, TurnID: id, CallID: call})
+}
diff --git a/services/core/internal/persistence/postgres/sessionpg/sessionpg_test.go b/services/core/internal/persistence/postgres/sessionpg/sessionpg_test.go
index b8aca3bd6..d9e6dc7d6 100644
--- a/services/core/internal/persistence/postgres/sessionpg/sessionpg_test.go
+++ b/services/core/internal/persistence/postgres/sessionpg/sessionpg_test.go
@@ -127,9 +127,9 @@ func TestItemsTakePositionsAndOutputIndexes(t *testing.T) {
 		if err != nil || !reflect.DeepEqual(stored, items.Stored{Item: answer}) {
 			t.Fatalf("stored %+v, %v", stored, err)
 		}
-		legacy, err := bound.LoadItem(t.Context(), turnID, items.Update{Item: v1.Item{ID: uuid.NewString()}, LegacyFinal: true})
-		if err != nil || !legacy.NativeMessage || legacy.Item.ID != "" {
-			t.Fatalf("legacy aggregate %+v, %v", legacy, err)
+		aggregate, err := bound.LoadItem(t.Context(), turnID, items.Update{Item: v1.Item{ID: uuid.NewString()}, AggregateFinal: true})
+		if err != nil || !aggregate.NativeMessage || aggregate.Item.ID != "" {
+			t.Fatalf("aggregate answer %+v, %v", aggregate, err)
 		}
 		return nil
 	})
diff --git a/services/core/internal/persistence/postgres/vaultpg/seal_test.go b/services/core/internal/persistence/postgres/vaultpg/seal_test.go
index d77172ab8..27ceea575 100644
--- a/services/core/internal/persistence/postgres/vaultpg/seal_test.go
+++ b/services/core/internal/persistence/postgres/vaultpg/seal_test.go
@@ -67,7 +67,7 @@ func TestCredentialSecretsKeepTheirSealedFormat(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
-	legacy, err := json.Marshal(storedGrant{Version: 1, Metadata: metadata, AccessToken: "old-access", RefreshToken: "refresh"})
+	grant, err := json.Marshal(storedGrant{Version: 1, Metadata: metadata, AccessToken: "old-access", RefreshToken: "refresh"})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -75,7 +75,7 @@ func TestCredentialSecretsKeepTheirSealedFormat(t *testing.T) {
 		return bearerToken(t.Context(), service, tenant, []string{vault.ID}, oauthBinding(credential))
 	}
 	write(static, []byte("old-static"), scope(static))
-	write(oauth, legacy, scope(oauth))
+	write(oauth, grant, scope(oauth))
 	for _, tc := range []struct {
 		credential  vaults.Credential
 		want, fails string
@@ -103,7 +103,7 @@ func TestCredentialSecretsKeepTheirSealedFormat(t *testing.T) {
 	wrongID.CredentialID = oauth.ID
 	wrongDestination.Destination += "/other"
 	write(static, []byte("old-static"), wrongID)
-	write(oauth, legacy, wrongDestination)
+	write(oauth, grant, wrongDestination)
 	for _, tc := range []struct {
 		credential vaults.Credential
 		message    string
diff --git a/services/core/internal/processconfig/config.go b/services/core/internal/processconfig/config.go
index c0f7b8e08..b395e5e89 100644
--- a/services/core/internal/processconfig/config.go
+++ b/services/core/internal/processconfig/config.go
@@ -19,11 +19,11 @@ import (
 	"strings"
 	"time"
 
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/api"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/credentialcrypto"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/databaseurl"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/execution"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/oauthrefresh"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
@@ -140,7 +140,7 @@ func Load() (Config, error) {
 		return Config{}, err
 	}
 	c.DefaultHarness = cmp.Or(os.Getenv("OAC_DEFAULT_HARNESS"), defaultHarness)
-	if _, known := (engine.Catalog{}).Lookup(c.DefaultHarness); !known {
+	if !builtin.Contains(c.DefaultHarness) {
 		return Config{}, configError("OAC_DEFAULT_HARNESS is not a known harness")
 	}
 	if c.Harnesses, err = harnesses(c.DefaultHarness); err != nil {
@@ -181,7 +181,7 @@ func (c Config) Settings() []api.InstallationSetting {
 		setting("OAC_LOG_ADD_SOURCE", c.Log.AddSource, false, []api.InstallationService{api.InstallationCore, api.InstallationWeb}),
 		setting("OAC_EXECUTION_CONCURRENCY", c.ExecutionConcurrency, execution.DefaultExecutionConcurrency, []api.InstallationService{api.InstallationCore}),
 		setting("OAC_TURN_AUTO_RETRIES", c.TurnAutoRetries, execution.DefaultTurnAutoRetries, []api.InstallationService{api.InstallationCore}),
-		setting("OAC_HARNESSES", c.Harnesses, (engine.Catalog{}).Kinds(), []api.InstallationService{api.InstallationCore}),
+		setting("OAC_HARNESSES", c.Harnesses, builtin.Kinds(), []api.InstallationService{api.InstallationCore}),
 		setting("OAC_DEFAULT_HARNESS", c.DefaultHarness, defaultHarness, []api.InstallationService{api.InstallationCore}),
 		setting("OAC_WRITE_AUDIT_RETENTION", duration(c.WriteAuditRetention), duration(defaultWriteAuditRetention), []api.InstallationService{api.InstallationCore}),
 		setting("OAC_OAUTH_TRUSTED_ORIGINS", origins, []string{}, []api.InstallationService{api.InstallationCore}),
@@ -295,11 +295,11 @@ func harnesses(defaultEngine string) ([]string, error) {
 	if value := os.Getenv("OAC_HARNESSES"); value != "" {
 		kinds = append(kinds, strings.Split(value, ",")...)
 	} else {
-		kinds = append(kinds, (engine.Catalog{}).Kinds()...)
+		kinds = append(kinds, builtin.Kinds()...)
 	}
 	for i, kind := range kinds {
 		kind = strings.TrimSpace(kind)
-		if _, known := (engine.Catalog{}).Lookup(kind); !known {
+		if !builtin.Contains(kind) {
 			return nil, configError("OAC_HARNESSES contains an unknown harness")
 		}
 		kinds[i] = kind
diff --git a/services/core/internal/runtimedevice/state.go b/services/core/internal/runtimedevice/state.go
index fd27fc78d..931dde4ae 100644
--- a/services/core/internal/runtimedevice/state.go
+++ b/services/core/internal/runtimedevice/state.go
@@ -1,51 +1,6 @@
 // Package device defines persistence data shared by daemon gateways and their stores.
 package runtimedevice
 
-import "time"
-
-const OwnerStatusConnected = "connected"
-const OwnerStatusDraining = "draining"
-const OwnerStatusExpired = "expired"
-
-// Owner is the persisted view of the current
-// WebSocket owner for one agent_daemon device. Generation is a fencing
-// token: renewal/release paths must carry it so stale pods can't act.
-type Owner struct {
-	DeviceID       string
-	WorkspaceID    string
-	OwnerPodID     string
-	OwnerURL       string
-	Generation     int64
-	Status         string
-	ConnectedAt    time.Time
-	LastSeenAt     time.Time
-	LeaseExpiresAt time.Time
-	UpdatedAt      time.Time
-}
-
-type ClaimOwner struct {
-	DeviceID       string
-	WorkspaceID    string
-	OwnerPodID     string
-	OwnerURL       string
-	LeaseExpiresAt time.Time
-	Now            time.Time
-}
-
-type RenewOwner struct {
-	DeviceID       string
-	OwnerPodID     string
-	Generation     int64
-	LeaseExpiresAt time.Time
-	Now            time.Time
-}
-
-type ReleaseOwner struct {
-	DeviceID   string
-	OwnerPodID string
-	Generation int64
-}
-
 // HeartbeatStatus is the post-heartbeat liveness the runner uses to
 // detect state changes.
 type HeartbeatStatus struct {
@@ -66,20 +21,16 @@ type KindCapabilities struct {
 	Resume                bool `json:"resume,omitempty"`
 	NativeSessionRecovery bool `json:"native_session_recovery,omitempty"`
 	RetainedNativeHistory bool `json:"retained_native_history,omitempty"`
-	Steering              bool `json:"steering,omitempty"`
 	MessageItems          bool `json:"message_items,omitempty"`
 
-	ToolObservations               bool `json:"tool_observations,omitempty"`
-	EnvironmentNone                bool `json:"environment_none,omitempty"`
-	LocalEnvironment               bool `json:"local_environment,omitempty"`
-	Preparation                    bool `json:"preparation,omitempty"`
-	WorkspaceReadPreparation       bool `json:"workspace_read_preparation,omitempty"`
-	WorkspaceOutputExport          bool `json:"workspace_output_export,omitempty"`
-	ProgrammaticToolCallingDisable bool `json:"programmatic_tool_calling_disable,omitempty"`
-	WebSearchControl               bool `json:"web_search_control,omitempty"`
-	// ExecutionControls supports typed search and verbosity controls.
+	ToolObservations         bool `json:"tool_observations,omitempty"`
+	EnvironmentNone          bool `json:"environment_none,omitempty"`
+	LocalEnvironment         bool `json:"local_environment,omitempty"`
+	Preparation              bool `json:"preparation,omitempty"`
+	WorkspaceReadPreparation bool `json:"workspace_read_preparation,omitempty"`
+	WorkspaceOutputExport    bool `json:"workspace_output_export,omitempty"`
+	// ExecutionControls accepts the typed execution controls.
 	ExecutionControls    bool `json:"execution_controls,omitempty"`
-	TextVerbosity        bool `json:"text_verbosity,omitempty"`
 	StructuredOutput     bool `json:"structured_output,omitempty"`
 	ToolSearch           bool `json:"tool_search,omitempty"`
 	MessageImages        bool `json:"message_images,omitempty"`
diff --git a/services/core/internal/runtimeenrollment/connection.go b/services/core/internal/runtimeenrollment/connection.go
index 7bebb425f..bd5b13e6f 100644
--- a/services/core/internal/runtimeenrollment/connection.go
+++ b/services/core/internal/runtimeenrollment/connection.go
@@ -113,7 +113,7 @@ func RuntimeConnected(ctx context.Context, s ConnectionStore, registry *runtimeg
 		return false, nil
 	}
 	// Recheck authority after reading the socket; rotation/revocation never inherits
-	// the connected observation of a socket authenticated with the former key.
+	// the connected observation of a socket authenticated with the previous key.
 	if _, err = s.AuthenticateEnvironmentExecutor(ctx, environment, digest); err != nil {
 		return false, err
 	}
diff --git a/services/core/internal/runtimegateway/artifact_transport_test.go b/services/core/internal/runtimegateway/artifact_transport_test.go
index f6b2c8ff6..5085433f9 100644
--- a/services/core/internal/runtimegateway/artifact_transport_test.go
+++ b/services/core/internal/runtimegateway/artifact_transport_test.go
@@ -31,7 +31,7 @@ func TestArtifactTransportActualLoopsAndSnapshot(t *testing.T) {
 			slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, nil)))
 			defer slog.SetDefault(previous)
 			conn := &artifactSlowConn{fakeConn: newFakeConn(), entered: make(chan struct{}), release: make(chan struct{})}
-			s := NewSession(conn, "device", "tenant", "test", nil, nil)
+			s := newTestSession(conn, "device", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			ctx := textobs.WithArtifact(t.Context(), "session", "turn")
 			finish := s.ObserveArtifactTransport(ctx, "prepare")
@@ -107,7 +107,7 @@ func TestArtifactTransportScopeClaimAndBound(t *testing.T) {
 	previous := slog.Default()
 	slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, nil)))
 	defer slog.SetDefault(previous)
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	s.ObserveArtifactTransport(context.Background(), "outside")()
 	if logs.Len() != 0 {
@@ -115,7 +115,7 @@ func TestArtifactTransportScopeClaimAndBound(t *testing.T) {
 	}
 	ctx := textobs.WithArtifact(t.Context(), "s", "t")
 	finish := s.ObserveArtifactTransport(ctx, "one")
-	other := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	other := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer other.Close("test")
 	other.ObserveArtifactTransport(ctx, "two")()
 	finish()
diff --git a/services/core/internal/runtimegateway/auth_test.go b/services/core/internal/runtimegateway/auth_test.go
index 4aeb25182..0754f2081 100644
--- a/services/core/internal/runtimegateway/auth_test.go
+++ b/services/core/internal/runtimegateway/auth_test.go
@@ -39,7 +39,7 @@ func TestAuthenticator_RejectsUnknownDevice(t *testing.T) {
 }
 
 func TestAuthenticator_RejectsWrongRuntimeType(t *testing.T) {
-	// A legacy local runtime row trying to dial in as agent_daemon
+	// A local runtime row trying to dial in as agent_daemon
 	// must fail — otherwise a paired local credential could open an
 	// agent_daemon WS and bypass the device picker.
 	row := runtimedevice.Credential{
diff --git a/services/core/internal/runtimegateway/boundary_independent_qa_test.go b/services/core/internal/runtimegateway/boundary_independent_qa_test.go
index b55fd0210..94f17d86b 100644
--- a/services/core/internal/runtimegateway/boundary_independent_qa_test.go
+++ b/services/core/internal/runtimegateway/boundary_independent_qa_test.go
@@ -16,7 +16,7 @@ func TestQAHeartbeatReconnectDuringOldStore(t *testing.T) {
 	slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, nil)))
 	defer slog.SetDefault(logger)
 	reg := NewRegistry()
-	old := NewSession(newFakeConn(), "qa-device", "tenant", "fixture", reg, nil)
+	old := newTestSession(newFakeConn(), "qa-device", "tenant", "fixture", reg, nil)
 	reg.Register(old)
 	blocked := &observationHeartbeatStore{entered: make(chan struct{}), release: make(chan struct{})}
 	old.heartbeat = blocked
@@ -25,7 +25,7 @@ func TestQAHeartbeatReconnectDuringOldStore(t *testing.T) {
 	go func() { old.handleHeartbeat(env); close(done) }()
 	<-blocked.entered
 	old.Close("replace")
-	next := NewSession(newFakeConn(), "qa-device", "tenant", "fixture", reg, nil)
+	next := newTestSession(newFakeConn(), "qa-device", "tenant", "fixture", reg, nil)
 	defer next.Close("test")
 	reg.Register(next)
 	next.handleHeartbeat(env)
diff --git a/services/core/internal/runtimegateway/c2_independent_qa_test.go b/services/core/internal/runtimegateway/c2_independent_qa_test.go
index 4562ef850..6bc23cd82 100644
--- a/services/core/internal/runtimegateway/c2_independent_qa_test.go
+++ b/services/core/internal/runtimegateway/c2_independent_qa_test.go
@@ -19,7 +19,7 @@ func TestIndependentC2SerialRoundsPairingAndCap(t *testing.T) {
 	prior := slog.Default()
 	slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, nil)))
 	defer slog.SetDefault(prior)
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	ctx := textobs.WithArtifact(t.Context(), "5889faac-763b-4a6b-bae6-e809fe65e0cd", "4fbfe7d7-cfdb-4b96-917f-79b3d251c8b5")
 	done := make(chan error, 1)
diff --git a/services/core/internal/runtimegateway/cancellation_test.go b/services/core/internal/runtimegateway/cancellation_test.go
index 174f31526..ec434e7b0 100644
--- a/services/core/internal/runtimegateway/cancellation_test.go
+++ b/services/core/internal/runtimegateway/cancellation_test.go
@@ -31,7 +31,7 @@ func (r *receiptStore) ArchivedCancellationReceipt(_ context.Context, id, hash s
 
 func TestArchivedReceiptTracksDeliveryBeyondDoneAndRejectsNewWork(t *testing.T) {
 	conn := newFakeConn()
-	peer := NewSession(conn, "device", "", "", NewRegistry(), nil)
+	peer := newTestSession(conn, "device", "", "", NewRegistry(), nil)
 	defer peer.Close("test complete")
 	peer.credentialHash = "original-hash"
 	receipt := runtimedevice.ArchivedCancellationReceipt{RunID: "run", Deadline: time.Now().Add(time.Second)}
@@ -94,7 +94,7 @@ func (c *blockedControlConn) WriteControl(kind int, data []byte, _ time.Time) er
 
 func TestCloseWithCodeUsesConcurrentControlWriter(t *testing.T) {
 	conn := &blockedControlConn{fakeConn: newFakeConn(), entered: make(chan struct{}), resume: make(chan struct{}), wrote: make(chan struct{})}
-	peer := NewSession(conn, "device", "", "", NewRegistry(), nil)
+	peer := newTestSession(conn, "device", "", "", NewRegistry(), nil)
 	peer.Start()
 	env, _ := proto.NewEnvelope(proto.TypePromptCancel, "run", nil)
 	if err := peer.Send(t.Context(), env); err != nil {
@@ -123,7 +123,7 @@ func TestCloseWithCodeUsesConcurrentControlWriter(t *testing.T) {
 }
 
 func TestArchivedReceiptDeadlineDoesNotRenew(t *testing.T) {
-	peer := NewSession(newFakeConn(), "device", "", "", NewRegistry(), nil)
+	peer := newTestSession(newFakeConn(), "device", "", "", NewRegistry(), nil)
 	defer peer.Close("test complete")
 	peer.credentialHash = "original-hash"
 	receipt := runtimedevice.ArchivedCancellationReceipt{RunID: "run", Deadline: time.Now().Add(100 * time.Millisecond)}
@@ -147,7 +147,7 @@ func TestArchivedReceiptDeadlineDoesNotRenew(t *testing.T) {
 }
 
 func TestArchivedCancellationDrainsEventCredit(t *testing.T) {
-	peer := NewSession(newFakeConn(), "device", "", proto.Version, NewRegistry(), nil)
+	peer := newTestSession(newFakeConn(), "device", "", proto.Version, NewRegistry(), nil)
 	peer.eventCredit = true
 	defer peer.Close("test complete")
 	peer.credentialHash = "original-hash"
diff --git a/services/core/internal/runtimegateway/capabilities_test.go b/services/core/internal/runtimegateway/capabilities_test.go
index da0a6af11..54baa1774 100644
--- a/services/core/internal/runtimegateway/capabilities_test.go
+++ b/services/core/internal/runtimegateway/capabilities_test.go
@@ -31,7 +31,7 @@ func TestCapabilityProjectionCoversEveryField(t *testing.T) {
 }
 
 func TestInvalidHeartbeatDiscardsPreviousDeclarationAndClosesTransport(t *testing.T) {
-	session := NewSession(newFakeConn(), "runtime", "workspace", proto.Version, NewRegistry(), nil)
+	session := newTestSession(newFakeConn(), "runtime", "workspace", proto.Version, NewRegistry(), nil)
 	valid, err := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "fixture", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}}})
 	if err != nil {
 		t.Fatal(err)
@@ -48,3 +48,25 @@ func TestInvalidHeartbeatDiscardsPreviousDeclarationAndClosesTransport(t *testin
 		t.Fatal("old declaration survived invalid heartbeat")
 	}
 }
+
+func TestFirstHeartbeatAnnouncesAgentKinds(t *testing.T) {
+	registry := NewRegistry()
+	session := newTestSession(newFakeConn(), "runtime", "workspace", proto.Version, registry, nil)
+	heartbeat, err := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "fixture", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []bool{true, false} {
+		session.handleHeartbeat(heartbeat)
+		select {
+		case <-registry.Announced():
+			if !want {
+				t.Fatal("repeated heartbeat announced again")
+			}
+		default:
+			if want {
+				t.Fatal("first agent kinds not announced")
+			}
+		}
+	}
+}
diff --git a/services/core/internal/runtimegateway/capability_hint_test.go b/services/core/internal/runtimegateway/capability_hint_test.go
index e171a7246..c2b72ee7f 100644
--- a/services/core/internal/runtimegateway/capability_hint_test.go
+++ b/services/core/internal/runtimegateway/capability_hint_test.go
@@ -30,7 +30,7 @@ func expectCapabilityHint(t *testing.T, reg *Registry, want bool) {
 
 func TestCapabilityHintsRequireCurrentAvailableSnapshot(t *testing.T) {
 	reg := NewRegistry()
-	old := NewSession(newFakeConn(), "device", "tenant", "version", reg, nil)
+	old := newTestSession(newFakeConn(), "device", "tenant", "version", reg, nil)
 	reg.Register(old)
 	expectCapabilityHint(t, reg, false) // Transport alone is insufficient.
 	publishCapabilityHeartbeat(t, old, []runtimedevice.SupportedAgentKind{{Kind: "fake", Available: false}})
@@ -40,7 +40,7 @@ func TestCapabilityHintsRequireCurrentAvailableSnapshot(t *testing.T) {
 	expectCapabilityHint(t, reg, true)
 	publishCapabilityHeartbeat(t, old, kinds)
 	expectCapabilityHint(t, reg, false) // Ordinary heartbeats do not rescan.
-	newer := NewSession(newFakeConn(), "device", "tenant", "version", reg, nil)
+	newer := newTestSession(newFakeConn(), "device", "tenant", "version", reg, nil)
 	reg.Register(newer)
 	kinds[0].Version = "changed"
 	publishCapabilityHeartbeat(t, old, kinds)
@@ -51,7 +51,7 @@ func TestCapabilityHintsRequireCurrentAvailableSnapshot(t *testing.T) {
 
 func TestCapabilityHintsCoalesceAndIgnoreDisconnectedPeers(t *testing.T) {
 	reg := NewRegistry()
-	s := NewSession(newFakeConn(), "device", "tenant", "version", reg, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "version", reg, nil)
 	reg.Register(s)
 	kinds := []runtimedevice.SupportedAgentKind{{Kind: "fake", Available: true}}
 	publishCapabilityHeartbeat(t, s, kinds)
@@ -60,14 +60,14 @@ func TestCapabilityHintsCoalesceAndIgnoreDisconnectedPeers(t *testing.T) {
 	expectCapabilityHint(t, reg, true)
 	expectCapabilityHint(t, reg, false)
 	reg.Deregister(s)
-	kinds[0].Capabilities.Steering = true
+	kinds[0].Capabilities.DurableTurns = true
 	publishCapabilityHeartbeat(t, s, kinds)
 	expectCapabilityHint(t, reg, false)
 }
 
 func TestInvalidHeartbeatCannotWakeScheduler(t *testing.T) {
 	reg := NewRegistry()
-	s := NewSession(newFakeConn(), "device", "tenant", "version", reg, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "version", reg, nil)
 	reg.Register(s)
 	s.handleHeartbeat(proto.Envelope{Type: proto.TypeHeartbeat, Payload: json.RawMessage(`{"ts":1,"active_requests":0,"supported_agent_kinds":[{"kind":"fake","available":true,"capabilities":{"streaming":"invented"}}]}`)})
 	expectCapabilityHint(t, reg, false)
@@ -82,8 +82,8 @@ func publishCapabilityHeartbeat(t *testing.T, s *Session, kinds []runtimedevice.
 	for i, k := range kinds {
 		advertised[i] = proto.SupportedAgentKind{Kind: k.Kind, Available: k.Available, Version: k.Version,
 			Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{
-				Streaming: proto.CapabilityFromBool(k.Capabilities.Streaming),
-				Steering:  proto.CapabilityFromBool(k.Capabilities.Steering),
+				Streaming:    proto.CapabilityFromBool(k.Capabilities.Streaming),
+				DurableTurns: proto.CapabilityFromBool(k.Capabilities.DurableTurns),
 			})}
 	}
 	env, err := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{SupportedAgentKinds: advertised})
@@ -99,7 +99,7 @@ func TestCapabilityObservationsExcludeRejectedAndStalePeers(t *testing.T) {
 	slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, nil)))
 	t.Cleanup(func() { slog.SetDefault(previous) })
 	reg := NewRegistry()
-	old := NewSession(newFakeConn(), "device", "tenant", "version", reg, nil)
+	old := newTestSession(newFakeConn(), "device", "tenant", "version", reg, nil)
 	reg.Register(old)
 	kinds := []runtimedevice.SupportedAgentKind{{Kind: "fake", Available: true}}
 	publishCapabilityHeartbeat(t, old, kinds)
@@ -111,7 +111,7 @@ func TestCapabilityObservationsExcludeRejectedAndStalePeers(t *testing.T) {
 	if strings.Contains(logs.String(), "runtime capability snapshot observed") {
 		t.Fatal("invalid declaration logged as an accepted snapshot")
 	}
-	newer := NewSession(newFakeConn(), "device", "tenant", "version", reg, nil)
+	newer := newTestSession(newFakeConn(), "device", "tenant", "version", reg, nil)
 	reg.Register(newer)
 	publishCapabilityHeartbeat(t, old, kinds)
 	if strings.Contains(logs.String(), "runtime capability snapshot observed") {
@@ -147,7 +147,7 @@ func TestCapabilityConfirmationRetriesWithoutObservingRejectedAuthority(t *testi
 			slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, nil)))
 			t.Cleanup(func() { slog.SetDefault(previous) })
 			reg := NewRegistry()
-			s := NewSession(newFakeConn(), "device", "tenant", "version", reg, nil)
+			s := newTestSession(newFakeConn(), "device", "tenant", "version", reg, nil)
 			reg.Register(s)
 			t.Cleanup(func() { s.Close("test finished") })
 			authority := &capabilityAuthorityStore{deleted: mode != "error"}
diff --git a/services/core/internal/runtimegateway/export_rounds_test.go b/services/core/internal/runtimegateway/export_rounds_test.go
index dc5cc6e6a..dc5be821d 100644
--- a/services/core/internal/runtimegateway/export_rounds_test.go
+++ b/services/core/internal/runtimegateway/export_rounds_test.go
@@ -2,10 +2,8 @@ package runtimegateway
 
 import (
 	"bytes"
-	"context"
 	"encoding/json"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimedevice"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/textobs"
 	"io"
 	"log/slog"
@@ -15,19 +13,9 @@ import (
 	"time"
 )
 
-type predecodeOwner struct{ DeviceOwnerStore }
-
-func (*predecodeOwner) RenewAgentDaemonDeviceOwner(context.Context, runtimedevice.RenewOwner) (runtimedevice.Owner, bool, error) {
-	time.Sleep(30 * time.Millisecond)
-	return runtimedevice.Owner{}, true, nil
-}
-func (*predecodeOwner) ReleaseAgentDaemonDeviceOwner(context.Context, runtimedevice.ReleaseOwner) (bool, error) {
-	return true, nil
-}
 func TestPredecodeRealReadLoop(t *testing.T) {
 	c := newFakeConn()
-	s := NewSession(c, "device", "tenant", "test", nil, nil)
-	s.owner = &ownerLease{store: &predecodeOwner{}}
+	s := newTestSession(c, "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	ctx := textobs.WithArtifact(t.Context(), "5889faac-763b-4a6b-bae6-e809fe65e0cd", "4fbfe7d7-cfdb-4b96-917f-79b3d251c8b5")
 	finish := s.ObserveArtifactTransport(ctx, "prepare")
@@ -44,7 +32,7 @@ func TestPredecodeRealReadLoop(t *testing.T) {
 		m := o.stages[artifactPredecode]
 		o.mu.Unlock()
 		if m.count == 1 {
-			if m.total < 20*time.Millisecond {
+			if m.total < 0 {
 				t.Fatal(m)
 			}
 			break
@@ -95,7 +83,7 @@ func TestC2CoreProducerFixtures(t *testing.T) {
 			r.dispatched = time.Now()
 			r.observeRound(start, proto.WorkspaceExportPayload{Step: "begin"}, "completed")
 			r.observe(scope, nil)
-			s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+			s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			finish := s.ObserveArtifactTransport(ctx, "29117c12-a502-4d69-9ad5-27848a6b92ea")
 			s.observeArtifactExport(ctx, "378281c9-a535-412a-b217-45520991855e")
@@ -115,7 +103,7 @@ func TestReceiptCanPrecedeWriteReturn(t *testing.T) {
 	slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, nil)))
 	defer slog.SetDefault(old)
 	c := &artifactSlowConn{fakeConn: newFakeConn(), entered: make(chan struct{}), release: make(chan struct{})}
-	s := NewSession(c, "device", "tenant", "test", nil, nil)
+	s := newTestSession(c, "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	s.Start()
 	ctx := textobs.WithArtifact(t.Context(), "5889faac-763b-4a6b-bae6-e809fe65e0cd", "4fbfe7d7-cfdb-4b96-917f-79b3d251c8b5")
diff --git a/services/core/internal/runtimegateway/handler.go b/services/core/internal/runtimegateway/handler.go
index b3ec4a5cf..de33bee33 100644
--- a/services/core/internal/runtimegateway/handler.go
+++ b/services/core/internal/runtimegateway/handler.go
@@ -46,18 +46,6 @@ type HandlerConfig struct {
 	// the externally-reachable URL.
 	PublicWSURL string
 
-	// OwnerStore enables multi-pod WebSocket ownership. When set, every
-	// successful daemon WS dial-in claims device_id -> owner_pod_id in
-	// Postgres and receives a generation fencing token. nil preserves
-	// the legacy single-pod in-memory Registry behavior.
-	OwnerStore DeviceOwnerStore
-	OwnerPodID string
-	OwnerURL   string
-
-	// OwnerLeaseTTL controls how long the owner row stays valid without
-	// a renewing inbound daemon frame. Zero uses the package default.
-	OwnerLeaseTTL time.Duration
-
 	// HeartbeatInterval overrides DefaultHeartbeatInterval. Zero -> default.
 	HeartbeatInterval time.Duration
 
@@ -84,7 +72,6 @@ func NewHandler(cfg HandlerConfig) *Handler {
 	if cfg.HeartbeatInterval <= 0 {
 		cfg.HeartbeatInterval = DefaultHeartbeatInterval
 	}
-	cfg.OwnerLeaseTTL = normalizeOwnerTTL(cfg.OwnerLeaseTTL)
 	if cfg.Log == nil {
 		cfg.Log = func(string, ...any) {}
 	}
@@ -150,38 +137,13 @@ func (h *Handler) WS(w http.ResponseWriter, r *http.Request) {
 			h.cfg.Log("agentdaemon gateway: heartbeat on connect: %v", hbErr)
 		}
 	}
-	var lease *ownerLease
-	if h.cfg.OwnerStore != nil {
-		now := time.Now().UTC()
-		owner, ownerErr := h.cfg.OwnerStore.ClaimAgentDaemonDeviceOwner(r.Context(), runtimedevice.ClaimOwner{
-			DeviceID:       auth.DeviceID,
-			WorkspaceID:    auth.WorkspaceID,
-			OwnerPodID:     h.cfg.OwnerPodID,
-			OwnerURL:       h.cfg.OwnerURL,
-			Now:            now,
-			LeaseExpiresAt: now.Add(h.cfg.OwnerLeaseTTL),
-		})
-		if ownerErr != nil {
-			h.cfg.Log("agentdaemon gateway: owner claim failed: %v", ownerErr)
-			_ = conn.Close()
-			return
-		}
-		lease = &ownerLease{
-			store:      h.cfg.OwnerStore,
-			deviceID:   auth.DeviceID,
-			ownerPodID: owner.OwnerPodID,
-			ownerURL:   owner.OwnerURL,
-			generation: owner.Generation,
-			ttl:        h.cfg.OwnerLeaseTTL,
-		}
-	}
-	sess := NewSessionWithOwner(conn, auth.DeviceID, auth.WorkspaceID, version, h.cfg.Registry, h.cfg.Log, lease)
+	sess := NewSession(conn, auth.DeviceID, auth.WorkspaceID, version, h.cfg.Registry, h.cfg.Log)
 	sess.eventCredit = eventCredit
 	sess.heartbeat = h.cfg.Heartbeat
 	sess.archivedCancellations = h.cfg.ArchivedCancellations
 	sess.credentialHash = runtimedevice.HashCredential(token)
-	h.cfg.Log("agentdaemon gateway: ws upgrade ok, registering device_id=%s owner_pod=%s waiters=%d",
-		auth.DeviceID, h.cfg.OwnerPodID, len(h.cfg.Registry.PendingWaiters(auth.DeviceID)))
+	h.cfg.Log("agentdaemon gateway: ws upgrade ok, registering device_id=%s waiters=%d",
+		auth.DeviceID, len(h.cfg.Registry.PendingWaiters(auth.DeviceID)))
 	if prev := h.cfg.Registry.Register(sess); prev != nil {
 		// Latest dial-in wins; close the zombie out-of-band.
 		prev.Close("preempted by newer connection from same device_id")
@@ -237,54 +199,6 @@ func (h *Handler) Bootstrap(w http.ResponseWriter, r *http.Request) {
 	_ = json.NewEncoder(w).Encode(resp)
 }
 
-// DeviceStatus is a lightweight liveness probe the daemon hits before
-// the WS dial.
-func (h *Handler) DeviceStatus(w http.ResponseWriter, r *http.Request) {
-	bearer := bearerFromAuthHeader(r)
-	if bearer == "" {
-		writeAuthError(w, http.StatusUnauthorized, "missing_bearer", "")
-		return
-	}
-	deviceID := r.URL.Query().Get("device_id")
-	if deviceID == "" {
-		writeAuthError(w, http.StatusBadRequest, "missing_device_id", "device_id query param required")
-		return
-	}
-	auth, err := h.cfg.Authenticator.AuthenticateBearer(r.Context(), deviceID, bearer)
-	if err != nil {
-		status, code := mapAuthError(err)
-		h.cfg.Log("agentdaemon gateway: device-status auth rejected device_id=%s code=%s status=%d err=%v",
-			deviceID, code, status, err)
-		writeAuthError(w, status, code, err.Error())
-		return
-	}
-	_, regErr := h.cfg.Registry.LookupDevice(auth.DeviceID)
-	online := regErr == nil
-	var owner map[string]any
-	if h.cfg.OwnerStore != nil {
-		if current, ok, ownerErr := h.cfg.OwnerStore.GetAgentDaemonDeviceOwner(r.Context(), auth.DeviceID); ownerErr != nil {
-			h.cfg.Log("agentdaemon gateway: device-status owner lookup failed: %v", ownerErr)
-		} else if ok {
-			leaseOnline := current.Status == runtimedevice.OwnerStatusConnected && current.LeaseExpiresAt.After(time.Now().UTC())
-			online = online || leaseOnline
-			owner = map[string]any{
-				"owner_pod_id":     current.OwnerPodID,
-				"owner_url":        current.OwnerURL,
-				"generation":       current.Generation,
-				"status":           current.Status,
-				"lease_expires_at": current.LeaseExpiresAt,
-			}
-		}
-	}
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(http.StatusOK)
-	_ = json.NewEncoder(w).Encode(map[string]any{
-		"device_id": auth.DeviceID,
-		"online":    online,
-		"owner":     owner,
-	})
-}
-
 // ----------------------------------------------------------------------
 // helpers
 // ----------------------------------------------------------------------
diff --git a/services/core/internal/runtimegateway/handler_test.go b/services/core/internal/runtimegateway/handler_test.go
index bd33e37c2..df89ef4c5 100644
--- a/services/core/internal/runtimegateway/handler_test.go
+++ b/services/core/internal/runtimegateway/handler_test.go
@@ -85,7 +85,7 @@ func TestWebSocketNegotiatesEventCredit(t *testing.T) {
 			if tc.offer != nil {
 				header[proto.ExecutionFlowHeader] = tc.offer
 			}
-			conn, resp, err := websocket.DefaultDialer.Dial("ws"+strings.TrimPrefix(server.URL, "http")+"?device_id=device&version=0.16.0", header)
+			conn, resp, err := websocket.DefaultDialer.Dial("ws"+strings.TrimPrefix(server.URL, "http")+"?device_id=device&version="+proto.Version, header)
 			if resp == nil {
 				t.Fatal(err)
 			}
diff --git a/services/core/internal/runtimegateway/heartbeat_observation_test.go b/services/core/internal/runtimegateway/heartbeat_observation_test.go
index 1004d87bf..271688014 100644
--- a/services/core/internal/runtimegateway/heartbeat_observation_test.go
+++ b/services/core/internal/runtimegateway/heartbeat_observation_test.go
@@ -42,7 +42,7 @@ func TestHeartbeatObservationStoreOutcomes(t *testing.T) {
 			old := slog.Default()
 			slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, nil)))
 			defer slog.SetDefault(old)
-			s := NewSession(newFakeConn(), "11111111-1111-4111-8111-111111111111", "tenant", "test", nil, nil)
+			s := newTestSession(newFakeConn(), "11111111-1111-4111-8111-111111111111", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			s.heartbeat = &observationHeartbeatStore{err: test.err, deleted: test.deleted}
 			env, _ := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{})
@@ -78,7 +78,7 @@ func TestHeartbeatObservationCloseDuringStore(t *testing.T) {
 	old := slog.Default()
 	slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, nil)))
 	defer slog.SetDefault(old)
-	s := NewSession(newFakeConn(), "11111111-1111-4111-8111-111111111111", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "11111111-1111-4111-8111-111111111111", "tenant", "test", nil, nil)
 	store := &observationHeartbeatStore{entered: make(chan struct{}), release: make(chan struct{})}
 	s.heartbeat = store
 	env, _ := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{})
@@ -111,7 +111,7 @@ func TestHeartbeatObservedTextHandlerScalarFixture(t *testing.T) {
 	previous := slog.Default()
 	slog.SetDefault(slog.New(slog.NewTextHandler(&logs, nil)))
 	defer slog.SetDefault(previous)
-	s := NewSession(newFakeConn(), "11111111-1111-4111-8111-111111111111", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "11111111-1111-4111-8111-111111111111", "tenant", "test", nil, nil)
 	s.heartbeat = &observationHeartbeatStore{err: context.Canceled}
 	env, _ := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{})
 	s.handleHeartbeat(env)
diff --git a/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go b/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go
index c0cfe329f..4a11b0739 100644
--- a/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go
+++ b/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go
@@ -96,7 +96,7 @@ func TestLiveMCPBearerGatewayColdContinuation(t *testing.T) {
 		turn := &mcpBearerTurn{}
 		turns = append(turns, turn)
 		runID, prepareID := uuid.NewString(), uuid.NewString()
-		request := proto.PromptRequestPayload{AgentKind: "codex", AgentStateKey: "agents-api-mcp-bearer-acceptance", AgentSessionID: resume, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, MCPHTTPServers: &servers, AgentOptions: map[string]any{"model": "MiniMax-M3"}, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
+		request := proto.PromptRequestPayload{AgentKind: "codex", AgentStateKey: "mcp-bearer-acceptance", AgentSessionID: resume, DisableExecutionEnvironment: true, DisableSubagents: true, MCPHTTPServers: &servers, AgentOptions: map[string]any{"model": "MiniMax-M3"}, ExecutionControls: &proto.ExecutionControls{TextVerbosity: "medium"}}
 		send := func(kind, id string, payload any) {
 			t.Helper()
 			envelope, err := proto.NewEnvelope(kind, id, payload)
diff --git a/services/core/internal/runtimegateway/owner.go b/services/core/internal/runtimegateway/owner.go
deleted file mode 100644
index 9155c5347..000000000
--- a/services/core/internal/runtimegateway/owner.go
+++ /dev/null
@@ -1,35 +0,0 @@
-package runtimegateway
-
-import (
-	"context"
-	"time"
-
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimedevice"
-)
-
-const defaultOwnerLeaseTTL = 90 * time.Second
-
-// DeviceOwnerStore is the DB-backed owner lease surface used by the
-// gateway.
-type DeviceOwnerStore interface {
-	ClaimAgentDaemonDeviceOwner(ctx context.Context, input runtimedevice.ClaimOwner) (runtimedevice.Owner, error)
-	RenewAgentDaemonDeviceOwner(ctx context.Context, input runtimedevice.RenewOwner) (runtimedevice.Owner, bool, error)
-	ReleaseAgentDaemonDeviceOwner(ctx context.Context, input runtimedevice.ReleaseOwner) (bool, error)
-	GetAgentDaemonDeviceOwner(ctx context.Context, deviceID string) (runtimedevice.Owner, bool, error)
-}
-
-type ownerLease struct {
-	store      DeviceOwnerStore
-	deviceID   string
-	ownerPodID string
-	ownerURL   string
-	generation int64
-	ttl        time.Duration
-}
-
-func normalizeOwnerTTL(ttl time.Duration) time.Duration {
-	if ttl <= 0 {
-		return defaultOwnerLeaseTTL
-	}
-	return ttl
-}
diff --git a/services/core/internal/runtimegateway/owner_test.go b/services/core/internal/runtimegateway/owner_test.go
deleted file mode 100644
index 09ace7043..000000000
--- a/services/core/internal/runtimegateway/owner_test.go
+++ /dev/null
@@ -1,75 +0,0 @@
-package runtimegateway
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimedevice"
-)
-
-type fakeOwnerStore struct {
-	renewOK      bool
-	renewCalls   int
-	releaseCalls int
-	releaseCh    chan struct{}
-	lastRenewGen int64
-}
-
-func (f *fakeOwnerStore) ClaimAgentDaemonDeviceOwner(context.Context, runtimedevice.ClaimOwner) (runtimedevice.Owner, error) {
-	return runtimedevice.Owner{}, nil
-}
-
-func (f *fakeOwnerStore) RenewAgentDaemonDeviceOwner(_ context.Context, in runtimedevice.RenewOwner) (runtimedevice.Owner, bool, error) {
-	f.renewCalls++
-	f.lastRenewGen = in.Generation
-	return runtimedevice.Owner{}, f.renewOK, nil
-}
-
-func (f *fakeOwnerStore) ReleaseAgentDaemonDeviceOwner(context.Context, runtimedevice.ReleaseOwner) (bool, error) {
-	f.releaseCalls++
-	if f.releaseCh != nil {
-		select {
-		case <-f.releaseCh:
-		default:
-			close(f.releaseCh)
-		}
-	}
-	return true, nil
-}
-
-func (f *fakeOwnerStore) GetAgentDaemonDeviceOwner(context.Context, string) (runtimedevice.Owner, bool, error) {
-	return runtimedevice.Owner{}, false, nil
-}
-
-func TestSessionOwnerLeaseLostClosesStaleConnection(t *testing.T) {
-	reg := NewRegistry()
-	conn := newFakeConn()
-	owners := &fakeOwnerStore{renewOK: false, releaseCh: make(chan struct{})}
-	lease := &ownerLease{store: owners, deviceID: "dev-1", ownerPodID: "pod-a", generation: 7, ttl: time.Minute}
-	sess := NewSessionWithOwner(conn, "dev-1", "wks-1", proto.Version, reg, func(string, ...any) {}, lease)
-	reg.Register(sess)
-	sess.Start()
-
-	heartbeat, _ := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{})
-	raw, _ := jsonMarshal(heartbeat)
-	conn.Feed(raw)
-
-	select {
-	case <-sess.Closed():
-	case <-time.After(2 * time.Second):
-		t.Fatal("session did not close after owner renew returned false")
-	}
-	if owners.renewCalls == 0 || owners.lastRenewGen != 7 {
-		t.Fatalf("renew not called with generation 7: calls=%d gen=%d", owners.renewCalls, owners.lastRenewGen)
-	}
-	select {
-	case <-owners.releaseCh:
-	case <-time.After(2 * time.Second):
-		t.Fatal("release not called on close")
-	}
-	if owners.releaseCalls == 0 {
-		t.Fatal("release count not incremented")
-	}
-}
diff --git a/services/core/internal/runtimegateway/preparation_test.go b/services/core/internal/runtimegateway/preparation_test.go
index b4383a498..421faf5a8 100644
--- a/services/core/internal/runtimegateway/preparation_test.go
+++ b/services/core/internal/runtimegateway/preparation_test.go
@@ -10,7 +10,7 @@ import (
 
 func TestPreparationSubscriptionHasNoRunIdentityAndOrdersRevisions(t *testing.T) {
 	registry := NewRegistry()
-	s := NewSession(newFakeConn(), "device", "tenant", "test", registry, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", registry, nil)
 	defer s.Close("test")
 	sub, err := s.SubscribePreparation("request")
 	if err != nil {
@@ -48,7 +48,7 @@ func TestPreparationSubscriptionHasNoRunIdentityAndOrdersRevisions(t *testing.T)
 
 func TestPreparationCloseAndOverflowDoNotInventRunEvents(t *testing.T) {
 	for _, overflow := range []bool{false, true} {
-		s := NewSession(newFakeConn(), "device", "tenant", "test", NewRegistry(), nil)
+		s := newTestSession(newFakeConn(), "device", "tenant", "test", NewRegistry(), nil)
 		sub, err := s.SubscribePreparation("request")
 		if err != nil {
 			t.Fatal(err)
diff --git a/services/core/internal/runtimegateway/registry.go b/services/core/internal/runtimegateway/registry.go
index 4b4c3a78b..f20f05b0b 100644
--- a/services/core/internal/runtimegateway/registry.go
+++ b/services/core/internal/runtimegateway/registry.go
@@ -39,7 +39,11 @@ type Registry struct {
 	// is inserted into byDevice. Buffered(1) so a Register that
 	// happens between WaitForDevice registering and selecting on the
 	// chan still wakes the waiter.
-	waiters         map[string][]chan *Session
+	waiters map[string][]chan *Session
+
+	// announced coalesces "a session reported its agent kinds for the first
+	// time" for the one owner that waits on known kinds.
+	announced       chan struct{}
 	capabilityHints chan struct{}
 }
 
@@ -50,10 +54,22 @@ func NewRegistry() *Registry {
 		byDevice:        map[string]*Session{},
 		byRun:           map[string]*Session{},
 		waiters:         map[string][]chan *Session{},
+		announced:       make(chan struct{}, 1),
 		capabilityHints: make(chan struct{}, 1),
 	}
 }
 
+// Announced signals after a session first reports its agent kinds. Polling
+// recovers a coalesced signal.
+func (r *Registry) Announced() <-chan struct{} { return r.announced }
+
+func (r *Registry) announce() {
+	select {
+	case r.announced <- struct{}{}:
+	default:
+	}
+}
+
 // Register adds a freshly-upgraded session under its deviceID. The
 // latest dial-in wins: if a session was already registered for that
 // device, the old one's run index entries are evicted (the caller
diff --git a/services/core/internal/runtimegateway/registry_test.go b/services/core/internal/runtimegateway/registry_test.go
index e67e87ccd..34a55af4b 100644
--- a/services/core/internal/runtimegateway/registry_test.go
+++ b/services/core/internal/runtimegateway/registry_test.go
@@ -10,7 +10,7 @@ import (
 
 func TestWaitForDevice_FastPath(t *testing.T) {
 	reg := NewRegistry()
-	sess := NewSession(newFakeConn(), "dev-warm", "wks-1", "0.1.0", reg, nil)
+	sess := newTestSession(newFakeConn(), "dev-warm", "wks-1", "0.1.0", reg, nil)
 	reg.Register(sess)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
@@ -27,7 +27,7 @@ func TestWaitForDevice_FastPath(t *testing.T) {
 
 func TestWaitForDevice_SignalledByRegister(t *testing.T) {
 	reg := NewRegistry()
-	sess := NewSession(newFakeConn(), "dev-cold", "wks-1", "0.1.0", reg, nil)
+	sess := newTestSession(newFakeConn(), "dev-cold", "wks-1", "0.1.0", reg, nil)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
 	defer cancel()
@@ -114,7 +114,7 @@ func TestWaitForDevice_EmptyDeviceID(t *testing.T) {
 // the post-race shape.
 func TestWaitForDevice_DoubleCheckAfterLock(t *testing.T) {
 	reg := NewRegistry()
-	sess := NewSession(newFakeConn(), "dev-race", "wks-1", "0.1.0", reg, nil)
+	sess := newTestSession(newFakeConn(), "dev-race", "wks-1", "0.1.0", reg, nil)
 	reg.Register(sess)
 
 	got, err := reg.WaitForDevice(context.Background(), "dev-race", 100*time.Millisecond)
@@ -137,7 +137,7 @@ func TestWaitForDevice_DoubleCheckAfterLock(t *testing.T) {
 // unblock with the same session.
 func TestWaitForDevice_MultipleWaitersSameDevice(t *testing.T) {
 	reg := NewRegistry()
-	sess := NewSession(newFakeConn(), "dev-shared", "wks-1", "0.1.0", reg, nil)
+	sess := newTestSession(newFakeConn(), "dev-shared", "wks-1", "0.1.0", reg, nil)
 
 	var wg sync.WaitGroup
 	var mu sync.Mutex
@@ -181,7 +181,7 @@ func TestWatchDeviceImmediateDeferredAndUnwatch(t *testing.T) {
 	if len(r.PendingWaiters("late")) != 1 {
 		t.Fatal("rearming duplicated watch")
 	}
-	s := NewSession(newFakeConn(), "late", "workspace", "0.1.0", r, nil)
+	s := newTestSession(newFakeConn(), "late", "workspace", "0.1.0", r, nil)
 	r.Register(s)
 	if got := <-ch; got != s {
 		t.Fatal("wrong registration")
@@ -196,7 +196,7 @@ func TestWatchDeviceImmediateDeferredAndUnwatch(t *testing.T) {
 	r.WatchDevice("removed", ch)
 	r.UnwatchDevice("removed", ch)
 	r.UnwatchDevice("removed", ch)
-	r.Register(NewSession(newFakeConn(), "removed", "workspace", "0.1.0", r, nil))
+	r.Register(newTestSession(newFakeConn(), "removed", "workspace", "0.1.0", r, nil))
 	select {
 	case <-ch:
 		t.Fatal("removed watch fired")
@@ -211,7 +211,7 @@ func TestWatchDeviceSharedChannelCoalescesWithoutBlockingRegistration(t *testing
 		r.WatchDevice(id, ch)
 	}
 	for _, id := range []string{"a", "b"} {
-		r.Register(NewSession(newFakeConn(), id, "workspace", "0.1.0", r, nil))
+		r.Register(newTestSession(newFakeConn(), id, "workspace", "0.1.0", r, nil))
 	}
 	if len(ch) != 1 || len(r.PendingWaiters("a")) != 0 || len(r.PendingWaiters("b")) != 0 {
 		t.Fatal("coalesced registrations retained waiter state")
diff --git a/services/core/internal/runtimegateway/routes.go b/services/core/internal/runtimegateway/routes.go
index d0c098c1e..c8f2dcf51 100644
--- a/services/core/internal/runtimegateway/routes.go
+++ b/services/core/internal/runtimegateway/routes.go
@@ -9,9 +9,8 @@ import (
 //
 //	GET  /agent-daemon/ws            — daemon dial-in (WS upgrade)
 //	POST /agent-daemon/bootstrap     — daemon first-call to fetch wsUrl + heartbeat cadence
-//	GET  /agent-daemon/device-status — daemon self-check
 //
-// All three accept the daemon credential described in
+// Both accept the daemon credential described in
 // contracts/agents-api/machine-api.md.
 func RegisterRoutes(r chi.Router, h *Handler) {
 	if h == nil {
@@ -20,6 +19,5 @@ func RegisterRoutes(r chi.Router, h *Handler) {
 	r.Route("/agent-daemon", func(r chi.Router) {
 		r.Get("/ws", h.WS)
 		r.Post("/bootstrap", h.Bootstrap)
-		r.Get("/device-status", h.DeviceStatus)
 	})
 }
diff --git a/services/core/internal/runtimegateway/runtime_prepare_test.go b/services/core/internal/runtimegateway/runtime_prepare_test.go
index c8ef2ca6e..3be7191b9 100644
--- a/services/core/internal/runtimegateway/runtime_prepare_test.go
+++ b/services/core/internal/runtimegateway/runtime_prepare_test.go
@@ -67,7 +67,7 @@ func noCapabilityFrame(t *testing.T, s *Session) {
 }
 
 func TestCapabilitiesTransfersMoreThanFrameLimitAndCorrelates(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	data := bytes.Repeat([]byte{0, 255, 3}, 2<<20)
 	id := uuid.NewString()
@@ -115,7 +115,7 @@ func TestCapabilitiesTransfersMoreThanFrameLimitAndCorrelates(t *testing.T) {
 }
 
 func TestCapabilitiesFinalizeTransfersNoArchive(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	request := proto.RuntimePreparePayload{BudgetMS: 300000, EnvironmentID: uuid.NewString(), SessionID: uuid.NewString(), Action: "finalize", Sources: &agentcapabilities.Input{}}
 	id := uuid.NewString()
@@ -137,7 +137,7 @@ func TestCapabilitiesFinalizeTransfersNoArchive(t *testing.T) {
 }
 
 func TestCapabilitiesRefusesConflictingArchiveBeforeSending(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	for _, mutate := range []func(*proto.RuntimePreparePayload){
 		func(p *proto.RuntimePreparePayload) { p.SHA256 = "incorrect" },
@@ -163,7 +163,7 @@ func TestCapabilitiesStopsAtTerminalOrMalformedReceipt(t *testing.T) {
 		"unsafe code":         {Outcome: "rejected", ErrorCode: "private detail"},
 	} {
 		t.Run(name, func(t *testing.T) {
-			s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+			s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			id := uuid.NewString()
 			done := beginCapabilities(s, t.Context(), id, skillPreparation(), []byte("data"))
@@ -183,7 +183,7 @@ func TestCapabilitiesStopsAtTerminalOrMalformedReceipt(t *testing.T) {
 }
 
 func TestCapabilitiesRejectsWrongChunkReceipt(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	id := uuid.NewString()
 	done := beginCapabilities(s, t.Context(), id, skillPreparation(), []byte("data"))
@@ -201,7 +201,7 @@ func TestCapabilitiesRejectsWrongChunkReceipt(t *testing.T) {
 func TestCapabilitiesConnectionOwnershipAndUnknownInterruption(t *testing.T) {
 	for _, closeConnection := range []bool{false, true} {
 		t.Run(map[bool]string{false: "deadline", true: "disconnect"}[closeConnection], func(t *testing.T) {
-			s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+			s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			ctx, cancel := context.WithTimeout(t.Context(), 150*time.Millisecond)
 			defer cancel()
@@ -238,7 +238,7 @@ func TestCapabilitiesConnectionOwnershipAndUnknownInterruption(t *testing.T) {
 func TestRuntimeInitialFileChunking(t *testing.T) {
 	for _, size := range []int{0, (4 << 20) + 1} {
 		t.Run(fmt.Sprint(size), func(t *testing.T) {
-			s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+			s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			request := proto.RuntimePreparePayload{BudgetMS: 300000, EnvironmentID: uuid.NewString(), SessionID: uuid.NewString(), Action: "file", File: &proto.RuntimeInitialFile{Path: "/workspace/project/file"}}
 			data := bytes.Repeat([]byte("z"), size)
@@ -288,7 +288,7 @@ func TestRuntimeInitialFileChunking(t *testing.T) {
 func TestRuntimeInitializationNoDataAndExitReceipt(t *testing.T) {
 	for _, exit := range []int{0, 42, 256} {
 		t.Run(fmt.Sprint(exit), func(t *testing.T) {
-			s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+			s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			request := proto.RuntimePreparePayload{BudgetMS: 300000, EnvironmentID: uuid.NewString(), SessionID: uuid.NewString(), Action: "initialize", Initialization: &proto.RuntimeInitialization{Action: "setup", Command: "echo test"}}
 			if _, err := s.PrepareRuntime(t.Context(), uuid.NewString(), request, []byte("forbidden")); err == nil {
@@ -333,7 +333,7 @@ func TestRuntimePreparationSeparatesTransferAndApplyBudgets(t *testing.T) {
 	for _, commit := range []bool{false, true} {
 		t.Run(fmt.Sprint(commit), func(t *testing.T) {
 			synctest.Test(t, func(t *testing.T) {
-				s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+				s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 				defer s.Close("test")
 				request := proto.RuntimePreparePayload{BudgetMS: 300000, EnvironmentID: uuid.NewString(), SessionID: uuid.NewString(), Action: "initialize", Initialization: &proto.RuntimeInitialization{Action: "configure"}}
 				id := uuid.NewString()
@@ -374,7 +374,7 @@ func TestRuntimePreparationSeparatesTransferAndApplyBudgets(t *testing.T) {
 func TestRuntimePreparationCommittedApplyStopsWaitingOnDisconnectOrCallerDeadline(t *testing.T) {
 	for _, disconnect := range []bool{false, true} {
 		t.Run(fmt.Sprint(disconnect), func(t *testing.T) {
-			s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+			s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			ctx, cancel := context.WithTimeout(t.Context(), 100*time.Millisecond)
 			defer cancel()
diff --git a/services/core/internal/runtimegateway/session.go b/services/core/internal/runtimegateway/session.go
index 8c113904a..8f3832067 100644
--- a/services/core/internal/runtimegateway/session.go
+++ b/services/core/internal/runtimegateway/session.go
@@ -84,12 +84,6 @@ type Session struct {
 	log  SessionLogger
 	reg  *Registry
 
-	// owner is non-nil in multi-pod mode. It fences this WebSocket
-	// against the DB owner row so stale connections from an older pod
-	// cannot keep handling prompts after a reconnect claimed a newer
-	// generation.
-	owner *ownerLease
-
 	// heartbeat persists daemon-advertised capability snapshots.
 	firstHeartbeat heartbeatObservation
 	heartbeat      HeartbeatTouch
@@ -149,12 +143,10 @@ type Session struct {
 	closed    chan struct{}
 }
 
-// NewSessionWithOwner wires a freshly-upgraded WS connection into a Session
-// with an optional DB-backed owner lease. Multi-pod deployments pass the lease
-// returned by ClaimAgentDaemonDeviceOwner so heartbeats can fence stale
-// connections. The session does NOT start its goroutines automatically — Start
-// runs once the handler is ready so the session can't race with response writes.
-func NewSessionWithOwner(conn WSConn, deviceID, workspaceID, daemonVersion string, reg *Registry, log SessionLogger, owner *ownerLease) *Session {
+// NewSession wires a freshly-upgraded WS connection into a Session. The session
+// does NOT start its goroutines automatically — Start runs once the handler is
+// ready so the session can't race with response writes.
+func NewSession(conn WSConn, deviceID, workspaceID, daemonVersion string, reg *Registry, log SessionLogger) *Session {
 	now := time.Now()
 	return &Session{
 		DeviceID:            deviceID,
@@ -165,7 +157,6 @@ func NewSessionWithOwner(conn WSConn, deviceID, workspaceID, daemonVersion strin
 		conn:                conn,
 		log:                 log,
 		reg:                 reg,
-		owner:               owner,
 		lastSeenAt:          now,
 		subs:                map[string]*Subscription{},
 		preparations:        map[string]*preparationSubscription{},
@@ -228,17 +219,20 @@ func (s *Session) AgentKindStatus(kind string) (info runtimedevice.SupportedAgen
 	return runtimedevice.SupportedAgentKind{}, false, true
 }
 
-func (s *Session) setSupportedAgentKinds(kinds []runtimedevice.SupportedAgentKind) {
+// setSupportedAgentKinds reports whether these are the session's first kinds.
+func (s *Session) setSupportedAgentKinds(kinds []runtimedevice.SupportedAgentKind) (first bool) {
 	copyKinds := make([]runtimedevice.SupportedAgentKind, len(kinds))
 	copy(copyKinds, kinds)
 	s.kindsMu.Lock()
 	changed := !s.kindsSeen || !reflect.DeepEqual(s.supportedKinds, copyKinds)
+	first = !s.kindsSeen
 	s.kindsSeen = true
 	s.supportedKinds = copyKinds
 	if changed {
 		s.capabilityObservationPending = true
 	}
 	s.kindsMu.Unlock()
+	return first
 }
 
 // A failed authorization or persistence check retains the diagnostic change
@@ -275,7 +269,6 @@ func (s *Session) Close(reason string) {
 		s.closeWorkspaceWrites()
 		s.closeCapabilities()
 		s.closeWorkspaceExports()
-		s.releaseOwnerLease()
 	})
 	s.firstHeartbeat.finish(s, "unknown")
 }
@@ -424,9 +417,6 @@ func (s *Session) readLoop() {
 		readReturned := time.Now()
 		if !s.receiptDraining() {
 			s.markSeen()
-			if !s.renewOwnerLease() {
-				return
-			}
 		}
 
 		decodeStarted := time.Now()
@@ -457,48 +447,6 @@ func (s *Session) markSeen() {
 	s.hbMu.Unlock()
 }
 
-func (s *Session) renewOwnerLease() bool {
-	if s.owner == nil || s.owner.store == nil {
-		return true
-	}
-	now := time.Now().UTC()
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
-	_, ok, err := s.owner.store.RenewAgentDaemonDeviceOwner(ctx, runtimedevice.RenewOwner{
-		DeviceID:       s.owner.deviceID,
-		OwnerPodID:     s.owner.ownerPodID,
-		Generation:     s.owner.generation,
-		Now:            now,
-		LeaseExpiresAt: now.Add(normalizeOwnerTTL(s.owner.ttl)),
-	})
-	if err != nil {
-		s.log("agentdaemon gateway: owner lease renew failed device=%s generation=%d: %v", s.DeviceID, s.owner.generation, err)
-		s.Close("owner lease renew failed")
-		return false
-	}
-	if !ok {
-		s.log("agentdaemon gateway: owner lease lost device=%s generation=%d", s.DeviceID, s.owner.generation)
-		s.Close("owner lease lost to a newer connection")
-		return false
-	}
-	return true
-}
-
-func (s *Session) releaseOwnerLease() {
-	if s.owner == nil || s.owner.store == nil {
-		return
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
-	if _, err := s.owner.store.ReleaseAgentDaemonDeviceOwner(ctx, runtimedevice.ReleaseOwner{
-		DeviceID:   s.owner.deviceID,
-		OwnerPodID: s.owner.ownerPodID,
-		Generation: s.owner.generation,
-	}); err != nil {
-		s.log("agentdaemon gateway: owner lease release failed device=%s generation=%d: %v", s.DeviceID, s.owner.generation, err)
-	}
-}
-
 func (s *Session) handleHeartbeat(env proto.Envelope) {
 	observing := s.firstHeartbeat.begin()
 	defer func() {
@@ -523,7 +471,9 @@ func (s *Session) handleHeartbeat(env proto.Envelope) {
 	}
 	started = time.Now()
 	kinds := deviceKindsFromHeartbeat(p)
-	s.setSupportedAgentKinds(kinds)
+	if s.setSupportedAgentKinds(kinds) {
+		s.reg.announce()
+	}
 	if observing {
 		s.firstHeartbeat.record("capability_set_ms", started)
 	}
@@ -595,33 +545,29 @@ func deviceKindsFromHeartbeat(p proto.HeartbeatPayload) []runtimedevice.Supporte
 				Streaming:             info.Capabilities.Streaming.IsSupported(),
 				Usage:                 info.Capabilities.Usage.IsSupported(),
 				Resume:                info.Capabilities.Resume.IsSupported(),
-				Steering:              info.Capabilities.Steering.IsSupported(),
 				DurableTurns:          info.Capabilities.DurableTurns.IsSupported(),
 				DurableInputReceipts:  info.Capabilities.DurableInputReceipts.IsSupported(),
 				NativeSessionRecovery: info.Capabilities.NativeSessionRecovery.IsSupported(),
 				RetainedNativeHistory: info.Capabilities.RetainedNativeHistory.IsSupported(),
 				MessageItems:          info.Capabilities.MessageItems.IsSupported(),
 
-				ToolObservations:               info.Capabilities.ToolObservations.IsSupported(),
-				EnvironmentNone:                info.Capabilities.EnvironmentNone.IsSupported(),
-				LocalEnvironment:               info.Capabilities.LocalEnvironment.IsSupported(),
-				Preparation:                    info.Capabilities.Preparation.IsSupported(),
-				WorkspaceReadPreparation:       info.Capabilities.WorkspaceReadPreparation.IsSupported(),
-				WorkspaceOutputExport:          info.Capabilities.WorkspaceOutputExport.IsSupported(),
-				WebSearchControl:               info.Capabilities.WebSearchControl.IsSupported(),
-				ProgrammaticToolCallingDisable: info.Capabilities.ProgrammaticToolCallingDisable.IsSupported(),
-				TextVerbosity:                  info.Capabilities.TextVerbosity.IsSupported(),
-				StructuredOutput:               info.Capabilities.StructuredOutput.IsSupported(),
-				ToolSearch:                     info.Capabilities.ToolSearch.IsSupported(),
-				MessageImages:                  info.Capabilities.MessageImages.IsSupported(),
-				FunctionResultImages:           info.Capabilities.FunctionResultImages.IsSupported(),
-				ExecutionControls:              info.Capabilities.ExecutionControls.IsSupported(),
-				SubagentControl:                info.Capabilities.SubagentControl.IsSupported(),
-				SubagentObservations:           info.Capabilities.SubagentObservations.IsSupported(),
-				FunctionTools:                  info.Capabilities.FunctionTools.IsSupported(),
-				MCPHTTPTools:                   info.Capabilities.MCPHTTPTools.IsSupported(),
-				MCPHTTPRequired:                info.Capabilities.MCPHTTPRequired.IsSupported(),
-				MCPHTTPBearerAuth:              info.Capabilities.MCPHTTPBearerAuth.IsSupported(),
+				ToolObservations:         info.Capabilities.ToolObservations.IsSupported(),
+				EnvironmentNone:          info.Capabilities.EnvironmentNone.IsSupported(),
+				LocalEnvironment:         info.Capabilities.LocalEnvironment.IsSupported(),
+				Preparation:              info.Capabilities.Preparation.IsSupported(),
+				WorkspaceReadPreparation: info.Capabilities.WorkspaceReadPreparation.IsSupported(),
+				WorkspaceOutputExport:    info.Capabilities.WorkspaceOutputExport.IsSupported(),
+				StructuredOutput:         info.Capabilities.StructuredOutput.IsSupported(),
+				ToolSearch:               info.Capabilities.ToolSearch.IsSupported(),
+				MessageImages:            info.Capabilities.MessageImages.IsSupported(),
+				FunctionResultImages:     info.Capabilities.FunctionResultImages.IsSupported(),
+				ExecutionControls:        info.Capabilities.ExecutionControls.IsSupported(),
+				SubagentControl:          info.Capabilities.SubagentControl.IsSupported(),
+				SubagentObservations:     info.Capabilities.SubagentObservations.IsSupported(),
+				FunctionTools:            info.Capabilities.FunctionTools.IsSupported(),
+				MCPHTTPTools:             info.Capabilities.MCPHTTPTools.IsSupported(),
+				MCPHTTPRequired:          info.Capabilities.MCPHTTPRequired.IsSupported(),
+				MCPHTTPBearerAuth:        info.Capabilities.MCPHTTPBearerAuth.IsSupported(),
 			},
 		})
 	}
diff --git a/services/core/internal/runtimegateway/session_test.go b/services/core/internal/runtimegateway/session_test.go
index c4e27e0f3..32cb3f7d0 100644
--- a/services/core/internal/runtimegateway/session_test.go
+++ b/services/core/internal/runtimegateway/session_test.go
@@ -14,15 +14,15 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimedevice"
 )
 
-// NewSession builds an unowned Session over a test connection.
-func NewSession(conn WSConn, deviceID, workspaceID, daemonVersion string, reg *Registry, log SessionLogger) *Session {
+// newTestSession builds a Session over a test connection, defaulting the log and Registry.
+func newTestSession(conn WSConn, deviceID, workspaceID, daemonVersion string, reg *Registry, log SessionLogger) *Session {
 	if log == nil {
 		log = func(string, ...any) {}
 	}
 	if reg == nil {
 		reg = NewRegistry()
 	}
-	return NewSessionWithOwner(conn, deviceID, workspaceID, daemonVersion, reg, log, nil)
+	return NewSession(conn, deviceID, workspaceID, daemonVersion, reg, log)
 }
 
 // fakeConn is the WSConn implementation used by session + registry
@@ -158,7 +158,7 @@ func (f *fakeHeartbeatStore) waitDaemonHeartbeat(t *testing.T) runtimedevice.Hea
 
 func TestRegistry_RegisterAndLookup(t *testing.T) {
 	reg := NewRegistry()
-	sess := NewSession(newFakeConn(), "dev-1", "wks-1", "0.1.0", reg, nil)
+	sess := newTestSession(newFakeConn(), "dev-1", "wks-1", "0.1.0", reg, nil)
 	if prev := reg.Register(sess); prev != nil {
 		t.Fatalf("first Register returned non-nil prev")
 	}
@@ -170,11 +170,11 @@ func TestRegistry_RegisterAndLookup(t *testing.T) {
 
 func TestRegistry_RegisterReplacesAndEvictsRuns(t *testing.T) {
 	reg := NewRegistry()
-	old := NewSession(newFakeConn(), "dev-1", "wks-1", "0.1.0", reg, nil)
+	old := newTestSession(newFakeConn(), "dev-1", "wks-1", "0.1.0", reg, nil)
 	reg.Register(old)
 	reg.AttachRun("run-1", old)
 
-	new := NewSession(newFakeConn(), "dev-1", "wks-1", "0.1.0", reg, nil)
+	new := newTestSession(newFakeConn(), "dev-1", "wks-1", "0.1.0", reg, nil)
 	prev := reg.Register(new)
 	if prev != old {
 		t.Fatalf("expected old session as displaced previous, got %p", prev)
@@ -188,9 +188,9 @@ func TestRegistry_RegisterReplacesAndEvictsRuns(t *testing.T) {
 
 func TestRegistry_DeregisterPreservesNewer(t *testing.T) {
 	reg := NewRegistry()
-	old := NewSession(newFakeConn(), "dev-1", "wks-1", "0.1.0", reg, nil)
+	old := newTestSession(newFakeConn(), "dev-1", "wks-1", "0.1.0", reg, nil)
 	reg.Register(old)
-	new := NewSession(newFakeConn(), "dev-1", "wks-1", "0.1.0", reg, nil)
+	new := newTestSession(newFakeConn(), "dev-1", "wks-1", "0.1.0", reg, nil)
 	reg.Register(new)
 	// A stale Deregister from the old session (e.g. its read loop
 	// wakes after preemption) must NOT remove the new session.
@@ -206,7 +206,7 @@ func TestRegistry_DeregisterPreservesNewer(t *testing.T) {
 func TestSession_DispatchDeliversToSubscriber(t *testing.T) {
 	reg := NewRegistry()
 	conn := newFakeConn()
-	sess := NewSession(conn, "dev-1", "wks-1", "0.1.0", reg, nil)
+	sess := newTestSession(conn, "dev-1", "wks-1", "0.1.0", reg, nil)
 	sess.Start()
 	defer sess.Close("test done")
 
@@ -232,7 +232,7 @@ func TestSession_DispatchDeliversToSubscriber(t *testing.T) {
 func TestSession_DoneFrameAutoUnsubscribes(t *testing.T) {
 	reg := NewRegistry()
 	conn := newFakeConn()
-	sess := NewSession(conn, "dev-1", "wks-1", "0.1.0", reg, nil)
+	sess := newTestSession(conn, "dev-1", "wks-1", "0.1.0", reg, nil)
 	sess.Start()
 	defer sess.Close("test done")
 
@@ -265,7 +265,7 @@ func TestSession_DoneFrameAutoUnsubscribes(t *testing.T) {
 }
 
 func TestSession_CloseReportsUnknownWithoutExecutionEvents(t *testing.T) {
-	sess := NewSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
+	sess := newTestSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
 	sub, err := sess.SubscribeDurable("run")
 	if err != nil {
 		t.Fatal(err)
@@ -280,7 +280,7 @@ func TestSession_CloseReportsUnknownWithoutExecutionEvents(t *testing.T) {
 }
 
 func TestSession_NoCapabilitiesBeforeHeartbeat(t *testing.T) {
-	sess := NewSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
+	sess := newTestSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
 	defer sess.Close("test done")
 	for _, kind := range []string{"fake_alpha", "codex", "contract"} {
 		if info, found, known := sess.AgentKindStatus(kind); found || known || info.Available {
@@ -291,7 +291,7 @@ func TestSession_NoCapabilitiesBeforeHeartbeat(t *testing.T) {
 
 func TestSession_SendOnClosedReturnsError(t *testing.T) {
 	reg := NewRegistry()
-	sess := NewSession(newFakeConn(), "dev-1", "wks-1", "0.1.0", reg, nil)
+	sess := newTestSession(newFakeConn(), "dev-1", "wks-1", "0.1.0", reg, nil)
 	sess.Close("never started")
 	env, _ := proto.NewEnvelope(proto.TypePromptCancel, "run-1", nil)
 	err := sess.Send(context.Background(), env)
@@ -303,7 +303,7 @@ func TestSession_SendOnClosedReturnsError(t *testing.T) {
 func TestSession_SendWritesToWire(t *testing.T) {
 	reg := NewRegistry()
 	conn := newFakeConn()
-	sess := NewSession(conn, "dev-1", "wks-1", "0.1.0", reg, nil)
+	sess := newTestSession(conn, "dev-1", "wks-1", "0.1.0", reg, nil)
 	sess.Start()
 	defer sess.Close("test done")
 
@@ -332,7 +332,7 @@ func TestSession_HeartbeatPersistsSupportedAgentKinds(t *testing.T) {
 	reg := NewRegistry()
 	conn := newFakeConn()
 	heartbeat := newFakeHeartbeatStore()
-	sess := NewSession(conn, "dev-1", "wks-1", "0.1.0", reg, nil)
+	sess := newTestSession(conn, "dev-1", "wks-1", "0.1.0", reg, nil)
 	sess.heartbeat = heartbeat
 	sess.Start()
 	defer sess.Close("test done")
@@ -363,7 +363,7 @@ func TestSession_HeartbeatPersistsSupportedAgentKinds(t *testing.T) {
 			{
 				Kind:         "codex",
 				Available:    true,
-				Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{MCPHTTPTools: proto.CapabilitySupported, Steering: proto.CapabilitySupported, MessageItems: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, WebSearchControl: proto.CapabilitySupported, TextVerbosity: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported}),
+				Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{MCPHTTPTools: proto.CapabilitySupported, MessageItems: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported}),
 			},
 		},
 	})
@@ -389,15 +389,15 @@ func TestSession_HeartbeatPersistsSupportedAgentKinds(t *testing.T) {
 	if fake_beta.Available || fake_beta.Version != "missing" || !fake_beta.Capabilities.Streaming {
 		t.Fatalf("fake_beta descriptor not converted: %#v", fake_beta)
 	}
-	if !byKind["codex"].Capabilities.ExecutionControls || claude.Capabilities.ExecutionControls || fake_beta.Capabilities.ExecutionControls || !byKind["codex"].Capabilities.ToolObservations || claude.Capabilities.ToolObservations || fake_beta.Capabilities.ToolObservations || !byKind["codex"].Capabilities.SubagentControl || claude.Capabilities.SubagentControl || fake_beta.Capabilities.SubagentControl || !byKind["codex"].Capabilities.TextVerbosity || claude.Capabilities.TextVerbosity || fake_beta.Capabilities.TextVerbosity || !byKind["codex"].Capabilities.WebSearchControl || claude.Capabilities.WebSearchControl || fake_beta.Capabilities.WebSearchControl || !byKind["codex"].Capabilities.EnvironmentNone || claude.Capabilities.EnvironmentNone || fake_beta.Capabilities.EnvironmentNone || !byKind["codex"].Capabilities.MessageItems || !byKind["codex"].Capabilities.Steering || claude.Capabilities.Steering || fake_beta.Capabilities.Steering {
-		t.Fatalf("steering capability not preserved: %#v", byKind)
+	if !byKind["codex"].Capabilities.ExecutionControls || claude.Capabilities.ExecutionControls || fake_beta.Capabilities.ExecutionControls || !byKind["codex"].Capabilities.ToolObservations || claude.Capabilities.ToolObservations || fake_beta.Capabilities.ToolObservations || !byKind["codex"].Capabilities.SubagentControl || claude.Capabilities.SubagentControl || fake_beta.Capabilities.SubagentControl || !byKind["codex"].Capabilities.EnvironmentNone || claude.Capabilities.EnvironmentNone || fake_beta.Capabilities.EnvironmentNone || !byKind["codex"].Capabilities.MessageItems {
+		t.Fatalf("capabilities not preserved: %#v", byKind)
 	}
 	if !byKind["codex"].Capabilities.MCPHTTPTools || claude.Capabilities.MCPHTTPTools || fake_beta.Capabilities.MCPHTTPTools {
 		t.Fatalf("HTTP MCP capability not preserved: %#v", byKind)
 	}
 	codex, found, known := sess.AgentKindStatus("codex")
-	if !found || !known || !codex.Capabilities.Steering || !codex.Capabilities.MCPHTTPTools {
-		t.Fatalf("steering capability absent from live session: %#v", codex)
+	if !found || !known || !codex.Capabilities.MCPHTTPTools {
+		t.Fatalf("capabilities absent from live session: %#v", codex)
 	}
 }
 
@@ -405,7 +405,7 @@ func TestSession_HeartbeatDoesNotInferCapabilities(t *testing.T) {
 	reg := NewRegistry()
 	conn := newFakeConn()
 	heartbeat := newFakeHeartbeatStore()
-	sess := NewSession(conn, "device", "tenant", proto.Version, reg, nil)
+	sess := newTestSession(conn, "device", "tenant", proto.Version, reg, nil)
 	sess.heartbeat = heartbeat
 	sess.Start()
 	defer sess.Close("test done")
diff --git a/services/core/internal/runtimegateway/subscription_test.go b/services/core/internal/runtimegateway/subscription_test.go
index 6d767992a..cbcfa8bb9 100644
--- a/services/core/internal/runtimegateway/subscription_test.go
+++ b/services/core/internal/runtimegateway/subscription_test.go
@@ -11,7 +11,7 @@ import (
 )
 
 func TestDurableSubscriptionOverflowIsExplicitAndIsolated(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
 	s.eventCredit = true
 	defer s.Close("test finished")
 	sub, err := s.SubscribeDurable("slow")
@@ -38,7 +38,7 @@ func TestDurableSubscriptionOverflowIsExplicitAndIsolated(t *testing.T) {
 
 func TestSubscriptionCloseAndDispatchAreSerialized(t *testing.T) {
 	for range 100 {
-		s := NewSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
+		s := newTestSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
 		s.eventCredit = true
 		sub, _ := s.SubscribeDurable("run")
 		var wg sync.WaitGroup
@@ -58,7 +58,7 @@ func TestSubscriptionCloseAndDispatchAreSerialized(t *testing.T) {
 }
 
 func TestSubscriptionCreditPreservesBurstAndTail(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
 	s.eventCredit = true
 	defer s.Close("test finished")
 	sub, err := s.SubscribeDurable("run")
@@ -101,7 +101,7 @@ func TestSubscriptionCreditPreservesBurstAndTail(t *testing.T) {
 }
 
 func TestSubscriptionRejectsByteWindowViolation(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
 	s.eventCredit = true
 	defer s.Close("test")
 	sub, _ := s.SubscribeDurable("run")
@@ -127,7 +127,7 @@ func TestConnectionCloseReasonDoesNotExposeProse(t *testing.T) {
 }
 
 func TestReceivedDoneDoesNotRequireLiveCreditTransport(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
 	s.eventCredit = true
 	sub, _ := s.SubscribeDurable("run")
 	s.dispatchToSubscriber(proto.Envelope{Type: proto.TypeDelta, ID: "run"})
@@ -146,7 +146,7 @@ func TestReceivedDoneDoesNotRequireLiveCreditTransport(t *testing.T) {
 }
 
 func TestBaseProtocolConsumerNeverSendsCredit(t *testing.T) {
-	s := NewSession(newFakeConn(), "old-runtime", "tenant", "0.16.0", NewRegistry(), nil)
+	s := newTestSession(newFakeConn(), "old-runtime", "tenant", "0.16.0", NewRegistry(), nil)
 	defer s.Close("test")
 	sub, err := s.SubscribeDurable("run")
 	if err != nil {
@@ -176,3 +176,53 @@ func TestBaseProtocolConsumerNeverSendsCredit(t *testing.T) {
 		t.Fatal("new control sent to an old Runtime")
 	}
 }
+
+// Withdrawal is an execution event: it must reach Core before Done and return
+// transport credit just like the corresponding function call.
+func TestFunctionWithdrawalDispatchesWithAndWithoutCredit(t *testing.T) {
+	for _, credit := range []bool{false, true} {
+		t.Run(map[bool]string{false: "base", true: "credit"}[credit], func(t *testing.T) {
+			s := newTestSession(newFakeConn(), "device", "tenant", proto.Version, NewRegistry(), nil)
+			s.eventCredit = credit
+			defer s.Close("test")
+			sub, err := s.SubscribeDurable("run")
+			if err != nil {
+				t.Fatal(err)
+			}
+			env, err := proto.NewEnvelope(proto.TypeFunctionCallWithdrawn, "run", proto.FunctionCallWithdrawnPayload{CallID: "call", NativeID: "child", TurnID: "child-turn"})
+			if err != nil {
+				t.Fatal(err)
+			}
+			s.dispatch(env)
+			select {
+			case got := <-sub.Events:
+				if got.Type != env.Type || string(got.Payload) != string(env.Payload) {
+					t.Fatal("withdrawal identity changed", got)
+				}
+				if err := sub.Consumed(t.Context(), got); err != nil {
+					t.Fatal(err)
+				}
+			default:
+				t.Fatal("function withdrawal was dropped")
+			}
+			select {
+			case frame := <-s.sendCh:
+				var ack proto.ExecutionEventsAckPayload
+				if !credit || frame.Type != proto.TypeExecutionEventsAck || frame.DecodePayload(&ack) != nil || ack.Count != 1 || ack.Bytes != proto.ExecutionEventBytes(env) {
+					t.Fatal("incorrect withdrawal credit", frame)
+				}
+			default:
+				if credit {
+					t.Fatal("withdrawal credit was not returned")
+				}
+			}
+			s.dispatch(proto.Envelope{Type: proto.TypeDone, ID: "run"})
+			if got := <-sub.Events; got.Type != proto.TypeDone {
+				t.Fatal("Done ordering lost", got)
+			}
+			if _, open := <-sub.Events; open || sub.Err() != nil {
+				t.Fatal("terminal event did not close subscription", sub.Err())
+			}
+		})
+	}
+}
diff --git a/services/core/internal/runtimegateway/suspension_test.go b/services/core/internal/runtimegateway/suspension_test.go
index 081d2332d..f66eb052c 100644
--- a/services/core/internal/runtimegateway/suspension_test.go
+++ b/services/core/internal/runtimegateway/suspension_test.go
@@ -9,7 +9,7 @@ import (
 
 func TestSuspendAcknowledgementSurvivesImmediateConnectionClose(t *testing.T) {
 	for range 100 {
-		s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+		s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 		done := make(chan error, 1)
 		go func() {
 			result, err := s.SuspendControl(t.Context(), proto.TypeEnvironmentQuiesce, proto.EnvironmentSuspendPayload{EnvironmentID: "env", SuspendID: "attempt"})
@@ -33,7 +33,7 @@ func TestSuspendControlRejectsForeignIdentityAndDoesNotReplay(t *testing.T) {
 		{EnvironmentID: "env", SuspendID: "old", Accepted: true},
 		{EnvironmentID: "env", SuspendID: "attempt", Accepted: true, ErrorCode: "resource_busy"},
 	} {
-		s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+		s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 		done := make(chan error, 1)
 		go func() {
 			_, err := s.SuspendControl(t.Context(), proto.TypeEnvironmentResume, proto.EnvironmentSuspendPayload{EnvironmentID: "env", SuspendID: "attempt"})
@@ -54,7 +54,7 @@ func TestSuspendControlRejectsForeignIdentityAndDoesNotReplay(t *testing.T) {
 	}
 }
 func TestSuspendObserverCancellationRetainsUnknownOutcome(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	ctx, cancel := context.WithCancel(t.Context())
 	done := make(chan error, 1)
diff --git a/services/core/internal/runtimegateway/workspace_directory_test.go b/services/core/internal/runtimegateway/workspace_directory_test.go
index 3f6ea3c0d..05704e9cb 100644
--- a/services/core/internal/runtimegateway/workspace_directory_test.go
+++ b/services/core/internal/runtimegateway/workspace_directory_test.go
@@ -10,7 +10,7 @@ import (
 )
 
 func TestWorkspaceDirectorySharesReadCorrelationAndFrameBound(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	request := proto.WorkspaceReadPayload{Handle: "prepared", EnvironmentID: "environment", MaxEntries: proto.WorkspaceDirectoryMaxEntries}
 	done := make(chan error, 1)
@@ -75,7 +75,7 @@ func TestWorkspaceDirectoryRequiresExplicitWireTruncation(t *testing.T) {
 		{"truncated", `{"entries":[{"name":"dir","kind":"directory","size_bytes":null}],"truncated":true}`, true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+			s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			done := make(chan error, 1)
 			go func() {
diff --git a/services/core/internal/runtimegateway/workspace_export_observation_test.go b/services/core/internal/runtimegateway/workspace_export_observation_test.go
index 4dfecfc21..9b3dcc3f1 100644
--- a/services/core/internal/runtimegateway/workspace_export_observation_test.go
+++ b/services/core/internal/runtimegateway/workspace_export_observation_test.go
@@ -23,7 +23,7 @@ func TestWorkspaceExportObservationBoundaries(t *testing.T) {
 			prior := slog.Default()
 			slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, nil)))
 			defer slog.SetDefault(prior)
-			s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+			s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			deadline := 3 * time.Second
 			if mode == "missing_completed" {
diff --git a/services/core/internal/runtimegateway/workspace_export_test.go b/services/core/internal/runtimegateway/workspace_export_test.go
index 2d57f6727..58ed4d3ef 100644
--- a/services/core/internal/runtimegateway/workspace_export_test.go
+++ b/services/core/internal/runtimegateway/workspace_export_test.go
@@ -93,7 +93,7 @@ func TestWorkspaceExportRoundTripFixture(t *testing.T) {
 		{"coalesced_prefetch", proto.WorkspaceExportChunkBytes, false},
 	} {
 		t.Run(test.name, func(t *testing.T) {
-			s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+			s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			ctx, cancel := context.WithTimeout(t.Context(), 15*time.Second)
 			defer cancel()
@@ -163,7 +163,7 @@ func TestWorkspaceExportRoundTripFixture(t *testing.T) {
 }
 
 func TestWorkspaceExportPrefetchesOneReplyAndRequiresCompletion(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	consumed, resume := make(chan struct{}), make(chan struct{})
 	done := make(chan error, 1)
@@ -209,7 +209,7 @@ func TestWorkspaceExportPrefetchesOneReplyAndRequiresCompletion(t *testing.T) {
 }
 
 func TestWorkspaceExportConsumerFailureCancelsPendingPrefetch(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	want := errors.New("consumer failed")
 	done := make(chan error, 1)
@@ -257,7 +257,7 @@ func TestWorkspaceExportRejectsInvalidReceiptScopeAndMaximum(t *testing.T) {
 		{"overflow", proto.WorkspaceExportMaxBytes, "export", proto.TypeWorkspaceExportResult, proto.WorkspaceExportResultPayload{Outcome: "chunk", Offset: proto.WorkspaceExportMaxBytes, Data: []byte("x")}},
 	} {
 		t.Run(test.name, func(t *testing.T) {
-			s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+			s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			replies := make(chan workspaceExportReceipt, 1)
 			env, err := proto.NewEnvelope(test.typ, test.id, test.result)
@@ -274,7 +274,7 @@ func TestWorkspaceExportRejectsInvalidReceiptScopeAndMaximum(t *testing.T) {
 }
 
 func TestWorkspaceExportPrefetchStaysOneChunkAheadOfSlowConsumer(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	ctx, cancel := context.WithCancel(t.Context())
 	defer cancel()
@@ -314,7 +314,7 @@ func TestWorkspaceExportRejectsInvalidChunksAndNativeFailure(t *testing.T) {
 		{Outcome: "completed", Data: []byte("x")},
 		{Outcome: "failed", ErrorCode: "export_failed"},
 	} {
-		s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+		s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 		done := make(chan error, 1)
 		go func() {
 			done <- s.ExportWorkspaceOutputs(t.Context(), proto.WorkspaceExportPayload{Handle: "prepared", EnvironmentID: "env"}, func(r io.Reader) error { _, err := io.Copy(io.Discard, r); return err })
@@ -335,7 +335,7 @@ func TestWorkspaceExportRejectsInvalidChunksAndNativeFailure(t *testing.T) {
 
 func TestWorkspaceExportDisconnectAndCancellationSettleRead(t *testing.T) {
 	for _, disconnect := range []bool{false, true} {
-		s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+		s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 		ctx, cancel := context.WithCancel(t.Context())
 		done := make(chan error, 1)
 		go func() {
diff --git a/services/core/internal/runtimegateway/workspace_export_timeout_test.go b/services/core/internal/runtimegateway/workspace_export_timeout_test.go
index 38afdfdea..2bef04951 100644
--- a/services/core/internal/runtimegateway/workspace_export_timeout_test.go
+++ b/services/core/internal/runtimegateway/workspace_export_timeout_test.go
@@ -15,7 +15,7 @@ func TestWorkspaceExportTenMinuteBudgetAndEarlierParent(t *testing.T) {
 	for _, budget := range []time.Duration{10 * time.Minute, time.Minute} {
 		t.Run(budget.String(), func(t *testing.T) {
 			synctest.Test(t, func(t *testing.T) {
-				s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+				s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 				defer s.Close("test")
 				ctx, cancel := context.WithTimeout(context.Background(), budget)
 				defer cancel()
diff --git a/services/core/internal/runtimegateway/workspace_read_test.go b/services/core/internal/runtimegateway/workspace_read_test.go
index f9df6a871..ed8089822 100644
--- a/services/core/internal/runtimegateway/workspace_read_test.go
+++ b/services/core/internal/runtimegateway/workspace_read_test.go
@@ -17,7 +17,7 @@ func workspaceReadRequest() proto.WorkspaceReadPayload {
 }
 
 func TestWorkspaceReadCorrelatesOneBoundedResult(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	done := make(chan error, 1)
 	data := bytes.Repeat([]byte{0, 127, 255, 3}, proto.WorkspaceReadMaxBytes/4)
@@ -54,7 +54,7 @@ func TestWorkspaceReadRejectsIncompleteOrContradictoryReplies(t *testing.T) {
 		{Outcome: "unknown", ErrorCode: "read_unconfirmed", Data: []byte("partial")},
 		{Outcome: "rejected", ErrorCode: "native-private-secret"},
 	} {
-		s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+		s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 		done := make(chan error, 1)
 		go func() { _, err := s.ReadWorkspaceFile(t.Context(), workspaceReadRequest()); done <- err }()
 		request := <-s.sendCh
@@ -82,7 +82,7 @@ func TestWorkspaceDirectoryAcceptsNotDirectoryOnlyForDirectoryReads(t *testing.T
 		{true, proto.WorkspaceReadResultPayload{Outcome: "completed", CloseAcknowledged: true, ErrorCode: proto.WorkspaceReadNotDirectory, Directory: &proto.WorkspaceDirectoryResult{Entries: []proto.WorkspaceDirectoryEntry{}}}, false},
 		{false, proto.WorkspaceReadResultPayload{Outcome: "rejected", ErrorCode: proto.WorkspaceReadNotDirectory}, false},
 	} {
-		s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+		s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 		done := make(chan error, 1)
 		go func() {
 			var err error
@@ -104,7 +104,7 @@ func TestWorkspaceDirectoryAcceptsNotDirectoryOnlyForDirectoryReads(t *testing.T
 }
 
 func TestWorkspaceReadObserverCancellationDoesNotSendCancelOrRetry(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	ctx, cancel := context.WithCancel(t.Context())
 	done := make(chan error, 1)
@@ -130,7 +130,7 @@ func TestWorkspaceReadObserverCancellationDoesNotSendCancelOrRetry(t *testing.T)
 }
 
 func TestWorkspaceReadCapacityAndConnectionLoss(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	done := make(chan error, 4)
 	for i := 0; i < 4; i++ {
 		go func() { _, err := s.ReadWorkspaceFile(t.Context(), workspaceReadRequest()); done <- err }()
@@ -154,7 +154,7 @@ func TestWorkspaceReadCapacityAndConnectionLoss(t *testing.T) {
 func TestWorkspaceReadRejectsOversizedRequestsBeforeQueueing(t *testing.T) {
 	for _, field := range []string{"path", "handle", "environment", "escaped"} {
 		t.Run(field, func(t *testing.T) {
-			s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+			s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 			defer s.Close("test")
 			request := workspaceReadRequest()
 			oversized := strings.Repeat("x", int(ReadLimit))
diff --git a/services/core/internal/runtimegateway/workspace_write_test.go b/services/core/internal/runtimegateway/workspace_write_test.go
index 924566f94..7bd10a4f7 100644
--- a/services/core/internal/runtimegateway/workspace_write_test.go
+++ b/services/core/internal/runtimegateway/workspace_write_test.go
@@ -13,7 +13,7 @@ import (
 )
 
 func TestWorkspaceWriteChunksAndCorrelatesReceipt(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	data := bytes.Repeat([]byte{0, 255, 3}, 400000)
 	id := uuid.NewString()
@@ -67,7 +67,7 @@ func TestWorkspaceWriteChunksAndCorrelatesReceipt(t *testing.T) {
 }
 
 func TestWorkspaceWriteDoesNotCommitAfterLostObservation(t *testing.T) {
-	s := NewSession(newFakeConn(), "device", "tenant", "test", nil, nil)
+	s := newTestSession(newFakeConn(), "device", "tenant", "test", nil, nil)
 	defer s.Close("test")
 	ctx, cancel := context.WithCancel(t.Context())
 	done := make(chan error, 1)
diff --git a/services/core/internal/runtimeobs/sample.go b/services/core/internal/runtimeobs/sample.go
index b5e06271a..2c2d110c9 100644
--- a/services/core/internal/runtimeobs/sample.go
+++ b/services/core/internal/runtimeobs/sample.go
@@ -34,15 +34,13 @@ type Sample struct {
 	CPUCapacityCores     *float64
 	// CPUUtilizationRatio is a provider-reported share of CPUCapacityCores, for
 	// providers such as E2B that report a current rate instead of cumulative time.
-	// Newer fields are omitted when absent: node frames carry Sample, and an
-	// older Core decodes them with unknown fields disallowed.
-	CPUUtilizationRatio *float64 `json:",omitempty"`
+	CPUUtilizationRatio *float64
 	MemoryUsageBytes    *uint64
 	MemoryLimitBytes    *uint64
 	// Disk values are current usage and capacity of the Runtime's disk, when
 	// the provider reports them (E2B). They are not part of the /v1 projection.
-	DiskUsageBytes *uint64 `json:",omitempty"`
-	DiskLimitBytes *uint64 `json:",omitempty"`
+	DiskUsageBytes *uint64
+	DiskLimitBytes *uint64
 }
 
 func (s Sample) validate(now time.Time) error {
diff --git a/services/core/internal/runtimeobs/service_test.go b/services/core/internal/runtimeobs/service_test.go
index 40f15551b..78b924c73 100644
--- a/services/core/internal/runtimeobs/service_test.go
+++ b/services/core/internal/runtimeobs/service_test.go
@@ -568,13 +568,3 @@ func TestServiceRejectsMismatchedResolvedOwnership(t *testing.T) {
 }
 
 func float64Pointer(value float64) *float64 { return &value }
-
-func TestSampleWithoutNewerFieldsKeepsItsNodeWireForm(t *testing.T) {
-	observedAt := time.Date(2026, 9, 25, 1, 0, 0, 0, time.UTC)
-	cpu, memory := 1.5, uint64(1024)
-	raw, err := json.Marshal(Sample{ObservedAt: observedAt, CPUUsageSecondsTotal: &cpu, MemoryUsageBytes: &memory})
-	want := `{"ObservedAt":"2026-09-25T01:00:00Z","StartedAt":null,"CPUUsageSecondsTotal":1.5,"CPUCapacityCores":null,"MemoryUsageBytes":1024,"MemoryLimitBytes":null}`
-	if err != nil || string(raw) != want {
-		t.Fatalf("an older Core could not decode this node sample: %s %v", raw, err)
-	}
-}
diff --git a/services/core/internal/sandbox/compute_profile.go b/services/core/internal/sandbox/compute_profile.go
new file mode 100644
index 000000000..547ee22e2
--- /dev/null
+++ b/services/core/internal/sandbox/compute_profile.go
@@ -0,0 +1,15 @@
+package sandbox
+
+import "regexp"
+
+var computeProfileName = regexp.MustCompile(`^[a-z][a-z0-9-]{0,47}$`)
+
+// ValidComputeProfile names an administrator-approved immutable compute selection.
+func ValidComputeProfile(name string) bool { return computeProfileName.MatchString(name) }
+
+// ComputeProfile shares its parent's provider, Runtime and credential. It never
+// accepts a client-supplied credential or selects a different backend namespace.
+type ComputeProfile struct {
+	Resources     Resources     `json:"resources"`
+	Configuration Configuration `json:"-"`
+}
diff --git a/services/core/internal/sandbox/deployment.go b/services/core/internal/sandbox/deployment.go
index 2e44bbd74..5ef002c60 100644
--- a/services/core/internal/sandbox/deployment.go
+++ b/services/core/internal/sandbox/deployment.go
@@ -6,7 +6,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"reflect"
-	"regexp"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/workspacefs"
 )
@@ -40,11 +39,13 @@ type Resources struct {
 	EnvironmentDiskMiB uint32 `json:"environment_disk_mib,omitempty"`
 }
 
+// ValidatePolicy validates the resources against a Provider's declaration. On
+// external storage, environment_disk_mib is only the capacity quota request: zero
+// requests none and the storage declaration decides whether a quota is possible.
 func (r Resources) ValidatePolicy(provider string, rules DeploymentPolicy) error {
-	return r.ValidateWorkspacePolicy(provider, rules, nil)
-}
-
-func (r Resources) validatePolicy(provider string, rules DeploymentPolicy) error {
+	if rules.Workspace != nil && r.EnvironmentDiskMiB == 0 && rules.Disk {
+		r.EnvironmentDiskMiB = minimumDiskMiB
+	}
 	values := reflect.ValueOf(r)
 	for i, rule := range resourceContract {
 		min, max := rule.Min, rule.Max
@@ -55,7 +56,10 @@ func (r Resources) validatePolicy(provider string, rules DeploymentPolicy) error
 			message = provider + " does not support independent disk capacity limits"
 			if rules.Disk {
 				min, max = minimumDiskMiB, ^uint32(0)
-				message = provider + " requires root_disk_mib and environment_disk_mib of at least 1024 MiB"
+				message = provider + " requires " + rule.Name + " of at least 1024 MiB"
+				if rules.Workspace != nil && rule.Name == "environment_disk_mib" {
+					message = provider + " requires environment_disk_mib of 0 or at least 1024 MiB"
+				}
 				maximum = nil
 			} else {
 				maximum = validationBound(max)
@@ -69,38 +73,27 @@ func (r Resources) validatePolicy(provider string, rules DeploymentPolicy) error
 	return nil
 }
 
-// RuntimeRelease preserves the identities of one verified distribution. Docker
-// may address the same archive by config ID or OCI manifest digest; microsandbox
-// has its own imported OCI identity. These are not interchangeable hashes.
-type RuntimeRelease struct {
-	SourceCommit        string `json:"source_commit" binding:"required"`
-	ImageID             string `json:"image_id" binding:"required"`
-	ImageManifestDigest string `json:"image_manifest_digest" binding:"required"`
-	MicrosandboxRef     string `json:"microsandbox_ref" binding:"required"`
-	RuntimeSHA256       string `json:"runtime_sha256" binding:"required"`
-	FirmwareSHA256      string `json:"firmware_sha256" binding:"required"`
-}
-
-func (r RuntimeRelease) Validate() error {
-	values := reflect.ValueOf(r)
-	for i, rule := range runtimeContract {
-		if !regexp.MustCompile("^(?:" + rule.Pattern + ")$").MatchString(values.Field(i).String()) {
-			return &ValidationError{Param: "runtime", Message: fmt.Sprintf("%s: Runtime must reference one immutable distribution", ErrInvalid)}
-		}
-	}
-	return nil
-}
-
 type DeploymentSpec struct {
-	Resources Resources       `json:"resources" binding:"required"`
-	Runtime   *RuntimeRelease `json:"runtime,omitempty"`
+	Resources Resources `json:"resources" binding:"required"`
 	// Workspace is a derived immutable capability receipt, never filesystem configuration.
 	Workspace *workspacefs.Declaration `json:"workspace,omitempty" readonly:"true"`
 }
 
 // ValidatePolicy applies a registered adapter's rules without knowing its kind.
+// A Provider that declares workspace requirements runs every Environment on
+// external storage and cannot be deployed without a selection.
 func (s DeploymentSpec) ValidatePolicy(provider string, policy DeploymentPolicy) error {
-	return s.ValidateWorkspacePolicy(provider, policy, s.Workspace)
+	switch {
+	case policy.Workspace == nil && s.Workspace != nil:
+		return workspacefs.ErrUnsupported
+	case policy.Workspace != nil && s.Workspace == nil:
+		return ErrWorkspaceRequired
+	case policy.Workspace != nil:
+		if err := workspacefs.ValidateCombination(*policy.Workspace, *s.Workspace, s.Resources.EnvironmentDiskMiB); err != nil {
+			return err
+		}
+	}
+	return s.Resources.ValidatePolicy(provider, policy)
 }
 
 func (s DeploymentSpec) Digest(provider string) string {
@@ -123,37 +116,3 @@ func BackendFingerprint(kind, namespace string) string {
 	digest := sha256.Sum256([]byte(kind + "\x00" + namespace))
 	return hex.EncodeToString(digest[:])
 }
-
-// ValidateWorkspacePolicy validates explicit external storage without weakening root disk limits.
-func (r Resources) ValidateWorkspacePolicy(provider string, rules DeploymentPolicy, declaration *workspacefs.Declaration) error {
-	if declaration == nil {
-		return r.validatePolicy(provider, rules)
-	}
-	if rules.Workspace == nil {
-		return workspacefs.ErrUnsupported
-	}
-	if err := workspacefs.ValidateCombination(*rules.Workspace, *declaration, r.EnvironmentDiskMiB); err != nil {
-		return err
-	}
-	checked := r
-	if checked.EnvironmentDiskMiB == 0 && rules.Disk {
-		checked.EnvironmentDiskMiB = minimumDiskMiB
-	}
-	return checked.validatePolicy(provider, rules)
-}
-func (s DeploymentSpec) ValidateWorkspacePolicy(provider string, policy DeploymentPolicy, declaration *workspacefs.Declaration) error {
-	if err := s.Resources.ValidateWorkspacePolicy(provider, policy, declaration); err != nil {
-		return err
-	}
-
-	if !policy.Runtime {
-		if s.Runtime != nil {
-			return &ValidationError{Param: "runtime", Message: fmt.Sprintf("%s: %s", ErrInvalid, policy.RuntimeError)}
-		}
-		return nil
-	}
-	if s.Runtime == nil {
-		return &ValidationError{Param: "runtime", Message: fmt.Sprintf("%s: managed nodes require a pinned Runtime release", ErrInvalid)}
-	}
-	return s.Runtime.Validate()
-}
diff --git a/services/core/internal/sandbox/deployment_contract.go b/services/core/internal/sandbox/deployment_contract.go
index d1bfaf248..4a0a94418 100644
--- a/services/core/internal/sandbox/deployment_contract.go
+++ b/services/core/internal/sandbox/deployment_contract.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 )
 
-// This contract owns numeric bounds, release patterns and canonical field order.
+// This contract owns numeric bounds and canonical field order.
 // The node installer (node_spec.py) and the TypeScript client
 // (deployment-contract.ts) consume its generated projections.
 const minimumDiskMiB uint32 = 1024
@@ -20,10 +20,6 @@ type resourceRule struct {
 	OmitZero bool   `json:"omit_zero"`
 	Message  string `json:"-"`
 }
-type runtimeRule struct {
-	Name    string `json:"name"`
-	Pattern string `json:"pattern"`
-}
 
 var resourceContract = []resourceRule{
 	{"cpus", 1, 255, false, "cpus must be 1..255 and memory_mib must be 512..1048576"},
@@ -31,14 +27,6 @@ var resourceContract = []resourceRule{
 	{"root_disk_mib", 0, ^uint32(0), true, ""},
 	{"environment_disk_mib", 0, ^uint32(0), true, ""},
 }
-var runtimeContract = []runtimeRule{
-	{"source_commit", "[0-9a-f]{40}"},
-	{"image_id", "sha256:[0-9a-f]{64}"},
-	{"image_manifest_digest", "sha256:[0-9a-f]{64}"},
-	{"microsandbox_ref", "oac-runtime@sha256:[0-9a-f]{64}"},
-	{"runtime_sha256", "[0-9a-f]{64}"},
-	{"firmware_sha256", "[0-9a-f]{64}"},
-}
 
 // ProviderProjection is one registered Provider in the generated projections.
 type ProviderProjection struct {
@@ -54,7 +42,7 @@ func DeploymentContract(providers map[string]ProviderProjection) (python, typesc
 		value any
 		names []string
 	}{
-		{Resources{}, resourceNames()}, {RuntimeRelease{}, runtimeNames()},
+		{Resources{}, resourceNames()},
 	} {
 		typ := reflect.TypeOf(item.value)
 		if typ.NumField() != len(item.names) {
@@ -74,10 +62,9 @@ func DeploymentContract(providers map[string]ProviderProjection) (python, typesc
 	raw, _ := json.Marshal(struct {
 		WorkspaceFields []string                      `json:"workspace_fields"`
 		Resources       []resourceRule                `json:"resources"`
-		Runtime         []runtimeRule                 `json:"runtime"`
 		Providers       map[string]ProviderProjection `json:"providers"`
 		MinimumDisk     uint32                        `json:"minimum_disk"`
-	}{workspaceFields, resourceContract, runtimeContract, providers, minimumDiskMiB})
+	}{workspaceFields, resourceContract, providers, minimumDiskMiB})
 	return "# BEGIN GENERATED DEPLOYMENT CONTRACT\n# Generated from sandbox/deployment_contract.go; do not edit.\n_CONTRACT = json.loads(" + fmt.Sprintf("%q", string(raw)) + ")\n# END GENERATED DEPLOYMENT CONTRACT",
 		"// Code generated by services/core/cmd/specification-contract from sandbox/deployment_contract.go; DO NOT EDIT.\n\nexport const deploymentContract = " + string(raw) + " as const;\n"
 }
@@ -88,10 +75,3 @@ func resourceNames() []string {
 	}
 	return names
 }
-func runtimeNames() []string {
-	var names []string
-	for _, r := range runtimeContract {
-		names = append(names, r.Name)
-	}
-	return names
-}
diff --git a/services/core/internal/sandbox/docker/contract_test.go b/services/core/internal/sandbox/docker/contract_test.go
index 8105d6d40..d3bddf6cf 100644
--- a/services/core/internal/sandbox/docker/contract_test.go
+++ b/services/core/internal/sandbox/docker/contract_test.go
@@ -26,7 +26,7 @@ type contractStep struct {
 
 func dockerContractFixture(t *testing.T, cancel context.CancelFunc, script func(*Provider, sandbox.Reference) []contractStep) contracttest.Fixture {
 	t.Helper()
-	b := sandbox.Bootstrap{Reference: sandbox.Reference{TenantID: uuid.NewString(), EnvironmentID: uuid.NewString(), AllocationID: uuid.NewString()}, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "synthetic", Harness: "codex", NetworkAccess: "enabled"}
+	b := sandbox.Bootstrap{Reference: sandbox.Reference{TenantID: uuid.NewString(), EnvironmentID: uuid.NewString(), AllocationID: uuid.NewString()}, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "synthetic", Harness: "codex"}
 	var mu sync.Mutex
 	var calls []string
 	var steps []contractStep
diff --git a/services/core/internal/sandbox/docker/deployment_test.go b/services/core/internal/sandbox/docker/deployment_test.go
index 7dfa1283c..af3b60f2d 100644
--- a/services/core/internal/sandbox/docker/deployment_test.go
+++ b/services/core/internal/sandbox/docker/deployment_test.go
@@ -87,7 +87,7 @@ func TestManagedDriftRejectsBeforeBootstrapAndRetainsCleanup(t *testing.T) {
 				t.Fatal(err)
 			}
 			resources.CPUs = 9
-			b := sandbox.Bootstrap{Reference: sandbox.Reference{TenantID: uuid.NewString(), EnvironmentID: uuid.NewString(), AllocationID: uuid.NewString()}, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "secret", Harness: "codex", NetworkAccess: "enabled"}
+			b := sandbox.Bootstrap{Reference: sandbox.Reference{TenantID: uuid.NewString(), EnvironmentID: uuid.NewString(), AllocationID: uuid.NewString()}, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "secret", Harness: "codex"}
 			info, err := p.Create(t.Context(), b)
 			if !errors.Is(err, sandbox.ErrInvalid) {
 				t.Fatal("drift accepted", err)
diff --git a/services/core/internal/sandbox/docker/node.go b/services/core/internal/sandbox/docker/node.go
index b8ddc04fb..4b3fcff0e 100644
--- a/services/core/internal/sandbox/docker/node.go
+++ b/services/core/internal/sandbox/docker/node.go
@@ -15,10 +15,8 @@ import (
 )
 
 // Native is the node configuration's native object for Docker. Image is the
-// local ID of the release's Runtime image: the host's image store decides
-// whether the config digest (image_id) or the manifest digest
-// (image_manifest_digest) names the loaded image, so the installer records the
-// one this host resolves.
+// local ID of the installation's Runtime image, as this host's image store
+// resolves it.
 type Native struct {
 	Host          string `json:"host"`
 	Image         string `json:"image"`
@@ -29,13 +27,9 @@ type Native struct {
 
 func decodeNative(config sandbox.NodeConfig) (Native, error) {
 	var entry Native
-	if sandbox.DecodeConfigurationObject(config.Native, &entry, "host", "image", "network", "seccomp_file", "nested_sandbox") != nil {
+	if sandbox.DecodeConfigurationObject(config.Native, &entry, "host", "image", "network", "seccomp_file", "nested_sandbox") != nil || entry.Image == "" {
 		return entry, errors.New("invalid managed Docker node configuration")
 	}
-	release := config.Specification.Runtime
-	if entry.Image != release.ImageID && entry.Image != release.ImageManifestDigest {
-		return entry, errors.New("Docker Runtime image differs from the deployment release")
-	}
 	return entry, nil
 }
 
@@ -77,7 +71,7 @@ func BuildNode(config sandbox.NodeConfig, _ sandbox.LocalOptions, result *sandbo
 
 // The probe reports its first failed check as its readiness class: the Docker
 // daemon, then limit support, then host capacity for one sandbox of the
-// deployment specification, then the pinned Runtime image. Unclassified
+// deployment specification, then the Runtime image. Unclassified
 // failures stay provider_unavailable. The returned text is local; only its
 // class is reported.
 func dockerProbe(c *client.Client, image string, resources sandbox.Resources) func(context.Context) error {
@@ -102,7 +96,7 @@ func dockerProbe(c *client.Client, image string, resources sandbox.Resources) fu
 			return sandbox.ErrRuntimeImageUnavailable
 		} else if err != nil {
 			// The daemon did not answer; the image may still be present.
-			return fmt.Errorf("%w: cannot inspect the pinned Runtime image", sandbox.ErrProviderUnavailable)
+			return fmt.Errorf("%w: cannot inspect the Runtime image", sandbox.ErrProviderUnavailable)
 		}
 		return nil
 	}
diff --git a/services/core/internal/sandbox/docker/node_test.go b/services/core/internal/sandbox/docker/node_test.go
index 0d5f576c2..61667bb14 100644
--- a/services/core/internal/sandbox/docker/node_test.go
+++ b/services/core/internal/sandbox/docker/node_test.go
@@ -12,17 +12,13 @@ import (
 	"github.com/moby/moby/client"
 )
 
-// The host's image store decides which release digest names the loaded image.
-func TestNativeImageIsAReleaseIdentity(t *testing.T) {
-	release := sandbox.RuntimeRelease{ImageID: "sha256:" + strings.Repeat("b", 64), ImageManifestDigest: "sha256:" + strings.Repeat("c", 64)}
-	config := sandbox.NodeConfig{Specification: sandbox.DeploymentSpec{Runtime: &release}}
-	for _, image := range []string{release.ImageID, release.ImageManifestDigest} {
-		config.Native = json.RawMessage(`{"image":"` + image + `"}`)
-		if entry, err := decodeNative(config); err != nil || entry.Image != image {
-			t.Fatalf("rejected release image %s: %v", image, err)
-		}
+func TestNativeRequiresTheInstalledImage(t *testing.T) {
+	image := "sha256:" + strings.Repeat("b", 64)
+	config := sandbox.NodeConfig{Native: json.RawMessage(`{"image":"` + image + `"}`)}
+	if entry, err := decodeNative(config); err != nil || entry.Image != image {
+		t.Fatalf("rejected the installed image: %v", err)
 	}
-	for _, native := range []string{`{"image":"sha256:` + strings.Repeat("a", 64) + `"}`, `{"image":"` + release.ImageID + `","cpus":2}`, `{"image":null}`} {
+	for _, native := range []string{`{"image":"` + image + `","cpus":2}`, `{"image":null}`, `{}`} {
 		config.Native = json.RawMessage(native)
 		if _, err := decodeNative(config); err == nil {
 			t.Fatalf("accepted native %s", native)
diff --git a/services/core/internal/sandbox/docker/operations.go b/services/core/internal/sandbox/docker/operations.go
index 0d479f3f1..59ddf59b1 100644
--- a/services/core/internal/sandbox/docker/operations.go
+++ b/services/core/internal/sandbox/docker/operations.go
@@ -9,22 +9,24 @@ import (
 // Operations is this adapter's complete authored resource contract.
 func Operations() providercontract.Operations {
 	return providercontract.Operations{
-		"Create":            {State: providercontract.Supported},
-		"GetInfo":           {State: providercontract.Supported},
-		"Renew":             {State: providercontract.Supported},
-		"Kill":              {State: providercontract.Supported},
-		"RunCommand":        {State: providercontract.Supported},
-		"Initial":           {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
-		"NewCompute":        {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
-		"RenewCompute":      {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
-		"GetCompute":        {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
-		"Suspend":           {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
-		"Resume":            {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
-		"KillCompute":       {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
-		"DeleteRetained":    {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
-		"RunCommandCompute": {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
-		"ResumeCompute":     {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
-		"Observe":           {State: providercontract.Supported},
+		"Create":             {State: providercontract.Supported},
+		"GetInfo":            {State: providercontract.Supported},
+		"Renew":              {State: providercontract.Supported},
+		"Kill":               {State: providercontract.Supported},
+		"RunCommand":         {State: providercontract.Supported},
+		"Initial":            {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
+		"NewCompute":         {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
+		"RenewCompute":       {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
+		"GetCompute":         {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
+		"Suspend":            {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
+		"Resume":             {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
+		"KillCompute":        {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
+		"DeleteRetained":     {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
+		"RunCommandCompute":  {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
+		"ResumeCompute":      {State: providercontract.Unsupported, Reason: "docker_does_not_support_checkpoints"},
+		"RestorePreparation": {State: providercontract.Unsupported, Reason: "docker_does_not_support_preparation_cache"},
+		"SavePreparation":    {State: providercontract.Unsupported, Reason: "docker_does_not_support_preparation_cache"},
+		"Observe":            {State: providercontract.Supported},
 	}
 }
 func (*Provider) ProviderOperations() providercontract.Operations { return Operations() }
@@ -59,3 +61,9 @@ func (p *Provider) ResumeCompute(context.Context, sandbox.Reference, sandbox.Com
 func (p *Provider) RenewCompute(context.Context, sandbox.Reference, sandbox.Compute) (sandbox.ComputeState, error) {
 	return sandbox.ComputeState{}, &providercontract.UnsupportedError{Operation: "RenewCompute", Reason: Operations()["RenewCompute"].Reason}
 }
+func (p *Provider) RestorePreparation(context.Context, sandbox.Reference, string) (bool, error) {
+	return false, &providercontract.UnsupportedError{Operation: "RestorePreparation", Reason: Operations()["RestorePreparation"].Reason}
+}
+func (p *Provider) SavePreparation(context.Context, sandbox.Reference, string) error {
+	return &providercontract.UnsupportedError{Operation: "SavePreparation", Reason: Operations()["SavePreparation"].Reason}
+}
diff --git a/services/core/internal/sandbox/docker/provider.go b/services/core/internal/sandbox/docker/provider.go
index f65a45a9d..2b38d7af7 100644
--- a/services/core/internal/sandbox/docker/provider.go
+++ b/services/core/internal/sandbox/docker/provider.go
@@ -5,13 +5,11 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/providercontract"
 	"strings"
 
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	"github.com/containerd/errdefs"
 	"github.com/google/uuid"
@@ -115,8 +113,7 @@ func (p *Provider) Create(ctx context.Context, b sandbox.Bootstrap) (sandbox.Inf
 		return sandbox.Info{Reference: b.Reference}, &providercontract.UnsupportedError{Operation: "Create", Reason: "external_workspace_unsupported"}
 	}
 	info := sandbox.Info{Reference: b.Reference}
-	policy := agentnetwork.Policy{Access: b.NetworkAccess, AllowedDomains: b.AllowedDomains}
-	if policy.Validate() != nil || !validReference(b.Reference) || !validID(b.SessionID) || !validID(b.DeviceID) || b.RuntimeConnection().Validate() != nil {
+	if !validReference(b.Reference) || !validID(b.SessionID) || !validID(b.DeviceID) || b.RuntimeConnection().Validate() != nil {
 		return info, sandbox.ErrInvalid
 	}
 	if existing, e := p.GetInfo(ctx, b.Reference); e == nil {
@@ -124,10 +121,6 @@ func (p *Provider) Create(ctx context.Context, b sandbox.Bootstrap) (sandbox.Inf
 	} else if !errors.Is(e, sandbox.ErrNotFound) {
 		return info, e
 	}
-	domains, err := json.Marshal(policy.Hosts())
-	if err != nil {
-		return info, sandbox.ErrInvalid
-	}
 	name := p.name(b.Reference)
 	// Retained volumes without a container are partial or lost state, not an
 	// invitation to overwrite native history with a new bootstrap identity.
@@ -152,7 +145,7 @@ func (p *Provider) Create(ctx context.Context, b sandbox.Bootstrap) (sandbox.Inf
 			return info, sandbox.ErrOwnership
 		}
 	}
-	options := runtimeContainerOptions(p.config, name, p.labels(b.Reference), []string{"OAC_RUNTIME_ENVIRONMENT_ID=" + b.EnvironmentID, "OAC_RUNTIME_SESSION_ID=" + b.SessionID, "OAC_RUNTIME_NETWORK_ACCESS=" + policy.Access, "OAC_RUNTIME_ALLOWED_DOMAINS=" + string(domains)})
+	options := runtimeContainerOptions(p.config, name, p.labels(b.Reference), []string{"OAC_RUNTIME_ENVIRONMENT_ID=" + b.EnvironmentID, "OAC_RUNTIME_SESSION_ID=" + b.SessionID})
 	options.Config.Cmd = []string{"connect", "--profile", "default", "--bootstrap-file", "/home/runtime/runtime-bootstrap.json"}
 	v, e := p.client.ContainerCreate(ctx, options)
 	if errdefs.IsConflict(e) {
diff --git a/services/core/internal/sandbox/docker/provider_test.go b/services/core/internal/sandbox/docker/provider_test.go
index 0df733084..015f79f45 100644
--- a/services/core/internal/sandbox/docker/provider_test.go
+++ b/services/core/internal/sandbox/docker/provider_test.go
@@ -36,22 +36,6 @@ func TestProviderRejectsUnsafeOperatorConfiguration(t *testing.T) {
 	}
 }
 
-func TestBootstrapRequiresCompleteNetworkPolicyBeforeDockerEffects(t *testing.T) {
-	p := &Provider{}
-	for _, policy := range []sandbox.Bootstrap{
-		{}, {NetworkAccess: "restricted"},
-		{NetworkAccess: "restricted", AllowedDomains: []string{"*.example.com"}},
-		{NetworkAccess: "enabled", AllowedDomains: []string{"example.com"}},
-	} {
-		policy.Reference = sandbox.Reference{TenantID: uuid.NewString(), EnvironmentID: uuid.NewString(), AllocationID: uuid.NewString()}
-		policy.SessionID, policy.DeviceID = uuid.NewString(), uuid.NewString()
-		policy.CoreURL, policy.Credential = "http://core.invalid/api/v1", "synthetic"
-		if _, err := p.Create(t.Context(), policy); !errors.Is(err, sandbox.ErrInvalid) {
-			t.Fatal("invalid bootstrap reached Docker", err)
-		}
-	}
-}
-
 // This optional Docker mechanism test uses a pinned fixture image whose entrypoint
 // is sleep. It is not native/model acceptance; the real Runtime has separate checks.
 func TestDockerProviderLifecycle(t *testing.T) {
@@ -76,10 +60,9 @@ func TestDockerProviderLifecycle(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
 	defer cancel()
 	bootstrap := func() sandbox.Bootstrap {
-		return sandbox.Bootstrap{Reference: sandbox.Reference{TenantID: uuid.NewString(), EnvironmentID: uuid.NewString(), AllocationID: uuid.NewString()}, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "http://core.invalid/api/v1", Credential: "synthetic-test-credential", Harness: "codex", NetworkAccess: "enabled"}
+		return sandbox.Bootstrap{Reference: sandbox.Reference{TenantID: uuid.NewString(), EnvironmentID: uuid.NewString(), AllocationID: uuid.NewString()}, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "http://core.invalid/api/v1", Credential: "synthetic-test-credential", Harness: "codex"}
 	}
 	b := bootstrap()
-	b.NetworkAccess, b.AllowedDomains = "restricted", []string{"Example.com", "api.example.com"}
 	t.Cleanup(func() {
 		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
 		defer cancel()
@@ -123,15 +106,6 @@ func TestDockerProviderLifecycle(t *testing.T) {
 	if strings.Contains(string(inspected.Raw), b.Credential) || inspected.Container.Config.User != "1000:1000" || !inspected.Container.HostConfig.ReadonlyRootfs || inspected.Container.HostConfig.Privileged {
 		t.Fatal("unsafe Docker configuration")
 	}
-	for _, value := range []string{"OAC_RUNTIME_NETWORK_ACCESS=restricted", `OAC_RUNTIME_ALLOWED_DOMAINS=["api.example.com","example.com"]`} {
-		found := false
-		for _, entry := range inspected.Container.Config.Env {
-			found = found || entry == value
-		}
-		if !found {
-			t.Fatalf("bootstrap lost network policy: %s", value)
-		}
-	}
 	changed := b
 	changed.Credential = "must-not-replace-existing"
 	if _, e = p.Create(ctx, changed); !errors.Is(e, sandbox.ErrExists) {
diff --git a/services/core/internal/sandbox/docker/recovery_test.go b/services/core/internal/sandbox/docker/recovery_test.go
index 9cb813598..1e1e53194 100644
--- a/services/core/internal/sandbox/docker/recovery_test.go
+++ b/services/core/internal/sandbox/docker/recovery_test.go
@@ -87,7 +87,7 @@ func TestDockerProviderRecoveryObservations(t *testing.T) {
 			if e != nil {
 				t.Fatal(e)
 			}
-			b := sandbox.Bootstrap{Reference: sandbox.Reference{TenantID: uuid.NewString(), EnvironmentID: uuid.NewString(), AllocationID: uuid.NewString()}, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "http://core.invalid/api/v1", Credential: "synthetic-recovery-token", Harness: "codex", NetworkAccess: "enabled"}
+			b := sandbox.Bootstrap{Reference: sandbox.Reference{TenantID: uuid.NewString(), EnvironmentID: uuid.NewString(), AllocationID: uuid.NewString()}, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "http://core.invalid/api/v1", Credential: "synthetic-recovery-token", Harness: "codex"}
 			direct, e := client.New(client.WithHost("unix:///var/run/docker.sock"))
 			if e != nil {
 				t.Fatal(e)
diff --git a/services/core/internal/sandbox/docker/selection.go b/services/core/internal/sandbox/docker/selection.go
index 3a7ec247a..80c83f758 100644
--- a/services/core/internal/sandbox/docker/selection.go
+++ b/services/core/internal/sandbox/docker/selection.go
@@ -5,7 +5,7 @@ import (
 )
 
 func Policy() sandbox.DeploymentPolicy {
-	return sandbox.DeploymentPolicy{Runtime: true, DefaultResources: &sandbox.Resources{CPUs: 2, MemoryMiB: 2048}}
+	return sandbox.DeploymentPolicy{DefaultResources: &sandbox.Resources{CPUs: 2, MemoryMiB: 2048}}
 }
 
 func ValidateResources(r sandbox.Resources) error { return r.ValidatePolicy("docker", Policy()) }
diff --git a/services/core/internal/sandbox/e2b/contract_test.go b/services/core/internal/sandbox/e2b/contract_test.go
index 0216cfc23..805d33c22 100644
--- a/services/core/internal/sandbox/e2b/contract_test.go
+++ b/services/core/internal/sandbox/e2b/contract_test.go
@@ -16,7 +16,7 @@ func (f contractCaller) Call(ctx context.Context, q Request) (Response, error) {
 func TestProviderContract(t *testing.T) {
 	contracttest.RunFailures(t, func(t *testing.T, s contracttest.Scenario, cancel context.CancelFunc) contracttest.Fixture {
 		p, _, r := fixture(t)
-		b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "synthetic", Harness: "codex", NetworkAccess: "enabled"}
+		b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "synthetic", Harness: "codex"}
 		var calls []string
 		p.caller = contractCaller(func(ctx context.Context, q Request) (Response, error) {
 			calls = append(calls, q.Operation)
@@ -47,7 +47,7 @@ func TestProviderContract(t *testing.T) {
 func TestProviderContractObservation(t *testing.T) {
 	p, f, r := fixture(t)
 	f.response.Info = &sandbox.Info{Reference: r, ProviderID: "native-owned", State: "running", CreateSettled: true, BootstrapComplete: true}
-	b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "synthetic", Harness: "codex", NetworkAccess: "enabled"}
+	b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "synthetic", Harness: "codex"}
 	got, err := p.Create(bounded(t), b)
 	contracttest.AssertObservation(t, got, err, r, "native-owned", "running")
 	got, err = p.GetInfo(bounded(t), r)
diff --git a/services/core/internal/sandbox/e2b/create_observations_test.go b/services/core/internal/sandbox/e2b/create_observations_test.go
index 95fc17d01..4ceafd835 100644
--- a/services/core/internal/sandbox/e2b/create_observations_test.go
+++ b/services/core/internal/sandbox/e2b/create_observations_test.go
@@ -62,7 +62,7 @@ func TestProcessCreateObservationsReachLogger(t *testing.T) {
 	for _, overflow := range []bool{false, true} {
 		t.Run(strconv.FormatBool(overflow), func(t *testing.T) {
 			p, caller, ref := fixture(t)
-			_, _ = p.Create(bounded(t), sandbox.Bootstrap{Reference: ref, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "private-bootstrap", Harness: "codex", NetworkAccess: "enabled"})
+			_, _ = p.Create(bounded(t), sandbox.Bootstrap{Reference: ref, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "private-bootstrap", Harness: "codex"})
 			q := caller.requests[0]
 			q.Deadline = time.Now().Add(time.Second)
 			raw := `{"event":"e2b_create_stage","stage":"sandbox_create","duration_us":1250,"completed":true}` + "\nprivate SDK secret\n"
diff --git a/services/core/internal/sandbox/e2b/deployment.go b/services/core/internal/sandbox/e2b/deployment.go
index 83c0cdc6c..8fcd9c285 100644
--- a/services/core/internal/sandbox/e2b/deployment.go
+++ b/services/core/internal/sandbox/e2b/deployment.go
@@ -12,7 +12,7 @@ import (
 )
 
 func Policy() sandbox.DeploymentPolicy {
-	return sandbox.DeploymentPolicy{RuntimeError: "E2B Runtime is selected by its immutable template build"}
+	return sandbox.DeploymentPolicy{}
 }
 
 func ValidateResources(r sandbox.Resources) error          { return r.ValidatePolicy("e2b", Policy()) }
@@ -44,12 +44,10 @@ func NormalizeSelection(s sandbox.Selection) (sandbox.Selection, error) {
 	if s.Workspace != nil {
 		return s, sandbox.ErrInvalid
 	}
-	if s.Resources == (sandbox.Resources{}) {
-		if s.Runtime != nil {
-			return s, &sandbox.ValidationError{Param: "runtime", Message: sandbox.ErrInvalid.Error() + ": " + Policy().RuntimeError}
+	if s.Resources != (sandbox.Resources{}) {
+		if err := ValidateSpecification(s.DeploymentSpec); err != nil {
+			return s, err
 		}
-	} else if err := ValidateSpecification(s.DeploymentSpec); err != nil {
-		return s, err
 	}
 	if err := ValidateConfiguration(configuration(s)); err != nil {
 		return s, err
diff --git a/services/core/internal/sandbox/e2b/helper_contract_test.go b/services/core/internal/sandbox/e2b/helper_contract_test.go
index de319aa09..6ad601a68 100644
--- a/services/core/internal/sandbox/e2b/helper_contract_test.go
+++ b/services/core/internal/sandbox/e2b/helper_contract_test.go
@@ -7,7 +7,6 @@ import (
 	"os/exec"
 	"testing"
 
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
@@ -92,8 +91,5 @@ func validManagedExchange(data []byte) bool {
 	delete(fields, "RuntimeBootstrap")
 	data, _ = json.Marshal(fields)
 	var bootstrap sandbox.Bootstrap
-	if json.Unmarshal(data, &bootstrap) != nil || !validReference(bootstrap.Reference) || !validID(bootstrap.DeviceID) || !validID(bootstrap.SessionID) {
-		return false
-	}
-	return (agentnetwork.Policy{Access: bootstrap.NetworkAccess, AllowedDomains: bootstrap.AllowedDomains}).Validate() == nil
+	return json.Unmarshal(data, &bootstrap) == nil && validReference(bootstrap.Reference) && validID(bootstrap.DeviceID) && validID(bootstrap.SessionID)
 }
diff --git a/services/core/internal/sandbox/e2b/internal/contractgen/main.go b/services/core/internal/sandbox/e2b/internal/contractgen/main.go
index de3685b1e..134a459aa 100644
--- a/services/core/internal/sandbox/e2b/internal/contractgen/main.go
+++ b/services/core/internal/sandbox/e2b/internal/contractgen/main.go
@@ -6,10 +6,7 @@ import (
 	"encoding/json"
 	"flag"
 	"fmt"
-	"go/ast"
 	"go/format"
-	"go/parser"
-	"go/token"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -19,7 +16,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimebootstrap"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/e2b"
@@ -97,7 +93,6 @@ func main() {
 		"SUSPEND_FIELDS":           fields(reflect.TypeFor[sandbox.SuspendRequest]()),
 		"RESUME_FIELDS":            fields(reflect.TypeFor[sandbox.ResumeRequest]()),
 		"MANAGED_BOOTSTRAP_FIELDS": bootstrap, "MANAGED_BOOTSTRAP_REQUIRED_FIELDS": requiredBootstrap, "MANAGED_IDENTITY_FIELDS": identity,
-		"NETWORK_ACCESS": networkValues(filepath.Join(root, "internal/agentnetwork/policy.go")),
 	}
 	var python bytes.Buffer
 	python.WriteString("# Code generated by contractgen; DO NOT EDIT.\n\"\"\"Adapter-private wire declarations. No SDK or repository dependency.\"\"\"\n")
@@ -121,7 +116,7 @@ func main() {
 // envelopes and managed bootstrap inputs in both implementations.
 func fixtures() []byte {
 	r := sandbox.Reference{TenantID: "11111111-1111-4111-8111-111111111111", EnvironmentID: "22222222-2222-4222-8222-222222222222", AllocationID: "33333333-3333-4333-8333-333333333333"}
-	b := sandbox.Bootstrap{Reference: r, SessionID: "44444444-4444-4444-8444-444444444444", DeviceID: "55555555-5555-4555-8555-555555555555", CoreURL: "https://core.example/api/v1", Credential: "fixture-only", Harness: "codex", NetworkAccess: "enabled"}
+	b := sandbox.Bootstrap{Reference: r, SessionID: "44444444-4444-4444-8444-444444444444", DeviceID: "55555555-5555-4555-8555-555555555555", CoreURL: "https://core.example/api/v1", Credential: "fixture-only", Harness: "codex"}
 	installation := "66666666-6666-4666-8666-666666666666"
 	connection := b.RuntimeConnection()
 	q := e2b.Request{Version: e2b.ProtocolVersion, Operation: "create", Config: e2b.Config{InstallationID: installation}, Reference: r, Bootstrap: &b, RuntimeBootstrap: &connection, Deadline: time.Date(2099, 1, 1, 0, 0, 0, 0, time.UTC)}
@@ -224,16 +219,11 @@ func fixtures() []byte {
 	delete(managed, "Harness")
 	managed["InstallationID"] = installation
 	managed["RuntimeBootstrap"] = runtimebootstrap.Connection(connection)
-	for _, policy := range []agentnetwork.Policy{{Access: "enabled"}, {Access: "disabled"}, {Access: "restricted", AllowedDomains: []string{"example.com"}}} {
-		value := object(managed)
-		value["NetworkAccess"] = policy.Access
-		value["AllowedDomains"] = policy.AllowedDomains
-		add("managed", policy.Access, true, value)
-	}
+	add("managed", "valid", true, object(managed))
 	for _, item := range []struct {
 		field string
 		value any
-	}{{"Extra", true}, {"DeviceID", nil}, {"DeviceID", "invalid"}, {"NetworkAccess", nil}, {"NetworkAccess", "unknown"}, {"NetworkAccess", true}, {"AllowedDomains", "example.com"}, {"AllowedDomains", []any{1}}} {
+	}{{"Extra", true}, {"DeviceID", nil}, {"DeviceID", "invalid"}} {
 		value := object(managed)
 		value[item.field] = item.value
 		add("managed", "invalid-"+item.field, false, value)
@@ -293,52 +283,6 @@ func fieldNames(t reflect.Type, required bool) []string {
 	return result
 }
 
-// Read only the access switch of Policy.Validate. Unexpected shapes fail rather
-// than silently emitting an incomplete enum or interpreting a general validator.
-func networkValues(path string) []string {
-	f, err := parser.ParseFile(token.NewFileSet(), path, nil, 0)
-	must(err)
-	var result []string
-	for _, d := range f.Decls {
-		fn, ok := d.(*ast.FuncDecl)
-		if !ok || fn.Name.Name != "Validate" || fn.Recv == nil {
-			continue
-		}
-		for _, statement := range fn.Body.List {
-			s, ok := statement.(*ast.SwitchStmt)
-			if !ok {
-				continue
-			}
-			tag, ok := s.Tag.(*ast.SelectorExpr)
-			if !ok || tag.Sel.Name != "Access" {
-				continue
-			}
-			for _, clause := range s.Body.List {
-				for _, value := range clause.(*ast.CaseClause).List {
-					literal, ok := value.(*ast.BasicLit)
-					if !ok || literal.Kind != token.STRING {
-						panic("network access cases must be string literals")
-					}
-					access, err := strconv.Unquote(literal.Value)
-					must(err)
-					p := agentnetwork.Policy{Access: access}
-					if p.Validate() != nil {
-						p.AllowedDomains = []string{"example.com"}
-					}
-					if p.Validate() != nil || slices.Contains(result, access) {
-						panic("invalid network access projection")
-					}
-					result = append(result, access)
-				}
-			}
-		}
-	}
-	if len(result) == 0 {
-		panic("network access switch not found")
-	}
-	return result
-}
-
 func must(err error) {
 	if err != nil {
 		panic(err)
diff --git a/services/core/internal/sandbox/e2b/operations.go b/services/core/internal/sandbox/e2b/operations.go
index 7bb90e068..312997232 100644
--- a/services/core/internal/sandbox/e2b/operations.go
+++ b/services/core/internal/sandbox/e2b/operations.go
@@ -1,6 +1,7 @@
 package e2b
 
 import (
+	"context"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/providercontract"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
@@ -10,22 +11,30 @@ var _ sandbox.SandboxProvider = (*Provider)(nil)
 // Operations is this adapter's complete authored resource contract.
 func Operations() providercontract.Operations {
 	return providercontract.Operations{
-		"Create":            {State: providercontract.Supported},
-		"GetInfo":           {State: providercontract.Supported},
-		"Renew":             {State: providercontract.Supported},
-		"Kill":              {State: providercontract.Supported},
-		"RunCommand":        {State: providercontract.Supported},
-		"Initial":           {State: providercontract.Supported},
-		"NewCompute":        {State: providercontract.Supported},
-		"GetCompute":        {State: providercontract.Supported},
-		"RenewCompute":      {State: providercontract.Supported},
-		"Suspend":           {State: providercontract.Supported},
-		"Resume":            {State: providercontract.Supported},
-		"KillCompute":       {State: providercontract.Supported},
-		"DeleteRetained":    {State: providercontract.Supported},
-		"RunCommandCompute": {State: providercontract.Supported},
-		"ResumeCompute":     {State: providercontract.Supported},
-		"Observe":           {State: providercontract.Supported},
+		"Create":             {State: providercontract.Supported},
+		"GetInfo":            {State: providercontract.Supported},
+		"Renew":              {State: providercontract.Supported},
+		"Kill":               {State: providercontract.Supported},
+		"RunCommand":         {State: providercontract.Supported},
+		"Initial":            {State: providercontract.Supported},
+		"NewCompute":         {State: providercontract.Supported},
+		"GetCompute":         {State: providercontract.Supported},
+		"RenewCompute":       {State: providercontract.Supported},
+		"Suspend":            {State: providercontract.Supported},
+		"Resume":             {State: providercontract.Supported},
+		"KillCompute":        {State: providercontract.Supported},
+		"DeleteRetained":     {State: providercontract.Supported},
+		"RunCommandCompute":  {State: providercontract.Supported},
+		"ResumeCompute":      {State: providercontract.Supported},
+		"RestorePreparation": {State: providercontract.Unsupported, Reason: "e2b_does_not_support_preparation_cache"},
+		"SavePreparation":    {State: providercontract.Unsupported, Reason: "e2b_does_not_support_preparation_cache"},
+		"Observe":            {State: providercontract.Supported},
 	}
 }
 func (*Provider) ProviderOperations() providercontract.Operations { return Operations() }
+func (p *Provider) RestorePreparation(context.Context, sandbox.Reference, string) (bool, error) {
+	return false, &providercontract.UnsupportedError{Operation: "RestorePreparation", Reason: Operations()["RestorePreparation"].Reason}
+}
+func (p *Provider) SavePreparation(context.Context, sandbox.Reference, string) error {
+	return &providercontract.UnsupportedError{Operation: "SavePreparation", Reason: Operations()["SavePreparation"].Reason}
+}
diff --git a/services/core/internal/sandbox/e2b/provider.go b/services/core/internal/sandbox/e2b/provider.go
index 4c022070e..0c96a509f 100644
--- a/services/core/internal/sandbox/e2b/provider.go
+++ b/services/core/internal/sandbox/e2b/provider.go
@@ -12,7 +12,6 @@ import (
 	"time"
 	"unicode"
 
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimebootstrap"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	"github.com/google/uuid"
@@ -273,15 +272,13 @@ func (p *Provider) Create(ctx context.Context, b sandbox.Bootstrap) (sandbox.Inf
 	if b.Workspace != nil {
 		return sandbox.Info{Reference: b.Reference}, &providercontract.UnsupportedError{Operation: "Create", Reason: "external_workspace_unsupported"}
 	}
-	policy := agentnetwork.Policy{Access: b.NetworkAccess, AllowedDomains: b.AllowedDomains}
-	if !validReference(b.Reference) || !validID(b.SessionID) || !validID(b.DeviceID) || policy.Validate() != nil || b.RuntimeConnection().Validate() != nil {
+	if !validReference(b.Reference) || !validID(b.SessionID) || !validID(b.DeviceID) || b.RuntimeConnection().Validate() != nil {
 		info := sandbox.Info{Reference: b.Reference}
 		if validReference(b.Reference) {
 			info.State, info.CreateSettled = "absent", true
 		}
 		return info, sandbox.ErrInvalid
 	}
-	b.AllowedDomains = policy.Hosts()
 	return p.info(ctx, "create", b.Reference, &b)
 }
 func (p *Provider) GetInfo(ctx context.Context, r sandbox.Reference) (sandbox.Info, error) {
diff --git a/services/core/internal/sandbox/e2b/provider_test.go b/services/core/internal/sandbox/e2b/provider_test.go
index 6263ede3e..4ed08a767 100644
--- a/services/core/internal/sandbox/e2b/provider_test.go
+++ b/services/core/internal/sandbox/e2b/provider_test.go
@@ -103,7 +103,7 @@ func TestKillRequiresTerminalProof(t *testing.T) {
 }
 func TestCreateAndCommandUseOnlyPrivateRequest(t *testing.T) {
 	p, f, r := fixture(t)
-	b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "private-bootstrap", Harness: "codex", NetworkAccess: "enabled"}
+	b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "private-bootstrap", Harness: "codex"}
 	f.response.Info = &sandbox.Info{Reference: r, State: "running", ProviderID: "native-id", CreateSettled: true, BootstrapComplete: true}
 	if _, err := p.Create(bounded(t), b); err != nil {
 		t.Fatal(err)
@@ -143,7 +143,7 @@ func TestDeadlineAndCommandAdmission(t *testing.T) {
 
 func TestDefinitePreHelperCreateFailureCarriesAbsenceProof(t *testing.T) {
 	p, f, r := fixture(t)
-	b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "private", Harness: "codex", NetworkAccess: "enabled"}
+	b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "private", Harness: "codex"}
 	for _, err := range []error{errHelperNotStarted, context.DeadlineExceeded} {
 		f.err = err
 		info, gotErr := p.Create(bounded(t), b)
diff --git a/services/core/internal/sandbox/microsandbox/checkpoint_linux.go b/services/core/internal/sandbox/microsandbox/checkpoint_linux.go
index e28018709..78ae4412e 100644
--- a/services/core/internal/sandbox/microsandbox/checkpoint_linux.go
+++ b/services/core/internal/sandbox/microsandbox/checkpoint_linux.go
@@ -16,7 +16,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
-// CheckpointStore opens only an explicitly configured, private archive root.
+// CheckpointStore opens only an explicitly configured, private checkpoint root.
 // Its marker is an operator-owned identity, never inferred from workspace paths.
 func CheckpointStore(c Config) (string, error) {
 	if !filepath.IsAbs(c.CheckpointRoot) || filepath.Clean(c.CheckpointRoot) != c.CheckpointRoot {
@@ -89,9 +89,9 @@ func CheckpointClass(c Config) (sandbox.CheckpointCompatibility, error) {
 	raw, _ := json.Marshal(struct {
 		SDK, Runtime, Firmware, Image, Kernel string
 		CPUs                                  uint8
-		Memory, Root, Environment             uint32
+		Memory, Root                          uint32
 		CPU                                   []string
-	}{SDKVersion, c.RuntimeSHA256, c.FirmwareSHA256, c.Image, strings.TrimSpace(string(kernel)), c.CPUs, c.MemoryMiB, c.RootDiskMiB, c.EnvironmentDiskMiB, stable})
+	}{SDKVersion, c.RuntimeSHA256, c.FirmwareSHA256, c.Image, strings.TrimSpace(string(kernel)), c.CPUs, c.MemoryMiB, c.RootDiskMiB, stable})
 	h := sha256.Sum256(raw)
 	return sandbox.CheckpointCompatibility{ArtifactDomain: domain, ExecutionClass: hex.EncodeToString(h[:])}, nil
 }
diff --git a/services/core/internal/sandbox/microsandbox/contract_test.go b/services/core/internal/sandbox/microsandbox/contract_test.go
index 7ecfc5da8..6b3698b8f 100644
--- a/services/core/internal/sandbox/microsandbox/contract_test.go
+++ b/services/core/internal/sandbox/microsandbox/contract_test.go
@@ -13,7 +13,7 @@ import (
 func TestProviderContract(t *testing.T) {
 	contracttest.RunFailures(t, func(t *testing.T, s contracttest.Scenario, cancel context.CancelFunc) contracttest.Fixture {
 		c, r := testConfig(), testRef()
-		b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "synthetic", Harness: "codex", NetworkAccess: "enabled"}
+		b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "synthetic", Harness: "codex", Workspace: workspaceBinding()}
 		var calls []string
 		p, err := NewWithCaller(c, callerFunc(func(ctx context.Context, q Request) (Response, error) {
 			calls = append(calls, q.Operation)
@@ -40,6 +40,7 @@ func TestProviderContract(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
+		resolveTo(p)
 		nativeOperation := s.Operation
 		if nativeOperation == "renew" || nativeOperation == "inspect" {
 			nativeOperation = "initial_info"
@@ -63,7 +64,8 @@ func TestProviderContractObservation(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "synthetic", Harness: "codex", NetworkAccess: "enabled"}
+	resolveTo(p)
+	b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "synthetic", Harness: "codex", Workspace: workspaceBinding()}
 	got, err := p.Create(deadline(t), b)
 	contracttest.AssertObservation(t, got, err, r, "native-owned", "running")
 	got, err = p.GetInfo(deadline(t), r)
@@ -74,8 +76,8 @@ func TestProviderContractObservation(t *testing.T) {
 
 func TestBootstrapWireRejectsSupersededVersion(t *testing.T) {
 	c, r := testConfig(), testRef()
-	b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "fixture", Harness: "codex", NetworkAccess: "enabled"}
-	q := Request{Version: ProtocolVersion, Operation: "create", Config: c, Reference: r, Bootstrap: &b, Deadline: time.Now().Add(time.Minute)}
+	b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "https://core.example/api/v1", Credential: "fixture", Harness: "codex"}
+	q := Request{Version: ProtocolVersion, Operation: "create", Config: c, Reference: r, Bootstrap: &b, Workspace: &WorkspaceDirectory{Path: "/resolved/environment", ObjectID: workspaceBinding().Attachment.Reference.ObjectID}, Deadline: time.Now().Add(time.Minute)}
 	if err := ValidateRequest(q); err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/internal/sandbox/microsandbox/creation_settlement_test.go b/services/core/internal/sandbox/microsandbox/creation_settlement_test.go
index f088e8308..65407a808 100644
--- a/services/core/internal/sandbox/microsandbox/creation_settlement_test.go
+++ b/services/core/internal/sandbox/microsandbox/creation_settlement_test.go
@@ -11,7 +11,7 @@ import (
 func TestCreateConfigurationRejectionSettlement(t *testing.T) {
 	config, ref := testConfig(), testRef()
 	bootstrap := sandbox.Bootstrap{Reference: ref, SessionID: ref.TenantID, DeviceID: ref.EnvironmentID,
-		CoreURL: "https://core.example/api/v1", Credential: "fixture", Harness: "codex", NetworkAccess: "disabled"}
+		CoreURL: "https://core.example/api/v1", Credential: "fixture", Harness: "codex", Workspace: workspaceBinding()}
 	for _, test := range []struct {
 		name    string
 		change  func(*Response)
@@ -50,6 +50,7 @@ func TestCreateConfigurationRejectionSettlement(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
+			resolveTo(provider)
 			info, err := provider.Create(deadline(t), bootstrap)
 			if err == nil || info.CreateSettled != test.settled || info.BootstrapComplete || calls != 1 {
 				t.Fatal("rejection changed readiness or settlement", info, err, calls)
diff --git a/services/core/internal/sandbox/microsandbox/deployment.go b/services/core/internal/sandbox/microsandbox/deployment.go
index c69d53c4d..bd471f9d3 100644
--- a/services/core/internal/sandbox/microsandbox/deployment.go
+++ b/services/core/internal/sandbox/microsandbox/deployment.go
@@ -6,8 +6,8 @@ import (
 )
 
 func Policy() sandbox.DeploymentPolicy {
-	return sandbox.DeploymentPolicy{Workspace: &workspacefs.Requirements{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}, Disk: true, Runtime: true,
-		DefaultResources: &sandbox.Resources{CPUs: 2, MemoryMiB: 4096, RootDiskMiB: 8192, EnvironmentDiskMiB: 8192}}
+	return sandbox.DeploymentPolicy{Workspace: &workspacefs.Requirements{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}, Disk: true,
+		DefaultResources: &sandbox.Resources{CPUs: 2, MemoryMiB: 4096, RootDiskMiB: 8192}}
 }
 
 func ValidateResources(r sandbox.Resources) error { return r.ValidatePolicy("microsandbox", Policy()) }
diff --git a/services/core/internal/sandbox/microsandbox/identity.go b/services/core/internal/sandbox/microsandbox/identity.go
index 80ddc2840..ddcc8d185 100644
--- a/services/core/internal/sandbox/microsandbox/identity.go
+++ b/services/core/internal/sandbox/microsandbox/identity.go
@@ -7,7 +7,6 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	"github.com/google/uuid"
 )
@@ -27,7 +26,7 @@ func (c Config) Validate() error {
 	if !filepath.IsAbs(c.CheckpointRoot) || filepath.Clean(c.CheckpointRoot) != c.CheckpointRoot {
 		return sandbox.ErrInvalid
 	}
-	if !validID(c.InstallationID) || !filepath.IsAbs(c.HelperPath) || !filepath.IsAbs(c.RuntimeHome) || !filepath.IsAbs(c.RuntimePath) || !filepath.IsAbs(c.FirmwarePath) || !validHash(c.RuntimeSHA256) || !validHash(c.FirmwareSHA256) || c.MemoryMiB == 0 || c.CPUs == 0 || c.RootDiskMiB == 0 || (!c.ExternalWorkspace && c.EnvironmentDiskMiB == 0) {
+	if !validID(c.InstallationID) || !filepath.IsAbs(c.HelperPath) || !filepath.IsAbs(c.RuntimeHome) || !filepath.IsAbs(c.RuntimePath) || !filepath.IsAbs(c.FirmwarePath) || !validHash(c.RuntimeSHA256) || !validHash(c.FirmwareSHA256) || c.MemoryMiB == 0 || c.CPUs == 0 || c.RootDiskMiB == 0 {
 		return sandbox.ErrInvalid
 	}
 	imageName, digest, pinned := strings.Cut(c.Image, "@sha256:")
@@ -82,7 +81,7 @@ func ValidateBootstrap(b sandbox.Bootstrap) error {
 	if !ValidReference(b.Reference) || !validID(b.SessionID) || !validID(b.DeviceID) || b.RuntimeConnection().Validate() != nil {
 		return sandbox.ErrInvalid
 	}
-	return (agentnetwork.Policy{Access: b.NetworkAccess, AllowedDomains: b.AllowedDomains}).Validate()
+	return nil
 }
 func ValidateCommand(c sandbox.Command) error {
 	if len(c.Args) == 0 || c.Args[0] == "" || len(c.Stdin) > sandbox.MaxCommandInputBytes || (c.Directory != "" && !filepath.IsAbs(c.Directory)) {
@@ -110,10 +109,7 @@ func ValidateRequest(q Request) error {
 	}
 	switch q.Operation {
 	case "create":
-		if q.Config.ExternalWorkspace != (q.Workspace != nil) {
-			return sandbox.ErrInvalid
-		}
-		if (q.Workspace == nil && q.Config.EnvironmentDiskMiB == 0) || (q.Bootstrap != nil && q.Bootstrap.Workspace != nil) || q.Bootstrap == nil || q.Bootstrap.Reference != q.Reference || ValidateBootstrap(*q.Bootstrap) != nil {
+		if q.Workspace == nil || (q.Bootstrap != nil && q.Bootstrap.Workspace != nil) || q.Bootstrap == nil || q.Bootstrap.Reference != q.Reference || ValidateBootstrap(*q.Bootstrap) != nil {
 			return sandbox.ErrInvalid
 		}
 	case "initial_info":
@@ -125,6 +121,10 @@ func ValidateRequest(q Request) error {
 			return sandbox.ErrInvalid
 		}
 		return ValidateCompute(q.Config, q.Reference, q.Compute)
+	case "restore_preparation", "save_preparation":
+		if !validHash(q.Key) || q.Compute != (Compute{Name: Name(q.Config, q.Reference, 0)}) {
+			return sandbox.ErrInvalid
+		}
 	case "command":
 		if q.Command == nil || ValidateCommand(*q.Command) != nil {
 			return sandbox.ErrInvalid
@@ -139,11 +139,8 @@ func ValidateRequest(q Request) error {
 			return sandbox.ErrInvalid
 		}
 	case "resume":
-		if q.Config.ExternalWorkspace != (q.Workspace != nil) {
-			return sandbox.ErrInvalid
-		}
 		v := q.Resume
-		if (q.Workspace == nil && q.Config.EnvironmentDiskMiB == 0) || (v != nil && v.Workspace != nil) || v == nil || v.Reference != q.Reference || !validID(v.OperationID) || ValidateSnapshot(q.Config, q.Reference, v.Snapshot) != nil || ValidateCompute(q.Config, q.Reference, v.Target) != nil || v.Target.RestoredFrom == nil || *v.Target.RestoredFrom != v.Snapshot {
+		if q.Workspace == nil || (v != nil && v.Workspace != nil) || v == nil || v.Reference != q.Reference || !validID(v.OperationID) || ValidateSnapshot(q.Config, q.Reference, v.Snapshot) != nil || ValidateCompute(q.Config, q.Reference, v.Target) != nil || v.Target.RestoredFrom == nil || *v.Target.RestoredFrom != v.Snapshot {
 			return sandbox.ErrInvalid
 		}
 	case "delete_snapshot":
diff --git a/services/core/internal/sandbox/microsandbox/node.go b/services/core/internal/sandbox/microsandbox/node.go
index 2b68552dc..50b864f7a 100644
--- a/services/core/internal/sandbox/microsandbox/node.go
+++ b/services/core/internal/sandbox/microsandbox/node.go
@@ -20,15 +20,19 @@ var NodeArtifacts = []providerassets.Artifact{
 }
 
 // Native is the node configuration's native object for microsandbox: the
-// helper, Runtime and firmware paths, the private store and the network policy.
-// The helper owns local paths; no ambient backend is selected. Resources, the
-// image and the artifact hashes come from the deployment specification.
+// helper, Runtime and firmware paths, the installation's verified Runtime image
+// and artifact hashes, the private store and the network policy. The helper owns
+// local paths; no ambient backend is selected. Resources come from the
+// deployment specification.
 type Native struct {
 	HelperPath     string  `json:"helper_path"`
 	RuntimeHome    string  `json:"runtime_home"`
 	CheckpointRoot string  `json:"checkpoint_root"`
 	RuntimePath    string  `json:"runtime_path"`
 	FirmwarePath   string  `json:"firmware_path"`
+	Image          string  `json:"image"`
+	RuntimeSHA256  string  `json:"runtime_sha256"`
+	FirmwareSHA256 string  `json:"firmware_sha256"`
 	Network        Network `json:"network"`
 }
 
@@ -54,12 +58,11 @@ func configureMicrosandbox(entry Native, spec sandbox.DeploymentSpec, caller *Pr
 	for _, rule := range entry.Network.Rules {
 		network.Rules = append(network.Rules, NetworkRule{Action: rule.Action, Direction: rule.Direction, Destination: rule.Destination, Protocol: rule.Protocol, Port: rule.Port})
 	}
-	release, resources := spec.Runtime, spec.Resources
+	resources := spec.Resources
 	config := Config{
-		ExternalWorkspace: spec.Workspace != nil,
-		InstallationID:    result.InstallationID, HelperPath: entry.HelperPath, RuntimeHome: entry.RuntimeHome, CheckpointRoot: entry.CheckpointRoot, RuntimePath: entry.RuntimePath, FirmwarePath: entry.FirmwarePath,
-		RuntimeSHA256: release.RuntimeSHA256, FirmwareSHA256: release.FirmwareSHA256, Image: release.MicrosandboxRef,
-		MemoryMiB: resources.MemoryMiB, CPUs: uint8(resources.CPUs), RootDiskMiB: resources.RootDiskMiB, EnvironmentDiskMiB: resources.EnvironmentDiskMiB, Network: network,
+		InstallationID: result.InstallationID, HelperPath: entry.HelperPath, RuntimeHome: entry.RuntimeHome, CheckpointRoot: entry.CheckpointRoot, RuntimePath: entry.RuntimePath, FirmwarePath: entry.FirmwarePath,
+		RuntimeSHA256: entry.RuntimeSHA256, FirmwareSHA256: entry.FirmwareSHA256, Image: entry.Image,
+		MemoryMiB: resources.MemoryMiB, CPUs: uint8(resources.CPUs), RootDiskMiB: resources.RootDiskMiB, Network: network,
 	}
 	provider, err := NewWithCaller(config, caller)
 	if err != nil {
@@ -87,7 +90,7 @@ func configureMicrosandbox(entry Native, spec sandbox.DeploymentSpec, caller *Pr
 func BuildNode(c sandbox.NodeConfig, options sandbox.LocalOptions, result *sandbox.Built) (func(), error) {
 	closeProvider := func() {}
 	var entry Native
-	if sandbox.DecodeConfigurationObject(c.Native, &entry, "helper_path", "runtime_home", "runtime_path", "firmware_path", "network", "checkpoint_root") != nil {
+	if sandbox.DecodeConfigurationObject(c.Native, &entry, "helper_path", "runtime_home", "runtime_path", "firmware_path", "image", "runtime_sha256", "firmware_sha256", "network", "checkpoint_root") != nil {
 		return closeProvider, errors.New("invalid managed microsandbox node configuration")
 	}
 	caller := &ProcessCaller{}
diff --git a/services/core/internal/sandbox/microsandbox/node_test.go b/services/core/internal/sandbox/microsandbox/node_test.go
index 8e542fda8..656bb567e 100644
--- a/services/core/internal/sandbox/microsandbox/node_test.go
+++ b/services/core/internal/sandbox/microsandbox/node_test.go
@@ -12,6 +12,7 @@ import (
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/workspacefs"
 	"github.com/google/uuid"
 )
 
@@ -21,7 +22,10 @@ func TestMicrosandboxConstructionSelectsGenerationReadiness(t *testing.T) {
 	}
 	useKVM(t, true)
 	dir := t.TempDir()
-	native := Native{HelperPath: filepath.Join(dir, "helper"), RuntimeHome: dir, CheckpointRoot: dir, RuntimePath: filepath.Join(dir, "msb"), FirmwarePath: filepath.Join(dir, "firmware"), Network: Network{DefaultEgress: "allow", DefaultIngress: "deny"}}
+	script := []byte("#!/bin/sh\nprintf '%s' '{}'\n")
+	digest := sha256.Sum256(script)
+	native := Native{HelperPath: filepath.Join(dir, "helper"), RuntimeHome: dir, CheckpointRoot: dir, RuntimePath: filepath.Join(dir, "msb"), FirmwarePath: filepath.Join(dir, "firmware"),
+		Image: "oac-runtime@sha256:" + strings.Repeat("d", 64), RuntimeSHA256: hex.EncodeToString(digest[:]), FirmwareSHA256: hex.EncodeToString(digest[:]), Network: Network{DefaultEgress: "allow", DefaultIngress: "deny"}}
 	if err := os.Chmod(dir, 0700); err != nil {
 		t.Fatal(err)
 	}
@@ -32,10 +36,7 @@ func TestMicrosandboxConstructionSelectsGenerationReadiness(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	script := []byte("#!/bin/sh\nprintf '%s' '{}'\n")
-	digest := sha256.Sum256(script)
-	release := sandbox.RuntimeRelease{MicrosandboxRef: "oac-runtime@sha256:" + strings.Repeat("d", 64), RuntimeSHA256: hex.EncodeToString(digest[:]), FirmwareSHA256: hex.EncodeToString(digest[:])}
-	config := sandbox.NodeConfig{Provider: "microsandbox", Generation: 9, Specification: sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048, RootDiskMiB: 8192, EnvironmentDiskMiB: 8192}, Runtime: &release}, Native: raw}
+	config := sandbox.NodeConfig{Provider: "microsandbox", Generation: 9, Specification: sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048, RootDiskMiB: 8192}, Workspace: &workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}}, Native: raw}
 	for _, path := range []string{native.RuntimePath, native.FirmwarePath, native.HelperPath} {
 		if err := os.WriteFile(path, script, 0700); err != nil {
 			t.Fatal(err)
diff --git a/services/core/internal/sandbox/microsandbox/operations.go b/services/core/internal/sandbox/microsandbox/operations.go
index e3742747e..ebe0e35a4 100644
--- a/services/core/internal/sandbox/microsandbox/operations.go
+++ b/services/core/internal/sandbox/microsandbox/operations.go
@@ -5,22 +5,24 @@ import "github.com/MiniMax-AI/OpenAgentCore/services/core/internal/providercontr
 // Operations is this adapter's complete authored resource contract.
 func Operations() providercontract.Operations {
 	return providercontract.Operations{
-		"Create":            {State: providercontract.Supported},
-		"GetInfo":           {State: providercontract.Supported},
-		"Renew":             {State: providercontract.Supported},
-		"Kill":              {State: providercontract.Supported},
-		"RunCommand":        {State: providercontract.Supported},
-		"Initial":           {State: providercontract.Supported},
-		"NewCompute":        {State: providercontract.Supported},
-		"RenewCompute":      {State: providercontract.Supported},
-		"GetCompute":        {State: providercontract.Supported},
-		"Suspend":           {State: providercontract.Supported},
-		"Resume":            {State: providercontract.Supported},
-		"KillCompute":       {State: providercontract.Supported},
-		"DeleteRetained":    {State: providercontract.Supported},
-		"RunCommandCompute": {State: providercontract.Supported},
-		"ResumeCompute":     {State: providercontract.Supported},
-		"Observe":           {State: providercontract.Supported},
+		"Create":             {State: providercontract.Supported},
+		"GetInfo":            {State: providercontract.Supported},
+		"Renew":              {State: providercontract.Supported},
+		"Kill":               {State: providercontract.Supported},
+		"RunCommand":         {State: providercontract.Supported},
+		"Initial":            {State: providercontract.Supported},
+		"NewCompute":         {State: providercontract.Supported},
+		"RenewCompute":       {State: providercontract.Supported},
+		"GetCompute":         {State: providercontract.Supported},
+		"Suspend":            {State: providercontract.Supported},
+		"Resume":             {State: providercontract.Supported},
+		"KillCompute":        {State: providercontract.Supported},
+		"DeleteRetained":     {State: providercontract.Supported},
+		"RunCommandCompute":  {State: providercontract.Supported},
+		"ResumeCompute":      {State: providercontract.Supported},
+		"RestorePreparation": {State: providercontract.Supported},
+		"SavePreparation":    {State: providercontract.Supported},
+		"Observe":            {State: providercontract.Supported},
 	}
 }
 func (*Provider) ProviderOperations() providercontract.Operations { return Operations() }
diff --git a/services/core/internal/sandbox/microsandbox/process.go b/services/core/internal/sandbox/microsandbox/process.go
index ce3218740..47898ad60 100644
--- a/services/core/internal/sandbox/microsandbox/process.go
+++ b/services/core/internal/sandbox/microsandbox/process.go
@@ -142,10 +142,8 @@ func (p *ProcessCaller) acquireLease() (*os.File, error) {
 	if err := p.verifyLeaseIdentity(stat); err != nil {
 		return fail(err)
 	}
-	for _, suffix := range []string{".preparing", ".collecting", ".dropped"} {
-		if _, err := os.Lstat(strings.TrimSuffix(p.LeasePath, ".lease") + suffix); !os.IsNotExist(err) {
-			return fail(errors.New("generation is not finalized and usable"))
-		}
+	if _, err := os.Lstat(strings.TrimSuffix(p.LeasePath, ".lease") + ".dropped"); !os.IsNotExist(err) {
+		return fail(errors.New("generation is not finalized and usable"))
 	}
 	if err := p.verifyFinalizedGeneration(); err != nil {
 		return fail(err)
diff --git a/services/core/internal/sandbox/microsandbox/process_test.go b/services/core/internal/sandbox/microsandbox/process_test.go
index 894568e83..4bd684e8e 100644
--- a/services/core/internal/sandbox/microsandbox/process_test.go
+++ b/services/core/internal/sandbox/microsandbox/process_test.go
@@ -396,7 +396,7 @@ func TestHelperRequiresFinalConfigWithoutAnyUnfinishedJournal(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "1.lease")
 	writeTestLease(t, path)
 	caller := &ProcessCaller{LeasePath: path, LeaseIdentity: testLeaseIdentity()}
-	for _, suffix := range []string{".preparing", ".collecting", ".dropped"} {
+	for _, suffix := range []string{".dropped"} {
 		marker := strings.TrimSuffix(path, ".lease") + suffix
 		if err := os.WriteFile(marker, []byte("{}"), 0600); err != nil {
 			t.Fatal(err)
diff --git a/services/core/internal/sandbox/microsandbox/provider.go b/services/core/internal/sandbox/microsandbox/provider.go
index 20b093e15..d6828e31f 100644
--- a/services/core/internal/sandbox/microsandbox/provider.go
+++ b/services/core/internal/sandbox/microsandbox/provider.go
@@ -67,6 +67,8 @@ func (p *Provider) call(ctx context.Context, q Request) (Response, error) {
 		return out, sandbox.ErrNotFound
 	case "command_unconfirmed":
 		return out, sandbox.ErrCommandUnconfirmed
+	case "checkpoint_unusable":
+		return out, sandbox.ErrCheckpointUnusable
 	case "metrics_unavailable":
 		return out, runtimeobs.ErrUnavailable
 	default:
@@ -144,9 +146,6 @@ func (p *Provider) Create(ctx context.Context, b sandbox.Bootstrap) (sandbox.Inf
 	if err := ValidateBootstrap(b); err != nil {
 		return absent, err
 	}
-	if p.config.ExternalWorkspace != (b.Workspace != nil) {
-		return absent, sandbox.ErrInvalid
-	}
 	workspace, err := p.resolveWorkspace(ctx, b.Reference, b.Workspace)
 	if err != nil {
 		return absent, err
@@ -220,7 +219,7 @@ func (p *Provider) nativeSuspend(ctx context.Context, q SuspendRequest) (State,
 	return p.state(ctx, Request{Operation: "suspend", Reference: q.Reference, Suspend: &q})
 }
 func (p *Provider) nativeResume(ctx context.Context, q ResumeRequest) (State, error) {
-	if p.config.ExternalWorkspace != (q.Workspace != nil) {
+	if q.Workspace == nil {
 		return State{}, sandbox.ErrInvalid
 	}
 	workspace, err := p.resolveWorkspace(ctx, q.Reference, q.Workspace)
@@ -241,6 +240,24 @@ func (p *Provider) nativeRunCommandCompute(ctx context.Context, r sandbox.Refere
 	return *out.Command, nil
 }
 
+// The preparation cache addresses the initial compute, like RunCommand.
+func (p *Provider) RestorePreparation(ctx context.Context, r sandbox.Reference, key string) (bool, error) {
+	c, e := p.nativeInitial(ctx, r)
+	if e != nil {
+		return false, e
+	}
+	out, e := p.call(ctx, Request{Operation: "restore_preparation", Reference: r, Compute: c, Key: key})
+	return out.Restored && e == nil, e
+}
+func (p *Provider) SavePreparation(ctx context.Context, r sandbox.Reference, key string) error {
+	c, e := p.nativeInitial(ctx, r)
+	if e != nil {
+		return e
+	}
+	_, e = p.call(ctx, Request{Operation: "save_preparation", Reference: r, Compute: c, Key: key})
+	return e
+}
+
 // ResumeCompute thaws the exact resident source after an aborted suspension.
 // It never starts stopped compute or restores a checkpoint.
 func (p *Provider) nativeResumeCompute(ctx context.Context, r sandbox.Reference, c Compute) (State, error) {
@@ -264,7 +281,7 @@ func (p *Provider) nativeNewCompute(ctx context.Context, r sandbox.Reference, ge
 
 func (p *Provider) resolveWorkspace(ctx context.Context, reference sandbox.Reference, binding *workspacefs.Binding) (*WorkspaceDirectory, error) {
 	if binding == nil {
-		return nil, nil
+		return nil, sandbox.ErrInvalid
 	}
 	if err := sandbox.ValidateWorkspaceBinding(reference, binding); err != nil {
 		return nil, err
diff --git a/services/core/internal/sandbox/microsandbox/provider_test.go b/services/core/internal/sandbox/microsandbox/provider_test.go
index 8b5f1153e..6fbd9eb31 100644
--- a/services/core/internal/sandbox/microsandbox/provider_test.go
+++ b/services/core/internal/sandbox/microsandbox/provider_test.go
@@ -17,7 +17,7 @@ func testConfig() Config {
 	return Config{CheckpointRoot: "/private-checkpoints",
 		InstallationID: "11111111-1111-4111-8111-111111111111", HelperPath: "/helper", RuntimeHome: "/private/msb", RuntimePath: "/private/bin/msb", FirmwarePath: "/private/lib/libkrunfw.so",
 		RuntimeSHA256: strings.Repeat("a", 64), FirmwareSHA256: strings.Repeat("b", 64), Image: "registry/runtime@sha256:" + strings.Repeat("c", 64),
-		MemoryMiB: 2048, CPUs: 2, RootDiskMiB: 4096, EnvironmentDiskMiB: 2048, Network: NetworkPolicy{DefaultEgress: "deny", DefaultIngress: "deny", Rules: []NetworkRule{{Action: "allow", Direction: "egress", Destination: "host"}}},
+		MemoryMiB: 2048, CPUs: 2, RootDiskMiB: 4096, Network: NetworkPolicy{DefaultEgress: "deny", DefaultIngress: "deny", Rules: []NetworkRule{{Action: "allow", Direction: "egress", Destination: "host"}}},
 	}
 }
 func testRef() sandbox.Reference {
@@ -60,7 +60,8 @@ func TestRestoreMustRetainExactProvenance(t *testing.T) {
 		got.RestoredFrom = &v
 		return Response{Version: ProtocolVersion, State: &State{Compute: got, Status: "running", BootstrapComplete: true}}, nil
 	}))
-	_, e := p.nativeResume(deadline(t), ResumeRequest{Reference: r, OperationID: "66666666-6666-4666-8666-666666666666", Snapshot: s, Target: target})
+	resolveTo(p)
+	_, e := p.nativeResume(deadline(t), ResumeRequest{Reference: r, OperationID: "66666666-6666-4666-8666-666666666666", Snapshot: s, Target: target, Workspace: workspaceBinding()})
 	if !errors.Is(e, sandbox.ErrOwnership) {
 		t.Fatalf("different snapshot accepted: %v", e)
 	}
diff --git a/services/core/internal/sandbox/microsandbox/resources.go b/services/core/internal/sandbox/microsandbox/resources.go
index ce586b389..4303c645b 100644
--- a/services/core/internal/sandbox/microsandbox/resources.go
+++ b/services/core/internal/sandbox/microsandbox/resources.go
@@ -28,7 +28,7 @@ func (p *Provider) Observe(ctx context.Context, target runtimeobs.Target) (runti
 		Current Compute `json:"current"`
 	}
 	if json.Unmarshal(target.Instance.ProviderState, &state) != nil || state.Current.ID == "" {
-		// Suspension-disabled allocations predate durable compute receipts. A
+		// A disabled allocation has no compute receipt yet. A
 		// deterministic name is not an incarnation fence, so do not sample it.
 		if target.Instance.ComputePhase == "disabled" {
 			return runtimeobs.Sample{}, runtimeobs.ErrUnavailable
diff --git a/services/core/internal/sandbox/microsandbox/types.go b/services/core/internal/sandbox/microsandbox/types.go
index 012a9f56a..ccb982944 100644
--- a/services/core/internal/sandbox/microsandbox/types.go
+++ b/services/core/internal/sandbox/microsandbox/types.go
@@ -10,7 +10,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
-const ProtocolVersion = 5
+const ProtocolVersion = 7
 const SDKVersion = "v0.7.8"
 const MaxOutputBytes = 1024 * 1024
 const MaxRequestBytes = 72 * 1024 * 1024
@@ -19,22 +19,19 @@ const MaxResponseBytes = 16 * 1024 * 1024
 // Config is trusted deployment configuration. Paths and hashes refer to one
 // immutable, qualified installation. Network is explicitly used on create and restore.
 type Config struct {
-	// ExternalWorkspace is derived from the immutable deployment specification.
-	ExternalWorkspace  bool
-	InstallationID     string
-	HelperPath         string
-	RuntimeHome        string
-	CheckpointRoot     string
-	RuntimePath        string
-	FirmwarePath       string
-	RuntimeSHA256      string
-	FirmwareSHA256     string
-	Image              string
-	MemoryMiB          uint32
-	CPUs               uint8
-	RootDiskMiB        uint32
-	EnvironmentDiskMiB uint32
-	Network            NetworkPolicy
+	InstallationID string
+	HelperPath     string
+	RuntimeHome    string
+	CheckpointRoot string
+	RuntimePath    string
+	FirmwarePath   string
+	RuntimeSHA256  string
+	FirmwareSHA256 string
+	Image          string
+	MemoryMiB      uint32
+	CPUs           uint8
+	RootDiskMiB    uint32
+	Network        NetworkPolicy
 }
 
 type NetworkPolicy struct {
@@ -114,7 +111,9 @@ type Request struct {
 	Suspend   *SuspendRequest
 	Resume    *ResumeRequest
 	Snapshot  *SnapshotIdentity
-	Deadline  time.Time
+	// Key is the opaque preparation cache key.
+	Key      string `json:",omitempty"`
+	Deadline time.Time
 }
 type Response struct {
 	// CreateSettled binds State to a completed Create rejection or an initial_info
@@ -124,6 +123,7 @@ type Response struct {
 	State         *State
 	Command       *sandbox.CommandResult
 	Metrics       *Metrics
+	Restored      bool `json:",omitempty"`
 	ErrorCode     string
 }
 
diff --git a/services/core/internal/sandbox/microsandbox/workspace_test.go b/services/core/internal/sandbox/microsandbox/workspace_test.go
index bc74b2aec..760608153 100644
--- a/services/core/internal/sandbox/microsandbox/workspace_test.go
+++ b/services/core/internal/sandbox/microsandbox/workspace_test.go
@@ -20,10 +20,15 @@ func workspaceBinding() *workspacefs.Binding {
 	c := workspacefs.Configuration{ID: "77777777-7777-4777-8777-777777777777", Adapter: "test", Parameters: json.RawMessage(`{}`)}
 	return &workspacefs.Binding{Configuration: c, Attachment: workspacefs.Attachment{Reference: workspacefs.Reference{TenantID: r.TenantID, EnvironmentID: r.EnvironmentID, ObjectID: "88888888-8888-4888-8888-888888888888"}, ConfigurationID: c.ID, Kind: workspacefs.AttachmentHostDirectory, Native: json.RawMessage(`{}`)}}
 }
+
+// resolveTo gives a Provider the resolver every Environment needs.
+func resolveTo(p *Provider) {
+	p.workspace = workspaceResolverFunc(func(context.Context, workspacefs.Binding) (workspacefs.Directory, error) {
+		return workspacefs.Directory{Path: "/resolved/environment"}, nil
+	})
+}
 func TestWorkspaceResolveBeforeRestoreAndRetainPartialTarget(t *testing.T) {
 	c, r, s := testConfig(), testRef(), testSnapshot()
-	c.EnvironmentDiskMiB = 0
-	c.ExternalWorkspace = true
 	resolves, calls := 0, 0
 	p, err := NewWithCaller(c, callerFunc(func(_ context.Context, q Request) (Response, error) {
 		calls++
@@ -60,9 +65,8 @@ func TestWorkspaceResolveBeforeRestoreAndRetainPartialTarget(t *testing.T) {
 func TestWorkspaceDoesNotFallbackWithoutResolver(t *testing.T) {
 	calls := 0
 	config := testConfig()
-	config.ExternalWorkspace = true
 	p, _ := NewWithCaller(config, callerFunc(func(context.Context, Request) (Response, error) { calls++; return Response{}, nil }))
-	_, err := p.Create(deadline(t), sandbox.Bootstrap{Reference: testRef(), SessionID: testRef().TenantID, DeviceID: testRef().EnvironmentID, CoreURL: "https://core.example/api/v1", Credential: "fixture", Harness: "codex", NetworkAccess: "disabled", Workspace: workspaceBinding()})
+	_, err := p.Create(deadline(t), sandbox.Bootstrap{Reference: testRef(), SessionID: testRef().TenantID, DeviceID: testRef().EnvironmentID, CoreURL: "https://core.example/api/v1", Credential: "fixture", Harness: "codex", Workspace: workspaceBinding()})
 	if !errors.Is(err, workspacefs.ErrUnsupported) || calls != 0 {
 		t.Fatal(err, calls)
 	}
@@ -72,7 +76,6 @@ func TestPreNativeWorkspaceFailureSettlesAbsentCreation(t *testing.T) {
 	for _, failure := range []string{"resolve", "mode", "bootstrap", "unbounded"} {
 		t.Run(failure, func(t *testing.T) {
 			config, ref := testConfig(), testRef()
-			config.ExternalWorkspace = true
 			calls := 0
 			provider, err := NewWithCaller(config, callerFunc(func(context.Context, Request) (Response, error) { calls++; return Response{}, nil }))
 			if err != nil {
@@ -81,7 +84,7 @@ func TestPreNativeWorkspaceFailureSettlesAbsentCreation(t *testing.T) {
 			provider.workspace = workspaceResolverFunc(func(context.Context, workspacefs.Binding) (workspacefs.Directory, error) {
 				return workspacefs.Directory{}, workspacefs.ErrUnavailable
 			})
-			bootstrap := sandbox.Bootstrap{Reference: ref, SessionID: ref.TenantID, DeviceID: ref.EnvironmentID, CoreURL: "https://core.example/api/v1", Credential: "fixture", Harness: "codex", NetworkAccess: "disabled", Workspace: workspaceBinding()}
+			bootstrap := sandbox.Bootstrap{Reference: ref, SessionID: ref.TenantID, DeviceID: ref.EnvironmentID, CoreURL: "https://core.example/api/v1", Credential: "fixture", Harness: "codex", Workspace: workspaceBinding()}
 			ctx := deadline(t)
 			switch failure {
 			case "mode":
diff --git a/services/core/internal/sandbox/node/agent.go b/services/core/internal/sandbox/node/agent.go
index 36804c5cc..6508929cd 100644
--- a/services/core/internal/sandbox/node/agent.go
+++ b/services/core/internal/sandbox/node/agent.go
@@ -27,21 +27,17 @@ type AgentConfig struct {
 	StateDirectory string
 	Identity       Identity
 	Credential     string
-	Provider       sandbox.SandboxProvider
-	Probe          func(context.Context) (Health, error)
 	// Dialer is optional, primarily for an operator-supplied TLS trust configuration.
 	Dialer *websocket.Dialer
 }
 
 type agent struct {
-	config     AgentConfig
-	stored     StoredIdentity
-	mu         sync.Mutex
-	current    *agentConnection
-	queue      chan work
-	active     atomic.Int32
-	ready      atomic.Bool
-	healthSeen atomic.Bool
+	config  AgentConfig
+	stored  StoredIdentity
+	mu      sync.Mutex
+	current *agentConnection
+	queue   chan work
+	active  atomic.Int32
 	// failureLogged is set when Run logged a connection failure and cleared when
 	// the next accepted connection is logged. Only Run's goroutine uses it.
 	failureLogged bool
@@ -78,20 +74,14 @@ type work struct {
 	connection *agentConnection
 	provider   sandbox.SandboxProvider
 	release    func()
-	ready      bool
 	queued     time.Time
 }
 
 // Run owns one persistent node identity and reconnects its transport only. It
 // never resends a Provider request. The bounded worker outlives each connection.
 func Run(ctx context.Context, config AgentConfig) error {
-	if config.Generations == nil && (config.Provider == nil || config.Probe == nil) {
-		return sandbox.ErrInvalid
-	}
 	if config.Generations == nil {
-		if err := sandbox.ValidateProvider(config.Provider); err != nil {
-			return err
-		}
+		return sandbox.ErrInvalid
 	}
 	release, err := lockDirectory(config.StateDirectory)
 	if err != nil {
@@ -163,33 +153,10 @@ func Run(ctx context.Context, config AgentConfig) error {
 		}
 	}
 }
-func (a *agent) health(ctx context.Context, host *hostHealthSampler) (Health, error) {
-	if a.config.Generations != nil {
-		health := Health{Generations: a.config.Generations.Statuses(), ObservedAt: time.Now().UTC(), ActiveOperations: int(a.active.Load())}
-		host.fill(&health, a.config.StateDirectory)
-		return health, nil
-	}
-	probeCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
-	defer cancel()
-	h, e := a.config.Probe(probeCtx)
-	h.ProviderReady = e == nil
-	// Only the fixed code leaves this process; the probe error may name host paths.
-	h.Diagnostic = sandbox.NodeDiagnostic(e)
-	if e != nil && ctx.Err() != nil {
-		// A closing connection cancelled the probe; that says nothing about the provider.
-		h.Diagnostic = string(sandbox.NodeProviderUnavailable)
-	} else {
-		wasReady := a.ready.Swap(h.ProviderReady)
-		seen := a.healthSeen.Swap(true)
-		if e != nil && probeCtx.Err() == nil && (!seen || wasReady) {
-			// The local error stays in this host's journal; it may name host paths.
-			log.Ctx(ctx).Warn("sandbox node provider unavailable; check local runtime configuration and permissions", "node_id", a.config.Identity.NodeID, "diagnostic", h.Diagnostic, "error", e)
-		}
-	}
-	h.ObservedAt = time.Now().UTC()
-	h.ActiveOperations = int(a.active.Load())
-	host.fill(&h, a.config.StateDirectory)
-	return h, e
+func (a *agent) health(host *hostHealthSampler) Health {
+	health := Health{Generations: a.config.Generations.Statuses(), ObservedAt: time.Now().UTC(), ActiveOperations: int(a.active.Load())}
+	host.fill(&health, a.config.StateDirectory)
+	return health
 }
 func (a *agent) connect(ctx context.Context) error {
 	endpointURL, err := endpoint(a.config.CoreURL, "/api/v1/sandbox-node/connect")
@@ -221,17 +188,17 @@ func (a *agent) connect(ctx context.Context) error {
 	defer conn.Close()
 	conn.SetReadLimit(MaxFrameBytes)
 	host := new(hostHealthSampler)
-	health, _ := a.health(ctx, host)
+	health := a.health(host)
 	_ = conn.SetReadDeadline(time.Now().Add(15 * time.Second))
 	version := ProtocolVersion
-	if err = writeFrame(conn, frame{Version: version, Type: "hello", GenerationManagement: a.config.Generations != nil, Identity: &a.config.Identity, Health: &health}); err != nil {
+	if err = writeFrame(conn, frame{Version: version, Type: "hello", Identity: &a.config.Identity, Health: &health}); err != nil {
 		return err
 	}
 	welcome, err := readFrame(conn)
 	if err != nil {
 		return notAccepted{err}
 	}
-	if (a.config.Generations == nil && welcome.Deployment != nil) || welcome.Version != version || welcome.Type != "welcome" || !validID(welcome.ConnectionID) || welcome.OwnerEpoch == 0 {
+	if welcome.Deployment == nil || welcome.Version != version || welcome.Type != "welcome" || !validID(welcome.ConnectionID) || welcome.OwnerEpoch == 0 {
 		return notAccepted{sandbox.ErrInvalid}
 	}
 	a.mu.Lock()
@@ -259,19 +226,13 @@ func (a *agent) connect(ctx context.Context) error {
 	detach := context.AfterFunc(connectionCtx, current.close)
 	defer detach()
 	go a.heartbeats(connectionCtx, current, host)
-	var controlDone chan struct{}
-	controlWork := make(chan []sandbox.GenerationRetention, 1)
-	if a.config.Generations != nil {
-		if welcome.Deployment == nil {
-			return sandbox.ErrInvalid
-		}
-		if err := a.config.Generations.Deployment(*welcome.Deployment); err != nil {
-			return err
-		}
-		controlDone = make(chan struct{})
-		go func() { defer close(controlDone); a.garbageCollection(connectionCtx, current, controlWork) }()
-		defer func() { cancel(); <-controlDone }()
+	if err := a.config.Generations.Deployment(*welcome.Deployment); err != nil {
+		return err
 	}
+	controlWork := make(chan []sandbox.GenerationRetention, 1)
+	controlDone := make(chan struct{})
+	go func() { defer close(controlDone); a.garbageCollection(connectionCtx, current, controlWork) }()
+	defer func() { cancel(); <-controlDone }()
 	sequence := uint64(0)
 	for {
 		_ = conn.SetReadDeadline(time.Now().Add(35 * time.Second))
@@ -283,20 +244,18 @@ func (a *agent) connect(ctx context.Context) error {
 			return sandbox.ErrInvalid
 		}
 		if f.Type == "heartbeat_ack" && f.ConnectionID == current.id {
-			if f.OwnerEpoch != current.epoch || (a.config.Generations == nil && f.Deployment != nil) {
+			if f.OwnerEpoch != current.epoch {
 				return sandbox.ErrOwnership
 			}
-			if a.config.Generations != nil {
-				if f.Deployment == nil {
-					return sandbox.ErrInvalid
-				}
-				if err := a.config.Generations.Deployment(*f.Deployment); err != nil {
-					return err
-				}
+			if f.Deployment == nil {
+				return sandbox.ErrInvalid
+			}
+			if err := a.config.Generations.Deployment(*f.Deployment); err != nil {
+				return err
 			}
 			continue
 		}
-		if f.Type == "retention_ack" && a.config.Generations != nil {
+		if f.Type == "retention_ack" {
 			if err := a.acceptRetention(current, f, controlWork); err != nil {
 				return err
 			}
@@ -306,9 +265,6 @@ func (a *agent) connect(ctx context.Context) error {
 			return sandbox.ErrInvalid
 		}
 		q := *f.Request
-		if a.config.Generations == nil && q.DeploymentGeneration != a.config.Identity.DeploymentGeneration {
-			return sandbox.ErrOwnership
-		}
 		if q.ConnectionID != current.id || q.OwnerEpoch != current.epoch || q.Sequence != sequence+1 {
 			return sandbox.ErrOwnership
 		}
@@ -317,20 +273,16 @@ func (a *agent) connect(ctx context.Context) error {
 			_ = current.write(frame{Type: "response", Response: &response{ID: q.ID, ConnectionID: current.id, ErrorCode: "invalid"}})
 			continue
 		}
-		task := work{request: q, connection: current, provider: a.config.Provider, ready: a.ready.Load(), queued: time.Now()}
-		if a.config.Generations != nil {
-			task.provider, task.ready, task.release, err = a.config.Generations.Acquire(q.DeploymentGeneration)
-			if err != nil {
-				_ = current.write(frame{Type: "response", Response: &response{ID: q.ID, ConnectionID: current.id, ErrorCode: "unconfirmed"}})
-				continue
-			}
+		task := work{request: q, connection: current, queued: time.Now()}
+		task.provider, _, task.release, err = a.config.Generations.Acquire(q.DeploymentGeneration)
+		if err != nil {
+			_ = current.write(frame{Type: "response", Response: &response{ID: q.ID, ConnectionID: current.id, ErrorCode: "unconfirmed"}})
+			continue
 		}
 		select {
 		case a.queue <- task:
 		default:
-			if task.release != nil {
-				task.release()
-			}
+			task.release()
 			return ErrUnavailable
 		}
 	}
@@ -382,12 +334,12 @@ func (a *agent) heartbeats(ctx context.Context, c *agentConnection, host *hostHe
 		case <-c.done:
 			return
 		case <-ticker.C:
-			h, _ := a.health(ctx, host)
+			h := a.health(host)
 			if c.write(frame{Type: "heartbeat", ConnectionID: c.id, OwnerEpoch: c.epoch, Health: &h}) != nil {
 				c.close()
 				return
 			}
-			if a.config.Generations != nil && a.requestRetention(c) != nil {
+			if a.requestRetention(c) != nil {
 				c.close()
 				return
 			}
@@ -399,9 +351,7 @@ func (a *agent) worker(ctx context.Context) {
 		for {
 			select {
 			case task := <-a.queue:
-				if task.release != nil {
-					task.release()
-				}
+				task.release()
 			default:
 				return
 			}
@@ -417,9 +367,7 @@ func (a *agent) worker(ctx context.Context) {
 	}
 }
 func (a *agent) executeWork(ctx context.Context, task work) {
-	if task.release != nil {
-		defer task.release()
-	}
+	defer task.release()
 	a.mu.Lock()
 	current := a.current
 	a.mu.Unlock()
@@ -431,10 +379,7 @@ func (a *agent) executeWork(ctx context.Context, task work) {
 		return
 	default:
 	}
-	ready := a.ready.Load()
-	if a.config.Generations != nil {
-		ready = a.config.Generations.Ready(task.request.DeploymentGeneration)
-	}
+	ready := a.config.Generations.Ready(task.request.DeploymentGeneration)
 	if !time.Now().Before(task.request.deadline) || requiresReady(task.request) && !ready {
 		_ = task.connection.write(frame{Type: "response", Response: &response{ID: task.request.ID, ConnectionID: task.connection.id, ErrorCode: "unconfirmed"}})
 		return
@@ -443,17 +388,18 @@ func (a *agent) executeWork(ctx context.Context, task work) {
 	operationCtx, cancel := context.WithDeadline(context.Background(), task.request.deadline)
 	a.active.Add(1)
 	started := time.Now()
-	result := execute(operationCtx, task.provider, task.request)
+	result, err := execute(operationCtx, task.provider, task.request)
 	finished := time.Now()
 	a.active.Add(-1)
 	cancel()
 	_ = task.connection.write(frame{Type: "response", Response: &result})
-	logOperation(ctx, task, started, finished, result.ErrorCode)
+	logOperation(ctx, task, started, finished, result.ErrorCode, err)
 }
 
 // Queue wait and execution share this node's monotonic clock. Read-only
 // observations repeat on every reconciliation tick and log at debug level.
-func logOperation(ctx context.Context, task work, started, finished time.Time, code string) {
+// The local error stays in this host's journal; it may name host paths.
+func logOperation(ctx context.Context, task work, started, finished time.Time, code string, err error) {
 	level := slog.LevelInfo
 	switch task.request.Operation {
 	case "info", "renew", "initial", "new_compute", "compute", "observe":
@@ -461,6 +407,10 @@ func logOperation(ctx context.Context, task work, started, finished time.Time, c
 			level = slog.LevelDebug
 		}
 	}
-	log.Bg().Log(ctx, level, "sandbox node operation", "operation", task.request.Operation, "allocation_id", task.request.Reference.AllocationID,
-		"queue_ms", started.Sub(task.queued).Milliseconds(), "duration_ms", finished.Sub(started).Milliseconds(), "error_code", code)
+	attrs := []any{"operation", task.request.Operation, "allocation_id", task.request.Reference.AllocationID,
+		"queue_ms", started.Sub(task.queued).Milliseconds(), "duration_ms", finished.Sub(started).Milliseconds(), "error_code", code}
+	if err != nil {
+		attrs = append(attrs, "error", err)
+	}
+	log.Bg().Log(ctx, level, "sandbox node operation", attrs...)
 }
diff --git a/services/core/internal/sandbox/node/capacity_test.go b/services/core/internal/sandbox/node/capacity_test.go
index c408cb82a..3a3aee5b2 100644
--- a/services/core/internal/sandbox/node/capacity_test.go
+++ b/services/core/internal/sandbox/node/capacity_test.go
@@ -52,7 +52,7 @@ func TestHubCapacityCacheCannotOverrideAdminChangesOrBlockReconnect(t *testing.T
 	id := identity()
 	approved := id
 	var mu sync.Mutex
-	hub := NewHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) {
+	hub := newTestHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) {
 		mu.Lock()
 		defer mu.Unlock()
 		return approved, nil
@@ -74,7 +74,7 @@ func TestHubCapacityCacheCannotOverrideAdminChangesOrBlockReconnect(t *testing.T
 	mu.Lock()
 	approved.MaxActive, approved.MaxRetained = 2, 8
 	mu.Unlock()
-	if err := writeFrame(conn, frame{Type: "heartbeat", ConnectionID: peer.id, OwnerEpoch: peer.epoch, Health: &Health{ProviderReady: true, ObservedAt: time.Now().UTC()}}); err != nil {
+	if err := writeFrame(conn, frame{Type: "heartbeat", ConnectionID: peer.id, OwnerEpoch: peer.epoch, Health: &Health{ObservedAt: time.Now().UTC()}}); err != nil {
 		t.Fatal(err)
 	}
 	_ = conn.SetReadDeadline(time.Now().Add(time.Second))
diff --git a/services/core/internal/sandbox/node/checkpoint_generation_test.go b/services/core/internal/sandbox/node/checkpoint_generation_test.go
index b54341383..580d39ca1 100644
--- a/services/core/internal/sandbox/node/checkpoint_generation_test.go
+++ b/services/core/internal/sandbox/node/checkpoint_generation_test.go
@@ -6,51 +6,11 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/microsandbox"
 	"github.com/google/uuid"
 	"net/http/httptest"
-	"strings"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
-func TestStaticNodeReportsExactCheckpointGeneration(t *testing.T) {
-	id := identity()
-	compatibility := &sandbox.CheckpointCompatibility{ArtifactDomain: "private-store", ExecutionClass: "native-class"}
-	status := sandbox.GenerationStatus{Generation: id.DeploymentGeneration, SpecificationDigest: id.SpecificationDigest, State: "ready", Checkpoint: compatibility}
-	seen := false
-	hub := NewHub(HubOptions{Heartbeat: func(_ context.Context, _ Identity, _ string, _ uint64, health Health) error {
-		seen = true
-		if len(health.Generations) != 1 || *health.Generations[0].Checkpoint != *compatibility {
-			t.Fatal("qualification lost")
-		}
-		return nil
-	}})
-	p := &peer{identity: id}
-	health := Health{ProviderReady: true, Generations: []sandbox.GenerationStatus{status}}
-	if err := hub.recordHealth(t.Context(), p, health); err != nil || !seen {
-		t.Fatal(err, seen)
-	}
-	for _, mutation := range []string{"generation", "digest", "readiness", "extra"} {
-		t.Run(mutation, func(t *testing.T) {
-			changed := health
-			changed.Generations = append([]sandbox.GenerationStatus(nil), health.Generations...)
-			switch mutation {
-			case "generation":
-				changed.Generations[0].Generation++
-			case "digest":
-				changed.Generations[0].SpecificationDigest = strings.Repeat("f", 64)
-			case "readiness":
-				changed.ProviderReady = false
-			case "extra":
-				changed.Generations = append(changed.Generations, status)
-			}
-			seen = false
-			if err := hub.recordHealth(t.Context(), p, changed); err == nil || seen {
-				t.Fatal("invalid static qualification reached persistence")
-			}
-		})
-	}
-}
-
 type closedRestoreProvider struct{ fakeProvider }
 
 func (*closedRestoreProvider) ProviderOperations() providercontract.Operations {
@@ -62,7 +22,7 @@ func (*closedRestoreProvider) Resume(_ context.Context, q sandbox.ResumeRequest)
 func TestClosedRestoreEvidenceSurvivesNodeTransport(t *testing.T) {
 	id := identity()
 	var credential string
-	hub := NewHub(HubOptions{Authenticate: func(_ context.Context, node, token string) (Identity, error) {
+	hub := newTestHub(HubOptions{Authenticate: func(_ context.Context, node, token string) (Identity, error) {
 		if node != id.NodeID || token != credential {
 			return Identity{}, ErrAuthentication
 		}
@@ -80,7 +40,7 @@ func TestClosedRestoreEvidenceSurvivesNodeTransport(t *testing.T) {
 	ctx, cancel := context.WithCancel(t.Context())
 	done := make(chan error, 1)
 	go func() {
-		done <- Run(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: directory, Identity: id, Credential: credential, Provider: &closedRestoreProvider{}, Probe: probe})
+		done <- runProvider(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: directory, Identity: id, Credential: credential}, &closedRestoreProvider{}, probe)
 	}()
 	defer func() {
 		cancel()
diff --git a/services/core/internal/sandbox/node/connection_test.go b/services/core/internal/sandbox/node/connection_test.go
index 7daa846d2..40c0d66ee 100644
--- a/services/core/internal/sandbox/node/connection_test.go
+++ b/services/core/internal/sandbox/node/connection_test.go
@@ -53,7 +53,7 @@ func connectRawNode(t *testing.T, origin string, id Identity) *websocket.Conn {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err = writeFrame(conn, frame{Type: "hello", Identity: &id, Health: &Health{ProviderReady: true, ObservedAt: time.Now().UTC()}}); err != nil {
+	if err = writeFrame(conn, frame{Type: "hello", Identity: &id, Health: &Health{ObservedAt: time.Now().UTC()}}); err != nil {
 		conn.Close()
 		t.Fatal(err)
 	}
@@ -67,7 +67,7 @@ func connectRawNode(t *testing.T, origin string, id Identity) *websocket.Conn {
 func TestHubReservesIdentityAcrossConcurrentOpeningHandshakes(t *testing.T) {
 	id := identity()
 	var connected atomic.Int32
-	hub := NewHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }, Connected: func(context.Context, Identity, string, uint64) error { connected.Add(1); return nil }})
+	hub := newTestHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }, Connected: func(context.Context, Identity, string, uint64) error { connected.Add(1); return nil }})
 	server := httptest.NewServer(hub)
 	defer server.Close()
 	defer hub.Close()
@@ -127,7 +127,7 @@ func TestCopiedIdentityCannotReplaceNodeWithInflightCreate(t *testing.T) {
 	var credential string
 	var authenticated, connected atomic.Int32
 	duplicateAttempt := make(chan struct{}, 1)
-	hub := NewHub(HubOptions{Authenticate: func(ctx context.Context, node, token string) (Identity, error) {
+	hub := newTestHub(HubOptions{Authenticate: func(ctx context.Context, node, token string) (Identity, error) {
 		if node != id.NodeID || token != credential {
 			return Identity{}, ErrAuthentication
 		}
@@ -160,7 +160,7 @@ func TestCopiedIdentityCannotReplaceNodeWithInflightCreate(t *testing.T) {
 		ctx, cancel := context.WithCancel(context.Background())
 		done := make(chan error, 1)
 		go func() {
-			done <- Run(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: credential, Provider: p, Probe: probe})
+			done <- runProvider(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: credential}, p, probe)
 		}()
 		return cancel, done
 	}
@@ -232,7 +232,7 @@ func TestReservationRemainsUntilFencedDisconnectFinishes(t *testing.T) {
 	active := ""
 	connections := 0
 	var callbackErr error
-	hub := NewHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 9, nil }, Connected: func(ctx context.Context, id Identity, connection string, epoch uint64) error {
+	hub := newTestHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 9, nil }, Connected: func(ctx context.Context, id Identity, connection string, epoch uint64) error {
 		mu.Lock()
 		defer mu.Unlock()
 		if epoch != 9 {
@@ -323,7 +323,7 @@ func TestNodeLogsEachConnectionCauseOnce(t *testing.T) {
 			return
 		}
 		defer conn.Close()
-		if _, err = readFrame(conn); err != nil || writeFrame(conn, frame{Type: "welcome", ConnectionID: uuid.NewString(), OwnerEpoch: 1}) != nil {
+		if _, err = readFrame(conn); err != nil || writeFrame(conn, frame{Type: "welcome", ConnectionID: uuid.NewString(), OwnerEpoch: 1, Deployment: testDeployment()}) != nil {
 			return
 		}
 		for err == nil {
@@ -344,7 +344,7 @@ func TestNodeLogsEachConnectionCauseOnce(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	done := make(chan error, 1)
 	go func() {
-		done <- Run(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential, Provider: &fakeProvider{}, Probe: probe})
+		done <- runProvider(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential}, &fakeProvider{}, probe)
 	}()
 	wait(t, func() bool { return refused.Load() >= 2 })
 	accept.Store(true)
@@ -366,7 +366,7 @@ func TestNodeConnectionFailuresNameTheirCause(t *testing.T) {
 	defer untrusted.Close()
 	// Core closes the socket without a frame when it refuses a hello, here one
 	// whose identity differs from the registered node.
-	hub := NewHub(HubOptions{
+	hub := newTestHub(HubOptions{
 		Authenticate: func(_ context.Context, node, _ string) (Identity, error) {
 			other := identity()
 			other.NodeID = node
@@ -382,7 +382,7 @@ func TestNodeConnectionFailuresNameTheirCause(t *testing.T) {
 		{untrusted.URL, "tls: failed to verify certificate: x509: certificate signed by unknown authority"},
 		{core.URL, "Core did not accept the node: websocket: close 1006 (abnormal closure): unexpected EOF"},
 	} {
-		a := agent{config: AgentConfig{CoreURL: c.origin, StateDirectory: t.TempDir(), Identity: identity(), Credential: "credential", Probe: probe}}
+		a := agent{config: AgentConfig{CoreURL: c.origin, StateDirectory: t.TempDir(), Identity: identity(), Credential: "credential", Generations: generationFixture(0)}}
 		if cause := connectionCause(a.connect(t.Context())); cause != c.cause {
 			t.Errorf("%s: cause %q, want %q", c.origin, cause, c.cause)
 		}
diff --git a/services/core/internal/sandbox/node/creation_settlement_test.go b/services/core/internal/sandbox/node/creation_settlement_test.go
index cc0048506..7adfb3e1d 100644
--- a/services/core/internal/sandbox/node/creation_settlement_test.go
+++ b/services/core/internal/sandbox/node/creation_settlement_test.go
@@ -43,7 +43,7 @@ func TestNodeCarriesCreationSettlementWithoutConvertingFailureToSuccess(t *testi
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			id := identity()
-			hub := NewHub(HubOptions{
+			hub := newTestHub(HubOptions{
 				Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil },
 				OwnerEpoch:   func(context.Context) (uint64, error) { return 1, nil },
 			})
@@ -58,8 +58,8 @@ func TestNodeCarriesCreationSettlementWithoutConvertingFailureToSuccess(t *testi
 			ctx, cancel := context.WithCancel(t.Context())
 			done := make(chan error, 1)
 			go func() {
-				done <- Run(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential,
-					Provider: &settledProvider{info: test.info, err: test.err}, Probe: probe})
+				done <- runProvider(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential},
+					&settledProvider{info: test.info, err: test.err}, probe)
 			}()
 			defer func() {
 				cancel()
diff --git a/services/core/internal/sandbox/node/docker_live_test.go b/services/core/internal/sandbox/node/docker_live_test.go
index 3c59d3bc7..ab0e10225 100644
--- a/services/core/internal/sandbox/node/docker_live_test.go
+++ b/services/core/internal/sandbox/node/docker_live_test.go
@@ -39,7 +39,7 @@ func TestDockerNodeTransportLifecycle(t *testing.T) {
 		t.Fatal(err)
 	}
 	var credential string
-	hub := NewHub(HubOptions{Authenticate: func(ctx context.Context, node, token string) (Identity, error) {
+	hub := newTestHub(HubOptions{Authenticate: func(ctx context.Context, node, token string) (Identity, error) {
 		if node != id.NodeID || token != credential {
 			return Identity{}, ErrAuthentication
 		}
@@ -58,10 +58,10 @@ func TestDockerNodeTransportLifecycle(t *testing.T) {
 		ctx, cancel := context.WithCancel(context.Background())
 		done := make(chan error, 1)
 		go func() {
-			done <- Run(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: credential, Provider: provider, Probe: func(ctx context.Context) (Health, error) {
+			done <- runProvider(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: credential}, provider, func(ctx context.Context) (*sandbox.CheckpointCompatibility, error) {
 				_, err := dockerClient.Ping(ctx, client.PingOptions{})
-				return Health{}, err
-			}})
+				return nil, err
+			})
 		}()
 		return cancel, done
 	}
@@ -87,7 +87,7 @@ func TestDockerNodeTransportLifecycle(t *testing.T) {
 	}()
 	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
 	defer cancel()
-	b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "http://core.invalid/api/v1", Credential: "synthetic-node-transport-credential", Harness: "codex", NetworkAccess: "enabled"}
+	b := sandbox.Bootstrap{Reference: r, SessionID: uuid.NewString(), DeviceID: uuid.NewString(), CoreURL: "http://core.invalid/api/v1", Credential: "synthetic-node-transport-credential", Harness: "codex"}
 	callCtx, callCancel := context.WithTimeout(ctx, 25*time.Second)
 	info, err := proxy.Create(callCtx, b)
 	callCancel()
diff --git a/services/core/internal/sandbox/node/enrollment.go b/services/core/internal/sandbox/node/enrollment.go
index cf8dfc2e3..7b5a98acd 100644
--- a/services/core/internal/sandbox/node/enrollment.go
+++ b/services/core/internal/sandbox/node/enrollment.go
@@ -33,6 +33,9 @@ func Enroll(ctx context.Context, coreURL, dir, token string, input EnrollmentReq
 	input.NodeID, input.Credential = stored.Identity.NodeID, stored.Credential
 	input.Provider, input.BackendFingerprint = stored.Identity.Provider, stored.Identity.BackendFingerprint
 	input.CoreURL = coreURL
+	var host Health
+	new(hostHealthSampler).fill(&host, dir)
+	input.CPUCount, input.EffectiveCPUCores, input.TotalMemoryBytes, input.AvailableDiskBytes = host.CPUCount, host.EffectiveCPUCores, host.TotalMemoryBytes, host.AvailableDiskBytes
 	client := &http.Client{Timeout: 15 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
 	// This also recovers a consumed registration whose success response was lost.
 	target, err := endpoint(coreURL, "/api/v1/sandbox-node/identity")
diff --git a/services/core/internal/sandbox/node/generation_connection_test.go b/services/core/internal/sandbox/node/generation_connection_test.go
index efc41798d..b4908d46c 100644
--- a/services/core/internal/sandbox/node/generation_connection_test.go
+++ b/services/core/internal/sandbox/node/generation_connection_test.go
@@ -20,7 +20,7 @@ func TestGenerationWireRoutesOldOwnershipAndCurrentTargetSeparately(t *testing.T
 	original := manager.values[1].value.Provider.(*fakeProvider)
 	current := manager.values[17].value.Provider.(*fakeProvider)
 	ninth := manager.values[9].value.Provider.(*fakeProvider)
-	hub := NewHub(HubOptions{
+	hub := newTestHub(HubOptions{
 		Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil },
 		OwnerEpoch:   func(context.Context) (uint64, error) { return 7, nil },
 		Generations: func(_ context.Context, _ Identity, _ string, _ uint64, h Health) error {
diff --git a/services/core/internal/sandbox/node/generation_json.go b/services/core/internal/sandbox/node/generation_json.go
index d3a68ef7b..8c0abbf7f 100644
--- a/services/core/internal/sandbox/node/generation_json.go
+++ b/services/core/internal/sandbox/node/generation_json.go
@@ -80,7 +80,6 @@ func validateGenerationJSON(raw []byte, kind string) error {
 	switch kind {
 	case "hello":
 		fields = "identity health"
-		optional = "generation_management"
 	case "welcome", "heartbeat_ack":
 		fields = "connection_id owner_epoch"
 		optional = "deployment"
@@ -112,7 +111,7 @@ func validateGenerationJSON(raw []byte, kind string) error {
 		}
 	}
 	if value := values["health"]; value != nil {
-		health, err := generationObject(value, "provider_ready observed_at active_operations cpu_utilization total_memory_bytes effective_cpu_cores", "generations diagnostic cpu_count available_memory_bytes available_disk_bytes", "cpu_utilization total_memory_bytes effective_cpu_cores cpu_count available_memory_bytes available_disk_bytes")
+		health, err := generationObject(value, "observed_at active_operations cpu_utilization total_memory_bytes effective_cpu_cores", "generations cpu_count available_memory_bytes available_disk_bytes", "cpu_utilization total_memory_bytes effective_cpu_cores cpu_count available_memory_bytes available_disk_bytes")
 		if err != nil {
 			return err
 		}
@@ -136,18 +135,18 @@ func validateGenerationJSON(raw []byte, kind string) error {
 		}
 	}
 	if value := values["request"]; value != nil {
-		request, err := generationObject(value, "deployment_generation id sequence connection_id owner_epoch operation timeout_ms reference", "bootstrap compute generation command suspend resume retained observation", "")
+		request, err := generationObject(value, "deployment_generation id sequence connection_id owner_epoch operation timeout_ms reference", "bootstrap compute generation command suspend resume retained observation key", "")
 		if err != nil {
 			return err
 		}
 		if bootstrap := request["bootstrap"]; bootstrap != nil {
-			if _, err := generationObject(bootstrap, "TenantID EnvironmentID AllocationID SessionID DeviceID CoreURL Credential Harness NetworkAccess AllowedDomains", "Workspace", "AllowedDomains Workspace"); err != nil {
+			if _, err := generationObject(bootstrap, "TenantID EnvironmentID AllocationID SessionID DeviceID CoreURL Credential Harness", "Workspace", "Workspace"); err != nil {
 				return err
 			}
 		}
 	}
 	if value := values["response"]; value != nil {
-		if _, err := generationObject(value, "id connection_id", "error_code unsupported info compute state command sample", ""); err != nil {
+		if _, err := generationObject(value, "id connection_id", "error_code unsupported info compute state command sample restored", ""); err != nil {
 			return err
 		}
 	}
diff --git a/services/core/internal/sandbox/node/generation_json_test.go b/services/core/internal/sandbox/node/generation_json_test.go
index 37fbd8a3f..b14086372 100644
--- a/services/core/internal/sandbox/node/generation_json_test.go
+++ b/services/core/internal/sandbox/node/generation_json_test.go
@@ -2,7 +2,6 @@ package node
 
 import (
 	"encoding/json"
-	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -55,7 +54,7 @@ func TestGenerationHealthRejectsUnboundedOrAmbiguousNumbers(t *testing.T) {
 		{`"cpu_utilization":null`, `"cpu_utilization":1.1`},
 		{`"total_memory_bytes":null`, `"total_memory_bytes":9007199254740992`},
 		{`"effective_cpu_cores":null`, `"effective_cpu_cores":0`},
-		{`"provider_ready":false`, `"Provider_Ready":false`},
+		{`"active_operations":0`, `"Active_Operations":0`},
 	} {
 		if _, err := decodeFrame([]byte(strings.Replace(string(good), replacement.from, replacement.to, 1))); err == nil {
 			t.Fatal("invalid health accepted", replacement.to)
@@ -72,24 +71,56 @@ func TestNodeProtocolRejectsHistoricalVersions(t *testing.T) {
 	}
 }
 
-func TestNodeGenerationManagementIsAnExplicitCurrentCapability(t *testing.T) {
-	for _, managed := range []bool{false, true} {
-		f := frame{Version: ProtocolVersion, Type: "hello", GenerationManagement: managed, Identity: new(Identity), Health: &Health{ObservedAt: time.Now().UTC()}}
-		if managed {
-			f.Health.Generations = []sandbox.GenerationStatus{{Generation: 1, SpecificationDigest: strings.Repeat("a", 64), State: "ready"}}
-		}
-		raw, _ := json.Marshal(f)
-		if _, err := decodeFrame(raw); err != nil {
-			t.Fatalf("current mode managed=%v: %v", managed, err)
-		}
-		if managed {
-			f.GenerationManagement = false
-			raw, _ = json.Marshal(f)
+func TestCheckpointGenerationHealthJSONRoundTrip(t *testing.T) {
+	for _, kind := range []string{"hello", "heartbeat"} {
+		t.Run(kind, func(t *testing.T) {
+			compatibility := sandbox.CheckpointCompatibility{ArtifactDomain: "private-store", ExecutionClass: "native-class"}
+			f := frame{Version: ProtocolVersion, Type: kind, Health: &Health{ObservedAt: time.Now().UTC(), Generations: []sandbox.GenerationStatus{{Generation: 5, SpecificationDigest: strings.Repeat("a", 64), State: "ready", Checkpoint: &compatibility}}}}
+			if kind == "hello" {
+				f.Identity = new(Identity)
+			} else {
+				f.ConnectionID = uuid.NewString()
+				f.OwnerEpoch = 1
+			}
+			raw, err := json.Marshal(f)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := validateVersionFrame(f, len(raw)); err != nil {
+				t.Fatal("writer rejected valid status", err)
+			}
 			decoded, err := decodeFrame(raw)
-			if err != nil || decoded.GenerationManagement || len(decoded.Health.Generations) != 1 {
-				t.Fatal("static qualification implicitly enabled generation management", err)
+			if err != nil {
+				t.Fatal("decoder rejected valid status", err)
 			}
-		}
+			if decoded.Health == nil || len(decoded.Health.Generations) != 1 || decoded.Health.Generations[0].Checkpoint == nil || *decoded.Health.Generations[0].Checkpoint != compatibility {
+				t.Fatal("checkpoint qualification lost", decoded)
+			}
+			original := string(raw)
+			for name, replacement := range map[string]string{
+				"unknown nested field":     strings.Replace(original, `"artifact_domain":"private-store"`, `"artifact_domain":"private-store","extra":"value"`, 1),
+				"unknown generation field": strings.Replace(original, `"checkpoint":`, `"extra":true,"checkpoint":`, 1),
+				"duplicate token":          strings.Replace(original, `"artifact_domain":"private-store"`, `"artifact_domain":"private-store","artifact_domain":"other"`, 1),
+				"case alias":               strings.Replace(original, `"artifact_domain":`, `"Artifact_Domain":`, 1),
+				"missing token":            strings.Replace(original, `"artifact_domain":"private-store",`, "", 1),
+				"null token":               strings.Replace(original, `"artifact_domain":"private-store"`, `"artifact_domain":null`, 1),
+				"null checkpoint":          strings.Replace(original, `{"artifact_domain":"private-store","execution_class":"native-class"}`, `null`, 1),
+				"empty domain":             strings.Replace(original, `"private-store"`, `""`, 1),
+				"empty execution":          strings.Replace(original, `"native-class"`, `""`, 1),
+				"oversized domain":         strings.Replace(original, `"private-store"`, `"`+strings.Repeat("x", 257)+`"`, 1),
+				"oversized execution":      strings.Replace(original, `"native-class"`, `"`+strings.Repeat("x", 257)+`"`, 1),
+				"nonready checkpoint":      strings.Replace(original, `"state":"ready"`, `"state":"preparing"`, 1),
+			} {
+				t.Run(name, func(t *testing.T) {
+					if replacement == original {
+						t.Fatal("fixture unchanged")
+					}
+					if _, err := decodeFrame([]byte(replacement)); err == nil {
+						t.Fatal("invalid checkpoint accepted")
+					}
+				})
+			}
+		})
 	}
 }
 
@@ -113,58 +144,20 @@ func TestNodeBootstrapRejectsAmbiguousHarness(t *testing.T) {
 	}
 }
 
-func TestCheckpointGenerationHealthJSONRoundTrip(t *testing.T) {
-	for _, managed := range []bool{false, true} {
-		for _, kind := range []string{"hello", "heartbeat"} {
-			t.Run(fmt.Sprintf("managed=%t/%s", managed, kind), func(t *testing.T) {
-				compatibility := sandbox.CheckpointCompatibility{ArtifactDomain: "private-store", ExecutionClass: "native-class"}
-				f := frame{Version: ProtocolVersion, Type: kind, Health: &Health{ProviderReady: true, ObservedAt: time.Now().UTC(), Generations: []sandbox.GenerationStatus{{Generation: 5, SpecificationDigest: strings.Repeat("a", 64), State: "ready", Checkpoint: &compatibility}}}}
-				if kind == "hello" {
-					f.Identity = new(Identity)
-					f.GenerationManagement = managed
-				} else {
-					f.ConnectionID = uuid.NewString()
-					f.OwnerEpoch = 1
-				}
-				raw, err := json.Marshal(f)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if err := validateVersionFrame(f, len(raw)); err != nil {
-					t.Fatal("writer rejected valid status", err)
-				}
-				decoded, err := decodeFrame(raw)
-				if err != nil {
-					t.Fatal("decoder rejected valid status", err)
-				}
-				if decoded.Health == nil || len(decoded.Health.Generations) != 1 || decoded.Health.Generations[0].Checkpoint == nil || *decoded.Health.Generations[0].Checkpoint != compatibility {
-					t.Fatal("checkpoint qualification lost", decoded)
-				}
-				original := string(raw)
-				for name, replacement := range map[string]string{
-					"unknown nested field":     strings.Replace(original, `"artifact_domain":"private-store"`, `"artifact_domain":"private-store","extra":"value"`, 1),
-					"unknown generation field": strings.Replace(original, `"checkpoint":`, `"extra":true,"checkpoint":`, 1),
-					"duplicate token":          strings.Replace(original, `"artifact_domain":"private-store"`, `"artifact_domain":"private-store","artifact_domain":"other"`, 1),
-					"case alias":               strings.Replace(original, `"artifact_domain":`, `"Artifact_Domain":`, 1),
-					"missing token":            strings.Replace(original, `"artifact_domain":"private-store",`, "", 1),
-					"null token":               strings.Replace(original, `"artifact_domain":"private-store"`, `"artifact_domain":null`, 1),
-					"null checkpoint":          strings.Replace(original, `{"artifact_domain":"private-store","execution_class":"native-class"}`, `null`, 1),
-					"empty domain":             strings.Replace(original, `"private-store"`, `""`, 1),
-					"empty execution":          strings.Replace(original, `"native-class"`, `""`, 1),
-					"oversized domain":         strings.Replace(original, `"private-store"`, `"`+strings.Repeat("x", 257)+`"`, 1),
-					"oversized execution":      strings.Replace(original, `"native-class"`, `"`+strings.Repeat("x", 257)+`"`, 1),
-					"nonready checkpoint":      strings.Replace(original, `"state":"ready"`, `"state":"preparing"`, 1),
-				} {
-					t.Run(name, func(t *testing.T) {
-						if replacement == original {
-							t.Fatal("fixture unchanged")
-						}
-						if _, err := decodeFrame([]byte(replacement)); err == nil {
-							t.Fatal("invalid checkpoint accepted")
-						}
-					})
-				}
-			})
+func TestPreparationFramesSurviveStrictFrame(t *testing.T) {
+	q := request{DeploymentGeneration: 1, ID: uuid.NewString(), Sequence: 1, ConnectionID: uuid.NewString(), OwnerEpoch: 1, Operation: "restore_preparation", TimeoutMillis: 60000, Reference: reference(), Key: strings.Repeat("a", 64)}
+	out := response{ID: q.ID, ConnectionID: q.ConnectionID, Restored: true}
+	for _, f := range []frame{{Version: ProtocolVersion, Type: "request", Request: &q}, {Version: ProtocolVersion, Type: "response", Response: &out}} {
+		raw, err := json.Marshal(f)
+		if err != nil {
+			t.Fatal(err)
+		}
+		decoded, err := decodeFrame(raw)
+		if err != nil {
+			t.Fatal("preparation frame rejected", f.Type, err)
+		}
+		if (decoded.Request != nil && decoded.Request.Key != q.Key) || (decoded.Response != nil && !decoded.Response.Restored) {
+			t.Fatal("preparation field lost", f.Type)
 		}
 	}
 }
diff --git a/services/core/internal/sandbox/node/generation_wire.go b/services/core/internal/sandbox/node/generation_wire.go
index d8c83327b..4df61cc2a 100644
--- a/services/core/internal/sandbox/node/generation_wire.go
+++ b/services/core/internal/sandbox/node/generation_wire.go
@@ -28,9 +28,6 @@ func validateVersionFrame(f frame, size int) error {
 	if f.Version != ProtocolVersion {
 		return sandbox.ErrInvalid
 	}
-	if f.GenerationManagement && f.Type != "hello" {
-		return sandbox.ErrInvalid
-	}
 	if f.Type != "request" && f.Type != "response" && size > MaxControlFrameBytes {
 		return sandbox.ErrInvalid
 	}
@@ -112,9 +109,6 @@ func validGenerationHealth(h Health) bool {
 	if h.ObservedAt.IsZero() || h.ObservedAt.Year() < 1970 || h.ObservedAt.Year() > 9999 || h.ActiveOperations < 0 || h.ActiveOperations > maxPending {
 		return false
 	}
-	if len(h.Diagnostic) > 64 || sandbox.NormalizeNodeDiagnostic(h.Diagnostic) != h.Diagnostic {
-		return false
-	}
 	for _, value := range []*int64{h.CPUCount, h.TotalMemoryBytes, h.AvailableMemoryBytes, h.AvailableDiskBytes} {
 		if value != nil && (*value < 0 || *value > 1<<53-1) {
 			return false
diff --git a/services/core/internal/sandbox/node/generations.go b/services/core/internal/sandbox/node/generations.go
index c28029a8d..eebe198bd 100644
--- a/services/core/internal/sandbox/node/generations.go
+++ b/services/core/internal/sandbox/node/generations.go
@@ -25,7 +25,6 @@ type GenerationProvider struct {
 type GenerationManagerOptions struct {
 	Initial []GenerationProvider
 	Recover []sandbox.GenerationReference
-	Collect []sandbox.GenerationReference
 	Prepare func(context.Context, uint64, string) (GenerationProvider, error)
 	Remove  func(context.Context, GenerationProvider) error
 }
@@ -78,13 +77,6 @@ func NewGenerationManager(ctx context.Context, options GenerationManagerOptions)
 		}
 		m.values[ref.Generation] = &localGeneration{value: GenerationProvider{Generation: ref.Generation, SpecificationDigest: ref.SpecificationDigest}, state: "failed", diagnostic: string(sandbox.NodeProviderUnavailable), repairing: true}
 	}
-	for _, ref := range options.Collect {
-		if !validGeneration(ref.Generation) || !validSpecificationDigest(ref.SpecificationDigest) || m.values[ref.Generation] != nil {
-			cancel()
-			return nil, sandbox.ErrInvalid
-		}
-		m.values[ref.Generation] = &localGeneration{value: GenerationProvider{Generation: ref.Generation, SpecificationDigest: ref.SpecificationDigest}, collecting: true}
-	}
 	m.workers.Add(2)
 	go func() { defer m.workers.Done(); m.prepareLoop() }()
 	go func() { defer m.workers.Done(); m.probeLoop() }()
diff --git a/services/core/internal/sandbox/node/generations_test.go b/services/core/internal/sandbox/node/generations_test.go
index f81a5e38f..b8256c771 100644
--- a/services/core/internal/sandbox/node/generations_test.go
+++ b/services/core/internal/sandbox/node/generations_test.go
@@ -290,81 +290,8 @@ func TestGenerationDeploymentRejectsConflictingImmutableIdentity(t *testing.T) {
 	}
 }
 
-func TestInterruptedCollectionNeverPreparesOrServesAfterRestart(t *testing.T) {
-	digest := strings.Repeat("a", 64)
-	ref := sandbox.GenerationReference{Generation: 1, SpecificationDigest: digest}
-	probed := make(chan struct{}, 1)
-	removes := 0
-	manager, err := NewGenerationManager(t.Context(), GenerationManagerOptions{
-		Initial: []GenerationProvider{{Generation: 2, SpecificationDigest: digest, Provider: &fakeProvider{}, Probe: func(context.Context) (*sandbox.CheckpointCompatibility, error) {
-			select {
-			case probed <- struct{}{}:
-			default:
-			}
-			return nil, nil
-		}}},
-		Collect: []sandbox.GenerationReference{ref},
-		Prepare: func(context.Context, uint64, string) (GenerationProvider, error) {
-			t.Error("collection entered preparation")
-			return GenerationProvider{}, sandbox.ErrInvalid
-		},
-		Remove: func(_ context.Context, value GenerationProvider) error {
-			removes++
-			if value.Generation != 1 {
-				t.Error("wrong generation")
-			}
-			if removes == 1 {
-				return errors.New("interrupted cleanup")
-			}
-			return nil
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer manager.Close()
-	pin := uint64(2)
-	if err = manager.Deployment(sandbox.NodeDeployment{Generation: 2, SpecificationDigest: digest, ServingGeneration: &pin}); err != nil {
-		t.Fatal(err)
-	}
-	select {
-	case <-probed:
-	case <-time.After(3 * time.Second):
-		t.Fatal("provider loop did not run")
-	}
-	if _, _, _, err = manager.Acquire(1); err == nil {
-		t.Fatal("unfinished collection admitted an operation")
-	}
-	for _, status := range manager.Statuses() {
-		if status.Generation == 1 {
-			t.Fatal("unfinished collection advertised readiness", status)
-		}
-	}
-	if len(manager.Retained(0)) != 2 || removes != 0 {
-		t.Fatal("restart consumed old drop authorization")
-	}
-	cancelled, cancel := context.WithCancel(t.Context())
-	cancel()
-	grant := sandbox.GenerationRetention{GenerationReference: ref}
-	if err = manager.Drop(cancelled, grant); err == nil || removes != 0 {
-		t.Fatal("cancelled connection collected")
-	}
-	if err = manager.Drop(t.Context(), grant); err == nil {
-		t.Fatal("expected interrupted cleanup")
-	}
-	if _, _, _, err = manager.Acquire(1); err == nil {
-		t.Fatal("failed cleanup resumed serving")
-	}
-	if err = manager.Drop(t.Context(), grant); err != nil {
-		t.Fatal(err)
-	}
-	if len(manager.Retained(0)) != 1 || removes != 2 {
-		t.Fatal("cleanup did not settle")
-	}
-}
-
 func TestPreparationDiagnosticPreservesTypedCause(t *testing.T) {
-	for _, cause := range []error{sandbox.ErrRuntimeDownloadFailed, sandbox.ErrProviderUnavailable, sandbox.ErrHostUnsupported, sandbox.ErrOwnership, context.Canceled, errors.New("raw secret provider text")} {
+	for _, cause := range []error{sandbox.ErrProviderUnavailable, sandbox.ErrHostUnsupported, sandbox.ErrOwnership, context.Canceled, errors.New("raw secret provider text")} {
 		t.Run(sandbox.NodeDiagnostic(cause)+cause.Error(), func(t *testing.T) {
 			m, err := NewGenerationManager(t.Context(), GenerationManagerOptions{
 				Prepare: func(context.Context, uint64, string) (GenerationProvider, error) { return GenerationProvider{}, cause },
diff --git a/services/core/internal/sandbox/node/health_connection_linux_test.go b/services/core/internal/sandbox/node/health_connection_linux_test.go
index c2c8fefae..695834890 100644
--- a/services/core/internal/sandbox/node/health_connection_linux_test.go
+++ b/services/core/internal/sandbox/node/health_connection_linux_test.go
@@ -28,12 +28,12 @@ func TestHostHealthReconnectStartsFreshInterval(t *testing.T) {
 			return
 		}
 		hellos <- *hello.Health
-		if err := writeFrame(conn, frame{Type: "welcome", ConnectionID: uuid.NewString(), OwnerEpoch: 1}); err != nil {
+		if err := writeFrame(conn, frame{Type: "welcome", ConnectionID: uuid.NewString(), OwnerEpoch: 1, Deployment: testDeployment()}); err != nil {
 			t.Error(err)
 		}
 	}))
 	defer server.Close()
-	a := agent{config: AgentConfig{CoreURL: server.URL, StateDirectory: t.TempDir(), Identity: identity(), Probe: probe}, stored: StoredIdentity{OwnerEpoch: 1}}
+	a := agent{config: AgentConfig{CoreURL: server.URL, StateDirectory: t.TempDir(), Identity: identity(), Generations: generationFixture(0)}, stored: StoredIdentity{OwnerEpoch: 1}}
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	for i := 0; i < 2; i++ {
diff --git a/services/core/internal/sandbox/node/health_linux_test.go b/services/core/internal/sandbox/node/health_linux_test.go
index e27dbf468..feaa7d1a4 100644
--- a/services/core/internal/sandbox/node/health_linux_test.go
+++ b/services/core/internal/sandbox/node/health_linux_test.go
@@ -3,7 +3,6 @@
 package node
 
 import (
-	"context"
 	"encoding/json"
 	"os"
 	"path/filepath"
@@ -187,11 +186,11 @@ func TestHealthCgroupMountPaths(t *testing.T) {
 func TestHostHealthReadOnly(t *testing.T) {
 	dir := t.TempDir()
 	sampler := new(hostHealthSampler)
-	a := agent{config: AgentConfig{StateDirectory: dir, Probe: probe}}
+	a := agent{config: AgentConfig{StateDirectory: dir, Generations: generationFixture(0)}}
 	before := time.Now().UTC()
-	h, err := a.health(context.Background(), sampler)
-	if err != nil || h.ObservedAt.Before(before) || h.ObservedAt.After(time.Now()) || h.ObservedAt.Location() != time.UTC {
-		t.Fatalf("invalid sample identity: %+v, %v", h, err)
+	h := a.health(sampler)
+	if h.ObservedAt.Before(before) || h.ObservedAt.After(time.Now()) || h.ObservedAt.Location() != time.UTC {
+		t.Fatalf("invalid sample identity: %+v", h)
 	}
 	if h.CPUUtilization != nil || h.TotalMemoryBytes == nil || *h.TotalMemoryBytes <= 0 || h.AvailableMemoryBytes == nil || *h.AvailableMemoryBytes < 0 || h.CPUCount == nil || *h.CPUCount <= 0 {
 		t.Fatalf("invalid initial host observation: %+v", h)
@@ -211,15 +210,15 @@ func TestHostHealthReadOnly(t *testing.T) {
 		t.Log(string(data))
 	}
 	time.Sleep(100 * time.Millisecond)
-	h, err = a.health(context.Background(), sampler)
-	if err != nil || h.CPUUtilization == nil || *h.CPUUtilization < 0 || *h.CPUUtilization > 1 || !h.ObservedAt.After(before) {
-		t.Fatalf("invalid follow-up observation: %+v, %v", h, err)
+	h = a.health(sampler)
+	if h.CPUUtilization == nil || *h.CPUUtilization < 0 || *h.CPUUtilization > 1 || !h.ObservedAt.After(before) {
+		t.Fatalf("invalid follow-up observation: %+v", h)
 	}
 	if os.Getenv("OAC_TEST_NODE_HEALTH_PROBE") == "1" {
 		data, _ := json.Marshal(h)
 		t.Log(string(data))
 	}
-	if fresh, _ := a.health(context.Background(), new(hostHealthSampler)); fresh.CPUUtilization != nil {
+	if fresh := a.health(new(hostHealthSampler)); fresh.CPUUtilization != nil {
 		t.Fatal("new connection reused a CPU baseline")
 	}
 	sampler.fill(&h, filepath.Join(dir, "missing"))
diff --git a/services/core/internal/sandbox/node/hub.go b/services/core/internal/sandbox/node/hub.go
index 4feb0e2f6..ddf5febe0 100644
--- a/services/core/internal/sandbox/node/hub.go
+++ b/services/core/internal/sandbox/node/hub.go
@@ -20,7 +20,6 @@ type HubOptions struct {
 	OwnerEpoch   func(context.Context) (uint64, error)
 	Connected    func(context.Context, Identity, string, uint64) error
 	Disconnected func(context.Context, Identity, string, uint64)
-	Heartbeat    func(context.Context, Identity, string, uint64, Health) error
 }
 
 type Hub struct {
@@ -35,22 +34,20 @@ type Hub struct {
 }
 
 type peer struct {
-	generationManagement bool
-	version              int
-	generations          map[uint64]sandbox.GenerationStatus
-	controlSequence      uint64
-	identity             Identity
-	id                   string
-	epoch                uint64
-	conn                 *websocket.Conn
-	send                 chan struct{}
-	mu                   sync.Mutex
-	sequence             uint64
-	ready                bool
-	pending              map[string]chan response
-	done                 chan struct{}
-	once                 sync.Once
-	cancel               context.CancelFunc
+	version         int
+	generations     map[uint64]sandbox.GenerationStatus
+	controlSequence uint64
+	identity        Identity
+	id              string
+	epoch           uint64
+	conn            *websocket.Conn
+	send            chan struct{}
+	mu              sync.Mutex
+	sequence        uint64
+	pending         map[string]chan response
+	done            chan struct{}
+	once            sync.Once
+	cancel          context.CancelFunc
 }
 
 func NewHub(options HubOptions) *Hub {
@@ -159,7 +156,7 @@ func (h *Hub) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		_ = conn.Close()
 		return
 	}
-	p := &peer{generationManagement: hello.GenerationManagement, version: hello.Version, generations: map[uint64]sandbox.GenerationStatus{}, identity: identity, id: uuid.NewString(), epoch: epoch, conn: conn, cancel: cancel, send: make(chan struct{}, 1), pending: map[string]chan response{}, ready: hello.Health.ProviderReady, done: make(chan struct{})}
+	p := &peer{version: hello.Version, generations: map[uint64]sandbox.GenerationStatus{}, identity: identity, id: uuid.NewString(), epoch: epoch, conn: conn, cancel: cancel, send: make(chan struct{}, 1), pending: map[string]chan response{}, done: make(chan struct{})}
 	stopPeerClose := context.AfterFunc(ctx, p.close)
 	defer stopPeerClose()
 	presenceAttempted := false
@@ -191,14 +188,11 @@ func (h *Hub) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if err = h.recordHealth(ctx, p, *hello.Health); err != nil {
 		return
 	}
-	welcome := frame{Version: p.version, Type: "welcome", ConnectionID: p.id, OwnerEpoch: epoch}
-	if p.generationManagement {
-		deployment, _, err := h.retention(ctx, p, nil)
-		if err != nil {
-			return
-		}
-		welcome.Deployment = &deployment
+	deployment, _, err := h.retention(ctx, p, nil)
+	if err != nil {
+		return
 	}
+	welcome := frame{Version: p.version, Type: "welcome", ConnectionID: p.id, OwnerEpoch: epoch, Deployment: &deployment}
 	if ctx.Err() != nil || writeFrame(conn, welcome) != nil {
 		return
 	}
@@ -251,22 +245,18 @@ func (h *Hub) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			if e = p.lockSend(ctx); e != nil {
 				return
 			}
-			ack := frame{Version: p.version, Type: "heartbeat_ack", ConnectionID: p.id, OwnerEpoch: p.epoch}
-			if p.generationManagement {
-				deployment, _, readErr := h.retention(ctx, p, nil)
-				if readErr != nil {
-					p.unlockSend()
-					return
-				}
-				ack.Deployment = &deployment
+			deployment, _, readErr := h.retention(ctx, p, nil)
+			if readErr != nil {
+				p.unlockSend()
+				return
 			}
-			e = writeFrame(conn, ack)
+			e = writeFrame(conn, frame{Version: p.version, Type: "heartbeat_ack", ConnectionID: p.id, OwnerEpoch: p.epoch, Deployment: &deployment})
 			p.unlockSend()
 			if e != nil {
 				return
 			}
 		case "retention":
-			if !p.generationManagement || f.Control == nil {
+			if f.Control == nil {
 				return
 			}
 			c := f.Control
@@ -329,14 +319,8 @@ func (h *Hub) call(ctx context.Context, id string, q request) (response, error)
 		return response{}, uncertain(q.Operation, ErrUnavailable)
 	}
 	p.mu.Lock()
-	ready := p.ready
-	if p.generationManagement {
-		status, ok := p.generations[q.DeploymentGeneration]
-		ready = ok && status.State == "ready"
-	} else if q.DeploymentGeneration != p.identity.DeploymentGeneration {
-		p.mu.Unlock()
-		return response{}, uncertain(q.Operation, ErrUnavailable)
-	}
+	status, ok := p.generations[q.DeploymentGeneration]
+	ready := ok && status.State == "ready"
 	p.mu.Unlock()
 	if requiresReady(q) && !ready {
 		return response{}, uncertain(q.Operation, ErrUnavailable)
@@ -391,52 +375,36 @@ func (h *Hub) call(ctx context.Context, id string, q request) (response, error)
 }
 
 func (h *Hub) recordHealth(ctx context.Context, p *peer, health Health) error {
-	if !p.generationManagement && len(health.Generations) > 0 {
-		if len(health.Generations) != 1 || health.Generations[0].Generation != p.identity.DeploymentGeneration || health.Generations[0].SpecificationDigest != p.identity.SpecificationDigest || (health.Generations[0].State == "ready") != health.ProviderReady {
-			return sandbox.ErrInvalid
-		}
+	if h.options.Generations == nil {
+		return sandbox.ErrInvalid
 	}
-	if p.generationManagement {
-		if h.options.Generations == nil {
-			return sandbox.ErrInvalid
-		}
-		if err := callback(ctx, func(ctx context.Context) error { return h.options.Generations(ctx, p.identity, p.id, p.epoch, health) }); err != nil {
-			return err
-		}
-		refs := make([]sandbox.GenerationReference, 0, len(health.Generations))
-		for _, g := range health.Generations {
-			refs = append(refs, sandbox.GenerationReference{Generation: g.Generation, SpecificationDigest: g.SpecificationDigest})
-		}
-		_, grants, err := h.retention(ctx, p, refs)
-		if err != nil {
-			return err
-		}
-		if len(grants) != len(refs) {
+	if err := callback(ctx, func(ctx context.Context) error { return h.options.Generations(ctx, p.identity, p.id, p.epoch, health) }); err != nil {
+		return err
+	}
+	refs := make([]sandbox.GenerationReference, 0, len(health.Generations))
+	for _, g := range health.Generations {
+		refs = append(refs, sandbox.GenerationReference{Generation: g.Generation, SpecificationDigest: g.SpecificationDigest})
+	}
+	_, grants, err := h.retention(ctx, p, refs)
+	if err != nil {
+		return err
+	}
+	if len(grants) != len(refs) {
+		return sandbox.ErrInvalid
+	}
+	for i, grant := range grants {
+		if grant.GenerationReference != refs[i] {
 			return sandbox.ErrInvalid
 		}
-		for i, grant := range grants {
-			if grant.GenerationReference != refs[i] {
-				return sandbox.ErrInvalid
-			}
-		}
-		p.mu.Lock()
-		for i, g := range health.Generations {
-			if grants[i].Keep {
-				p.generations[g.Generation] = g
-			} else {
-				delete(p.generations, g.Generation)
-			}
-		}
-		p.mu.Unlock()
-		return nil
 	}
-	if h.options.Heartbeat != nil {
-		if err := callback(ctx, func(ctx context.Context) error { return h.options.Heartbeat(ctx, p.identity, p.id, p.epoch, health) }); err != nil {
-			return err
+	p.mu.Lock()
+	for i, g := range health.Generations {
+		if grants[i].Keep {
+			p.generations[g.Generation] = g
+		} else {
+			delete(p.generations, g.Generation)
 		}
 	}
-	p.mu.Lock()
-	p.ready = health.ProviderReady
 	p.mu.Unlock()
 	return nil
 }
diff --git a/services/core/internal/sandbox/node/hub_lifetime_test.go b/services/core/internal/sandbox/node/hub_lifetime_test.go
index 37b07c74b..26850904e 100644
--- a/services/core/internal/sandbox/node/hub_lifetime_test.go
+++ b/services/core/internal/sandbox/node/hub_lifetime_test.go
@@ -23,7 +23,7 @@ func beginRawNode(t *testing.T, origin string, id Identity) *websocket.Conn {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { conn.Close() })
-	if err = writeFrame(conn, frame{Type: "hello", Identity: &id, Health: &Health{ProviderReady: true, ObservedAt: time.Now().UTC()}}); err != nil {
+	if err = writeFrame(conn, frame{Type: "hello", Identity: &id, Health: &Health{ObservedAt: time.Now().UTC()}}); err != nil {
 		t.Fatal(err)
 	}
 	return conn
@@ -77,7 +77,7 @@ func TestHubCloseCancelsEveryOpeningCallback(t *testing.T) {
 				close(returned)
 			}
 			var cleanups atomic.Int32
-			hub := NewHub(HubOptions{
+			hub := newTestHub(HubOptions{
 				Authenticate: func(ctx context.Context, _, _ string) (Identity, error) {
 					if stage == "authenticate" {
 						block(ctx)
@@ -96,7 +96,7 @@ func TestHubCloseCancelsEveryOpeningCallback(t *testing.T) {
 					}
 					return nil
 				},
-				Heartbeat: func(ctx context.Context, _ Identity, _ string, _ uint64, _ Health) error {
+				Generations: func(ctx context.Context, _ Identity, _ string, _ uint64, _ Health) error {
 					if stage == "heartbeat" {
 						block(ctx)
 					}
@@ -126,7 +126,7 @@ func TestHubCloseCancelsEveryOpeningCallback(t *testing.T) {
 					return
 				}
 				defer conn.Close()
-				_ = writeFrame(conn, frame{Type: "hello", Identity: &id, Health: &Health{ProviderReady: true, ObservedAt: time.Now().UTC()}})
+				_ = writeFrame(conn, frame{Type: "hello", Identity: &id, Health: &Health{ObservedAt: time.Now().UTC()}})
 				if f, err := readFrame(conn); err == nil {
 					t.Errorf("canceled opening published welcome: %s", f.Type)
 				}
@@ -167,7 +167,7 @@ func TestSlowOpeningAndClosingLeaveOtherNodesResponsive(t *testing.T) {
 	opening, closing, finish := make(chan struct{}), make(chan struct{}), make(chan struct{})
 	var release sync.Once
 	defer release.Do(func() { close(finish) })
-	hub := NewHub(HubOptions{
+	hub := newTestHub(HubOptions{
 		Authenticate: func(_ context.Context, id, _ string) (Identity, error) {
 			if id == slow.NodeID {
 				return slow, nil
@@ -228,7 +228,7 @@ func TestHubCleansPresenceAfterPartialOpeningFailure(t *testing.T) {
 			var mu sync.Mutex
 			persisted := ""
 			var connects, cleanups int
-			hub := NewHub(HubOptions{
+			hub := newTestHub(HubOptions{
 				Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil },
 				OwnerEpoch:   func(context.Context) (uint64, error) { return 11, nil },
 				Connected: func(_ context.Context, _ Identity, connection string, _ uint64) error {
@@ -241,7 +241,7 @@ func TestHubCleansPresenceAfterPartialOpeningFailure(t *testing.T) {
 					}
 					return nil
 				},
-				Heartbeat: func(context.Context, Identity, string, uint64, Health) error { return errors.New("heartbeat failed") },
+				Generations: func(context.Context, Identity, string, uint64, Health) error { return errors.New("heartbeat failed") },
 				Disconnected: func(_ context.Context, _ Identity, connection string, epoch uint64) {
 					mu.Lock()
 					defer mu.Unlock()
@@ -270,7 +270,7 @@ func TestHubCleansPresenceAfterPartialOpeningFailure(t *testing.T) {
 
 func TestHubSendQueueRespectsCallerCancellation(t *testing.T) {
 	id := identity()
-	hub := NewHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }})
+	hub := newTestHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }})
 	server := httptest.NewServer(hub)
 	defer server.Close()
 	defer hub.Close()
@@ -312,7 +312,7 @@ func TestHubSendQueueRespectsCallerCancellation(t *testing.T) {
 
 func TestHubCallBoundsOwnershipBeforeDispatch(t *testing.T) {
 	entered := make(chan struct{})
-	hub := NewHub(HubOptions{OwnerEpoch: func(ctx context.Context) (uint64, error) {
+	hub := newTestHub(HubOptions{OwnerEpoch: func(ctx context.Context) (uint64, error) {
 		deadline, ok := ctx.Deadline()
 		if !ok || time.Until(deadline) > callbackTimeout {
 			t.Error("ownership callback unbounded")
@@ -347,7 +347,7 @@ func TestHubRetainsOpeningReservationUntilCanceledCallbackReturns(t *testing.T)
 	var mu sync.Mutex
 	persisted := ""
 	cleanups := 0
-	hub := NewHub(HubOptions{
+	hub := newTestHub(HubOptions{
 		Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil },
 		OwnerEpoch:   func(context.Context) (uint64, error) { return 4, nil },
 		Connected: func(ctx context.Context, _ Identity, connection string, _ uint64) error {
@@ -403,10 +403,10 @@ func TestHubDisconnectCancelsPeriodicHeartbeatCallback(t *testing.T) {
 	id := identity()
 	entered := make(chan struct{})
 	var heartbeats atomic.Int32
-	hub := NewHub(HubOptions{
+	hub := newTestHub(HubOptions{
 		Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil },
 		OwnerEpoch:   func(context.Context) (uint64, error) { return 2, nil },
-		Heartbeat: func(ctx context.Context, _ Identity, _ string, _ uint64, _ Health) error {
+		Generations: func(ctx context.Context, _ Identity, _ string, _ uint64, _ Health) error {
 			if heartbeats.Add(1) == 1 {
 				return nil
 			}
@@ -427,7 +427,7 @@ func TestHubDisconnectCancelsPeriodicHeartbeatCallback(t *testing.T) {
 	hub.mu.Lock()
 	connection := hub.peers[id.NodeID].id
 	hub.mu.Unlock()
-	if err := writeFrame(conn, frame{Type: "heartbeat", ConnectionID: connection, OwnerEpoch: 2, Health: &Health{ProviderReady: true, ObservedAt: time.Now().UTC()}}); err != nil {
+	if err := writeFrame(conn, frame{Type: "heartbeat", ConnectionID: connection, OwnerEpoch: 2, Health: &Health{ObservedAt: time.Now().UTC()}}); err != nil {
 		t.Fatal(err)
 	}
 	select {
diff --git a/services/core/internal/sandbox/node/hub_postgres_test.go b/services/core/internal/sandbox/node/hub_postgres_test.go
index 38a751663..e379ff14d 100644
--- a/services/core/internal/sandbox/node/hub_postgres_test.go
+++ b/services/core/internal/sandbox/node/hub_postgres_test.go
@@ -56,7 +56,7 @@ func TestHubPostgresBlockedOpeningIsBounded(t *testing.T) {
 			}
 			pids, results := make(chan uint32, 1), make(chan error, 1)
 			var attempts atomic.Int32
-			hub := NewHub(HubOptions{
+			hub := newTestHub(HubOptions{
 				Authenticate: func(_ context.Context, id, _ string) (Identity, error) {
 					if id == slow.NodeID {
 						return slow, nil
diff --git a/services/core/internal/sandbox/node/node_test.go b/services/core/internal/sandbox/node/node_test.go
index 1b21674ca..3baa7aaba 100644
--- a/services/core/internal/sandbox/node/node_test.go
+++ b/services/core/internal/sandbox/node/node_test.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -82,12 +81,11 @@ func wait(t *testing.T, ready func() bool) {
 		time.Sleep(10 * time.Millisecond)
 	}
 }
-func probe(context.Context) (Health, error) { return Health{ProviderReady: true}, nil }
 
 func TestLostCreateResponseDoesNotReplayAndReconnectSerializesCleanup(t *testing.T) {
 	id := identity()
 	var credential string
-	hub := NewHub(HubOptions{Authenticate: func(ctx context.Context, node, token string) (Identity, error) {
+	hub := newTestHub(HubOptions{Authenticate: func(ctx context.Context, node, token string) (Identity, error) {
 		if node != id.NodeID || token != credential {
 			return Identity{}, ErrAuthentication
 		}
@@ -106,7 +104,7 @@ func TestLostCreateResponseDoesNotReplayAndReconnectSerializesCleanup(t *testing
 	ctx, cancel := context.WithCancel(context.Background())
 	done := make(chan error, 1)
 	go func() {
-		done <- Run(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: credential, Provider: p, Probe: probe})
+		done <- runProvider(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: credential}, p, probe)
 	}()
 	defer func() {
 		cancel()
@@ -170,7 +168,7 @@ func TestLostCreateResponseDoesNotReplayAndReconnectSerializesCleanup(t *testing
 }
 
 func TestOfflineIsUnknownAndDockerDoesNotAdvertiseSuspension(t *testing.T) {
-	h := NewHub(HubOptions{OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }})
+	h := newTestHub(HubOptions{OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }})
 	p := h.Proxy(uuid.NewString(), docker.Operations(), 1)
 	if sandbox.SupportsSuspension(p) {
 		t.Fatal("docker advertised suspension")
@@ -196,7 +194,7 @@ func TestAgentRejectsDuplicateSequenceAndRetainsEpoch(t *testing.T) {
 			return
 		}
 		connectionID := uuid.NewString()
-		_ = writeFrame(conn, frame{Type: "welcome", ConnectionID: connectionID, OwnerEpoch: 9})
+		_ = writeFrame(conn, frame{Type: "welcome", ConnectionID: connectionID, OwnerEpoch: 9, Deployment: testDeployment()})
 		q := request{DeploymentGeneration: id.DeploymentGeneration, ID: uuid.NewString(), Sequence: 1, ConnectionID: connectionID, OwnerEpoch: 9, Operation: "info", TimeoutMillis: 60000, Reference: reference()}
 		_ = writeFrame(conn, frame{Type: "request", Request: &q})
 		_, _ = readFrame(conn)
@@ -212,7 +210,7 @@ func TestAgentRejectsDuplicateSequenceAndRetainsEpoch(t *testing.T) {
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
-	err := Run(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential, Provider: p, Probe: probe})
+	err := runProvider(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential}, p, probe)
 	if !errors.Is(err, sandbox.ErrOwnership) {
 		t.Fatalf("duplicate sequence = %v", err)
 	}
@@ -253,6 +251,9 @@ func TestEnrollmentLostResponseRecoversWithPersistedCredential(t *testing.T) {
 		if body.CoreURL != "http://"+r.Host {
 			t.Error("enrollment did not name the node's Core address", body.CoreURL)
 		}
+		if body.CPUCount == nil || *body.CPUCount < 1 {
+			t.Error("enrollment did not report the host measurements", body)
+		}
 		enrollments++
 		registered = true
 		hijacker := w.(http.Hijacker)
@@ -300,26 +301,6 @@ func TestCoreURLRejectsOtherSchemesAndCredentials(t *testing.T) {
 	}
 }
 
-func TestHealthSendsOnlyFixedDiagnosticCode(t *testing.T) {
-	for _, tc := range []struct {
-		err  error
-		want string
-	}{
-		{fmt.Errorf("%w: open /home/operator/private/kvm", sandbox.ErrHostUnsupported), "host_unsupported"},
-		{errors.New("open /home/operator/private/runtime: permission denied"), "provider_unavailable"},
-		{nil, ""},
-	} {
-		a := &agent{config: AgentConfig{StateDirectory: stateDir(t), Identity: identity(), Probe: func(context.Context) (Health, error) {
-			return Health{Diagnostic: "/home/operator/private"}, tc.err
-		}}}
-		h, _ := a.health(t.Context(), new(hostHealthSampler))
-		raw, err := json.Marshal(frame{Type: "heartbeat", Health: &h})
-		if err != nil || h.Diagnostic != tc.want || h.ProviderReady != (tc.err == nil) || strings.Contains(string(raw), "private") {
-			t.Fatalf("heartbeat = %s, %v", raw, err)
-		}
-	}
-}
-
 // A rejected credential stops the node for good; any other rejection names Core's
 // status and error code so the installer can say what to fix.
 func TestEnrollmentRejectionNamesCoreCode(t *testing.T) {
diff --git a/services/core/internal/sandbox/node/observations_test.go b/services/core/internal/sandbox/node/observations_test.go
index 23a5cbfdb..9f389f11a 100644
--- a/services/core/internal/sandbox/node/observations_test.go
+++ b/services/core/internal/sandbox/node/observations_test.go
@@ -50,7 +50,9 @@ func runObservationNode(t *testing.T, hub *Hub, url string, id Identity, provide
 	ctx, cancel := context.WithCancel(t.Context())
 	done := make(chan error, 1)
 	go func() {
-		done <- Run(ctx, AgentConfig{CoreURL: url, StateDirectory: dir, Identity: id, Credential: stored.Credential, Provider: provider, Probe: func(context.Context) (Health, error) { return Health{}, errors.New("provider not ready for creation") }})
+		done <- runProvider(ctx, AgentConfig{CoreURL: url, StateDirectory: dir, Identity: id, Credential: stored.Credential}, provider, func(context.Context) (*sandbox.CheckpointCompatibility, error) {
+			return nil, errors.New("provider not ready for creation")
+		})
 	}()
 	t.Cleanup(func() {
 		cancel()
@@ -69,7 +71,7 @@ func runObservationNode(t *testing.T, hub *Hub, url string, id Identity, provide
 func TestObservationsRouteThroughAssignedNodeWithoutLifecycleCalls(t *testing.T) {
 	first, second := identity(), identity()
 	second.InstallationID = first.InstallationID
-	hub := NewHub(HubOptions{Authenticate: func(_ context.Context, id, _ string) (Identity, error) {
+	hub := newTestHub(HubOptions{Authenticate: func(_ context.Context, id, _ string) (Identity, error) {
 		switch id {
 		case first.NodeID:
 			return first, nil
@@ -150,7 +152,7 @@ func TestObservationWirePreservesUnavailableAndRejectsMismatchedIdentity(t *test
 	}
 	for _, test := range providers {
 		t.Run(test.name, func(t *testing.T) {
-			out := execute(t.Context(), test.provider, q)
+			out, _ := execute(t.Context(), test.provider, q)
 			if !errors.Is(responseError(out), test.want) || out.Sample != nil {
 				t.Fatal("observation error or missing sample was fabricated", out)
 			}
@@ -161,7 +163,7 @@ func TestObservationWirePreservesUnavailableAndRejectsMismatchedIdentity(t *test
 		invalid := target
 		mutate(&invalid)
 		q.Observation = &invalid
-		if out := execute(t.Context(), p, q); !errors.Is(responseError(out), sandbox.ErrInvalid) {
+		if out, _ := execute(t.Context(), p, q); !errors.Is(responseError(out), sandbox.ErrInvalid) {
 			t.Fatal("mismatched observation reached provider", out)
 		}
 	}
diff --git a/services/core/internal/sandbox/node/operations.go b/services/core/internal/sandbox/node/operations.go
index aca02dcb5..0e92ae0b8 100644
--- a/services/core/internal/sandbox/node/operations.go
+++ b/services/core/internal/sandbox/node/operations.go
@@ -2,22 +2,24 @@ package node
 
 // Transport operation names map to the authored Provider method declarations.
 var operationMethods = map[string]string{
-	"create":          "Create",
-	"info":            "GetInfo",
-	"renew":           "Renew",
-	"kill":            "Kill",
-	"command":         "RunCommand",
-	"initial":         "Initial",
-	"new_compute":     "NewCompute",
-	"compute":         "GetCompute",
-	"renew_compute":   "RenewCompute",
-	"suspend":         "Suspend",
-	"resume":          "Resume",
-	"kill_compute":    "KillCompute",
-	"delete_retained": "DeleteRetained",
-	"command_compute": "RunCommandCompute",
-	"resume_compute":  "ResumeCompute",
-	"observe":         "Observe",
+	"create":              "Create",
+	"info":                "GetInfo",
+	"renew":               "Renew",
+	"kill":                "Kill",
+	"command":             "RunCommand",
+	"initial":             "Initial",
+	"new_compute":         "NewCompute",
+	"compute":             "GetCompute",
+	"renew_compute":       "RenewCompute",
+	"suspend":             "Suspend",
+	"resume":              "Resume",
+	"kill_compute":        "KillCompute",
+	"delete_retained":     "DeleteRetained",
+	"command_compute":     "RunCommandCompute",
+	"resume_compute":      "ResumeCompute",
+	"observe":             "Observe",
+	"restore_preparation": "RestorePreparation",
+	"save_preparation":    "SavePreparation",
 }
 
 func operationMethod(wire string) string { return operationMethods[wire] }
diff --git a/services/core/internal/sandbox/node/operations_test.go b/services/core/internal/sandbox/node/operations_test.go
index f0567ad1c..311ec4002 100644
--- a/services/core/internal/sandbox/node/operations_test.go
+++ b/services/core/internal/sandbox/node/operations_test.go
@@ -15,7 +15,7 @@ import (
 func TestUnsupportedWireIsExplicitAndDoesNotInvokeProvider(t *testing.T) {
 	p := &fakeProvider{}
 	q := request{ID: uuid.NewString(), ConnectionID: uuid.NewString(), Reference: reference(), TimeoutMillis: 1000, Operation: "initial"}
-	out := execute(t.Context(), p, q)
+	out, _ := execute(t.Context(), p, q)
 	if p.creates != 0 || p.reads != 0 || p.kills != 0 {
 		t.Fatal("unsupported operation reached provider")
 	}
@@ -101,7 +101,7 @@ func TestRetainedLifecycleDispatchSurvivesStrictWire(t *testing.T) {
 		if err := decoded.Request.validate(); err != nil {
 			t.Fatal(err)
 		}
-		if out := execute(t.Context(), p, *decoded.Request); responseError(out) != nil {
+		if out, _ := execute(t.Context(), p, *decoded.Request); responseError(out) != nil {
 			t.Fatal(out)
 		}
 	}
@@ -109,3 +109,12 @@ func TestRetainedLifecycleDispatchSurvivesStrictWire(t *testing.T) {
 		t.Fatal("retained evidence lost in transport")
 	}
 }
+
+func TestCheckpointUnusableCrossesTheWireAsFixedCode(t *testing.T) {
+	if code := errorCode(sandbox.ErrCheckpointUnusable); code != "checkpoint_unusable" {
+		t.Fatal(code)
+	}
+	if !errors.Is(responseError(response{ErrorCode: "checkpoint_unusable"}), sandbox.ErrCheckpointUnusable) {
+		t.Fatal("code not mapped back")
+	}
+}
diff --git a/services/core/internal/sandbox/node/provider_agent_test.go b/services/core/internal/sandbox/node/provider_agent_test.go
new file mode 100644
index 000000000..83813db92
--- /dev/null
+++ b/services/core/internal/sandbox/node/provider_agent_test.go
@@ -0,0 +1,61 @@
+package node
+
+import (
+	"context"
+	"errors"
+
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+)
+
+func probe(context.Context) (*sandbox.CheckpointCompatibility, error) { return nil, nil }
+
+// testDeployment is the deployment Core tells a node built from identity().
+func testDeployment() *sandbox.NodeDeployment {
+	id := identity()
+	return &sandbox.NodeDeployment{Generation: id.DeploymentGeneration, SpecificationDigest: id.SpecificationDigest}
+}
+
+// newTestHub completes the generation callbacks a test does not observe:
+// every reported generation is kept and the deployment targets the identity.
+func newTestHub(options HubOptions) *Hub {
+	if options.Generations == nil {
+		options.Generations = func(context.Context, Identity, string, uint64, Health) error { return nil }
+	}
+	if options.Retention == nil {
+		options.Retention = func(_ context.Context, id Identity, _ string, _ uint64, refs []sandbox.GenerationReference) (sandbox.NodeDeployment, []sandbox.GenerationRetention, error) {
+			grants := make([]sandbox.GenerationRetention, 0, len(refs))
+			for _, ref := range refs {
+				grants = append(grants, sandbox.GenerationRetention{GenerationReference: ref, Keep: true})
+			}
+			return *testDeployment(), grants, nil
+		}
+	}
+	return NewHub(options)
+}
+
+// runProvider serves provider as the identity's only generation until ctx ends.
+func runProvider(ctx context.Context, config AgentConfig, provider sandbox.SandboxProvider, probe func(context.Context) (*sandbox.CheckpointCompatibility, error)) error {
+	manager, err := NewGenerationManager(ctx, GenerationManagerOptions{
+		Initial: []GenerationProvider{{Generation: config.Identity.DeploymentGeneration, SpecificationDigest: config.Identity.SpecificationDigest, Provider: provider, Probe: probe}},
+		Prepare: func(context.Context, uint64, string) (GenerationProvider, error) {
+			return GenerationProvider{}, errors.New("unexpected preparation")
+		},
+		Remove: func(context.Context, GenerationProvider) error { return nil },
+	})
+	if err != nil {
+		return err
+	}
+	defer manager.Close()
+	// Settle the first probe now so the first connection reports its outcome.
+	manager.mu.Lock()
+	g := manager.values[config.Identity.DeploymentGeneration]
+	g.state = "ready"
+	if checkpoint, err := probe(ctx); err != nil {
+		g.state, g.diagnostic = "failed", sandbox.NodeDiagnostic(err)
+	} else {
+		g.checkpoint = checkpoint
+	}
+	manager.mu.Unlock()
+	config.Generations = manager
+	return Run(ctx, config)
+}
diff --git a/services/core/internal/sandbox/node/provider_operations_fixture_test.go b/services/core/internal/sandbox/node/provider_operations_fixture_test.go
index fdcb82c42..bfa96233d 100644
--- a/services/core/internal/sandbox/node/provider_operations_fixture_test.go
+++ b/services/core/internal/sandbox/node/provider_operations_fixture_test.go
@@ -10,22 +10,24 @@ import (
 
 func (*fakeProvider) ProviderOperations() providercontract.Operations {
 	return providercontract.Operations{
-		"Create":            {State: providercontract.Supported},
-		"GetInfo":           {State: providercontract.Supported},
-		"Renew":             {State: providercontract.Supported},
-		"Kill":              {State: providercontract.Supported},
-		"RunCommand":        {State: providercontract.Supported},
-		"Initial":           {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"NewCompute":        {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"RenewCompute":      {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"GetCompute":        {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"Suspend":           {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"Resume":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"KillCompute":       {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"DeleteRetained":    {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"RunCommandCompute": {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"ResumeCompute":     {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"Observe":           {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Create":             {State: providercontract.Supported},
+		"GetInfo":            {State: providercontract.Supported},
+		"Renew":              {State: providercontract.Supported},
+		"Kill":               {State: providercontract.Supported},
+		"RunCommand":         {State: providercontract.Supported},
+		"Initial":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"NewCompute":         {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"RenewCompute":       {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"GetCompute":         {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Suspend":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Resume":             {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"KillCompute":        {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"DeleteRetained":     {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"RunCommandCompute":  {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"ResumeCompute":      {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"RestorePreparation": {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"SavePreparation":    {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Observe":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
 	}
 }
 func (*fakeProvider) Initial(context.Context, sandbox.Reference) (sandbox.Compute, error) {
@@ -60,25 +62,33 @@ func (*fakeProvider) Observe(context.Context, runtimeobs.Target) (runtimeobs.Sam
 }
 func (*observationProvider) ProviderOperations() providercontract.Operations {
 	return providercontract.Operations{
-		"Create":            {State: providercontract.Supported},
-		"GetInfo":           {State: providercontract.Supported},
-		"Renew":             {State: providercontract.Supported},
-		"Kill":              {State: providercontract.Supported},
-		"RunCommand":        {State: providercontract.Supported},
-		"Initial":           {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"NewCompute":        {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"RenewCompute":      {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"GetCompute":        {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"Suspend":           {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"Resume":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"KillCompute":       {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"DeleteRetained":    {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"RunCommandCompute": {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"ResumeCompute":     {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"Observe":           {State: providercontract.Supported},
+		"Create":             {State: providercontract.Supported},
+		"GetInfo":            {State: providercontract.Supported},
+		"Renew":              {State: providercontract.Supported},
+		"Kill":               {State: providercontract.Supported},
+		"RunCommand":         {State: providercontract.Supported},
+		"Initial":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"NewCompute":         {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"RenewCompute":       {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"GetCompute":         {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Suspend":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Resume":             {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"KillCompute":        {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"DeleteRetained":     {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"RunCommandCompute":  {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"ResumeCompute":      {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"RestorePreparation": {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"SavePreparation":    {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Observe":            {State: providercontract.Supported},
 	}
 }
 
 func (*fakeProvider) RenewCompute(context.Context, sandbox.Reference, sandbox.Compute) (sandbox.ComputeState, error) {
 	return sandbox.ComputeState{}, &providercontract.UnsupportedError{Operation: "RenewCompute", Reason: "fixture_operation_not_supported"}
 }
+func (*fakeProvider) RestorePreparation(context.Context, sandbox.Reference, string) (bool, error) {
+	return false, &providercontract.UnsupportedError{Operation: "RestorePreparation", Reason: "fixture_operation_not_supported"}
+}
+func (*fakeProvider) SavePreparation(context.Context, sandbox.Reference, string) error {
+	return &providercontract.UnsupportedError{Operation: "SavePreparation", Reason: "fixture_operation_not_supported"}
+}
diff --git a/services/core/internal/sandbox/node/proxy.go b/services/core/internal/sandbox/node/proxy.go
index c345a50c1..9e42ae71e 100644
--- a/services/core/internal/sandbox/node/proxy.go
+++ b/services/core/internal/sandbox/node/proxy.go
@@ -154,6 +154,14 @@ func (p *provider) DeleteRetained(ctx context.Context, r sandbox.Reference, s sa
 func (p *provider) RunCommandCompute(ctx context.Context, r sandbox.Reference, c sandbox.Compute, v sandbox.Command) (sandbox.CommandResult, error) {
 	return p.command(ctx, request{Operation: "command_compute", Reference: r, Compute: &c, Command: &v})
 }
+func (p *provider) RestorePreparation(ctx context.Context, r sandbox.Reference, key string) (bool, error) {
+	out, e := p.call(ctx, request{Operation: "restore_preparation", Reference: r, Key: key})
+	return out.Restored && e == nil, e
+}
+func (p *provider) SavePreparation(ctx context.Context, r sandbox.Reference, key string) error {
+	_, e := p.call(ctx, request{Operation: "save_preparation", Reference: r, Key: key})
+	return e
+}
 func (p *provider) ResumeCompute(ctx context.Context, r sandbox.Reference, c sandbox.Compute) (sandbox.ComputeState, error) {
 	return p.state(ctx, request{Operation: "resume_compute", Reference: r, Compute: &c})
 }
diff --git a/services/core/internal/sandbox/node/recovery_test.go b/services/core/internal/sandbox/node/recovery_test.go
index c5039ea9d..3295804af 100644
--- a/services/core/internal/sandbox/node/recovery_test.go
+++ b/services/core/internal/sandbox/node/recovery_test.go
@@ -24,8 +24,8 @@ func TestCoreRestartFencesOldConnectionAndNodeRestartKeepsIdentity(t *testing.T)
 	options := func(epoch uint64) HubOptions {
 		return HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return epoch, nil }}
 	}
-	first := NewHub(options(4))
-	second := NewHub(options(5))
+	first := newTestHub(options(4))
+	second := newTestHub(options(5))
 	defer first.Close()
 	defer second.Close()
 	var mu sync.Mutex
@@ -42,7 +42,7 @@ func TestCoreRestartFencesOldConnectionAndNodeRestartKeepsIdentity(t *testing.T)
 		ctx, cancel := context.WithCancel(context.Background())
 		done := make(chan error, 1)
 		go func() {
-			done <- Run(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: credential, Provider: &fakeProvider{}, Probe: probe})
+			done <- runProvider(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: credential}, &fakeProvider{}, probe)
 		}()
 		return cancel, done
 	}
@@ -90,7 +90,7 @@ func TestAgentRejectsOwnerEpochRollback(t *testing.T) {
 		}
 		defer conn.Close()
 		_, _ = readFrame(conn)
-		_ = writeFrame(conn, frame{Type: "welcome", ConnectionID: uuid.NewString(), OwnerEpoch: 3})
+		_ = writeFrame(conn, frame{Type: "welcome", ConnectionID: uuid.NewString(), OwnerEpoch: 3, Deployment: testDeployment()})
 		_, _ = readFrame(conn)
 	}))
 	defer server.Close()
@@ -105,7 +105,7 @@ func TestAgentRejectsOwnerEpochRollback(t *testing.T) {
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
 	defer cancel()
-	err = Run(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential, Provider: &fakeProvider{}, Probe: probe})
+	err = runProvider(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential}, &fakeProvider{}, probe)
 	if !errors.Is(err, sandbox.ErrOwnership) {
 		t.Fatalf("stale owner = %v", err)
 	}
@@ -115,7 +115,7 @@ func TestHeartbeatAcknowledgementKeepsIdleConnectionAlive(t *testing.T) {
 	id := identity()
 	beats := make(chan Health, 1)
 	var heartbeats int
-	hub := NewHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }, Heartbeat: func(ctx context.Context, id Identity, connection string, epoch uint64, h Health) error {
+	hub := newTestHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }, Generations: func(ctx context.Context, id Identity, connection string, epoch uint64, h Health) error {
 		heartbeats++
 		if heartbeats == 1 {
 			return nil
@@ -137,7 +137,7 @@ func TestHeartbeatAcknowledgementKeepsIdleConnectionAlive(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	done := make(chan error, 1)
 	go func() {
-		done <- Run(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential, Provider: &fakeProvider{}, Probe: probe})
+		done <- runProvider(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential}, &fakeProvider{}, probe)
 	}()
 	defer func() {
 		cancel()
@@ -147,7 +147,7 @@ func TestHeartbeatAcknowledgementKeepsIdleConnectionAlive(t *testing.T) {
 	}()
 	select {
 	case h := <-beats:
-		if !h.ProviderReady || h.ObservedAt.IsZero() {
+		if len(h.Generations) != 1 || h.Generations[0].State != "ready" || h.ObservedAt.IsZero() {
 			t.Fatal("invalid heartbeat")
 		}
 	case <-time.After(12 * time.Second):
@@ -166,7 +166,7 @@ func TestHubExpiresSilentNode(t *testing.T) {
 		t.Skip("real heartbeat timeout")
 	}
 	id := identity()
-	hub := NewHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }})
+	hub := newTestHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }})
 	server := httptest.NewServer(hub)
 	defer server.Close()
 	defer hub.Close()
@@ -176,7 +176,7 @@ func TestHubExpiresSilentNode(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer conn.Close()
-	if err = writeFrame(conn, frame{Type: "hello", Identity: &id, Health: &Health{ProviderReady: true, ObservedAt: time.Now().UTC()}}); err != nil {
+	if err = writeFrame(conn, frame{Type: "hello", Identity: &id, Health: &Health{ObservedAt: time.Now().UTC()}}); err != nil {
 		t.Fatal(err)
 	}
 	if _, err = readFrame(conn); err != nil {
@@ -198,7 +198,7 @@ func TestHubExpiresSilentNode(t *testing.T) {
 func TestDegradedNodeRetainsObservationAndCleanup(t *testing.T) {
 	id := identity()
 	health := make(chan Health, 1)
-	hub := NewHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }, Heartbeat: func(ctx context.Context, id Identity, connection string, epoch uint64, h Health) error {
+	hub := newTestHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }, Generations: func(ctx context.Context, id Identity, connection string, epoch uint64, h Health) error {
 		select {
 		case health <- h:
 		default:
@@ -217,7 +217,9 @@ func TestDegradedNodeRetainsObservationAndCleanup(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	done := make(chan error, 1)
 	go func() {
-		done <- Run(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential, Provider: p, Probe: func(context.Context) (Health, error) { return Health{}, errors.New("private backend detail") }})
+		done <- runProvider(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential}, p, func(context.Context) (*sandbox.CheckpointCompatibility, error) {
+			return nil, errors.New("private backend detail")
+		})
 	}()
 	defer func() {
 		cancel()
@@ -228,7 +230,7 @@ func TestDegradedNodeRetainsObservationAndCleanup(t *testing.T) {
 	wait(t, func() bool { return hub.Online(id.NodeID) })
 	select {
 	case h := <-health:
-		if h.ProviderReady || h.Diagnostic != "provider_unavailable" {
+		if len(h.Generations) != 1 || h.Generations[0].State != "failed" || h.Generations[0].Diagnostic != "provider_unavailable" {
 			t.Fatalf("unsafe health: %+v", h)
 		}
 	case <-time.After(time.Second):
diff --git a/services/core/internal/sandbox/node/timeout_test.go b/services/core/internal/sandbox/node/timeout_test.go
index aa6184be5..d4ef0babd 100644
--- a/services/core/internal/sandbox/node/timeout_test.go
+++ b/services/core/internal/sandbox/node/timeout_test.go
@@ -77,7 +77,7 @@ func TestRequestBudgetBounds(t *testing.T) {
 
 func TestQueuedMutationExpiresWithoutExecution(t *testing.T) {
 	id := identity()
-	hub := NewHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }})
+	hub := newTestHub(HubOptions{Authenticate: func(context.Context, string, string) (Identity, error) { return id, nil }, OwnerEpoch: func(context.Context) (uint64, error) { return 1, nil }})
 	server := httptest.NewServer(hub)
 	defer server.Close()
 	defer hub.Close()
@@ -90,7 +90,7 @@ func TestQueuedMutationExpiresWithoutExecution(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	done := make(chan error, 1)
 	go func() {
-		done <- Run(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential, Provider: p, Probe: probe})
+		done <- runProvider(ctx, AgentConfig{CoreURL: server.URL, StateDirectory: dir, Identity: id, Credential: stored.Credential}, p, probe)
 	}()
 	released := false
 	defer func() {
diff --git a/services/core/internal/sandbox/node/wire.go b/services/core/internal/sandbox/node/wire.go
index 31bfeefa6..85b858fcf 100644
--- a/services/core/internal/sandbox/node/wire.go
+++ b/services/core/internal/sandbox/node/wire.go
@@ -19,7 +19,7 @@ import (
 	"github.com/gorilla/websocket"
 )
 
-const ProtocolVersion = 8
+const ProtocolVersion = 9
 const MaxControlFrameBytes = 32 * 1024
 const MaxFrameBytes = 72 * 1024 * 1024
 const maxPending = 32
@@ -41,8 +41,6 @@ type Identity struct {
 
 type Health struct {
 	Generations          []sandbox.GenerationStatus `json:"generations,omitempty"`
-	Diagnostic           string                     `json:"diagnostic,omitempty"`
-	ProviderReady        bool                       `json:"provider_ready"`
 	ObservedAt           time.Time                  `json:"observed_at"`
 	ActiveOperations     int                        `json:"active_operations"`
 	CPUCount             *int64                     `json:"cpu_count,omitempty"`
@@ -63,6 +61,11 @@ type EnrollmentRequest struct {
 	BackendFingerprint   string `json:"backend_fingerprint"`
 	// The retained Core origin; Core refuses an enrollment whose address is not its public URL.
 	CoreURL string `json:"core_url"`
+	// The host measurements of Health. Core derives from them each limit the enrollment token leaves unset.
+	CPUCount           *int64   `json:"cpu_count,omitempty"`
+	EffectiveCPUCores  *float64 `json:"effective_cpu_cores,omitempty"`
+	TotalMemoryBytes   *int64   `json:"total_memory_bytes,omitempty"`
+	AvailableDiskBytes *int64   `json:"available_disk_bytes,omitempty"`
 }
 
 type EnrollmentResponse struct {
@@ -96,6 +99,8 @@ type request struct {
 	Resume      *sandbox.ResumeRequest  `json:"resume,omitempty"`
 	Retained    *sandbox.RetainedState  `json:"retained,omitempty"`
 	Observation *runtimeobs.Target      `json:"observation,omitempty"`
+	// Key is the opaque preparation cache key.
+	Key string `json:"key,omitempty"`
 }
 
 type response struct {
@@ -108,20 +113,20 @@ type response struct {
 	State        *sandbox.ComputeState              `json:"state,omitempty"`
 	Command      *sandbox.CommandResult             `json:"command,omitempty"`
 	Sample       *runtimeobs.Sample                 `json:"sample,omitempty"`
+	Restored     bool                               `json:"restored,omitempty"`
 }
 
 type frame struct {
-	GenerationManagement bool                    `json:"generation_management,omitempty"`
-	Deployment           *sandbox.NodeDeployment `json:"deployment,omitempty"`
-	Control              *generationControl      `json:"control,omitempty"`
-	Version              int                     `json:"version"`
-	Type                 string                  `json:"type"`
-	Identity             *Identity               `json:"identity,omitempty"`
-	Health               *Health                 `json:"health,omitempty"`
-	ConnectionID         string                  `json:"connection_id,omitempty"`
-	OwnerEpoch           uint64                  `json:"owner_epoch,omitempty"`
-	Request              *request                `json:"request,omitempty"`
-	Response             *response               `json:"response,omitempty"`
+	Deployment   *sandbox.NodeDeployment `json:"deployment,omitempty"`
+	Control      *generationControl      `json:"control,omitempty"`
+	Version      int                     `json:"version"`
+	Type         string                  `json:"type"`
+	Identity     *Identity               `json:"identity,omitempty"`
+	Health       *Health                 `json:"health,omitempty"`
+	ConnectionID string                  `json:"connection_id,omitempty"`
+	OwnerEpoch   uint64                  `json:"owner_epoch,omitempty"`
+	Request      *request                `json:"request,omitempty"`
+	Response     *response               `json:"response,omitempty"`
 }
 
 func validID(s string) bool {
@@ -193,6 +198,8 @@ func errorCode(err error) string {
 		return "not_found"
 	case errors.Is(err, sandbox.ErrCommandUnconfirmed):
 		return "command_unconfirmed"
+	case errors.Is(err, sandbox.ErrCheckpointUnusable):
+		return "checkpoint_unusable"
 	default:
 		return "unconfirmed"
 	}
@@ -229,6 +236,8 @@ func responseError(out response) error {
 		return sandbox.ErrNotFound
 	case "command_unconfirmed":
 		return sandbox.ErrCommandUnconfirmed
+	case "checkpoint_unusable":
+		return sandbox.ErrCheckpointUnusable
 	default:
 		return sandbox.ErrComputeUnconfirmed
 	}
@@ -262,6 +271,10 @@ func (q request) validate() error {
 		if count == 0 {
 			return nil
 		}
+	case "restore_preparation", "save_preparation":
+		if count == 0 && q.Key != "" && len(q.Key) <= 256 {
+			return nil
+		}
 	case "new_compute":
 		if count == 0 || count == 1 && q.Retained != nil {
 			return nil
@@ -293,12 +306,14 @@ func (q request) validate() error {
 	}
 	return sandbox.ErrInvalid
 }
-func execute(ctx context.Context, p sandbox.SandboxProvider, q request) response {
+
+// execute also returns the local error; only its code crosses the transport.
+func execute(ctx context.Context, p sandbox.SandboxProvider, q request) (response, error) {
 	out := response{ID: q.ID, ConnectionID: q.ConnectionID}
 	err := q.validate()
 	if err != nil {
 		out.ErrorCode = errorCode(err)
-		return out
+		return out, err
 	}
 	if err := providercontract.Require(p, operationMethod(q.Operation)); err != nil {
 		out.ErrorCode = errorCode(err)
@@ -306,7 +321,7 @@ func execute(ctx context.Context, p sandbox.SandboxProvider, q request) response
 		if errors.As(err, &unsupported) {
 			out.Unsupported = unsupported
 		}
-		return out
+		return out, err
 	}
 	var info sandbox.Info
 	var command sandbox.CommandResult
@@ -329,6 +344,10 @@ func execute(ctx context.Context, p sandbox.SandboxProvider, q request) response
 	case "command":
 		command, err = p.RunCommand(ctx, q.Reference, *q.Command)
 		out.Command = &command
+	case "restore_preparation":
+		out.Restored, err = p.RestorePreparation(ctx, q.Reference, q.Key)
+	case "save_preparation":
+		err = p.SavePreparation(ctx, q.Reference, q.Key)
 	default:
 		var state sandbox.ComputeState
 		var compute sandbox.Compute
@@ -380,8 +399,9 @@ func execute(ctx context.Context, p sandbox.SandboxProvider, q request) response
 		}
 		out.Command = nil
 		out.Compute = nil
+		out.Restored = false
 	}
-	return out
+	return out, err
 }
 
 func requiresReady(q request) bool {
diff --git a/services/core/internal/sandbox/node/workspace_test.go b/services/core/internal/sandbox/node/workspace_test.go
index 3c4ff1f7a..edd33e6ee 100644
--- a/services/core/internal/sandbox/node/workspace_test.go
+++ b/services/core/internal/sandbox/node/workspace_test.go
@@ -87,17 +87,20 @@ func (c *workspaceRefusalCaller) Call(context.Context, microsandbox.Request) (mi
 func TestActualWorkspaceRefusalKeepsSettledAbsenceOnWire(t *testing.T) {
 	ref := reference()
 	caller := new(workspaceRefusalCaller)
-	config := microsandbox.Config{ExternalWorkspace: true, InstallationID: "11111111-1111-4111-8111-111111111111", HelperPath: "/helper", RuntimeHome: "/runtime", CheckpointRoot: "/checkpoints", RuntimePath: "/runtime/msb", FirmwarePath: "/runtime/firmware", RuntimeSHA256: strings.Repeat("a", 64), FirmwareSHA256: strings.Repeat("b", 64), Image: "image@sha256:" + strings.Repeat("c", 64), CPUs: 2, MemoryMiB: 2048, RootDiskMiB: 4096, Network: microsandbox.NetworkPolicy{DefaultEgress: "deny", DefaultIngress: "deny"}}
+	config := microsandbox.Config{InstallationID: "11111111-1111-4111-8111-111111111111", HelperPath: "/helper", RuntimeHome: "/runtime", CheckpointRoot: "/checkpoints", RuntimePath: "/runtime/msb", FirmwarePath: "/runtime/firmware", RuntimeSHA256: strings.Repeat("a", 64), FirmwareSHA256: strings.Repeat("b", 64), Image: "image@sha256:" + strings.Repeat("c", 64), CPUs: 2, MemoryMiB: 2048, RootDiskMiB: 4096, Network: microsandbox.NetworkPolicy{DefaultEgress: "deny", DefaultIngress: "deny"}}
 	provider, err := microsandbox.NewWithCaller(config, caller)
 	if err != nil {
 		t.Fatal(err)
 	}
 	fsConfig := workspacefs.Configuration{ID: "44444444-4444-4444-8444-444444444444", Adapter: "fixture", Parameters: json.RawMessage(`{}`)}
 	binding := &workspacefs.Binding{Configuration: fsConfig, Attachment: workspacefs.Attachment{Reference: workspacefs.Reference{TenantID: ref.TenantID, EnvironmentID: ref.EnvironmentID, ObjectID: "55555555-5555-4555-8555-555555555555"}, ConfigurationID: fsConfig.ID, Kind: workspacefs.AttachmentHostDirectory, Native: json.RawMessage(`{}`)}}
-	bootstrap := sandbox.Bootstrap{Harness: "codex", Reference: ref, SessionID: ref.TenantID, DeviceID: ref.EnvironmentID, CoreURL: "https://core.example/api/v1", Credential: "fixture", NetworkAccess: "disabled", Workspace: binding}
+	bootstrap := sandbox.Bootstrap{Reference: ref, SessionID: ref.TenantID, DeviceID: ref.EnvironmentID, CoreURL: "https://core.example/api/v1", Credential: "fixture", Harness: "codex", Workspace: binding}
 	ctx, cancel := context.WithTimeout(t.Context(), time.Second)
 	defer cancel()
-	out := execute(ctx, provider, request{ID: ref.AllocationID, ConnectionID: ref.TenantID, Reference: ref, Operation: "create", TimeoutMillis: 1000, Bootstrap: &bootstrap})
+	out, local := execute(ctx, provider, request{ID: ref.AllocationID, ConnectionID: ref.TenantID, Reference: ref, Operation: "create", TimeoutMillis: 1000, Bootstrap: &bootstrap})
+	if !errors.Is(local, workspacefs.ErrUnsupported) {
+		t.Fatal("the node journal lost the local error", local)
+	}
 	raw, err := json.Marshal(frame{Version: ProtocolVersion, Type: "response", Response: &out})
 	if err != nil {
 		t.Fatal(err)
diff --git a/services/core/internal/sandbox/node_diagnostic.go b/services/core/internal/sandbox/node_diagnostic.go
index 15527a4d2..2a2f29035 100644
--- a/services/core/internal/sandbox/node_diagnostic.go
+++ b/services/core/internal/sandbox/node_diagnostic.go
@@ -16,10 +16,8 @@ var (
 	ErrHostUnsupported = errors.New("host lacks a capability the sandbox provider requires")
 	// A pinned native artifact is missing or fails its integrity check.
 	ErrArtifactsUnavailable = errors.New("pinned provider artifacts are unavailable")
-	// The exact Runtime artifacts could not be transferred or verified.
-	ErrRuntimeDownloadFailed = errors.New("Runtime preparation failed")
-	// The pinned Runtime image is not available to the Provider.
-	ErrRuntimeImageUnavailable = errors.New("pinned Runtime image is unavailable")
+	// The Runtime image installed on the node is not available to the Provider.
+	ErrRuntimeImageUnavailable = errors.New("installed Runtime image is unavailable")
 	// The host cannot hold one sandbox of the deployment specification.
 	ErrCapacityInsufficient = errors.New("node cannot provide one sandbox of the deployment specification")
 )
@@ -38,7 +36,6 @@ const (
 	NodeProviderUnavailable     NodeDiagnosticCode = "provider_unavailable"
 	NodeHostUnsupported         NodeDiagnosticCode = "host_unsupported"
 	NodeArtifactsUnavailable    NodeDiagnosticCode = "artifacts_unavailable"
-	NodeRuntimeDownloadFailed   NodeDiagnosticCode = "runtime_download_failed"
 	NodeRuntimeImageUnavailable NodeDiagnosticCode = "runtime_image_unavailable"
 	NodeCapacityInsufficient    NodeDiagnosticCode = "capacity_insufficient"
 )
@@ -50,7 +47,6 @@ var nodeDiagnostics = []struct {
 	{ErrProviderUnavailable, NodeProviderUnavailable},
 	{ErrHostUnsupported, NodeHostUnsupported},
 	{ErrArtifactsUnavailable, NodeArtifactsUnavailable},
-	{ErrRuntimeDownloadFailed, NodeRuntimeDownloadFailed},
 	{ErrRuntimeImageUnavailable, NodeRuntimeImageUnavailable},
 	{ErrCapacityInsufficient, NodeCapacityInsufficient},
 }
diff --git a/services/core/internal/sandbox/providers/compute_profiles_test.go b/services/core/internal/sandbox/providers/compute_profiles_test.go
new file mode 100644
index 000000000..02d05412d
--- /dev/null
+++ b/services/core/internal/sandbox/providers/compute_profiles_test.go
@@ -0,0 +1,55 @@
+package providers
+
+import (
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/e2b"
+	"github.com/google/uuid"
+	"testing"
+)
+
+func TestComputeProfilesInheritOnlyCredentialAndRejectEndpointChanges(t *testing.T) {
+	base := sandbox.Selection{Provider: "e2b", DeploymentSpec: sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048}}, Configuration: &e2b.DeploymentConfiguration{Template: "default:" + uuid.NewString(), APIKey: "fixture-key"}}
+	variant := &e2b.DeploymentConfiguration{Template: "large:" + uuid.NewString()}
+	base.ComputeProfiles = map[string]sandbox.ComputeProfile{"memory-8g": {Resources: sandbox.Resources{CPUs: 4, MemoryMiB: 8192}, Configuration: variant}}
+	got, err := Builtin().Normalize(base)
+	if err != nil {
+		t.Fatal(err)
+	}
+	profile := got.ComputeProfiles["memory-8g"]
+	if profile.Resources.CPUs != 4 || profile.Resources.MemoryMiB != 8192 || got.Resources.MemoryMiB != 2048 || profile.Configuration.(*e2b.DeploymentConfiguration).APIKey != "fixture-key" || variant.APIKey != "" {
+		t.Fatal("selection mutated or lost isolation")
+	}
+	variant.APIURL = "https://api.other.example"
+	variant.Domain = "other.example"
+	if _, err = Builtin().Normalize(base); err == nil {
+		t.Fatal("profile changed provider endpoint")
+	}
+	variant.APIURL = ""
+	variant.Domain = ""
+	base.ComputeProfiles["bad/name"] = base.ComputeProfiles["memory-8g"]
+	if _, err = Builtin().Normalize(base); err == nil {
+		t.Fatal("invalid profile accepted")
+	}
+}
+
+func TestComputeProfilesDoNotRequireOptionalDiscovery(t *testing.T) {
+	registry := Builtin()
+	adapter := registry.adapters["docker"]
+	adapter.Mode = sandbox.DeploymentDirect
+	adapter.BuildLocal = nil
+	adapter.NodeArtifacts = nil
+	adapter.BuildDirect = func(sandbox.DirectConfig) (sandbox.SandboxProvider, error) {
+		t.Fatal("preparation constructed compute")
+		return nil, nil
+	}
+	registry.adapters["direct-fixture"] = adapter
+	input := sandbox.Selection{Provider: "direct-fixture", DeploymentSpec: validRegistrationSpec(), Configuration: nodeConfiguration{}, ComputeProfiles: map[string]sandbox.ComputeProfile{"memory-8g": {Resources: sandbox.Resources{CPUs: 4, MemoryMiB: 8192}, Configuration: nodeConfiguration{}}}}
+	prepared, err := registry.PrepareSelection(t.Context(), sandbox.DirectConfig{Selection: input})
+	if err != nil || prepared.ComputeProfiles["memory-8g"].Resources.MemoryMiB != 8192 {
+		t.Fatal("optional discovery blocked direct profile", err)
+	}
+	input.Provider = "docker"
+	if _, err = registry.Normalize(input); err == nil {
+		t.Fatal("node provider admitted compute profiles")
+	}
+}
diff --git a/services/core/internal/sandbox/providers/configuration.go b/services/core/internal/sandbox/providers/configuration.go
index e2497e3b3..79e4087b7 100644
--- a/services/core/internal/sandbox/providers/configuration.go
+++ b/services/core/internal/sandbox/providers/configuration.go
@@ -73,14 +73,49 @@ func (r *Registry) Normalize(s sandbox.Selection) (sandbox.Selection, error) {
 	if e != nil {
 		return s, e
 	}
-	return a.Configuration.Normalize(s)
+	normalized, err := a.Configuration.Normalize(s)
+	if err != nil {
+		return normalized, err
+	}
+	if len(s.ComputeProfiles) > 8 || len(s.ComputeProfiles) > 0 && a.Mode != sandbox.DeploymentDirect {
+		return s, sandbox.ErrInvalid
+	}
+	normalized.ComputeProfiles = make(map[string]sandbox.ComputeProfile, len(s.ComputeProfiles))
+	for name, profile := range s.ComputeProfiles {
+		if !sandbox.ValidComputeProfile(name) || profile.Resources.CPUs == 0 || profile.Resources.MemoryMiB == 0 {
+			return s, sandbox.ErrInvalid
+		}
+		owner := sandbox.Selection{Provider: s.Provider, DeploymentSpec: sandbox.DeploymentSpec{Resources: profile.Resources, Workspace: normalized.Workspace}, Configuration: profile.Configuration}
+		if normalized.HasCredential() {
+			owner, err = r.WithCredential(owner, normalized)
+			if err != nil {
+				return s, err
+			}
+		}
+		owner, err = a.Configuration.Normalize(owner)
+		if err != nil {
+			return s, err
+		}
+		if normalized.HasCredential() {
+			equal, err := a.Configuration.CredentialAccessEqual(owner.Configuration, normalized.Configuration)
+			if err != nil || !equal {
+				return s, sandbox.ErrInvalid
+			}
+		}
+		normalized.ComputeProfiles[name] = sandbox.ComputeProfile{Resources: owner.Resources, Configuration: owner.Configuration}
+	}
+	return normalized, nil
 }
 func (r *Registry) ResolveChange(next, previous sandbox.Selection) (sandbox.Selection, error) {
 	a, e := r.Lookup(next.Provider)
 	if e != nil {
 		return next, e
 	}
-	return a.Configuration.ResolveChange(next, previous)
+	resolved, err := a.Configuration.ResolveChange(next, previous)
+	if err != nil {
+		return resolved, err
+	}
+	return r.Normalize(resolved)
 }
 func (r *Registry) WithCredential(owner, candidate sandbox.Selection) (sandbox.Selection, error) {
 	if owner.Provider != candidate.Provider {
@@ -222,3 +257,36 @@ func (nodeConfigurationAdapter) VerifyCredential(context.Context, sandbox.Direct
 func (a nodeConfigurationAdapter) CredentialAccessEqual(x, y sandbox.Configuration) (bool, error) {
 	return a.Equal(x, y)
 }
+
+// PrepareSelection applies the same declared discovery policy to the default
+// normalized selection and every approved variant. It performs no compute allocation.
+func (r *Registry) PrepareSelection(ctx context.Context, c sandbox.DirectConfig) (sandbox.Selection, error) {
+	selection := c.Selection
+	adapter, err := r.Lookup(selection.Provider)
+	if err != nil {
+		return selection, err
+	}
+	discovery := adapter.Configuration.Requirements().SelectionDiscovery.State == providercontract.Supported
+	c.Selection = selection
+	if discovery {
+		selection, err = r.DiscoverSelection(ctx, c)
+		if err != nil {
+			return selection, err
+		}
+	}
+	profiles := make(map[string]sandbox.ComputeProfile, len(selection.ComputeProfiles))
+	for name, p := range selection.ComputeProfiles {
+		variant := c
+		variant.Selection = sandbox.Selection{Provider: selection.Provider, DeploymentSpec: sandbox.DeploymentSpec{Resources: p.Resources, Workspace: selection.Workspace}, Configuration: p.Configuration}
+		resolved := variant.Selection
+		if discovery {
+			resolved, err = r.DiscoverSelection(ctx, variant)
+			if err != nil {
+				return selection, err
+			}
+		}
+		profiles[name] = sandbox.ComputeProfile{Resources: resolved.Resources, Configuration: resolved.Configuration}
+	}
+	selection.ComputeProfiles = profiles
+	return selection, nil
+}
diff --git a/services/core/internal/sandbox/providers/configuration_flow_test.go b/services/core/internal/sandbox/providers/configuration_flow_test.go
index fc2070839..c959b0b61 100644
--- a/services/core/internal/sandbox/providers/configuration_flow_test.go
+++ b/services/core/internal/sandbox/providers/configuration_flow_test.go
@@ -4,7 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"net/http/httptest"
 	"strings"
 	"testing"
@@ -116,7 +116,7 @@ func TestAdditionalConfigurationProviderUsesCommonAPIAndStore(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer lease.Close(context.Background())
-	changes, err := deployment.NewExecutionOperations(service, deploymentpg.NewExecution(lease, pgtest.CredentialKey(t)), engine.Catalog{})
+	changes, err := deployment.NewExecutionOperations(service, deploymentpg.NewExecution(lease, pgtest.CredentialKey(t)), builtin.Registry())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -165,8 +165,7 @@ func TestAdditionalConfigurationProviderUsesCommonAPIAndStore(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	runtime := sandbox.RuntimeRelease{SourceCommit: strings.Repeat("a", 40), ImageID: "sha256:" + strings.Repeat("b", 64), ImageManifestDigest: "sha256:" + strings.Repeat("c", 64), MicrosandboxRef: "oac-runtime@sha256:" + strings.Repeat("d", 64), RuntimeSHA256: strings.Repeat("e", 64), FirmwareSHA256: strings.Repeat("f", 64)}
-	body, _ := json.Marshal(map[string]any{"provider": kind, "expected_generation": 0, "resources": sandbox.Resources{CPUs: 2, MemoryMiB: 2048}, "runtime": runtime, "configuration": map[string]string{"zone": "west"}})
+	body, _ := json.Marshal(map[string]any{"provider": kind, "expected_generation": 0, "resources": sandbox.Resources{CPUs: 2, MemoryMiB: 2048}, "configuration": map[string]string{"zone": "west"}})
 	request := httptest.NewRequest("POST", "/core/v1/sandbox/deployment", bytes.NewReader(body))
 	request.Header.Set("Authorization", "Bearer fixture-admin")
 	response := httptest.NewRecorder()
diff --git a/services/core/internal/sandbox/providers/generation_test.go b/services/core/internal/sandbox/providers/generation_test.go
index 60b42d297..5dd51c02b 100644
--- a/services/core/internal/sandbox/providers/generation_test.go
+++ b/services/core/internal/sandbox/providers/generation_test.go
@@ -7,12 +7,14 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"syscall"
 	"testing"
 	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	sandboxmicro "github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/microsandbox"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/workspacefs"
 	"github.com/google/uuid"
 )
 
@@ -20,8 +22,10 @@ func generationConfig(t *testing.T) (sandbox.NodeConfig, sandboxmicro.Native) {
 	t.Helper()
 	dir := t.TempDir()
 	spec := validRegistrationSpec()
-	spec.Resources.RootDiskMiB, spec.Resources.EnvironmentDiskMiB = 8192, 8192
+	spec.Resources.RootDiskMiB = 8192
+	spec.Workspace = &workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}
 	native := sandboxmicro.Native{HelperPath: filepath.Join(dir, "helper"), RuntimeHome: dir, CheckpointRoot: t.TempDir(), RuntimePath: filepath.Join(dir, "msb"), FirmwarePath: filepath.Join(dir, "firmware"),
+		Image: "oac-runtime@sha256:" + strings.Repeat("d", 64), RuntimeSHA256: strings.Repeat("e", 64), FirmwareSHA256: strings.Repeat("f", 64),
 		Network: sandboxmicro.Network{DefaultEgress: "allow", DefaultIngress: "deny"}}
 	raw, err := json.Marshal(native)
 	if err != nil {
@@ -54,7 +58,7 @@ func TestMicrosandboxGenerationDirectoryOwnership(t *testing.T) {
 				}
 			}
 			config, _ := generationConfig(t)
-			built, closeProvider, err := registry.Build(config, sandbox.LocalOptions{GenerationStateDirectory: state})
+			built, closeProvider, err := registry.Build(config, sandbox.LocalOptions{GenerationStateDirectory: state, Workspace: unreachableWorkspaceResolver{}})
 			closeProvider()
 			if mode == "private" {
 				info, statErr := os.Lstat(directory)
@@ -76,7 +80,7 @@ func TestMicrosandboxGenerationBindsLeaseIdentity(t *testing.T) {
 	registry := Builtin()
 	config, native := generationConfig(t)
 	state := t.TempDir()
-	built, closeProvider, err := registry.Build(config, sandbox.LocalOptions{GenerationStateDirectory: state})
+	built, closeProvider, err := registry.Build(config, sandbox.LocalOptions{GenerationStateDirectory: state, Workspace: unreachableWorkspaceResolver{}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -152,9 +156,10 @@ func TestMicrosandboxGenerationRejectsUnpinnedImage(t *testing.T) {
 	registry := Builtin()
 	for _, image := range []string{"latest", "oac-runtime@sha256:bad", "oac-runtime@sha256:"} {
 		t.Run(image, func(t *testing.T) {
-			config, _ := generationConfig(t)
-			config.Specification.Runtime.MicrosandboxRef = image
-			built, closeProvider, err := registry.Build(config, sandbox.LocalOptions{GenerationStateDirectory: t.TempDir()})
+			config, native := generationConfig(t)
+			native.Image = image
+			config.Native, _ = json.Marshal(native)
+			built, closeProvider, err := registry.Build(config, sandbox.LocalOptions{GenerationStateDirectory: t.TempDir(), Workspace: unreachableWorkspaceResolver{}})
 			closeProvider()
 			if err == nil || built != nil {
 				t.Fatalf("accepted image %q", image)
@@ -168,10 +173,10 @@ func TestLocalConstructionRequiresExplicitContext(t *testing.T) {
 	state := t.TempDir()
 	config, _ := generationConfig(t)
 	for _, options := range []sandbox.LocalOptions{
-		{},
-		{Standalone: true, GenerationStateDirectory: state},
-		{GenerationStateDirectory: "relative"},
-		{GenerationStateDirectory: state + "/../node"},
+		{Workspace: unreachableWorkspaceResolver{}},
+		{Standalone: true, GenerationStateDirectory: state, Workspace: unreachableWorkspaceResolver{}},
+		{GenerationStateDirectory: "relative", Workspace: unreachableWorkspaceResolver{}},
+		{GenerationStateDirectory: state + "/../node", Workspace: unreachableWorkspaceResolver{}},
 	} {
 		built, closeProvider, err := registry.Build(config, options)
 		closeProvider()
@@ -179,7 +184,7 @@ func TestLocalConstructionRequiresExplicitContext(t *testing.T) {
 			t.Fatalf("accepted construction context %+v: %v", options, err)
 		}
 	}
-	built, closeProvider, err := registry.Build(config, sandbox.LocalOptions{Standalone: true})
+	built, closeProvider, err := registry.Build(config, sandbox.LocalOptions{Standalone: true, Workspace: unreachableWorkspaceResolver{}})
 	closeProvider()
 	if err != nil || built == nil {
 		t.Fatalf("standalone construction: %v", err)
diff --git a/services/core/internal/sandbox/providers/registration.go b/services/core/internal/sandbox/providers/registration.go
index eb7c455a7..8e1baece3 100644
--- a/services/core/internal/sandbox/providers/registration.go
+++ b/services/core/internal/sandbox/providers/registration.go
@@ -45,9 +45,6 @@ func ValidateRegistration(a Adapter) error {
 	if a.Policy.Workspace != nil && a.Policy.Workspace.Attachment != workspacefs.AttachmentHostDirectory {
 		return invalid("workspace attachment requirements")
 	}
-	if a.Policy.Runtime == (a.Policy.RuntimeError != "") {
-		return invalid("Runtime input policy")
-	}
 	if a.Operations == nil {
 		return invalid("operation declaration")
 	}
diff --git a/services/core/internal/sandbox/providers/registration_test.go b/services/core/internal/sandbox/providers/registration_test.go
index e5c20bc80..da11416a9 100644
--- a/services/core/internal/sandbox/providers/registration_test.go
+++ b/services/core/internal/sandbox/providers/registration_test.go
@@ -14,12 +14,6 @@ import (
 func validRegistrationSpec() sandbox.DeploymentSpec {
 	return sandbox.DeploymentSpec{
 		Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048},
-		Runtime: &sandbox.RuntimeRelease{
-			SourceCommit: strings.Repeat("a", 40), ImageID: "sha256:" + strings.Repeat("b", 64),
-			ImageManifestDigest: "sha256:" + strings.Repeat("c", 64),
-			MicrosandboxRef:     "oac-runtime@sha256:" + strings.Repeat("d", 64),
-			RuntimeSHA256:       strings.Repeat("e", 64), FirmwareSHA256: strings.Repeat("f", 64),
-		},
 	}
 }
 
@@ -30,8 +24,6 @@ func TestRegistrationRejectsBeforeCallbacksOrConstruction(t *testing.T) {
 		name   string
 		mutate func(*Adapter)
 	}{
-		{"missing Runtime input policy", func(a *Adapter) { a.Policy = sandbox.DeploymentPolicy{} }},
-		{"contradictory Runtime input policy", func(a *Adapter) { a.Policy.RuntimeError = "Runtime rejected" }},
 		{"missing mode", func(a *Adapter) { a.Mode = "" }},
 		{"unknown mode", func(a *Adapter) { a.Mode = "private-token" }},
 		{"missing local constructor", func(a *Adapter) { a.BuildLocal = nil }},
diff --git a/services/core/internal/sandbox/providers/validation_test.go b/services/core/internal/sandbox/providers/validation_test.go
index 3fe6eb981..ff3adfc91 100644
--- a/services/core/internal/sandbox/providers/validation_test.go
+++ b/services/core/internal/sandbox/providers/validation_test.go
@@ -17,8 +17,8 @@ func TestDeploymentValidationFieldsPreserveMessages(t *testing.T) {
 	}{
 		{"docker", sandbox.Resources{}, "resources.cpus", "cpus must be 1..255 and memory_mib must be 512..1048576", validationBound(1), validationBound(255)},
 		{"docker", sandbox.Resources{CPUs: 1, MemoryMiB: 511}, "resources.memory_mib", "cpus must be 1..255 and memory_mib must be 512..1048576", validationBound(512), validationBound(1048576)},
-		{"microsandbox", sandbox.Resources{CPUs: 1, MemoryMiB: 512}, "resources.root_disk_mib", "microsandbox requires root_disk_mib and environment_disk_mib of at least 1024 MiB", validationBound(1024), nil},
-		{"microsandbox", sandbox.Resources{CPUs: 1, MemoryMiB: 512, RootDiskMiB: 1024}, "resources.environment_disk_mib", "microsandbox requires root_disk_mib and environment_disk_mib of at least 1024 MiB", validationBound(1024), nil},
+		{"microsandbox", sandbox.Resources{CPUs: 1, MemoryMiB: 512}, "resources.root_disk_mib", "microsandbox requires root_disk_mib of at least 1024 MiB", validationBound(1024), nil},
+		{"microsandbox", sandbox.Resources{CPUs: 1, MemoryMiB: 512, RootDiskMiB: 1024, EnvironmentDiskMiB: 1}, "resources.environment_disk_mib", "microsandbox requires environment_disk_mib of 0 or at least 1024 MiB", validationBound(1024), nil},
 		{"docker", sandbox.Resources{CPUs: 1, MemoryMiB: 512, RootDiskMiB: 1}, "resources.root_disk_mib", "docker does not support independent disk capacity limits", validationBound(0), validationBound(0)},
 		{"e2b", sandbox.Resources{CPUs: 1, MemoryMiB: 512, EnvironmentDiskMiB: 1}, "resources.environment_disk_mib", "e2b does not support independent disk capacity limits", validationBound(0), validationBound(0)},
 	} {
@@ -34,21 +34,6 @@ func TestDeploymentValidationFieldsPreserveMessages(t *testing.T) {
 			}
 		}
 	}
-	for _, tc := range []struct {
-		provider string
-		runtime  *sandbox.RuntimeRelease
-		message  string
-	}{
-		{"docker", nil, "managed nodes require a pinned Runtime release"},
-		{"docker", &sandbox.RuntimeRelease{}, "Runtime must reference one immutable distribution"},
-		{"e2b", &sandbox.RuntimeRelease{}, "E2B Runtime is selected by its immutable template build"},
-	} {
-		err := registry.ValidateSpecification(tc.provider, sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 1, MemoryMiB: 512}, Runtime: tc.runtime})
-		var field *sandbox.ValidationError
-		if !errors.As(err, &field) || field.Param != "runtime" || err.Error() != sandbox.ErrInvalid.Error()+": "+tc.message || !errors.Is(err, sandbox.ErrInvalid) {
-			t.Fatal(err)
-		}
-	}
 	if err := registry.ValidateResources("docker", sandbox.Resources{CPUs: 255, MemoryMiB: 1048576}); err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/internal/sandbox/providers/workspace_test.go b/services/core/internal/sandbox/providers/workspace_test.go
index b1f2c505e..fe0fbb231 100644
--- a/services/core/internal/sandbox/providers/workspace_test.go
+++ b/services/core/internal/sandbox/providers/workspace_test.go
@@ -12,7 +12,6 @@ func TestWorkspaceReceiptValidatesNormalizationAndGenerationBuild(t *testing.T)
 	registry := Builtin()
 	spec := validRegistrationSpec()
 	spec.Resources.RootDiskMiB = 4096
-	spec.Resources.EnvironmentDiskMiB = 0
 	spec.Workspace = &workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}
 	if err := registry.ValidateSpecification("microsandbox", spec); err != nil {
 		t.Fatal(err)
@@ -35,8 +34,8 @@ func TestWorkspaceReceiptValidatesNormalizationAndGenerationBuild(t *testing.T)
 		t.Fatal("external generation built without resolver", err)
 	}
 	config.Specification.Workspace = nil
-	if _, _, err = registry.Build(config, sandbox.LocalOptions{Standalone: true}); err == nil || errors.Is(err, reached) {
-		t.Fatal("owned zero disk bypassed validation", err)
+	if _, _, err = registry.Build(config, sandbox.LocalOptions{Standalone: true, Workspace: unreachableWorkspaceResolver{}}); !errors.Is(err, sandbox.ErrWorkspaceRequired) {
+		t.Fatal("generation without storage bypassed validation", err)
 	}
 }
 
diff --git a/services/core/internal/sandbox/sandbox_provider.go b/services/core/internal/sandbox/sandbox_provider.go
index ed2c498e0..1e6bf4b8c 100644
--- a/services/core/internal/sandbox/sandbox_provider.go
+++ b/services/core/internal/sandbox/sandbox_provider.go
@@ -35,7 +35,10 @@ import (
 )
 
 var (
-	ErrInvalid            = errors.New("invalid sandbox configuration")
+	ErrInvalid = errors.New("invalid sandbox configuration")
+	// ErrWorkspaceRequired reports a Provider that runs every Environment on
+	// external storage while none is selected.
+	ErrWorkspaceRequired  = errors.New("sandbox provider requires workspace storage")
 	ErrOwnership          = errors.New("sandbox ownership mismatch")
 	ErrExists             = errors.New("sandbox allocation already exists")
 	ErrNotFound           = errors.New("sandbox allocation not found")
@@ -43,6 +46,11 @@ var (
 	// ErrComputeUnconfirmed requires observation of the retained operation identity;
 	// it does not authorize another Create, capture, restore, or cold start.
 	ErrComputeUnconfirmed = errors.New("sandbox lifecycle outcome unconfirmed")
+	// ErrCheckpointUnusable is a Resume outcome: the adapter durably closed this
+	// operation before dispatching native restoration, and the snapshot cannot be
+	// restored. It repeats for the same operation and is never returned once
+	// native restoration was dispatched.
+	ErrCheckpointUnusable = errors.New("sandbox checkpoint cannot be restored")
 )
 
 // Reference must be persisted by the caller before Create. AllocationID is a fresh
@@ -55,8 +63,6 @@ type Bootstrap struct {
 	Harness   string
 	Reference
 	SessionID, DeviceID, CoreURL, Credential string
-	NetworkAccess                            string
-	AllowedDomains                           []string
 }
 
 // Info describes compute only. Running does not establish daemon authentication,
@@ -122,6 +128,13 @@ type SandboxProvider interface {
 	// ResumeCompute thaws only the same resident instance after an aborted pause.
 	ResumeCompute(context.Context, Reference, Compute) (ComputeState, error)
 
+	// The preparation cache keeps the Environment filesystem left by one finished
+	// preparation. Key is opaque and the adapter owns storage and lifetime. Both
+	// address the allocation's initial compute and share one declaration.
+	// RestorePreparation returns false when it holds no valid entry.
+	RestorePreparation(ctx context.Context, r Reference, key string) (bool, error)
+	SavePreparation(ctx context.Context, r Reference, key string) error
+
 	// Observe reads one owned Runtime instance after verifying its ownership. It
 	// never renews, restarts or stops compute.
 	Observe(context.Context, runtimeobs.Target) (runtimeobs.Sample, error)
@@ -145,6 +158,9 @@ func ValidateRetained(s RetainedState) error {
 	return nil
 }
 
+// preparationOperations are both supported or both unsupported.
+var preparationOperations = []string{"RestorePreparation", "SavePreparation"}
+
 // Compute identifies one incarnation of an allocation. Name is provider-derived.
 // ID is empty only until the original create or restore result is observed.
 type Compute struct {
@@ -154,7 +170,7 @@ type Compute struct {
 	RestoredFrom *RetainedState
 }
 
-// CheckpointCompatibility identifies an adapter-verified private archive domain
+// CheckpointCompatibility identifies an adapter-verified private checkpoint domain
 // and execution compatibility class. Core compares these opaque tokens only.
 type CheckpointCompatibility struct {
 	ArtifactDomain string `json:"artifact_domain"`
@@ -301,6 +317,9 @@ func ValidateOperations(operations providercontract.Operations) error {
 			return fmt.Errorf("%w: incomplete suspension lifecycle", providercontract.ErrContract)
 		}
 	}
+	if operations[preparationOperations[0]].State != operations[preparationOperations[1]].State {
+		return fmt.Errorf("%w: incomplete preparation cache", providercontract.ErrContract)
+	}
 	return nil
 }
 
@@ -335,15 +354,13 @@ type ConfigurationRequirements struct {
 	CredentialVerification providercontract.Support
 }
 
-// DeploymentPolicy is the deployment declaration. Disk declares independent
-// disk limits; Runtime requires a pinned Runtime release, and RuntimeError is
-// the fixed reason for rejecting one otherwise. DefaultResources is the size
-// setup proposes, or nil when the Provider's configuration selects it.
+// DeploymentPolicy is the deployment declaration. Workspace, when present, means
+// the Provider runs every Environment on external storage; absent means its own
+// disk. Disk declares independent disk limits. DefaultResources is the size setup
+// proposes, or nil when the Provider's configuration selects it.
 type DeploymentPolicy struct {
 	Workspace        *workspacefs.Requirements `json:"workspace,omitempty"`
-	RuntimeError     string                    `json:"-"`
 	Disk             bool                      `json:"disk"`
-	Runtime          bool                      `json:"runtime"`
 	DefaultResources *Resources                `json:"default_resources"`
 }
 
@@ -365,6 +382,7 @@ type ConfigurationRecord struct {
 
 // Selection is the typed deployment configuration shared by preview and commit.
 type Selection struct {
+	ComputeProfiles map[string]ComputeProfile `json:"-"`
 	DeploymentSpec
 	ExpectedGeneration uint64        `json:"expected_generation"`
 	Provider           string        `json:"provider"`
@@ -390,8 +408,8 @@ type DirectConfig struct {
 
 // NodeConfig is a node's configuration for one deployment generation. Native
 // holds only the selected adapter's node-local settings, such as host paths;
-// that adapter alone decodes it, strictly. Resources and the Runtime release
-// are read from Specification, never copied into Native.
+// that adapter alone decodes it, strictly. Resources are read from
+// Specification, never copied into Native.
 type NodeConfig struct {
 	Specification  DeploymentSpec  `json:"specification"`
 	Generation     uint64          `json:"generation"`
diff --git a/services/core/internal/sandbox/sandbox_provider_test.go b/services/core/internal/sandbox/sandbox_provider_test.go
index 59806b0f3..98b74771b 100644
--- a/services/core/internal/sandbox/sandbox_provider_test.go
+++ b/services/core/internal/sandbox/sandbox_provider_test.go
@@ -16,7 +16,7 @@ func TestOperationGroupsPartitionTheInterface(t *testing.T) {
 			methods = append(methods, name)
 		}
 	}
-	groups := slices.Concat(requiredOperations, suspensionOperations, []string{"Observe"})
+	groups := slices.Concat(requiredOperations, suspensionOperations, preparationOperations, []string{"Observe"})
 	slices.Sort(groups)
 	if !slices.Equal(methods, groups) {
 		t.Fatalf("SandboxProvider operations %v, groups %v", methods, groups)
diff --git a/services/core/internal/sandbox/testdata/deployment-contract.json b/services/core/internal/sandbox/testdata/deployment-contract.json
index bd4a68738..f9b24c5d1 100644
--- a/services/core/internal/sandbox/testdata/deployment-contract.json
+++ b/services/core/internal/sandbox/testdata/deployment-contract.json
@@ -6,19 +6,11 @@
       "resources": {
         "cpus": 2,
         "memory_mib": 4096
-      },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
       }
     },
     "valid": true,
-    "canonical": "{\"provider\":\"docker\",\"resources\":{\"cpus\":2,\"memory_mib\":4096},\"runtime\":{\"source_commit\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"image_id\":\"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\"image_manifest_digest\":\"sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc\",\"microsandbox_ref\":\"oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd\",\"runtime_sha256\":\"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\"firmware_sha256\":\"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\"}}",
-    "digest": "1237a0d19e665b387922ad3d60143d5cd530864f0e3e4ee2c5ace57a1134aa38"
+    "canonical": "{\"provider\":\"docker\",\"resources\":{\"cpus\":2,\"memory_mib\":4096}}",
+    "digest": "6931ff71e3c92bccfbc422fb11d0e69fdf591e7bdd1aed76ac47fa4f144baca1"
   },
   {
     "name": "docker-zero-disks",
@@ -29,19 +21,11 @@
         "memory_mib": 4096,
         "root_disk_mib": 0,
         "environment_disk_mib": 0
-      },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
       }
     },
     "valid": true,
-    "canonical": "{\"provider\":\"docker\",\"resources\":{\"cpus\":2,\"memory_mib\":4096},\"runtime\":{\"source_commit\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"image_id\":\"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\"image_manifest_digest\":\"sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc\",\"microsandbox_ref\":\"oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd\",\"runtime_sha256\":\"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\"firmware_sha256\":\"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\"}}",
-    "digest": "1237a0d19e665b387922ad3d60143d5cd530864f0e3e4ee2c5ace57a1134aa38"
+    "canonical": "{\"provider\":\"docker\",\"resources\":{\"cpus\":2,\"memory_mib\":4096}}",
+    "digest": "6931ff71e3c92bccfbc422fb11d0e69fdf591e7bdd1aed76ac47fa4f144baca1"
   },
   {
     "name": "microsandbox",
@@ -53,18 +37,15 @@
         "root_disk_mib": 1024,
         "environment_disk_mib": 4294967295
       },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+      "workspace": {
+        "attachment": "host_directory",
+        "user_xattr": true,
+        "capacity_quota": true
       }
     },
     "valid": true,
-    "canonical": "{\"provider\":\"microsandbox\",\"resources\":{\"cpus\":255,\"memory_mib\":1048576,\"root_disk_mib\":1024,\"environment_disk_mib\":4294967295},\"runtime\":{\"source_commit\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"image_id\":\"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\"image_manifest_digest\":\"sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc\",\"microsandbox_ref\":\"oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd\",\"runtime_sha256\":\"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\"firmware_sha256\":\"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\"}}",
-    "digest": "1bb6daadcf9e34b236a8ecba6eb4c5215b946a3f226721b2bf148f72acb5f05e"
+    "canonical": "{\"provider\":\"microsandbox\",\"resources\":{\"cpus\":255,\"memory_mib\":1048576,\"root_disk_mib\":1024,\"environment_disk_mib\":4294967295},\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true,\"capacity_quota\":true}}",
+    "digest": "a0f5348e68e36ff01ffcef3e6c71c5eddfd429f34b440a4b3bb273b8f9eeac94"
   },
   {
     "name": "e2b",
@@ -86,14 +67,6 @@
       "resources": {
         "cpus": 0,
         "memory_mib": 4096
-      },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
       }
     },
     "valid": false
@@ -105,14 +78,6 @@
       "resources": {
         "cpus": 256,
         "memory_mib": 4096
-      },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
       }
     },
     "valid": false
@@ -124,14 +89,6 @@
       "resources": {
         "cpus": true,
         "memory_mib": 4096
-      },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
       }
     },
     "valid": false
@@ -143,14 +100,6 @@
       "resources": {
         "cpus": 2,
         "memory_mib": 511
-      },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
       }
     },
     "valid": false
@@ -163,14 +112,6 @@
         "cpus": 2,
         "memory_mib": 4096,
         "other": 1
-      },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
       }
     },
     "valid": false
@@ -183,14 +124,6 @@
         "cpus": 2,
         "memory_mib": 4096,
         "root_disk_mib": 1024
-      },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
       }
     },
     "valid": false
@@ -205,19 +138,16 @@
         "root_disk_mib": 1023,
         "environment_disk_mib": 4294967295
       },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+      "workspace": {
+        "attachment": "host_directory",
+        "user_xattr": true,
+        "capacity_quota": true
       }
     },
     "valid": false
   },
   {
-    "name": "invalid-release-digest",
+    "name": "runtime-rejected",
     "provider": "docker",
     "specification": {
       "resources": {
@@ -225,12 +155,7 @@
         "memory_mib": 4096
       },
       "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
       }
     },
     "valid": false
@@ -244,14 +169,6 @@
         "memory_mib": 1048576,
         "root_disk_mib": 1024
       },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
-      },
       "workspace": {
         "attachment": "host_directory",
         "user_xattr": true,
@@ -259,8 +176,8 @@
       }
     },
     "valid": true,
-    "canonical": "{\"provider\":\"microsandbox\",\"resources\":{\"cpus\":255,\"memory_mib\":1048576,\"root_disk_mib\":1024},\"runtime\":{\"source_commit\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"image_id\":\"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\"image_manifest_digest\":\"sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc\",\"microsandbox_ref\":\"oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd\",\"runtime_sha256\":\"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\"firmware_sha256\":\"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\"},\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true,\"capacity_quota\":false}}",
-    "digest": "ea1aa3cb9bd74682f5fb1a727dc43c63df193f71c7946c395da30451ee5ee3b0"
+    "canonical": "{\"provider\":\"microsandbox\",\"resources\":{\"cpus\":255,\"memory_mib\":1048576,\"root_disk_mib\":1024},\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true,\"capacity_quota\":false}}",
+    "digest": "cd31758a8ec9df729120eccd3db650d0f82cb35c4fbd1b1f5b7cf70140ae9faf"
   },
   {
     "name": "microsandbox-external-requires-root",
@@ -271,14 +188,6 @@
         "memory_mib": 1048576,
         "root_disk_mib": 0
       },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
-      },
       "workspace": {
         "attachment": "host_directory",
         "user_xattr": true,
@@ -297,14 +206,6 @@
         "root_disk_mib": 1024,
         "environment_disk_mib": 4096
       },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
-      },
       "workspace": {
         "attachment": "host_directory",
         "user_xattr": true,
@@ -322,14 +223,6 @@
         "memory_mib": 1048576,
         "root_disk_mib": 1024
       },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
-      },
       "workspace": {
         "attachment": "host_directory",
         "user_xattr": false,
@@ -339,21 +232,13 @@
     "valid": false
   },
   {
-    "name": "microsandbox-owned-zero-environment-rejected",
+    "name": "microsandbox-requires-workspace",
     "provider": "microsandbox",
     "specification": {
       "resources": {
         "cpus": 255,
         "memory_mib": 1048576,
         "root_disk_mib": 1024
-      },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
       }
     },
     "valid": false
@@ -366,14 +251,6 @@
         "cpus": 255,
         "memory_mib": 1048576
       },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
-      },
       "workspace": {
         "attachment": "host_directory",
         "user_xattr": true,
@@ -391,22 +268,14 @@
         "memory_mib": 1048576,
         "root_disk_mib": 1024
       },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
-      },
       "workspace": {
         "attachment": "host_directory",
         "user_xattr": true
       }
     },
     "valid": true,
-    "canonical": "{\"provider\":\"microsandbox\",\"resources\":{\"cpus\":255,\"memory_mib\":1048576,\"root_disk_mib\":1024},\"runtime\":{\"source_commit\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"image_id\":\"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\"image_manifest_digest\":\"sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc\",\"microsandbox_ref\":\"oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd\",\"runtime_sha256\":\"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\"firmware_sha256\":\"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\"},\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true,\"capacity_quota\":false}}",
-    "digest": "ea1aa3cb9bd74682f5fb1a727dc43c63df193f71c7946c395da30451ee5ee3b0"
+    "canonical": "{\"provider\":\"microsandbox\",\"resources\":{\"cpus\":255,\"memory_mib\":1048576,\"root_disk_mib\":1024},\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true,\"capacity_quota\":false}}",
+    "digest": "cd31758a8ec9df729120eccd3db650d0f82cb35c4fbd1b1f5b7cf70140ae9faf"
   },
   {
     "name": "microsandbox-external-null-false-quota",
@@ -417,14 +286,6 @@
         "memory_mib": 1048576,
         "root_disk_mib": 1024
       },
-      "runtime": {
-        "source_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "image_id": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-        "image_manifest_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-        "microsandbox_ref": "oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-        "runtime_sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
-        "firmware_sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
-      },
       "workspace": {
         "attachment": "host_directory",
         "user_xattr": true,
@@ -432,7 +293,7 @@
       }
     },
     "valid": true,
-    "canonical": "{\"provider\":\"microsandbox\",\"resources\":{\"cpus\":255,\"memory_mib\":1048576,\"root_disk_mib\":1024},\"runtime\":{\"source_commit\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"image_id\":\"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\"image_manifest_digest\":\"sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc\",\"microsandbox_ref\":\"oac-runtime@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd\",\"runtime_sha256\":\"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\"firmware_sha256\":\"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\"},\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true,\"capacity_quota\":false}}",
-    "digest": "ea1aa3cb9bd74682f5fb1a727dc43c63df193f71c7946c395da30451ee5ee3b0"
+    "canonical": "{\"provider\":\"microsandbox\",\"resources\":{\"cpus\":255,\"memory_mib\":1048576,\"root_disk_mib\":1024},\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true,\"capacity_quota\":false}}",
+    "digest": "cd31758a8ec9df729120eccd3db650d0f82cb35c4fbd1b1f5b7cf70140ae9faf"
   }
 ]
diff --git a/services/core/internal/sandbox/testdata/node-diagnostics.json b/services/core/internal/sandbox/testdata/node-diagnostics.json
index 4c885eec2..7d799410e 100644
--- a/services/core/internal/sandbox/testdata/node-diagnostics.json
+++ b/services/core/internal/sandbox/testdata/node-diagnostics.json
@@ -2,7 +2,6 @@
   "provider_unavailable",
   "host_unsupported",
   "artifacts_unavailable",
-  "runtime_download_failed",
   "runtime_image_unavailable",
   "capacity_insufficient"
 ]
diff --git a/services/core/internal/sandbox/workspace_test.go b/services/core/internal/sandbox/workspace_test.go
index d8a0aee70..d22cd3d06 100644
--- a/services/core/internal/sandbox/workspace_test.go
+++ b/services/core/internal/sandbox/workspace_test.go
@@ -1,27 +1,32 @@
 package sandbox
 
 import (
+	"errors"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/workspacefs"
 	"testing"
 )
 
-func TestWorkspaceQuotaDoesNotWeakenRootCapacity(t *testing.T) {
+func TestExternalStorageProviderRequiresSelectionAndKeepsRootCapacity(t *testing.T) {
 	policy := DeploymentPolicy{Disk: true, Workspace: &workspacefs.Requirements{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}}
-	declaration := workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}
-	resources := Resources{CPUs: 2, MemoryMiB: 2048, RootDiskMiB: 4096}
-	if err := resources.ValidateWorkspacePolicy("test", policy, &declaration); err != nil {
+	declaration := &workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}
+	spec := DeploymentSpec{Resources: Resources{CPUs: 2, MemoryMiB: 2048, RootDiskMiB: 4096}, Workspace: declaration}
+	if err := spec.ValidatePolicy("test", policy); err != nil {
 		t.Fatal(err)
 	}
-	if err := resources.ValidatePolicy("test", policy); err == nil {
-		t.Fatal("owned disk accepted zero")
+	if err := (DeploymentSpec{Resources: spec.Resources}).ValidatePolicy("test", policy); !errors.Is(err, ErrWorkspaceRequired) {
+		t.Fatal("missing storage accepted", err)
 	}
-	resources.EnvironmentDiskMiB = 4096
-	if err := resources.ValidateWorkspacePolicy("test", policy, &declaration); err == nil {
+	if err := spec.ValidatePolicy("test", DeploymentPolicy{}); !errors.Is(err, workspacefs.ErrUnsupported) {
+		t.Fatal("storage accepted by a Provider with its own disk", err)
+	}
+	quota := spec
+	quota.Resources.EnvironmentDiskMiB = 4096
+	if err := quota.ValidatePolicy("test", policy); err == nil {
 		t.Fatal("unenforced external quota accepted")
 	}
-	resources.EnvironmentDiskMiB = 0
-	resources.RootDiskMiB = 0
-	if err := resources.ValidateWorkspacePolicy("test", policy, &declaration); err == nil {
+	noRoot := spec
+	noRoot.Resources.RootDiskMiB = 0
+	if err := noRoot.ValidatePolicy("test", policy); err == nil {
 		t.Fatal("root quota omitted")
 	}
 }
diff --git a/services/core/internal/sessions/creation.go b/services/core/internal/sessions/creation.go
index 56957dad3..dff6720c6 100644
--- a/services/core/internal/sessions/creation.go
+++ b/services/core/internal/sessions/creation.go
@@ -98,6 +98,9 @@ type CreationTx interface {
 	// preparation when the Session froze a setup or initial files, and
 	// returns its ID.
 	CreateEnvironment(ctx context.Context) (string, error)
+	// FreezeComputeProfile binds the selected immutable generation while the
+	// deployment lock is held, including before an allocation exists.
+	FreezeComputeProfile(ctx context.Context, profile string, generation uint64) error
 	// CreateInputReservation reserves the batch under key until the deadline
 	// the database clock sets, marked as the Session's initial input.
 	CreateInputReservation(ctx context.Context, key string, batch json.RawMessage, initial bool) (EnvironmentInputReservation, error)
@@ -150,7 +153,8 @@ func (s *Service) CreateSession(ctx context.Context, tenant string, input Create
 // Skills, then the Session's own rows. It returns the resources created.
 func (s *Service) createResources(ctx context.Context, tx CreationTx, session Session, input CreateSession, batch []Input, encoded json.RawMessage) ([]writeaudit.Resource, error) {
 	var configuration struct {
-		Environment struct {
+		ComputeProfile string `json:"compute_profile"`
+		Environment    struct {
 			Type string `json:"type"`
 		} `json:"environment"`
 	}
@@ -171,6 +175,15 @@ func (s *Service) createResources(ctx context.Context, tx CreationTx, session Se
 			return nil, err
 		}
 	}
+	if profile := configuration.ComputeProfile; profile != "" {
+		selected, ok := deployment.ComputeProfiles[profile]
+		if !hosted || deployment.Mode != string(sandbox.DeploymentDirect) || !sandbox.ValidComputeProfile(profile) || !ok || selected.Generation == 0 || selected.Generation >= deployment.Generation {
+			return nil, placement.ErrComputeProfileUnavailable
+		}
+		if err := tx.FreezeComputeProfile(ctx, profile, selected.Generation); err != nil {
+			return nil, err
+		}
+	}
 	setup, err := freezeSkills(ctx, tx, input.Initialization)
 	if err != nil {
 		return nil, err
diff --git a/services/core/internal/sessions/creation_test.go b/services/core/internal/sessions/creation_test.go
index 7cbc81e34..50d6156b8 100644
--- a/services/core/internal/sessions/creation_test.go
+++ b/services/core/internal/sessions/creation_test.go
@@ -612,3 +612,8 @@ func TestFindSessionCreation(t *testing.T) {
 		})
 	}
 }
+
+func (f *fakeCreationTx) FreezeComputeProfile(context.Context, string, uint64) error {
+	f.t.Fatal("unexpected FreezeComputeProfile")
+	return nil
+}
diff --git a/services/core/internal/sessions/environment.go b/services/core/internal/sessions/environment.go
index dd0afb7ae..0172dcda1 100644
--- a/services/core/internal/sessions/environment.go
+++ b/services/core/internal/sessions/environment.go
@@ -141,7 +141,7 @@ type EnvironmentFileWrite struct {
 // ValidateRetainedHistory checks the selected external filesystem and Harness combination.
 func ValidateRetainedHistory(required, supported bool) error {
 	if required && !supported {
-		return fmt.Errorf("%w: external workspace storage requires retained_native_history", ErrInvalidInput)
+		return ErrRetainedHistoryUnsupported
 	}
 	return nil
 }
diff --git a/services/core/internal/sessions/errors.go b/services/core/internal/sessions/errors.go
index 116914bb3..3b14d76d5 100644
--- a/services/core/internal/sessions/errors.go
+++ b/services/core/internal/sessions/errors.go
@@ -23,6 +23,11 @@ var ErrInputPending = fmt.Errorf("%w: session input is still pending", ErrTurnCo
 // internal callers; an expired Environment keeps that plain error.
 var ErrHostedEnvironmentFailed = fmt.Errorf("%w: the hosted environment failed to provision", ErrEnvironmentUnavailable)
 
+// ErrRetainedHistoryUnsupported rejects a Harness without retained native
+// history on external workspace storage. It remains ErrInvalidInput for
+// internal callers.
+var ErrRetainedHistoryUnsupported = fmt.Errorf("%w: external workspace storage requires retained_native_history", ErrInvalidInput)
+
 // ErrNotIdle rejects deletion of a Session that still has work or input
 // pending. Callers cancel first and delete after the Session settles.
 var ErrNotIdle = errors.New("session must be durably idle or failed without required actions before deletion")
diff --git a/services/core/internal/sessions/execution_functions.go b/services/core/internal/sessions/execution_functions.go
index 1285a1a9e..9495cc8fe 100644
--- a/services/core/internal/sessions/execution_functions.go
+++ b/services/core/internal/sessions/execution_functions.go
@@ -3,6 +3,8 @@ package sessions
 import (
 	"context"
 	"encoding/json"
+
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/items"
 )
 
 // FunctionCallMatch is what a Turn's stored call shows about a reported call.
@@ -20,6 +22,7 @@ type FunctionCallMatch struct {
 type FunctionTx interface {
 	JournalTx
 	PendingFunctionCallsTx
+	NativeSubagents
 	// MatchFunctionCall compares call with the Turn's call of the same public
 	// identity.
 	MatchFunctionCall(ctx context.Context, turn string, call FunctionCall) (FunctionCallMatch, error)
@@ -31,6 +34,8 @@ type FunctionTx interface {
 	// ApplyFunctionResult records the application receipt of the call's
 	// result.
 	ApplyFunctionResult(ctx context.Context, turn, call string) error
+	// WithdrawFunctionCall records that the native Harness abandoned the call.
+	WithdrawFunctionCall(ctx context.Context, turn, call string) error
 	// ApplyTurnStatus moves the Turn as change decides and returns it as
 	// stored. A Turn no longer in the expected status is ErrTurnConflict.
 	ApplyTurnStatus(ctx context.Context, turn string, change TurnStatusChange) (Turn, error)
@@ -64,25 +69,62 @@ func decideFunctionCall(turn Turn, match FunctionCallMatch) (bool, error) {
 
 // decideFunctionConfirmation decides whether to record the native application
 // of a call's result: an applied call records nothing, and a call without a
-// result or on a Turn that no longer accepts results conflicts.
+// result, a withdrawn call or a call on a Turn that no longer accepts results
+// conflicts.
 func decideFunctionConfirmation(turn Turn, call FunctionCall) (bool, error) {
 	if call.Applied {
 		return false, nil
 	}
-	if len(call.Result) == 0 || !acceptsFunctionResults(turn) {
+	if len(call.Result) == 0 || call.Withdrawn || !acceptsFunctionResults(turn) {
+		return false, ErrTurnConflict
+	}
+	return true, nil
+}
+
+// decideFunctionWithdrawal decides whether to record that the native Harness
+// abandoned a call: a withdrawn call records nothing, and an applied call or a
+// Turn that no longer accepts results conflicts.
+func decideFunctionWithdrawal(turn Turn, call FunctionCall) (bool, error) {
+	if call.Withdrawn {
+		return false, nil
+	}
+	if call.Applied || !acceptsFunctionResults(turn) {
 		return false, ErrTurnConflict
 	}
 	return true, nil
 }
 
+// resolveFunctionCall gives a call a Subagent made the identity of the child's
+// function Item. A child the Session has not published, or a malformed native
+// identity, is ErrInvalidInput.
+func resolveFunctionCall(ctx context.Context, tx NativeSubagents, call FunctionCall) (FunctionCall, error) {
+	if call.Subagent == "" && call.SubagentTurn == "" {
+		return call, nil
+	}
+	if !validNativeIdentity(call.Subagent) || !validNativeIdentity(call.SubagentTurn) {
+		return call, ErrInvalidInput
+	}
+	child, err := visibleSubagent(ctx, tx, call.Subagent)
+	if err != nil {
+		return call, err
+	}
+	call.CallID = items.Identity(items.Identity(child.ID, "turn:"+call.SubagentTurn), "tool:"+call.ExecutorCallID)
+	return call, nil
+}
+
 // RecordFunctionCall records a call an executor reported for its Turn and
-// journals the Turn's required actions with it. A retry of the recorded call
+// journals the Turn's required actions with it. A call a Subagent made takes
+// the identity of the child's function Item. A retry of the recorded call
 // changes nothing.
 func (o *ExecutionOperations) RecordFunctionCall(ctx context.Context, tenant, session, turn string, call FunctionCall) error {
 	if err := validateFunctionCall(call); err != nil {
 		return err
 	}
 	return o.storage.WithFunctionTurn(ctx, tenant, session, turn, func(ctx context.Context, tx FunctionTx, current Turn) error {
+		call, err := resolveFunctionCall(ctx, tx, call)
+		if err != nil {
+			return err
+		}
 		match, err := tx.MatchFunctionCall(ctx, current.ID, call)
 		if err != nil {
 			return err
@@ -139,6 +181,36 @@ func (o *ExecutionOperations) ConfirmFunctionResult(ctx context.Context, tenant,
 	})
 }
 
+// WithdrawFunctionCall records that the native Harness will never apply a
+// result for the call, which stops being a required action, and journals the
+// Turn's remaining required actions. A repeated withdrawal changes nothing.
+func (o *ExecutionOperations) WithdrawFunctionCall(ctx context.Context, tenant, session, turn string, call FunctionCall) error {
+	if !validFunctionIdentity(call.CallID) || !validFunctionIdentity(call.ExecutorCallID) {
+		return ErrInvalidInput
+	}
+	return o.storage.WithFunctionTurn(ctx, tenant, session, turn, func(ctx context.Context, tx FunctionTx, current Turn) error {
+		call, err := resolveFunctionCall(ctx, tx, call)
+		if err != nil {
+			return err
+		}
+		stored, found, err := tx.LoadFunctionCall(ctx, current.ID, call.CallID)
+		if err != nil {
+			return err
+		}
+		if !found {
+			return ErrNotFound
+		}
+		withdraw, err := decideFunctionWithdrawal(current, stored)
+		if err != nil || !withdraw {
+			return err
+		}
+		if err := tx.WithdrawFunctionCall(ctx, current.ID, call.CallID); err != nil {
+			return err
+		}
+		return settleFunctionState(ctx, tx, current)
+	})
+}
+
 // settleFunctionState moves a Turn that accepts results to waiting while it
 // has required actions and back to in progress once it has none, journals
 // that transition, then journals the Session activity with the required
diff --git a/services/core/internal/sessions/execution_functions_test.go b/services/core/internal/sessions/execution_functions_test.go
index 03cdbb09e..811e9c59b 100644
--- a/services/core/internal/sessions/execution_functions_test.go
+++ b/services/core/internal/sessions/execution_functions_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/items"
 )
 
 // fakeExecutionStorage is strict lease-bound Session storage: a method whose
@@ -180,6 +181,20 @@ func TestRecordFunctionCall(t *testing.T) {
 			assertCalls(t, f.fakeTx, "MatchFunctionCall "+testTurn+" call")
 		}
 	})
+	t.Run("a Subagent call takes the identity of the child's function Item", func(t *testing.T) {
+		call := testCall
+		call.Subagent, call.SubagentTurn = "child", "child-turn"
+		hidden := &fakeFunctionTx{fakeTx: &fakeTx{t: t, loadNativeSubagent: native(NativeSubagent{ID: testSubagent})}}
+		if err := functionOperations(t, hidden, turnWith(TurnInProgress)).RecordFunctionCall(t.Context(), testTenant, testSession, testTurn, call); !errors.Is(err, ErrInvalidInput) {
+			t.Errorf("hidden child: %v", err)
+		}
+		want := items.Identity(items.Identity(testSubagent, "turn:child-turn"), "tool:native-call")
+		f := &fakeFunctionTx{fakeTx: &fakeTx{t: t, loadNativeSubagent: native(NativeSubagent{ID: testSubagent, Visible: true})}, matchFunctionCall: returns(FunctionCallMatch{Recorded: true, Matches: true})}
+		if err := functionOperations(t, f, turnWith(TurnWaiting)).RecordFunctionCall(t.Context(), testTenant, testSession, testTurn, call); err != nil {
+			t.Fatal(err)
+		}
+		assertCalls(t, f.fakeTx, "LoadNativeSubagent child", "MatchFunctionCall "+testTurn+" "+want)
+	})
 	t.Run("an invalid call reaches no storage", func(t *testing.T) {
 		call := testCall
 		call.Name = ""
@@ -270,3 +285,43 @@ func TestPendingFunctionCalls(t *testing.T) {
 		t.Fatal(calls, err)
 	}
 }
+
+func TestWithdrawFunctionCall(t *testing.T) {
+	stored := FunctionCall{CallID: "call"}
+	t.Run("last withdrawal resumes the Turn", func(t *testing.T) {
+		f := &fakeFunctionTx{fakeTx: &fakeTx{t: t, loadUsage: returns(json.RawMessage(`{}`)), appendChanges: func([]SessionChange) error { return nil },
+			applyTurnStatus: func(TurnStatusChange) (Turn, error) { return turnWith(TurnInProgress), nil }},
+			loadFunctionCall: func() (FunctionCall, bool, error) { return stored, true, nil }, withdrawFunctionCall: done,
+			loadPendingFunctionCalls: returns([]FunctionCall{})}
+		if err := functionOperations(t, f, turnWith(TurnWaiting)).WithdrawFunctionCall(t.Context(), testTenant, testSession, testTurn, testCall); err != nil {
+			t.Fatal(err)
+		}
+		assertCalls(t, f.fakeTx, "LoadFunctionCall "+testTurn+" call", "WithdrawFunctionCall "+testTurn+" call", "LoadPendingFunctionCalls "+testTurn,
+			"ApplyTurnStatus "+testTurn+" waiting in_progress {}", "AppendChanges agent.session.turn.in_progress", "LoadUsage", "AppendChanges agent.session.in_progress")
+	})
+	t.Run("repeated withdrawal records nothing", func(t *testing.T) {
+		withdrawn := stored
+		withdrawn.Withdrawn = true
+		f := &fakeFunctionTx{fakeTx: &fakeTx{t: t}, loadFunctionCall: func() (FunctionCall, bool, error) { return withdrawn, true, nil }}
+		if err := functionOperations(t, f, turnWith(TurnInProgress)).WithdrawFunctionCall(t.Context(), testTenant, testSession, testTurn, testCall); err != nil {
+			t.Fatal(err)
+		}
+		assertCalls(t, f.fakeTx, "LoadFunctionCall "+testTurn+" call")
+	})
+	t.Run("an applied call conflicts", func(t *testing.T) {
+		applied := stored
+		applied.Applied = true
+		f := &fakeFunctionTx{fakeTx: &fakeTx{t: t}, loadFunctionCall: func() (FunctionCall, bool, error) { return applied, true, nil }}
+		if err := functionOperations(t, f, turnWith(TurnWaiting)).WithdrawFunctionCall(t.Context(), testTenant, testSession, testTurn, testCall); !errors.Is(err, ErrTurnConflict) {
+			t.Fatal(err)
+		}
+	})
+	t.Run("a malformed Subagent identity is invalid input", func(t *testing.T) {
+		call := testCall
+		call.Subagent, call.SubagentTurn = "child\n", "child-turn"
+		f := &fakeFunctionTx{fakeTx: &fakeTx{t: t}}
+		if err := functionOperations(t, f, turnWith(TurnWaiting)).WithdrawFunctionCall(t.Context(), testTenant, testSession, testTurn, call); !errors.Is(err, ErrInvalidInput) {
+			t.Fatal(err)
+		}
+	})
+}
diff --git a/services/core/internal/sessions/execution_turns.go b/services/core/internal/sessions/execution_turns.go
index a6fbf912c..875297b3a 100644
--- a/services/core/internal/sessions/execution_turns.go
+++ b/services/core/internal/sessions/execution_turns.go
@@ -221,7 +221,7 @@ func (o *ExecutionOperations) CompleteExecution(ctx context.Context, tenant, ses
 	if !TerminalStatus(status) || len(outcome) > maxOutcomeBytes || len(nativeID) > 512 || appliedThrough < 0 {
 		return Turn{}, ErrInvalidInput
 	}
-	outcome, err := jsonobject.Normalize(outcome)
+	outcome, err := journalPayload(outcome)
 	if err != nil {
 		return Turn{}, fmt.Errorf("%w: %w", ErrInvalidInput, err)
 	}
diff --git a/services/core/internal/sessions/functions.go b/services/core/internal/sessions/functions.go
index df4832f21..7a666664b 100644
--- a/services/core/internal/sessions/functions.go
+++ b/services/core/internal/sessions/functions.go
@@ -60,12 +60,15 @@ type FunctionResultMatch struct {
 	Submitted bool
 	// Matches reports that the saved result equals the submitted one.
 	Matches bool
+	// Withdrawn reports that the native Harness abandoned the call.
+	Withdrawn bool
 }
 
 // decideFunctionResult decides whether to store a submitted result for a call
 // the Turn has. An identical retry of a saved result stores nothing, even after
-// the Turn ended; a different result conflicts with the saved one. A new result
-// needs a Turn that accepts results.
+// the Turn ended or the call was withdrawn; a different result conflicts with
+// the saved one. A new result needs a call that was not withdrawn and a Turn
+// that accepts results.
 func decideFunctionResult(turn Turn, match FunctionResultMatch) (bool, error) {
 	if match.Submitted {
 		if !match.Matches {
@@ -73,7 +76,7 @@ func decideFunctionResult(turn Turn, match FunctionResultMatch) (bool, error) {
 		}
 		return false, nil
 	}
-	if !acceptsFunctionResults(turn) {
+	if match.Withdrawn || !acceptsFunctionResults(turn) {
 		return false, ErrTurnConflict
 	}
 	return true, nil
diff --git a/services/core/internal/sessions/functions_test.go b/services/core/internal/sessions/functions_test.go
index 76d661868..c220b5c48 100644
--- a/services/core/internal/sessions/functions_test.go
+++ b/services/core/internal/sessions/functions_test.go
@@ -24,6 +24,7 @@ type fakeFunctionTx struct {
 	createFunctionCall       func() error
 	loadFunctionCall         func() (FunctionCall, bool, error)
 	applyFunctionResult      func() error
+	withdrawFunctionCall     func() error
 }
 
 var (
@@ -76,6 +77,11 @@ func (f *fakeFunctionTx) ApplyFunctionResult(_ context.Context, turn, call strin
 	return f.applyFunctionResult()
 }
 
+func (f *fakeFunctionTx) WithdrawFunctionCall(_ context.Context, turn, call string) error {
+	f.record("WithdrawFunctionCall", f.withdrawFunctionCall != nil, turn, call)
+	return f.withdrawFunctionCall()
+}
+
 func cancelling(status string) Turn {
 	turn := turnWith(status)
 	turn.CancelRequestedAt = time.Unix(1700000001, 0)
@@ -164,13 +170,15 @@ func TestDecideFunctionResult(t *testing.T) {
 		store bool
 		err   error
 	}{
-		"new result":                    {turnWith(TurnWaiting), FunctionResultMatch{Recorded: true}, true, nil},
-		"identical retry":               {turnWith(TurnWaiting), same, false, nil},
-		"identical retry after end":     {turnWith(TurnCompleted), same, false, nil},
-		"different result":              {turnWith(TurnWaiting), saved, false, ErrFunctionResultConflict},
-		"different result after end":    {turnWith(TurnCancelled), saved, false, ErrFunctionResultConflict},
-		"new result while cancelling":   {cancelling(TurnWaiting), FunctionResultMatch{Recorded: true}, false, ErrTurnConflict},
-		"new result after the Turn end": {turnWith(TurnFailed), FunctionResultMatch{Recorded: true}, false, ErrTurnConflict},
+		"new result":                       {turnWith(TurnWaiting), FunctionResultMatch{Recorded: true}, true, nil},
+		"identical retry":                  {turnWith(TurnWaiting), same, false, nil},
+		"identical retry after end":        {turnWith(TurnCompleted), same, false, nil},
+		"different result":                 {turnWith(TurnWaiting), saved, false, ErrFunctionResultConflict},
+		"different result after end":       {turnWith(TurnCancelled), saved, false, ErrFunctionResultConflict},
+		"new result while cancelling":      {cancelling(TurnWaiting), FunctionResultMatch{Recorded: true}, false, ErrTurnConflict},
+		"new result after the Turn end":    {turnWith(TurnFailed), FunctionResultMatch{Recorded: true}, false, ErrTurnConflict},
+		"identical retry after withdrawal": {turnWith(TurnInProgress), FunctionResultMatch{Recorded: true, Submitted: true, Matches: true, Withdrawn: true}, false, nil},
+		"new result after withdrawal":      {turnWith(TurnInProgress), FunctionResultMatch{Recorded: true, Withdrawn: true}, false, ErrTurnConflict},
 	} {
 		store, err := decideFunctionResult(test.turn, test.match)
 		if store != test.store || !errors.Is(err, test.err) || (test.err == nil && err != nil) {
diff --git a/services/core/internal/sessions/inputs.go b/services/core/internal/sessions/inputs.go
index 12d579f6f..7d9c63d86 100644
--- a/services/core/internal/sessions/inputs.go
+++ b/services/core/internal/sessions/inputs.go
@@ -379,7 +379,10 @@ type FunctionCall struct {
 	CallID, ExecutorCallID, Name string
 	Arguments                    json.RawMessage
 	Result                       json.RawMessage
-	Applied                      bool
+	Applied, Withdrawn           bool
+	// Subagent and SubagentTurn are the native child and Turn that made the
+	// call. They are inputs only and are not stored.
+	Subagent, SubagentTurn string
 }
 
 // FunctionResultInput identifies a persisted call; Result is validated by the API.
diff --git a/services/core/internal/sessions/journal.go b/services/core/internal/sessions/journal.go
index e083458c4..43612a80e 100644
--- a/services/core/internal/sessions/journal.go
+++ b/services/core/internal/sessions/journal.go
@@ -1,8 +1,11 @@
 package sessions
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
+	"strings"
 
 	"github.com/google/uuid"
 
@@ -24,7 +27,7 @@ const (
 )
 
 // JournalBatch is a validated batch of execution observations for a Turn's
-// journal, each payload normalized. NewJournalBatch makes one.
+// journal, each payload in its journalPayload form. NewJournalBatch makes one.
 type JournalBatch struct {
 	turn   string
 	first  int32
@@ -46,7 +49,7 @@ func NewJournalBatch(turn string, first int32, events []ExecutionEvent) (Journal
 		if len(event.Payload) > journalPayloadBytes || !ValidEngine(event.Kind) {
 			return JournalBatch{}, ErrInvalidInput
 		}
-		payload, err := jsonobject.Normalize(event.Payload)
+		payload, err := journalPayload(event.Payload)
 		if err != nil {
 			return JournalBatch{}, fmt.Errorf("%w: %w", ErrInvalidInput, err)
 		}
@@ -59,6 +62,43 @@ func NewJournalBatch(turn string, first int32, events []ExecutionEvent) (Journal
 	return batch, nil
 }
 
+// journalPayload normalizes an execution observation's payload into the form
+// the journal stores. Observed text is the Harness's own output, such as a
+// command's, so U+0000, which jsonb cannot store, becomes U+FFFD in every
+// string, as decoding already does for invalid UTF-8, instead of failing the
+// Turn.
+func journalPayload(raw json.RawMessage) (json.RawMessage, error) {
+	payload, err := jsonobject.Normalize(raw)
+	if err != nil || !bytes.Contains(payload, []byte(`\u0000`)) {
+		return payload, err
+	}
+	decoder := json.NewDecoder(bytes.NewReader(payload))
+	decoder.UseNumber()
+	var value any
+	if err := decoder.Decode(&value); err != nil {
+		return nil, err
+	}
+	return json.Marshal(withoutNUL(value))
+}
+
+func withoutNUL(value any) any {
+	switch v := value.(type) {
+	case string:
+		return strings.ReplaceAll(v, "\x00", "\uFFFD")
+	case []any:
+		for i, item := range v {
+			v[i] = withoutNUL(item)
+		}
+	case map[string]any:
+		replaced := make(map[string]any, len(v))
+		for key, item := range v {
+			replaced[strings.ReplaceAll(key, "\x00", "\uFFFD")] = withoutNUL(item)
+		}
+		return replaced
+	}
+	return value
+}
+
 // validID reports whether value can name a stored resource: a nonzero UUID.
 func validID(value string) bool {
 	id, err := uuid.Parse(value)
diff --git a/services/core/internal/sessions/session.go b/services/core/internal/sessions/session.go
index 534ac908d..dddf2e0c0 100644
--- a/services/core/internal/sessions/session.go
+++ b/services/core/internal/sessions/session.go
@@ -42,7 +42,7 @@ type Session struct {
 }
 
 type CreateSession struct {
-	// SupportsRetainedNativeHistory is trusted admission input from the immutable engine profile.
+	// SupportsRetainedNativeHistory is trusted admission input from the Harness declaration.
 	// It is not persisted and never contributes to the caller's retry identity.
 	SupportsRetainedNativeHistory bool `json:"-"`
 	// DeploymentProviderRevision is private creation metadata, never retry identity.
diff --git a/services/core/internal/sessions/subagents.go b/services/core/internal/sessions/subagents.go
index 14327ff31..458263d9e 100644
--- a/services/core/internal/sessions/subagents.go
+++ b/services/core/internal/sessions/subagents.go
@@ -92,14 +92,19 @@ type ChildItem struct {
 	Output             bool
 }
 
+// NativeSubagents reads the Session's native Subagents.
+type NativeSubagents interface {
+	// LoadNativeSubagent reads the Session's native Subagent and reports whether
+	// the Session has it.
+	LoadNativeSubagent(ctx context.Context, native string) (NativeSubagent, bool, error)
+}
+
 // SubagentProjectionTx loads and applies what projecting Subagent observations
 // reads and writes.
 type SubagentProjectionTx interface {
+	NativeSubagents
 	// LoadRootAgent reads the Session's Agent ID.
 	LoadRootAgent(ctx context.Context) (string, error)
-	// LoadNativeSubagent reads the Session's native Subagent and reports whether
-	// the Session has it.
-	LoadNativeSubagent(ctx context.Context, native string) (NativeSubagent, bool, error)
 	// PutSubagentIdentity binds a native Subagent to the Session, or finds the
 	// same binding, and returns its ID. A different binding of the native ID,
 	// or a parent the Session does not know, is ErrIdempotencyConflict.
@@ -138,7 +143,7 @@ func validNativeIdentity(value string) bool {
 
 // visibleSubagent reads the public native Subagent an observation names; one
 // the Session does not have or has not published is ErrInvalidInput.
-func visibleSubagent(ctx context.Context, tx SubagentProjectionTx, native string) (NativeSubagent, error) {
+func visibleSubagent(ctx context.Context, tx NativeSubagents, native string) (NativeSubagent, error) {
 	child, found, err := tx.LoadNativeSubagent(ctx, native)
 	if err != nil {
 		return NativeSubagent{}, err
diff --git a/services/core/internal/sessions/turn.go b/services/core/internal/sessions/turn.go
index f6a4574c5..9e902048a 100644
--- a/services/core/internal/sessions/turn.go
+++ b/services/core/internal/sessions/turn.go
@@ -108,8 +108,7 @@ type TurnReader interface {
 	// cursor Turn is ErrNotFound.
 	ListTurns(ctx context.Context, tenant, session, cursor string, limit int, ascending bool) (TurnPage, error)
 	// ListExecutionWork lists, in ID order after the Turn after names, up to
-	// 100 root Turns in statuses across tenants; the queued Turns of a publicly
-	// deleted Session are not work. With connectedDevices not nil, it lists
-	// only the Turns of tenants that own one of those devices, unrevoked.
+	// 100 root Turns in statuses across tenants. With connectedDevices not nil, it
+	// lists only the Turns of tenants that own one of those devices, unrevoked.
 	ListExecutionWork(ctx context.Context, after string, statuses, connectedDevices []string) ([]ExecutionWork, error)
 }
diff --git a/services/core/migrations/000001_baseline.sql b/services/core/migrations/000001_baseline.sql
new file mode 100644
index 000000000..c23491663
--- /dev/null
+++ b/services/core/migrations/000001_baseline.sql
@@ -0,0 +1,1344 @@
+-- +goose Up
+-- +goose StatementBegin
+CREATE FUNCTION immutable_runtime_deployment_generation() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    IF NEW.deployment_generation IS DISTINCT FROM OLD.deployment_generation THEN
+        RAISE EXCEPTION 'Sandbox ownership generation is immutable';
+    END IF;
+    RETURN NEW;
+END $$;
+-- +goose StatementEnd
+
+-- +goose StatementBegin
+CREATE FUNCTION immutable_sandbox_specification() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    RAISE EXCEPTION 'Retained sandbox specifications are immutable';
+END $$;
+-- +goose StatementEnd
+
+-- +goose StatementBegin
+CREATE FUNCTION immutable_workspace_configuration() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    IF (NEW.id, NEW.adapter, NEW.parameters, NEW.credential) IS DISTINCT FROM (OLD.id, OLD.adapter, OLD.parameters, OLD.credential) THEN
+        RAISE EXCEPTION 'Workspace filesystem configuration is immutable';
+    END IF;
+    RETURN NEW;
+END $$;
+-- +goose StatementEnd
+
+-- +goose StatementBegin
+CREATE FUNCTION immutable_workspace_identity() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    IF (NEW.object_id, NEW.environment_id, NEW.configuration_id, NEW.capacity_mib) IS DISTINCT FROM (OLD.object_id, OLD.environment_id, OLD.configuration_id, OLD.capacity_mib) THEN
+        RAISE EXCEPTION 'Environment workspace identity is immutable';
+    END IF;
+    RETURN NEW;
+END $$;
+-- +goose StatementEnd
+
+CREATE TABLE admin_audit_log (
+    id uuid NOT NULL,
+    tenant_id uuid,
+    project_id uuid,
+    admin_credential_id text NOT NULL,
+    actor_label text NOT NULL,
+    action text NOT NULL,
+    resource_type text NOT NULL,
+    resource_id text NOT NULL,
+    request_id text NOT NULL,
+    trace_id text NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    CONSTRAINT admin_audit_log_scope_check CHECK (((tenant_id IS NULL) = (project_id IS NULL)))
+);
+
+CREATE TABLE agent_model_execution (
+    agent_id uuid NOT NULL,
+    encrypted_config bytea NOT NULL
+);
+
+CREATE TABLE agents (
+    id uuid NOT NULL,
+    tenant_id uuid NOT NULL,
+    metadata jsonb NOT NULL,
+    configuration jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT statement_timestamp() NOT NULL,
+    updated_at timestamp with time zone DEFAULT statement_timestamp() NOT NULL,
+    CONSTRAINT agents_configuration_check CHECK ((jsonb_typeof(configuration) = 'object'::text)),
+    CONSTRAINT agents_metadata_check CHECK ((jsonb_typeof(metadata) = 'object'::text))
+);
+
+CREATE TABLE deployment_model_providers (
+    harness text NOT NULL,
+    protocol text NOT NULL,
+    base_url text NOT NULL,
+    context_window integer DEFAULT 0 NOT NULL,
+    max_output_tokens integer DEFAULT 0 NOT NULL,
+    encrypted_config bytea NOT NULL,
+    updated_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    revision uuid DEFAULT gen_random_uuid() NOT NULL,
+    last_used_at timestamp with time zone,
+    last_error_code text,
+    last_error_at timestamp with time zone,
+    recovery_pending boolean DEFAULT false NOT NULL,
+    model text DEFAULT ''::text NOT NULL,
+    harness_config jsonb DEFAULT '{}'::jsonb NOT NULL,
+    CONSTRAINT deployment_model_providers_context_window_check CHECK ((context_window >= 0)),
+    CONSTRAINT deployment_model_providers_max_output_tokens_check CHECK ((max_output_tokens >= 0)),
+    CONSTRAINT deployment_provider_error_code CHECK ((last_error_code = ANY (ARRAY['authentication_error'::text, 'connection_failed'::text, 'rate_limit_exceeded'::text, 'usage_limit_exceeded'::text, 'server_overloaded'::text, 'server_error'::text, 'resource_not_found'::text, 'request_timeout'::text, 'invalid_request'::text]))),
+    CONSTRAINT deployment_provider_error_pair CHECK (((last_error_code IS NULL) = (last_error_at IS NULL))),
+    CONSTRAINT deployment_provider_recovery CHECK (((NOT recovery_pending) OR (last_error_at IS NOT NULL)))
+);
+
+CREATE TABLE devices (
+    id uuid NOT NULL,
+    tenant_id uuid NOT NULL,
+    name text NOT NULL,
+    credential_hash text,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    last_seen_at timestamp with time zone,
+    revoked_at timestamp with time zone,
+    environment_id uuid,
+    executor_key_id uuid,
+    archive_cancel_turn_id uuid,
+    supported_agent_kinds jsonb DEFAULT '[]'::jsonb NOT NULL,
+    CONSTRAINT device_credential_source CHECK ((((executor_key_id IS NULL) AND (credential_hash IS NOT NULL)) OR ((executor_key_id IS NOT NULL) AND (credential_hash IS NULL) AND (environment_id IS NOT NULL)))),
+    CONSTRAINT devices_credential_hash_check CHECK ((credential_hash ~ '^[0-9a-f]{64}$'::text)),
+    CONSTRAINT devices_supported_agent_kinds_check CHECK ((jsonb_typeof(supported_agent_kinds) = 'array'::text))
+);
+
+CREATE TABLE environment_connections (
+    environment_id uuid NOT NULL,
+    generation uuid NOT NULL,
+    revision bigint DEFAULT 0 NOT NULL,
+    CONSTRAINT environment_connections_revision_check CHECK ((revision >= 0))
+);
+
+CREATE TABLE environment_executor_credentials (
+    environment_id uuid,
+    token_sha256 text NOT NULL,
+    issued_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    revoked_at timestamp with time zone,
+    key_id uuid NOT NULL,
+    tenant_id uuid,
+    subject_kind text,
+    subject_id text,
+    created_at timestamp with time zone,
+    CONSTRAINT environment_executor_credentials_token_sha256_check CHECK ((token_sha256 ~ '^[0-9a-f]{64}$'::text)),
+    CONSTRAINT executor_principal_complete CHECK ((((tenant_id IS NULL) AND (subject_kind IS NULL) AND (subject_id IS NULL) AND (environment_id IS NOT NULL) AND (revoked_at IS NOT NULL) AND (created_at IS NULL)) OR ((tenant_id IS NOT NULL) AND (subject_kind IS NOT NULL) AND (subject_id IS NOT NULL) AND (subject_kind = ANY (ARRAY['user'::text, 'service_account'::text])) AND (subject_id <> ''::text) AND (created_at IS NOT NULL))))
+);
+
+CREATE TABLE environment_file_writes (
+    id uuid NOT NULL,
+    environment_id uuid NOT NULL,
+    device_id uuid NOT NULL,
+    request_sha256 text NOT NULL,
+    state text DEFAULT 'pending'::text NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    settled_at timestamp with time zone,
+    audit_source jsonb,
+    CONSTRAINT environment_file_write_audit_source_object CHECK (((audit_source IS NULL) OR (jsonb_typeof(audit_source) = 'object'::text))),
+    CONSTRAINT environment_file_writes_check CHECK (((state = 'pending'::text) = (settled_at IS NULL))),
+    CONSTRAINT environment_file_writes_request_sha256_check CHECK ((request_sha256 ~ '^[0-9a-f]{64}$'::text)),
+    CONSTRAINT environment_file_writes_state_check CHECK ((state = ANY (ARRAY['pending'::text, 'committed'::text, 'rejected'::text])))
+);
+
+CREATE TABLE environment_input_reservations (
+    id uuid NOT NULL,
+    session_id uuid NOT NULL,
+    idempotency_key text NOT NULL,
+    batch jsonb NOT NULL,
+    state text DEFAULT 'pending'::text NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    deadline timestamp with time zone NOT NULL,
+    settled_at timestamp with time zone,
+    is_initial boolean DEFAULT false NOT NULL,
+    failure_code text,
+    CONSTRAINT environment_input_reservations_batch_check CHECK (
+CASE
+    WHEN (jsonb_typeof(batch) = 'array'::text) THEN ((jsonb_array_length(batch) >= 1) AND (jsonb_array_length(batch) <= 64))
+    ELSE false
+END),
+    CONSTRAINT environment_input_reservations_check CHECK (((settled_at IS NOT NULL) = (state <> 'pending'::text))),
+    CONSTRAINT environment_input_reservations_check1 CHECK (((failure_code IS NULL) OR ((state = 'failed'::text) AND (failure_code = ANY (ARRAY['model_provider_required'::text, 'runtime_preparation_failed'::text]))))),
+    CONSTRAINT environment_input_reservations_state_check CHECK ((state = ANY (ARRAY['pending'::text, 'admitted'::text, 'expired'::text, 'cancelled'::text, 'failed'::text])))
+);
+
+CREATE TABLE environment_setups (
+    session_id uuid NOT NULL,
+    contents bytea NOT NULL
+);
+
+CREATE TABLE environment_templates (
+    id uuid NOT NULL,
+    tenant_id uuid NOT NULL,
+    name text,
+    network_access text NOT NULL,
+    created_at timestamp with time zone DEFAULT statement_timestamp() NOT NULL,
+    updated_at timestamp with time zone DEFAULT statement_timestamp() NOT NULL,
+    files jsonb DEFAULT '[]'::jsonb NOT NULL,
+    file_contents bytea,
+    packages jsonb DEFAULT '{"npm": [], "python": [], "system": []}'::jsonb NOT NULL,
+    env_contents bytea,
+    setup_contents bytea,
+    skills jsonb DEFAULT '[]'::jsonb NOT NULL,
+    skill_contents bytea,
+    network_allowed_domains text[] DEFAULT '{}'::text[] NOT NULL,
+    plugins jsonb DEFAULT '[]'::jsonb NOT NULL,
+    plugin_contents bytea,
+    capability_directories text[] DEFAULT '{}'::text[] NOT NULL,
+    CONSTRAINT environment_templates_files_check CHECK ((jsonb_typeof(files) = 'array'::text)),
+    CONSTRAINT environment_templates_name_check CHECK (((name IS NULL) OR ((char_length(name) >= 1) AND (char_length(name) <= 256)))),
+    CONSTRAINT environment_templates_network_access_check CHECK ((network_access = ANY (ARRAY['enabled'::text, 'disabled'::text, 'restricted'::text]))),
+    CONSTRAINT environment_templates_network_domains_check CHECK ((((network_access = 'restricted'::text) AND ((cardinality(network_allowed_domains) >= 1) AND (cardinality(network_allowed_domains) <= 100))) OR ((network_access = ANY (ARRAY['enabled'::text, 'disabled'::text])) AND (cardinality(network_allowed_domains) = 0)))),
+    CONSTRAINT environment_templates_packages_check CHECK ((jsonb_typeof(packages) = 'object'::text))
+);
+
+CREATE TABLE environment_workspaces (
+    object_id uuid NOT NULL,
+    environment_id uuid NOT NULL,
+    configuration_id uuid NOT NULL,
+    state text DEFAULT 'creating'::text NOT NULL,
+    attachment jsonb,
+    capacity_mib bigint DEFAULT 0 NOT NULL,
+    CONSTRAINT environment_workspaces_attachment_check CHECK (((attachment IS NULL) OR (jsonb_typeof(attachment) = 'object'::text))),
+    CONSTRAINT environment_workspaces_capacity_mib_check CHECK (((capacity_mib >= 0) AND (capacity_mib <= '4294967295'::bigint))),
+    CONSTRAINT environment_workspaces_check CHECK (((state <> 'ready'::text) OR (attachment IS NOT NULL))),
+    CONSTRAINT environment_workspaces_state_check CHECK ((state = ANY (ARRAY['creating'::text, 'ready'::text, 'deleting'::text, 'deleted'::text])))
+);
+
+CREATE TABLE environments (
+    id uuid NOT NULL,
+    session_id uuid NOT NULL,
+    status text DEFAULT 'pending'::text NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    failure_reason text,
+    failed_at timestamp with time zone,
+    failure_detail jsonb,
+    initialization text DEFAULT 'complete'::text NOT NULL,
+    CONSTRAINT environment_failure_recorded CHECK ((((failure_reason IS NULL) = (failed_at IS NULL)) AND ((failed_at IS NULL) OR (status = 'failed'::text)) AND (char_length(failure_reason) <= 256))),
+    CONSTRAINT environments_failure_detail_check CHECK (((failure_detail IS NULL) OR (jsonb_typeof(failure_detail) = 'object'::text))),
+    CONSTRAINT environments_initialization_check CHECK ((initialization = ANY (ARRAY['pending'::text, 'running'::text, 'complete'::text, 'failed'::text]))),
+    CONSTRAINT environments_status_check CHECK ((status = ANY (ARRAY['pending'::text, 'connected'::text, 'disconnected'::text, 'expired'::text, 'failed'::text])))
+);
+
+CREATE TABLE execution_project_scopes (
+    tenant_id uuid NOT NULL,
+    organization_id text NOT NULL,
+    project_id text NOT NULL,
+    CONSTRAINT execution_project_scopes_organization_id_check CHECK ((organization_id <> ''::text)),
+    CONSTRAINT execution_project_scopes_project_id_check CHECK ((project_id <> ''::text)),
+    CONSTRAINT execution_project_scopes_tenant_id_check CHECK ((tenant_id <> '00000000-0000-0000-0000-000000000000'::uuid))
+);
+
+CREATE TABLE function_calls (
+    session_id uuid NOT NULL,
+    turn_id uuid NOT NULL,
+    call_id text NOT NULL,
+    executor_call_id text NOT NULL,
+    name text NOT NULL,
+    arguments jsonb NOT NULL,
+    result jsonb,
+    applied boolean DEFAULT false NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    withdrawn boolean DEFAULT false NOT NULL,
+    CONSTRAINT function_calls_check CHECK (((NOT applied) OR (result IS NOT NULL))),
+    CONSTRAINT function_calls_not_applied_and_withdrawn CHECK ((NOT (applied AND withdrawn))),
+    CONSTRAINT function_calls_result_check CHECK (((result IS NULL) OR (jsonb_typeof(result) = 'object'::text)))
+);
+
+CREATE TABLE initial_environment_files (
+    id uuid NOT NULL,
+    session_id uuid NOT NULL,
+    "position" integer NOT NULL,
+    path text NOT NULL,
+    size_bytes bigint NOT NULL,
+    contents bytea NOT NULL,
+    CONSTRAINT initial_environment_files_position_check CHECK ((("position" >= 0) AND ("position" <= 49))),
+    CONSTRAINT initial_environment_files_size_bytes_check CHECK (((size_bytes >= 0) AND (size_bytes <= 52428800)))
+);
+
+CREATE TABLE node_host_history_samples (
+    node_id uuid NOT NULL,
+    observed_at timestamp with time zone NOT NULL,
+    cpu_utilization double precision,
+    memory_used_bytes bigint,
+    available_disk_bytes bigint,
+    CONSTRAINT node_host_history_samples_available_disk_bytes_check CHECK ((available_disk_bytes >= 0)),
+    CONSTRAINT node_host_history_samples_cpu_utilization_check CHECK (((cpu_utilization >= (0)::double precision) AND (cpu_utilization <= (1)::double precision))),
+    CONSTRAINT node_host_history_samples_memory_used_bytes_check CHECK ((memory_used_bytes >= 0))
+);
+
+CREATE TABLE project_api_keys (
+    id uuid NOT NULL,
+    name text NOT NULL,
+    prefix text NOT NULL,
+    token_sha256 text NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    revoked_at timestamp with time zone,
+    project_id uuid NOT NULL,
+    CONSTRAINT project_api_keys_name_check CHECK (((char_length(name) >= 1) AND (char_length(name) <= 80))),
+    CONSTRAINT project_api_keys_token_sha256_check CHECK ((token_sha256 ~ '^[0-9a-f]{64}$'::text))
+);
+
+CREATE TABLE projects (
+    id uuid NOT NULL,
+    name text NOT NULL,
+    tenant_id uuid NOT NULL,
+    subject_kind text NOT NULL,
+    subject_id text NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    archived_at timestamp with time zone,
+    CONSTRAINT projects_name_check CHECK (((char_length(name) >= 1) AND (char_length(name) <= 128))),
+    CONSTRAINT projects_subject_kind_check CHECK ((subject_kind = 'service_account'::text))
+);
+
+CREATE TABLE subagent_turns (
+    id uuid NOT NULL,
+    session_id uuid NOT NULL,
+    subagent_id uuid NOT NULL,
+    native_id text NOT NULL,
+    status text NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    started_at timestamp with time zone,
+    completed_at timestamp with time zone,
+    token_usage jsonb,
+    CONSTRAINT subagent_turns_check CHECK (((completed_at IS NOT NULL) = (status = ANY (ARRAY['completed'::text, 'failed'::text, 'cancelled'::text])))),
+    CONSTRAINT subagent_turns_native_id_check CHECK ((native_id <> ''::text)),
+    CONSTRAINT subagent_turns_status_check CHECK ((status = ANY (ARRAY['queued'::text, 'in_progress'::text, 'waiting'::text, 'completed'::text, 'failed'::text, 'cancelled'::text])))
+);
+
+CREATE TABLE turns (
+    id uuid NOT NULL,
+    session_id uuid NOT NULL,
+    status text DEFAULT 'queued'::text NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    started_at timestamp with time zone,
+    completed_at timestamp with time zone,
+    cancel_requested_at timestamp with time zone,
+    outcome jsonb DEFAULT '{}'::jsonb NOT NULL,
+    event_count integer DEFAULT 0 NOT NULL,
+    event_bytes bigint DEFAULT 0 NOT NULL,
+    token_usage jsonb,
+    artifact_capture_started boolean DEFAULT false NOT NULL,
+    CONSTRAINT turns_check CHECK (((completed_at IS NOT NULL) = (status = ANY (ARRAY['completed'::text, 'failed'::text, 'cancelled'::text])))),
+    CONSTRAINT turns_outcome_check CHECK ((jsonb_typeof(outcome) = 'object'::text)),
+    CONSTRAINT turns_status_check CHECK ((status = ANY (ARRAY['queued'::text, 'in_progress'::text, 'waiting'::text, 'completed'::text, 'failed'::text, 'cancelled'::text])))
+);
+
+CREATE VIEW public_execution_turns AS
+ SELECT turns.id,
+    turns.session_id,
+    turns.status,
+    turns.created_at,
+    turns.started_at,
+    turns.completed_at,
+    turns.cancel_requested_at,
+    turns.outcome,
+    turns.token_usage,
+    turns.artifact_capture_started,
+    NULL::uuid AS subagent_id
+   FROM turns
+UNION ALL
+ SELECT subagent_turns.id,
+    subagent_turns.session_id,
+    subagent_turns.status,
+    subagent_turns.created_at,
+    subagent_turns.started_at,
+    subagent_turns.completed_at,
+    NULL::timestamp with time zone AS cancel_requested_at,
+    '{}'::jsonb AS outcome,
+    subagent_turns.token_usage,
+    false AS artifact_capture_started,
+    subagent_turns.subagent_id
+   FROM subagent_turns;
+
+CREATE TABLE runtime_allocations (
+    id uuid NOT NULL,
+    environment_id uuid NOT NULL,
+    device_id uuid NOT NULL,
+    provider_key uuid NOT NULL,
+    state text DEFAULT 'creating'::text NOT NULL,
+    create_settled boolean DEFAULT false NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    released_at timestamp with time zone,
+    compute_phase text DEFAULT 'disabled'::text NOT NULL,
+    compute_revision bigint DEFAULT 0 NOT NULL,
+    compute_state jsonb DEFAULT '{}'::jsonb NOT NULL,
+    compute_activity_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    compute_wake_requested boolean DEFAULT false NOT NULL,
+    compute_retained_until timestamp with time zone,
+    node_id uuid,
+    observation_error text DEFAULT ''::text NOT NULL,
+    compute_phase_changed_at timestamp with time zone DEFAULT clock_timestamp(),
+    deployment_generation bigint,
+    CONSTRAINT runtime_allocations_check CHECK (((state = 'released'::text) = (released_at IS NOT NULL))),
+    CONSTRAINT runtime_allocations_check1 CHECK (((state <> 'released'::text) OR create_settled)),
+    CONSTRAINT runtime_allocations_check2 CHECK (((state = 'released'::text) OR (deployment_generation IS NOT NULL))),
+    CONSTRAINT runtime_allocations_compute_phase_check CHECK ((compute_phase = ANY (ARRAY['disabled'::text, 'running'::text, 'quiescing'::text, 'suspending'::text, 'suspended'::text, 'restoring'::text, 'waking'::text]))),
+    CONSTRAINT runtime_allocations_compute_revision_check CHECK ((compute_revision >= 0)),
+    CONSTRAINT runtime_allocations_compute_state_check CHECK ((jsonb_typeof(compute_state) = 'object'::text)),
+    CONSTRAINT runtime_allocations_deployment_generation_check CHECK ((deployment_generation >= 0)),
+    CONSTRAINT runtime_allocations_observation_error_check CHECK ((observation_error = ANY (ARRAY[''::text, 'node_unavailable'::text, 'resource_missing'::text, 'compute_unconfirmed'::text, 'ownership_mismatch'::text, 'provider_unavailable'::text]))),
+    CONSTRAINT runtime_allocations_state_check CHECK ((state = ANY (ARRAY['creating'::text, 'running'::text, 'cleanup_pending'::text, 'released'::text])))
+);
+
+CREATE TABLE runtime_deployment (
+    singleton boolean DEFAULT true NOT NULL,
+    installation_id uuid,
+    backend_fingerprint text DEFAULT ''::text NOT NULL,
+    updated_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    provider_kind text DEFAULT ''::text NOT NULL,
+    owner_epoch bigint DEFAULT 0 NOT NULL,
+    generation bigint DEFAULT 0 NOT NULL,
+    mode text DEFAULT ''::text NOT NULL,
+    provider_credential bytea,
+    specification jsonb DEFAULT '{}'::jsonb NOT NULL,
+    reset_clear text,
+    reset_requested_at timestamp with time zone,
+    reset_deadline_at timestamp with time zone,
+    reset_forced_at timestamp with time zone,
+    reset_audit jsonb,
+    provider_config jsonb DEFAULT '{}'::jsonb NOT NULL,
+    provider_metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    idle_seconds bigint DEFAULT 300 NOT NULL,
+    CONSTRAINT runtime_deployment_generation_check CHECK ((generation >= 0)),
+    CONSTRAINT runtime_deployment_identity_check CHECK ((((installation_id IS NULL) AND (backend_fingerprint = ''::text)) OR ((installation_id IS NOT NULL) AND (backend_fingerprint ~ '^[0-9a-f]{64}$'::text)) OR ((installation_id IS NOT NULL) AND (provider_kind = ''::text) AND (backend_fingerprint = ''::text)))),
+    CONSTRAINT runtime_deployment_idle_seconds_check CHECK (((idle_seconds >= 30) AND (idle_seconds <= 86400))),
+    CONSTRAINT runtime_deployment_mode_check CHECK ((mode = ANY (ARRAY[''::text, 'nodes'::text, 'direct'::text]))),
+    CONSTRAINT runtime_deployment_owner_epoch_check CHECK ((owner_epoch >= 0)),
+    CONSTRAINT runtime_deployment_provider_config_check CHECK ((jsonb_typeof(provider_config) = 'object'::text)),
+    CONSTRAINT runtime_deployment_provider_kind_check CHECK (((provider_kind = ''::text) OR (provider_kind ~ '^[a-z][a-z0-9_-]{0,63}$'::text))),
+    CONSTRAINT runtime_deployment_provider_metadata_check CHECK ((jsonb_typeof(provider_metadata) = 'object'::text)),
+    CONSTRAINT runtime_deployment_reset_check CHECK ((((reset_clear IS NULL) AND (reset_requested_at IS NULL) AND (reset_deadline_at IS NULL) AND (reset_forced_at IS NULL) AND (reset_audit IS NULL)) OR ((reset_clear IS NOT NULL) AND (installation_id IS NOT NULL) AND (provider_kind <> ''::text) AND (reset_requested_at IS NOT NULL) AND (reset_audit IS NOT NULL) AND (jsonb_typeof(reset_audit) = 'object'::text) AND (((reset_clear = 'auto'::text) AND (reset_deadline_at IS NOT NULL) AND (reset_forced_at IS NULL)) OR ((reset_clear = 'force'::text) AND (reset_forced_at IS NOT NULL)))))),
+    CONSTRAINT runtime_deployment_setup_check CHECK (((installation_id IS NULL) OR ((provider_kind = ''::text) AND (mode = ''::text) AND (generation >= 0)) OR ((provider_kind <> ''::text) AND (mode = ANY (ARRAY['nodes'::text, 'direct'::text])) AND (generation > 0)))),
+    CONSTRAINT runtime_deployment_singleton_check CHECK (singleton)
+);
+
+CREATE TABLE runtime_deployment_generations (
+    generation bigint NOT NULL,
+    provider_kind text NOT NULL,
+    specification jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    provider_config jsonb DEFAULT '{}'::jsonb NOT NULL,
+    provider_metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    CONSTRAINT runtime_deployment_generations_generation_check CHECK ((generation >= 0)),
+    CONSTRAINT runtime_deployment_generations_provider_config_check CHECK ((jsonb_typeof(provider_config) = 'object'::text)),
+    CONSTRAINT runtime_deployment_generations_provider_kind_check CHECK ((provider_kind ~ '^[a-z][a-z0-9_-]{0,63}$'::text)),
+    CONSTRAINT runtime_deployment_generations_provider_metadata_check CHECK ((jsonb_typeof(provider_metadata) = 'object'::text))
+);
+
+CREATE TABLE sessions (
+    id uuid NOT NULL,
+    tenant_id uuid NOT NULL,
+    engine text NOT NULL,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    idempotency_key text NOT NULL,
+    request_hash text NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    configuration jsonb DEFAULT '{}'::jsonb NOT NULL,
+    event_sequence bigint DEFAULT 0 NOT NULL,
+    creation_request_hash text,
+    deleted_at timestamp with time zone,
+    creator_kind text,
+    creator_id text,
+    CONSTRAINT sessions_configuration_check CHECK ((jsonb_typeof(configuration) = 'object'::text)),
+    CONSTRAINT sessions_creation_request_hash_check CHECK ((creation_request_hash ~ '^[0-9a-f]{64}$'::text)),
+    CONSTRAINT sessions_creator_complete CHECK ((((creator_kind IS NULL) AND (creator_id IS NULL)) OR ((creator_kind IS NOT NULL) AND (creator_id IS NOT NULL) AND (creator_kind = ANY (ARRAY['user'::text, 'service_account'::text])) AND (creator_id <> ''::text)))),
+    CONSTRAINT sessions_metadata_check CHECK ((jsonb_typeof(metadata) = 'object'::text))
+);
+
+CREATE VIEW runtime_device_authority AS
+ SELECT d.id,
+    d.tenant_id,
+    d.name,
+    d.environment_id,
+    COALESCE(c.token_sha256, d.credential_hash) AS credential_hash
+   FROM (((devices d
+     LEFT JOIN environments e ON ((e.id = d.environment_id)))
+     LEFT JOIN sessions s ON (((s.id = e.session_id) AND (s.tenant_id = d.tenant_id))))
+     LEFT JOIN environment_executor_credentials c ON ((c.key_id = d.executor_key_id)))
+  WHERE ((d.revoked_at IS NULL) AND ((d.environment_id IS NULL) OR ((s.id IS NOT NULL) AND (s.deleted_at IS NULL))) AND ((d.executor_key_id IS NULL) OR ((c.revoked_at IS NULL) AND (c.tenant_id = s.tenant_id) AND (c.subject_kind = s.creator_kind) AND (c.subject_id = s.creator_id) AND ((c.environment_id IS NULL) OR (c.environment_id = e.id)) AND (((s.configuration -> 'environment'::text) ->> 'type'::text) = 'self_hosted'::text) AND (e.status <> ALL (ARRAY['failed'::text, 'expired'::text])) AND (EXISTS ( SELECT 1
+           FROM execution_project_scopes p
+          WHERE (p.tenant_id = c.tenant_id))))));
+
+CREATE TABLE runtime_history_samples (
+    tenant_id uuid NOT NULL,
+    session_id uuid NOT NULL,
+    environment_id uuid NOT NULL,
+    resolved_at_ns bigint NOT NULL,
+    allocation_id uuid,
+    provider_type text NOT NULL,
+    status text NOT NULL,
+    observed_at_ns bigint,
+    started_at_ns bigint,
+    cpu_usage_seconds double precision,
+    cpu_capacity_cores double precision,
+    memory_usage_bytes bigint,
+    memory_limit_bytes bigint,
+    input_tokens bigint,
+    output_tokens bigint,
+    cpu_utilization_ratio double precision,
+    CONSTRAINT runtime_history_samples_check CHECK (((input_tokens IS NULL) = (output_tokens IS NULL))),
+    CONSTRAINT runtime_history_samples_check1 CHECK (((observed_at_ns >= 0) AND (observed_at_ns <= resolved_at_ns))),
+    CONSTRAINT runtime_history_samples_check2 CHECK (((started_at_ns >= 0) AND (started_at_ns <= observed_at_ns))),
+    CONSTRAINT runtime_history_samples_check3 CHECK (((status = 'observed'::text) = (observed_at_ns IS NOT NULL))),
+    CONSTRAINT runtime_history_samples_check4 CHECK (((started_at_ns IS NULL) OR (observed_at_ns IS NOT NULL))),
+    CONSTRAINT runtime_history_samples_check5 CHECK (((started_at_ns IS NOT NULL) OR ((cpu_usage_seconds IS NULL) AND (cpu_capacity_cores IS NULL) AND (memory_usage_bytes IS NULL) AND (memory_limit_bytes IS NULL)))),
+    CONSTRAINT runtime_history_samples_cpu_capacity_cores_check CHECK (((cpu_capacity_cores > (0)::double precision) AND (cpu_capacity_cores < 'Infinity'::double precision))),
+    CONSTRAINT runtime_history_samples_cpu_usage_seconds_check CHECK (((cpu_usage_seconds >= (0)::double precision) AND (cpu_usage_seconds < 'Infinity'::double precision))),
+    CONSTRAINT runtime_history_samples_cpu_utilization_incarnation CHECK (((started_at_ns IS NOT NULL) OR (cpu_utilization_ratio IS NULL))),
+    CONSTRAINT runtime_history_samples_cpu_utilization_ratio_check CHECK (((cpu_utilization_ratio >= (0)::double precision) AND (cpu_utilization_ratio < 'Infinity'::double precision))),
+    CONSTRAINT runtime_history_samples_input_tokens_check CHECK (((input_tokens >= 0) AND (input_tokens <= '9007199254740991'::bigint))),
+    CONSTRAINT runtime_history_samples_memory_limit_bytes_check CHECK (((memory_limit_bytes > 0) AND (memory_limit_bytes <= '9007199254740991'::bigint))),
+    CONSTRAINT runtime_history_samples_memory_usage_bytes_check CHECK (((memory_usage_bytes >= 0) AND (memory_usage_bytes <= '9007199254740991'::bigint))),
+    CONSTRAINT runtime_history_samples_output_tokens_check CHECK (((output_tokens >= 0) AND (output_tokens <= '9007199254740991'::bigint))),
+    CONSTRAINT runtime_history_samples_resolved_at_ns_check CHECK ((resolved_at_ns >= 0)),
+    CONSTRAINT runtime_history_samples_status_check CHECK ((status = ANY (ARRAY['observed'::text, 'unavailable'::text, 'unsupported'::text])))
+);
+
+CREATE TABLE runtime_node_enrollments (
+    token_sha256 text NOT NULL,
+    installation_id uuid NOT NULL,
+    expires_at timestamp with time zone NOT NULL,
+    consumed_at timestamp with time zone,
+    node_id uuid,
+    max_active integer DEFAULT 2 NOT NULL,
+    max_retained integer DEFAULT 8 NOT NULL,
+    id uuid,
+    CONSTRAINT runtime_enrollment_capacity CHECK (((max_active >= 1) AND (max_retained >= max_active) AND (max_retained <= 1000000))),
+    CONSTRAINT runtime_node_enrollments_token_sha256_check CHECK ((token_sha256 ~ '^[0-9a-f]{64}$'::text))
+);
+
+CREATE TABLE runtime_node_generation_status (
+    node_id uuid NOT NULL,
+    generation bigint NOT NULL,
+    specification_digest text NOT NULL,
+    connection_id uuid NOT NULL,
+    owner_epoch bigint NOT NULL,
+    state text NOT NULL,
+    diagnostic text DEFAULT ''::text NOT NULL,
+    observed_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    checkpoint jsonb,
+    CONSTRAINT runtime_node_generation_status_checkpoint_check CHECK (((checkpoint IS NULL) OR (jsonb_typeof(checkpoint) = 'object'::text))),
+    CONSTRAINT runtime_node_generation_status_generation_check CHECK ((generation > 0)),
+    CONSTRAINT runtime_node_generation_status_owner_epoch_check CHECK ((owner_epoch > 0)),
+    CONSTRAINT runtime_node_generation_status_specification_digest_check CHECK ((specification_digest ~ '^[0-9a-f]{64}$'::text)),
+    CONSTRAINT runtime_node_generation_status_state_check CHECK ((state = ANY (ARRAY['ready'::text, 'preparing'::text, 'failed'::text])))
+);
+
+CREATE TABLE runtime_nodes (
+    id uuid NOT NULL,
+    installation_id uuid NOT NULL,
+    name text NOT NULL,
+    backend_fingerprint text NOT NULL,
+    credential_sha256 text NOT NULL,
+    max_active integer NOT NULL,
+    max_retained integer NOT NULL,
+    connection_id uuid,
+    provider_ready boolean DEFAULT false NOT NULL,
+    health jsonb DEFAULT '{}'::jsonb NOT NULL,
+    connected_epoch bigint DEFAULT 0 NOT NULL,
+    last_seen_at timestamp with time zone,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    removed_at timestamp with time zone,
+    specification_digest text DEFAULT ''::text NOT NULL,
+    deployment_generation bigint DEFAULT 0 NOT NULL,
+    core_url text DEFAULT ''::text NOT NULL,
+    enrollment_id uuid,
+    ready_generation bigint,
+    protocol_version integer DEFAULT 1 NOT NULL,
+    CONSTRAINT runtime_node_deployment_generation CHECK ((deployment_generation >= 0)),
+    CONSTRAINT runtime_node_specification_digest CHECK (((specification_digest = ''::text) OR (specification_digest ~ '^[0-9a-f]{64}$'::text))),
+    CONSTRAINT runtime_nodes_backend_fingerprint_check CHECK ((backend_fingerprint ~ '^[0-9a-f]{64}$'::text)),
+    CONSTRAINT runtime_nodes_check CHECK ((max_retained >= max_active)),
+    CONSTRAINT runtime_nodes_credential_sha256_check CHECK ((credential_sha256 ~ '^[0-9a-f]{64}$'::text)),
+    CONSTRAINT runtime_nodes_max_active_check CHECK ((max_active > 0)),
+    CONSTRAINT runtime_nodes_name_check CHECK (((length(name) >= 1) AND (length(name) <= 128))),
+    CONSTRAINT runtime_nodes_protocol_version_check CHECK ((protocol_version = ANY (ARRAY[1, 2]))),
+    CONSTRAINT runtime_nodes_ready_generation_check CHECK ((ready_generation >= 0))
+);
+
+CREATE TABLE runtime_placements (
+    environment_id uuid NOT NULL,
+    node_id uuid NOT NULL,
+    reserved_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    released_at timestamp with time zone,
+    deployment_generation bigint,
+    CONSTRAINT runtime_placements_check CHECK (((released_at IS NOT NULL) OR (deployment_generation IS NOT NULL))),
+    CONSTRAINT runtime_placements_deployment_generation_check CHECK ((deployment_generation >= 0))
+);
+
+CREATE VIEW runtime_reset_retained_environments AS
+ SELECT e.id AS environment_id,
+    s.id AS session_id,
+    s.tenant_id,
+    a.deployment_generation
+   FROM ((((environments e
+     JOIN sessions s ON ((s.id = e.session_id)))
+     JOIN environment_workspaces w ON (((w.environment_id = e.id) AND (w.state = 'ready'::text))))
+     JOIN LATERAL ( SELECT allocation.id,
+            allocation.environment_id,
+            allocation.device_id,
+            allocation.provider_key,
+            allocation.state,
+            allocation.create_settled,
+            allocation.created_at,
+            allocation.released_at,
+            allocation.compute_phase,
+            allocation.compute_revision,
+            allocation.compute_state,
+            allocation.compute_activity_at,
+            allocation.compute_wake_requested,
+            allocation.compute_retained_until,
+            allocation.node_id,
+            allocation.observation_error,
+            allocation.compute_phase_changed_at,
+            allocation.deployment_generation
+           FROM runtime_allocations allocation
+          WHERE (allocation.environment_id = e.id)
+          ORDER BY allocation.created_at DESC, allocation.id DESC
+         LIMIT 1) a ON (true))
+     CROSS JOIN runtime_deployment d)
+  WHERE ((d.reset_clear IS NOT NULL) AND (d.reset_requested_at IS NOT NULL) AND (s.deleted_at IS NULL) AND (s.created_at <= d.reset_requested_at) AND (e.status <> ALL (ARRAY['failed'::text, 'expired'::text])) AND (e.initialization = 'complete'::text) AND (((s.configuration -> 'environment'::text) ->> 'type'::text) = 'openai_hosted'::text) AND (a.state = 'released'::text) AND (a.provider_key = d.installation_id) AND (a.deployment_generation <= d.generation) AND (a.created_at <= d.reset_requested_at) AND (NOT (EXISTS ( SELECT 1
+           FROM runtime_placements p
+          WHERE ((p.environment_id = e.id) AND (p.released_at IS NULL))))));
+
+CREATE TABLE session_artifacts (
+    id uuid NOT NULL,
+    session_id uuid NOT NULL,
+    turn_id uuid NOT NULL,
+    environment_id uuid NOT NULL,
+    path text NOT NULL,
+    size_bytes bigint NOT NULL,
+    body_oid oid NOT NULL,
+    sha256 text NOT NULL,
+    created_at timestamp with time zone,
+    CONSTRAINT session_artifacts_path_check CHECK (((octet_length(path) >= 20) AND (octet_length(path) <= 4110))),
+    CONSTRAINT session_artifacts_sha256_check CHECK ((sha256 ~ '^[0-9a-f]{64}$'::text)),
+    CONSTRAINT session_artifacts_size_bytes_check CHECK (((size_bytes >= 0) AND (size_bytes <= 209715200)))
+);
+
+CREATE TABLE session_devices (
+    session_id uuid NOT NULL,
+    device_id uuid NOT NULL,
+    native_session_id text DEFAULT ''::text NOT NULL
+);
+
+CREATE TABLE session_events (
+    session_id uuid NOT NULL,
+    sequence bigint NOT NULL,
+    payload jsonb NOT NULL,
+    payload_bytes integer GENERATED ALWAYS AS (octet_length((payload)::text)) STORED
+);
+
+CREATE TABLE session_execution_configuration (
+    session_id uuid NOT NULL,
+    configuration jsonb NOT NULL,
+    deployment_provider_revision uuid,
+    CONSTRAINT session_execution_configuration_configuration_check CHECK ((jsonb_typeof(configuration) = 'object'::text))
+);
+
+CREATE TABLE session_items (
+    id uuid NOT NULL,
+    session_id uuid NOT NULL,
+    turn_id uuid NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    "position" integer DEFAULT 0 NOT NULL,
+    payload jsonb NOT NULL,
+    output_index integer,
+    settled_at timestamp with time zone,
+    CONSTRAINT session_items_output_index_check CHECK ((output_index >= 0)),
+    CONSTRAINT session_items_payload_check CHECK ((jsonb_typeof(payload) = 'object'::text))
+);
+
+CREATE TABLE session_model_execution (
+    session_id uuid NOT NULL,
+    encrypted_config bytea NOT NULL
+);
+
+CREATE TABLE skill_versions (
+    id uuid NOT NULL,
+    tenant_id uuid NOT NULL,
+    skill_id uuid NOT NULL,
+    version bigint NOT NULL,
+    name text NOT NULL,
+    description text NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    contents bytea NOT NULL,
+    CONSTRAINT skill_versions_version_check CHECK ((version > 0))
+);
+
+CREATE TABLE skills (
+    id uuid NOT NULL,
+    tenant_id uuid NOT NULL,
+    name text NOT NULL,
+    description text NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    default_version bigint NOT NULL,
+    latest_version bigint NOT NULL,
+    next_version bigint NOT NULL,
+    CONSTRAINT skills_check CHECK ((next_version > latest_version)),
+    CONSTRAINT skills_default_version_check CHECK ((default_version > 0)),
+    CONSTRAINT skills_latest_version_check CHECK ((latest_version > 0))
+);
+
+CREATE TABLE source_files (
+    id uuid NOT NULL,
+    tenant_id uuid NOT NULL,
+    filename text NOT NULL,
+    purpose text NOT NULL,
+    body_oid oid NOT NULL,
+    size_bytes bigint NOT NULL,
+    sha256 text NOT NULL,
+    created_at timestamp with time zone DEFAULT statement_timestamp() NOT NULL,
+    CONSTRAINT source_files_filename_check CHECK (((octet_length(filename) >= 1) AND (octet_length(filename) <= 1024))),
+    CONSTRAINT source_files_purpose_check CHECK ((purpose = 'user_data'::text)),
+    CONSTRAINT source_files_sha256_check CHECK ((sha256 ~ '^[0-9a-f]{64}$'::text)),
+    CONSTRAINT source_files_size_bytes_check CHECK (((size_bytes >= 0) AND (size_bytes <= 536870912)))
+);
+
+CREATE TABLE subagent_effects (
+    session_id uuid NOT NULL,
+    effect_id text NOT NULL,
+    payload jsonb NOT NULL,
+    CONSTRAINT subagent_effects_payload_check CHECK ((jsonb_typeof(payload) = 'object'::text))
+);
+
+CREATE TABLE subagent_identities (
+    id uuid NOT NULL,
+    session_id uuid NOT NULL,
+    device_id uuid NOT NULL,
+    engine text NOT NULL,
+    native_id text NOT NULL,
+    parent_native_id text NOT NULL,
+    native_created_at bigint NOT NULL,
+    first_turn_id uuid NOT NULL,
+    first_event_ordinal integer NOT NULL,
+    name text,
+    instructions text,
+    public_visible boolean DEFAULT false NOT NULL,
+    status text DEFAULT 'active'::text NOT NULL,
+    closed_at_ms bigint,
+    lifecycle_at_ms bigint DEFAULT 0 NOT NULL,
+    CONSTRAINT subagent_closed_state CHECK (((status = 'closed'::text) = (closed_at_ms IS NOT NULL))),
+    CONSTRAINT subagent_identities_check CHECK (((parent_native_id <> ''::text) AND (parent_native_id <> native_id))),
+    CONSTRAINT subagent_identities_native_created_at_check CHECK ((native_created_at > 0)),
+    CONSTRAINT subagent_identities_native_id_check CHECK ((native_id <> ''::text)),
+    CONSTRAINT subagent_identities_status_check CHECK ((status = ANY (ARRAY['active'::text, 'closed'::text])))
+);
+
+CREATE TABLE subagent_items (
+    id uuid NOT NULL,
+    session_id uuid NOT NULL,
+    subagent_id uuid NOT NULL,
+    turn_id uuid NOT NULL,
+    "position" integer NOT NULL,
+    output_index integer,
+    payload jsonb NOT NULL,
+    CONSTRAINT subagent_items_payload_check CHECK ((jsonb_typeof(payload) = 'object'::text)),
+    CONSTRAINT subagent_items_position_check CHECK (("position" >= 0))
+);
+
+CREATE TABLE turn_events (
+    session_id uuid NOT NULL,
+    turn_id uuid NOT NULL,
+    ordinal integer NOT NULL,
+    kind text NOT NULL,
+    payload jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    CONSTRAINT turn_events_ordinal_check CHECK ((ordinal > 0)),
+    CONSTRAINT turn_events_payload_check CHECK ((jsonb_typeof(payload) = 'object'::text))
+);
+
+CREATE TABLE turn_inputs (
+    sequence bigint GENERATED ALWAYS AS IDENTITY NOT NULL,
+    session_id uuid NOT NULL,
+    turn_id uuid,
+    idempotency_key text NOT NULL,
+    kind text NOT NULL,
+    payload jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    batch_position integer DEFAULT 0 NOT NULL,
+    CONSTRAINT turn_inputs_batch_position_check CHECK ((batch_position >= 0)),
+    CONSTRAINT turn_inputs_check CHECK (((kind <> 'message'::text) OR (turn_id IS NOT NULL))),
+    CONSTRAINT turn_inputs_function_turn_check CHECK (((kind <> 'tool_result'::text) OR (turn_id IS NOT NULL))),
+    CONSTRAINT turn_inputs_kind_check CHECK ((kind = ANY (ARRAY['message'::text, 'cancel'::text, 'tool_result'::text]))),
+    CONSTRAINT turn_inputs_payload_check CHECK ((jsonb_typeof(payload) = 'object'::text))
+);
+
+CREATE TABLE vault_credentials (
+    id uuid NOT NULL,
+    vault_id uuid NOT NULL,
+    name text NOT NULL,
+    auth_type text NOT NULL,
+    mcp_server_url text NOT NULL,
+    token_ciphertext bytea NOT NULL,
+    created_at timestamp with time zone DEFAULT statement_timestamp() NOT NULL,
+    updated_at timestamp with time zone DEFAULT statement_timestamp() NOT NULL,
+    status text DEFAULT 'active'::text NOT NULL,
+    oauth_metadata jsonb,
+    CONSTRAINT vault_credentials_auth_type_check CHECK ((auth_type = ANY (ARRAY['static_bearer'::text, 'mcp_oauth'::text]))),
+    CONSTRAINT vault_credentials_name_check CHECK (((octet_length(name) >= 1) AND (octet_length(name) <= 256))),
+    CONSTRAINT vault_credentials_oauth_metadata_check CHECK ((((auth_type = 'static_bearer'::text) AND (oauth_metadata IS NULL)) OR ((auth_type = 'mcp_oauth'::text) AND (oauth_metadata IS NOT NULL) AND (jsonb_typeof(oauth_metadata) = 'object'::text)))),
+    CONSTRAINT vault_credentials_status_check CHECK ((status = ANY (ARRAY['active'::text, 'archived'::text]))),
+    CONSTRAINT vault_credentials_token_ciphertext_check CHECK ((octet_length(token_ciphertext) > 0))
+);
+
+CREATE TABLE vaults (
+    id uuid NOT NULL,
+    tenant_id uuid NOT NULL,
+    name text,
+    metadata jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT statement_timestamp() NOT NULL,
+    status text DEFAULT 'active'::text NOT NULL,
+    CONSTRAINT vaults_metadata_check CHECK ((jsonb_typeof(metadata) = 'object'::text)),
+    CONSTRAINT vaults_name_check CHECK (((name IS NULL) OR ((octet_length(name) >= 1) AND (octet_length(name) <= 256)))),
+    CONSTRAINT vaults_status_check CHECK ((status = ANY (ARRAY['active'::text, 'archived'::text])))
+);
+
+CREATE TABLE workspace_fs_configurations (
+    id uuid NOT NULL,
+    adapter text NOT NULL,
+    parameters jsonb NOT NULL,
+    active boolean DEFAULT false NOT NULL,
+    credential bytea,
+    CONSTRAINT workspace_fs_configurations_adapter_check CHECK ((adapter <> ''::text)),
+    CONSTRAINT workspace_fs_configurations_credential_check CHECK (((credential IS NULL) OR (length(credential) > 0))),
+    CONSTRAINT workspace_fs_configurations_parameters_check CHECK ((jsonb_typeof(parameters) = 'object'::text))
+);
+
+CREATE TABLE workspace_storage_admission (
+    singleton boolean DEFAULT true NOT NULL,
+    tenant_capacity_mib bigint DEFAULT 0 NOT NULL,
+    CONSTRAINT workspace_storage_admission_singleton_check CHECK (singleton),
+    CONSTRAINT workspace_storage_admission_tenant_capacity_mib_check CHECK (((tenant_capacity_mib >= 0) AND (tenant_capacity_mib <= '4294967295'::bigint)))
+);
+
+CREATE TABLE write_audit_operations (
+    id uuid NOT NULL,
+    tenant_id uuid NOT NULL,
+    key_id text NOT NULL,
+    key_name text NOT NULL,
+    key_prefix text NOT NULL,
+    key_kind text NOT NULL,
+    action text NOT NULL,
+    resource_type text NOT NULL,
+    resource_id text NOT NULL,
+    parent_id text DEFAULT ''::text NOT NULL,
+    request_id text NOT NULL,
+    trace_id text NOT NULL,
+    created_at timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+    CONSTRAINT write_audit_operations_key_kind_check CHECK ((key_kind = ANY (ARRAY['static'::text, 'issued'::text, 'console'::text])))
+);
+
+CREATE TABLE write_audit_owners (
+    tenant_id uuid NOT NULL,
+    resource_type text NOT NULL,
+    resource_id text NOT NULL,
+    parent_id text DEFAULT ''::text NOT NULL,
+    operation_id uuid NOT NULL
+);
+
+ALTER TABLE admin_audit_log
+    ADD CONSTRAINT admin_audit_log_pkey PRIMARY KEY (id);
+
+ALTER TABLE admin_audit_log
+    ADD CONSTRAINT admin_audit_log_tenant_id_request_id_action_resource_type_r_key UNIQUE (tenant_id, request_id, action, resource_type, resource_id);
+
+ALTER TABLE agent_model_execution
+    ADD CONSTRAINT agent_model_execution_pkey PRIMARY KEY (agent_id);
+
+ALTER TABLE agents
+    ADD CONSTRAINT agents_pkey PRIMARY KEY (id);
+
+ALTER TABLE deployment_model_providers
+    ADD CONSTRAINT deployment_model_providers_pkey PRIMARY KEY (harness);
+
+ALTER TABLE devices
+    ADD CONSTRAINT devices_pkey PRIMARY KEY (id);
+
+ALTER TABLE environment_connections
+    ADD CONSTRAINT environment_connections_pkey PRIMARY KEY (environment_id);
+
+ALTER TABLE environment_executor_credentials
+    ADD CONSTRAINT environment_executor_credentials_pkey PRIMARY KEY (key_id);
+
+ALTER TABLE environment_executor_credentials
+    ADD CONSTRAINT environment_executor_credentials_token_sha256_key UNIQUE (token_sha256);
+
+ALTER TABLE environment_file_writes
+    ADD CONSTRAINT environment_file_writes_pkey PRIMARY KEY (id);
+
+ALTER TABLE environment_input_reservations
+    ADD CONSTRAINT environment_input_reservations_pkey PRIMARY KEY (id);
+
+ALTER TABLE environment_input_reservations
+    ADD CONSTRAINT environment_input_reservations_session_id_idempotency_key_key UNIQUE (session_id, idempotency_key);
+
+ALTER TABLE environment_setups
+    ADD CONSTRAINT environment_setups_pkey PRIMARY KEY (session_id);
+
+ALTER TABLE environment_templates
+    ADD CONSTRAINT environment_templates_pkey PRIMARY KEY (id);
+
+ALTER TABLE environment_workspaces
+    ADD CONSTRAINT environment_workspaces_environment_id_key UNIQUE (environment_id);
+
+ALTER TABLE environment_workspaces
+    ADD CONSTRAINT environment_workspaces_pkey PRIMARY KEY (object_id);
+
+ALTER TABLE environments
+    ADD CONSTRAINT environments_pkey PRIMARY KEY (id);
+
+ALTER TABLE environments
+    ADD CONSTRAINT environments_session_id_key UNIQUE (session_id);
+
+ALTER TABLE execution_project_scopes
+    ADD CONSTRAINT execution_project_scopes_organization_id_project_id_key UNIQUE (organization_id, project_id);
+
+ALTER TABLE execution_project_scopes
+    ADD CONSTRAINT execution_project_scopes_pkey PRIMARY KEY (tenant_id);
+
+ALTER TABLE function_calls
+    ADD CONSTRAINT function_calls_pkey PRIMARY KEY (session_id, turn_id, call_id);
+
+ALTER TABLE function_calls
+    ADD CONSTRAINT function_calls_session_id_turn_id_executor_call_id_key UNIQUE (session_id, turn_id, executor_call_id);
+
+ALTER TABLE initial_environment_files
+    ADD CONSTRAINT initial_environment_files_pkey PRIMARY KEY (id);
+
+ALTER TABLE initial_environment_files
+    ADD CONSTRAINT initial_environment_files_session_id_path_key UNIQUE (session_id, path);
+
+ALTER TABLE initial_environment_files
+    ADD CONSTRAINT initial_environment_files_session_id_position_key UNIQUE (session_id, "position");
+
+ALTER TABLE node_host_history_samples
+    ADD CONSTRAINT node_host_history_samples_pkey PRIMARY KEY (node_id, observed_at);
+
+ALTER TABLE project_api_keys
+    ADD CONSTRAINT project_api_keys_pkey PRIMARY KEY (id);
+
+ALTER TABLE project_api_keys
+    ADD CONSTRAINT project_api_keys_token_sha256_key UNIQUE (token_sha256);
+
+ALTER TABLE projects
+    ADD CONSTRAINT projects_id_tenant_id_key UNIQUE (id, tenant_id);
+
+ALTER TABLE projects
+    ADD CONSTRAINT projects_pkey PRIMARY KEY (id);
+
+ALTER TABLE projects
+    ADD CONSTRAINT projects_tenant_id_key UNIQUE (tenant_id);
+
+ALTER TABLE runtime_allocations
+    ADD CONSTRAINT runtime_allocations_device_id_key UNIQUE (device_id);
+
+ALTER TABLE runtime_allocations
+    ADD CONSTRAINT runtime_allocations_pkey PRIMARY KEY (id);
+
+ALTER TABLE runtime_deployment_generations
+    ADD CONSTRAINT runtime_deployment_generations_pkey PRIMARY KEY (generation);
+
+ALTER TABLE runtime_deployment
+    ADD CONSTRAINT runtime_deployment_pkey PRIMARY KEY (singleton);
+
+ALTER TABLE runtime_history_samples
+    ADD CONSTRAINT runtime_history_samples_pkey PRIMARY KEY (tenant_id, session_id, environment_id, resolved_at_ns);
+
+ALTER TABLE runtime_node_enrollments
+    ADD CONSTRAINT runtime_node_enrollments_id_key UNIQUE (id);
+
+ALTER TABLE runtime_node_enrollments
+    ADD CONSTRAINT runtime_node_enrollments_pkey PRIMARY KEY (token_sha256);
+
+ALTER TABLE runtime_node_generation_status
+    ADD CONSTRAINT runtime_node_generation_status_pkey PRIMARY KEY (node_id, generation);
+
+ALTER TABLE runtime_nodes
+    ADD CONSTRAINT runtime_nodes_pkey PRIMARY KEY (id);
+
+ALTER TABLE runtime_placements
+    ADD CONSTRAINT runtime_placements_environment_id_node_id_key UNIQUE (environment_id, node_id);
+
+ALTER TABLE runtime_placements
+    ADD CONSTRAINT runtime_placements_pkey PRIMARY KEY (environment_id);
+
+ALTER TABLE session_artifacts
+    ADD CONSTRAINT session_artifacts_body_oid_key UNIQUE (body_oid);
+
+ALTER TABLE session_artifacts
+    ADD CONSTRAINT session_artifacts_pkey PRIMARY KEY (id);
+
+ALTER TABLE session_artifacts
+    ADD CONSTRAINT session_artifacts_turn_id_path_key UNIQUE (turn_id, path);
+
+ALTER TABLE session_devices
+    ADD CONSTRAINT session_devices_pkey PRIMARY KEY (session_id);
+
+ALTER TABLE session_events
+    ADD CONSTRAINT session_events_pkey PRIMARY KEY (session_id, sequence);
+
+ALTER TABLE session_execution_configuration
+    ADD CONSTRAINT session_execution_configuration_pkey PRIMARY KEY (session_id);
+
+ALTER TABLE session_items
+    ADD CONSTRAINT session_items_pkey PRIMARY KEY (id);
+
+ALTER TABLE session_model_execution
+    ADD CONSTRAINT session_model_execution_pkey PRIMARY KEY (session_id);
+
+ALTER TABLE sessions
+    ADD CONSTRAINT sessions_pkey PRIMARY KEY (id);
+
+ALTER TABLE sessions
+    ADD CONSTRAINT sessions_tenant_id_idempotency_key_key UNIQUE (tenant_id, idempotency_key);
+
+ALTER TABLE skill_versions
+    ADD CONSTRAINT skill_versions_pkey PRIMARY KEY (id);
+
+ALTER TABLE skill_versions
+    ADD CONSTRAINT skill_versions_skill_id_version_key UNIQUE (skill_id, version);
+
+ALTER TABLE skills
+    ADD CONSTRAINT skills_pkey PRIMARY KEY (id);
+
+ALTER TABLE skills
+    ADD CONSTRAINT skills_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE source_files
+    ADD CONSTRAINT source_files_body_oid_key UNIQUE (body_oid);
+
+ALTER TABLE source_files
+    ADD CONSTRAINT source_files_pkey PRIMARY KEY (id);
+
+ALTER TABLE subagent_effects
+    ADD CONSTRAINT subagent_effects_pkey PRIMARY KEY (session_id, effect_id);
+
+ALTER TABLE subagent_identities
+    ADD CONSTRAINT subagent_identities_device_id_engine_native_id_key UNIQUE (device_id, engine, native_id);
+
+ALTER TABLE subagent_identities
+    ADD CONSTRAINT subagent_identities_pkey PRIMARY KEY (id);
+
+ALTER TABLE subagent_identities
+    ADD CONSTRAINT subagent_identities_session_id_native_id_key UNIQUE (session_id, native_id);
+
+ALTER TABLE subagent_items
+    ADD CONSTRAINT subagent_items_pkey PRIMARY KEY (id);
+
+ALTER TABLE subagent_items
+    ADD CONSTRAINT subagent_items_turn_id_position_key UNIQUE (turn_id, "position");
+
+ALTER TABLE subagent_identities
+    ADD CONSTRAINT subagent_session_identity UNIQUE (session_id, id);
+
+ALTER TABLE subagent_turns
+    ADD CONSTRAINT subagent_turns_pkey PRIMARY KEY (id);
+
+ALTER TABLE subagent_turns
+    ADD CONSTRAINT subagent_turns_session_id_subagent_id_id_key UNIQUE (session_id, subagent_id, id);
+
+ALTER TABLE subagent_turns
+    ADD CONSTRAINT subagent_turns_subagent_id_native_id_key UNIQUE (subagent_id, native_id);
+
+ALTER TABLE turn_events
+    ADD CONSTRAINT turn_events_pkey PRIMARY KEY (turn_id, ordinal);
+
+ALTER TABLE turn_inputs
+    ADD CONSTRAINT turn_inputs_pkey PRIMARY KEY (sequence);
+
+ALTER TABLE turn_inputs
+    ADD CONSTRAINT turn_inputs_session_id_idempotency_key_batch_position_key UNIQUE (session_id, idempotency_key, batch_position);
+
+ALTER TABLE turns
+    ADD CONSTRAINT turns_pkey PRIMARY KEY (id);
+
+ALTER TABLE turns
+    ADD CONSTRAINT turns_session_id_id_key UNIQUE (session_id, id);
+
+ALTER TABLE vault_credentials
+    ADD CONSTRAINT vault_credentials_pkey PRIMARY KEY (id);
+
+ALTER TABLE vaults
+    ADD CONSTRAINT vaults_pkey PRIMARY KEY (id);
+
+ALTER TABLE workspace_fs_configurations
+    ADD CONSTRAINT workspace_fs_configurations_pkey PRIMARY KEY (id);
+
+ALTER TABLE workspace_storage_admission
+    ADD CONSTRAINT workspace_storage_admission_pkey PRIMARY KEY (singleton);
+
+ALTER TABLE write_audit_operations
+    ADD CONSTRAINT write_audit_operations_pkey PRIMARY KEY (id);
+
+ALTER TABLE write_audit_operations
+    ADD CONSTRAINT write_audit_operations_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE write_audit_operations
+    ADD CONSTRAINT write_audit_operations_tenant_id_request_id_key UNIQUE (tenant_id, request_id);
+
+ALTER TABLE write_audit_owners
+    ADD CONSTRAINT write_audit_owners_pkey PRIMARY KEY (tenant_id, resource_type, resource_id);
+
+CREATE INDEX admin_audit_log_history ON admin_audit_log USING btree (project_id, created_at DESC, id DESC);
+
+CREATE INDEX agents_tenant_created_idx ON agents USING btree (tenant_id, created_at DESC, id DESC);
+
+CREATE UNIQUE INDEX devices_environment_authority ON devices USING btree (environment_id) WHERE ((revoked_at IS NULL) OR (executor_key_id IS NOT NULL));
+
+CREATE INDEX devices_tenant_idx ON devices USING btree (tenant_id);
+
+CREATE UNIQUE INDEX environment_file_writes_pending ON environment_file_writes USING btree (environment_id) WHERE (state = 'pending'::text);
+
+CREATE INDEX environment_input_reservations_latest_idx ON environment_input_reservations USING btree (session_id, created_at DESC, id DESC);
+
+CREATE UNIQUE INDEX environment_input_reservations_one_pending_idx ON environment_input_reservations USING btree (session_id) WHERE (state = 'pending'::text);
+
+CREATE INDEX environment_input_reservations_pending_deadline_idx ON environment_input_reservations USING btree (deadline, id) WHERE (state = 'pending'::text);
+
+CREATE INDEX environment_templates_tenant_order ON environment_templates USING btree (tenant_id, created_at, id);
+
+CREATE INDEX function_calls_pending_idx ON function_calls USING btree (session_id, turn_id) WHERE ((NOT applied) AND (NOT withdrawn));
+
+CREATE INDEX node_host_history_retention ON node_host_history_samples USING btree (observed_at);
+
+CREATE INDEX project_api_keys_project ON project_api_keys USING btree (project_id, id);
+
+CREATE UNIQUE INDEX runtime_allocations_current_environment ON runtime_allocations USING btree (environment_id) WHERE (state <> 'released'::text);
+
+CREATE INDEX runtime_allocations_environment_receipts ON runtime_allocations USING btree (environment_id, created_at DESC, id DESC);
+
+CREATE INDEX runtime_allocations_generation_live ON runtime_allocations USING btree (deployment_generation) WHERE (state <> 'released'::text);
+
+CREATE INDEX runtime_history_samples_retention_idx ON runtime_history_samples USING btree (resolved_at_ns);
+
+CREATE INDEX runtime_nodes_generation_live ON runtime_nodes USING btree (ready_generation) WHERE (removed_at IS NULL);
+
+CREATE INDEX runtime_placements_generation_live ON runtime_placements USING btree (deployment_generation) WHERE (released_at IS NULL);
+
+CREATE INDEX runtime_placements_node_idx ON runtime_placements USING btree (node_id) WHERE (released_at IS NULL);
+
+CREATE INDEX session_artifacts_page_idx ON session_artifacts USING btree (session_id, created_at DESC, id DESC) WHERE (created_at IS NOT NULL);
+
+CREATE UNIQUE INDEX session_items_output_idx ON session_items USING btree (turn_id, output_index);
+
+CREATE INDEX session_items_page_idx ON session_items USING btree (session_id, created_at, "position", id);
+
+CREATE UNIQUE INDEX session_items_position_idx ON session_items USING btree (session_id, "position");
+
+CREATE INDEX session_items_turn_idx ON session_items USING btree (turn_id);
+
+CREATE INDEX sessions_tenant_agent_created_idx ON sessions USING btree (tenant_id, ((configuration #>> '{agent,id}'::text[])), created_at DESC, id DESC);
+
+CREATE INDEX sessions_tenant_created_idx ON sessions USING btree (tenant_id, created_at DESC, id DESC);
+
+CREATE INDEX skills_tenant_created ON skills USING btree (tenant_id, created_at, id);
+
+CREATE INDEX source_files_page_idx ON source_files USING btree (tenant_id, created_at DESC, id DESC);
+
+CREATE INDEX turn_events_item_history_idx ON turn_events USING btree (turn_id, created_at, ordinal);
+
+CREATE INDEX turn_inputs_item_history_idx ON turn_inputs USING btree (turn_id, created_at, sequence) WHERE (kind = 'message'::text);
+
+CREATE INDEX turn_inputs_turn_sequence_idx ON turn_inputs USING btree (turn_id, sequence);
+
+CREATE INDEX turns_execution_queue_idx ON turns USING btree (status, id) WHERE (status = ANY (ARRAY['queued'::text, 'in_progress'::text, 'waiting'::text]));
+
+CREATE INDEX turns_metrics_interrupted_idx ON turns USING btree (completed_at) WHERE ((status = 'failed'::text) AND ((outcome ->> 'error_code'::text) = 'execution_interrupted'::text));
+
+CREATE INDEX turns_metrics_started_idx ON turns USING btree (started_at) INCLUDE (created_at) WHERE (started_at IS NOT NULL);
+
+CREATE UNIQUE INDEX turns_one_active_idx ON turns USING btree (session_id) WHERE (status = ANY (ARRAY['queued'::text, 'in_progress'::text, 'waiting'::text]));
+
+CREATE INDEX vault_credentials_vault_created_id_idx ON vault_credentials USING btree (vault_id, created_at, id);
+
+CREATE INDEX vaults_tenant_created_id_idx ON vaults USING btree (tenant_id, created_at, id);
+
+CREATE UNIQUE INDEX workspace_fs_active_idx ON workspace_fs_configurations USING btree (active) WHERE active;
+
+CREATE INDEX write_audit_operations_expiry ON write_audit_operations USING btree (created_at, id);
+
+CREATE INDEX write_audit_operations_history ON write_audit_operations USING btree (tenant_id, created_at DESC, id DESC);
+
+CREATE INDEX write_audit_operations_key_history ON write_audit_operations USING btree (tenant_id, key_id, created_at DESC, id DESC);
+
+CREATE INDEX write_audit_operations_resource_history ON write_audit_operations USING btree (tenant_id, resource_type, resource_id, created_at DESC, id DESC);
+
+CREATE INDEX write_audit_owners_operation ON write_audit_owners USING btree (operation_id);
+
+CREATE TRIGGER immutable_runtime_allocation_generation BEFORE UPDATE ON runtime_allocations FOR EACH ROW EXECUTE FUNCTION immutable_runtime_deployment_generation();
+
+CREATE TRIGGER immutable_runtime_placement_generation BEFORE UPDATE ON runtime_placements FOR EACH ROW EXECUTE FUNCTION immutable_runtime_deployment_generation();
+
+CREATE TRIGGER immutable_sandbox_specification BEFORE UPDATE ON runtime_deployment_generations FOR EACH ROW EXECUTE FUNCTION immutable_sandbox_specification();
+
+CREATE TRIGGER immutable_workspace_configuration BEFORE UPDATE ON workspace_fs_configurations FOR EACH ROW EXECUTE FUNCTION immutable_workspace_configuration();
+
+CREATE TRIGGER immutable_workspace_identity BEFORE UPDATE ON environment_workspaces FOR EACH ROW EXECUTE FUNCTION immutable_workspace_identity();
+
+ALTER TABLE admin_audit_log
+    ADD CONSTRAINT admin_audit_log_project_id_tenant_id_fkey FOREIGN KEY (project_id, tenant_id) REFERENCES projects(id, tenant_id);
+
+ALTER TABLE agent_model_execution
+    ADD CONSTRAINT agent_model_execution_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES agents(id) ON DELETE CASCADE;
+
+ALTER TABLE devices
+    ADD CONSTRAINT devices_archive_cancel_turn_id_fkey FOREIGN KEY (archive_cancel_turn_id) REFERENCES turns(id) ON DELETE SET NULL;
+
+ALTER TABLE devices
+    ADD CONSTRAINT devices_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES environments(id);
+
+ALTER TABLE devices
+    ADD CONSTRAINT devices_executor_key_id_fkey FOREIGN KEY (executor_key_id) REFERENCES environment_executor_credentials(key_id);
+
+ALTER TABLE environment_connections
+    ADD CONSTRAINT environment_connections_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES environments(id);
+
+ALTER TABLE environment_executor_credentials
+    ADD CONSTRAINT environment_executor_credentials_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES environments(id);
+
+ALTER TABLE environment_executor_credentials
+    ADD CONSTRAINT environment_executor_credentials_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES execution_project_scopes(tenant_id);
+
+ALTER TABLE environment_file_writes
+    ADD CONSTRAINT environment_file_writes_device_id_fkey FOREIGN KEY (device_id) REFERENCES devices(id);
+
+ALTER TABLE environment_file_writes
+    ADD CONSTRAINT environment_file_writes_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES environments(id);
+
+ALTER TABLE environment_input_reservations
+    ADD CONSTRAINT environment_input_reservations_session_id_fkey FOREIGN KEY (session_id) REFERENCES environments(session_id);
+
+ALTER TABLE environment_setups
+    ADD CONSTRAINT environment_setups_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id) ON DELETE CASCADE;
+
+ALTER TABLE environment_workspaces
+    ADD CONSTRAINT environment_workspaces_configuration_id_fkey FOREIGN KEY (configuration_id) REFERENCES workspace_fs_configurations(id);
+
+ALTER TABLE environment_workspaces
+    ADD CONSTRAINT environment_workspaces_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES environments(id);
+
+ALTER TABLE environments
+    ADD CONSTRAINT environments_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id);
+
+ALTER TABLE function_calls
+    ADD CONSTRAINT function_calls_session_id_turn_id_fkey FOREIGN KEY (session_id, turn_id) REFERENCES turns(session_id, id);
+
+ALTER TABLE initial_environment_files
+    ADD CONSTRAINT initial_environment_files_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id) ON DELETE CASCADE;
+
+ALTER TABLE node_host_history_samples
+    ADD CONSTRAINT node_host_history_samples_node_id_fkey FOREIGN KEY (node_id) REFERENCES runtime_nodes(id);
+
+ALTER TABLE project_api_keys
+    ADD CONSTRAINT project_api_keys_project_id_fkey FOREIGN KEY (project_id) REFERENCES projects(id);
+
+ALTER TABLE projects
+    ADD CONSTRAINT projects_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES execution_project_scopes(tenant_id);
+
+ALTER TABLE runtime_allocations
+    ADD CONSTRAINT runtime_allocation_node_fk FOREIGN KEY (node_id) REFERENCES runtime_nodes(id);
+
+ALTER TABLE runtime_allocations
+    ADD CONSTRAINT runtime_allocations_device_id_fkey FOREIGN KEY (device_id) REFERENCES devices(id);
+
+ALTER TABLE runtime_allocations
+    ADD CONSTRAINT runtime_allocations_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES environments(id);
+
+ALTER TABLE runtime_history_samples
+    ADD CONSTRAINT runtime_history_samples_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES environments(id) ON DELETE CASCADE;
+
+ALTER TABLE runtime_history_samples
+    ADD CONSTRAINT runtime_history_samples_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id) ON DELETE CASCADE;
+
+ALTER TABLE runtime_node_enrollments
+    ADD CONSTRAINT runtime_node_enrollments_node_id_fkey FOREIGN KEY (node_id) REFERENCES runtime_nodes(id);
+
+ALTER TABLE runtime_node_generation_status
+    ADD CONSTRAINT runtime_node_generation_status_node_id_fkey FOREIGN KEY (node_id) REFERENCES runtime_nodes(id);
+
+ALTER TABLE runtime_placements
+    ADD CONSTRAINT runtime_placements_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES environments(id);
+
+ALTER TABLE runtime_placements
+    ADD CONSTRAINT runtime_placements_node_id_fkey FOREIGN KEY (node_id) REFERENCES runtime_nodes(id);
+
+ALTER TABLE session_artifacts
+    ADD CONSTRAINT session_artifacts_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES environments(id);
+
+ALTER TABLE session_artifacts
+    ADD CONSTRAINT session_artifacts_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id);
+
+ALTER TABLE session_artifacts
+    ADD CONSTRAINT session_artifacts_session_id_turn_id_fkey FOREIGN KEY (session_id, turn_id) REFERENCES turns(session_id, id);
+
+ALTER TABLE session_devices
+    ADD CONSTRAINT session_devices_device_id_fkey FOREIGN KEY (device_id) REFERENCES devices(id);
+
+ALTER TABLE session_devices
+    ADD CONSTRAINT session_devices_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id);
+
+ALTER TABLE session_events
+    ADD CONSTRAINT session_events_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id);
+
+ALTER TABLE session_execution_configuration
+    ADD CONSTRAINT session_execution_configuration_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id) ON DELETE CASCADE;
+
+ALTER TABLE session_items
+    ADD CONSTRAINT session_items_session_id_turn_id_fkey FOREIGN KEY (session_id, turn_id) REFERENCES turns(session_id, id);
+
+ALTER TABLE session_model_execution
+    ADD CONSTRAINT session_model_execution_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id) ON DELETE CASCADE;
+
+ALTER TABLE skill_versions
+    ADD CONSTRAINT skill_versions_tenant_id_skill_id_fkey FOREIGN KEY (tenant_id, skill_id) REFERENCES skills(tenant_id, id) ON DELETE CASCADE;
+
+ALTER TABLE skills
+    ADD CONSTRAINT skills_default_version FOREIGN KEY (id, default_version) REFERENCES skill_versions(skill_id, version) DEFERRABLE INITIALLY DEFERRED;
+
+ALTER TABLE skills
+    ADD CONSTRAINT skills_latest_version FOREIGN KEY (id, latest_version) REFERENCES skill_versions(skill_id, version) DEFERRABLE INITIALLY DEFERRED;
+
+ALTER TABLE subagent_effects
+    ADD CONSTRAINT subagent_effects_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id);
+
+ALTER TABLE subagent_identities
+    ADD CONSTRAINT subagent_identities_device_id_fkey FOREIGN KEY (device_id) REFERENCES devices(id);
+
+ALTER TABLE subagent_identities
+    ADD CONSTRAINT subagent_identities_first_turn_id_first_event_ordinal_fkey FOREIGN KEY (first_turn_id, first_event_ordinal) REFERENCES turn_events(turn_id, ordinal);
+
+ALTER TABLE subagent_identities
+    ADD CONSTRAINT subagent_identities_session_id_first_turn_id_fkey FOREIGN KEY (session_id, first_turn_id) REFERENCES turns(session_id, id);
+
+ALTER TABLE subagent_identities
+    ADD CONSTRAINT subagent_identities_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id);
+
+ALTER TABLE subagent_items
+    ADD CONSTRAINT subagent_items_session_id_subagent_id_turn_id_fkey FOREIGN KEY (session_id, subagent_id, turn_id) REFERENCES subagent_turns(session_id, subagent_id, id);
+
+ALTER TABLE subagent_turns
+    ADD CONSTRAINT subagent_turns_session_id_subagent_id_fkey FOREIGN KEY (session_id, subagent_id) REFERENCES subagent_identities(session_id, id);
+
+ALTER TABLE turn_events
+    ADD CONSTRAINT turn_events_session_id_turn_id_fkey FOREIGN KEY (session_id, turn_id) REFERENCES turns(session_id, id);
+
+ALTER TABLE turn_inputs
+    ADD CONSTRAINT turn_inputs_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id);
+
+ALTER TABLE turn_inputs
+    ADD CONSTRAINT turn_inputs_session_id_turn_id_fkey FOREIGN KEY (session_id, turn_id) REFERENCES turns(session_id, id);
+
+ALTER TABLE turns
+    ADD CONSTRAINT turns_session_id_fkey FOREIGN KEY (session_id) REFERENCES sessions(id);
+
+ALTER TABLE vault_credentials
+    ADD CONSTRAINT vault_credentials_vault_id_fkey FOREIGN KEY (vault_id) REFERENCES vaults(id) ON DELETE CASCADE;
+
+ALTER TABLE write_audit_owners
+    ADD CONSTRAINT write_audit_owners_tenant_id_operation_id_fkey FOREIGN KEY (tenant_id, operation_id) REFERENCES write_audit_operations(tenant_id, id);
+
+INSERT INTO runtime_deployment (singleton) VALUES (true);
+INSERT INTO workspace_storage_admission DEFAULT VALUES;
diff --git a/services/core/migrations/000001_sessions.sql b/services/core/migrations/000001_sessions.sql
deleted file mode 100644
index 1ceeb5e7c..000000000
--- a/services/core/migrations/000001_sessions.sql
+++ /dev/null
@@ -1,15 +0,0 @@
--- +goose Up
-CREATE TABLE sessions (
-    id uuid PRIMARY KEY,
-    tenant_id uuid NOT NULL,
-    engine text NOT NULL,
-    metadata jsonb NOT NULL DEFAULT '{}'::jsonb CHECK (jsonb_typeof(metadata) = 'object'),
-    idempotency_key text NOT NULL,
-    request_hash text NOT NULL,
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    UNIQUE (tenant_id, idempotency_key)
-);
-CREATE INDEX sessions_tenant_created_idx ON sessions (tenant_id, created_at DESC, id DESC);
-
--- +goose Down
-DROP TABLE sessions;
diff --git a/services/core/migrations/000002_remove_dead_node_columns.sql b/services/core/migrations/000002_remove_dead_node_columns.sql
new file mode 100644
index 000000000..32fd3dbfa
--- /dev/null
+++ b/services/core/migrations/000002_remove_dead_node_columns.sql
@@ -0,0 +1,4 @@
+-- +goose Up
+ALTER TABLE runtime_nodes DROP CONSTRAINT runtime_nodes_protocol_version_check;
+ALTER TABLE runtime_nodes DROP COLUMN protocol_version;
+ALTER TABLE runtime_nodes DROP COLUMN provider_ready;
diff --git a/services/core/migrations/000002_session_configuration.sql b/services/core/migrations/000002_session_configuration.sql
deleted file mode 100644
index f97c2d629..000000000
--- a/services/core/migrations/000002_session_configuration.sql
+++ /dev/null
@@ -1,6 +0,0 @@
--- +goose Up
-ALTER TABLE sessions ADD COLUMN configuration jsonb NOT NULL DEFAULT '{}'::jsonb
-    CHECK (jsonb_typeof(configuration) = 'object');
-
--- +goose Down
-ALTER TABLE sessions DROP COLUMN configuration;
diff --git a/services/core/migrations/000003_enrollment_limits_optional.sql b/services/core/migrations/000003_enrollment_limits_optional.sql
new file mode 100644
index 000000000..40aec7410
--- /dev/null
+++ b/services/core/migrations/000003_enrollment_limits_optional.sql
@@ -0,0 +1,3 @@
+-- +goose Up
+ALTER TABLE runtime_node_enrollments ALTER COLUMN max_active DROP DEFAULT, ALTER COLUMN max_active DROP NOT NULL;
+ALTER TABLE runtime_node_enrollments ALTER COLUMN max_retained DROP DEFAULT, ALTER COLUMN max_retained DROP NOT NULL;
diff --git a/services/core/migrations/000003_turns.sql b/services/core/migrations/000003_turns.sql
deleted file mode 100644
index 879bd9213..000000000
--- a/services/core/migrations/000003_turns.sql
+++ /dev/null
@@ -1,35 +0,0 @@
--- +goose Up
-CREATE TABLE turns (
-    id uuid PRIMARY KEY,
-    session_id uuid NOT NULL REFERENCES sessions(id),
-    status text NOT NULL DEFAULT 'queued'
-        CHECK (status IN ('queued', 'in_progress', 'waiting', 'completed', 'failed', 'cancelled')),
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    started_at timestamptz,
-    completed_at timestamptz,
-    cancel_requested_at timestamptz,
-    outcome jsonb NOT NULL DEFAULT '{}'::jsonb CHECK (jsonb_typeof(outcome) = 'object'),
-    UNIQUE (session_id, id),
-    CHECK ((completed_at IS NOT NULL) = (status IN ('completed', 'failed', 'cancelled')))
-);
-CREATE UNIQUE INDEX turns_one_active_idx ON turns(session_id)
-    WHERE status IN ('queued', 'in_progress', 'waiting');
-
--- Inputs also retain retry identity after their target Turn has ended.
-CREATE TABLE turn_inputs (
-    sequence bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
-    session_id uuid NOT NULL REFERENCES sessions(id),
-    turn_id uuid,
-    idempotency_key text NOT NULL,
-    kind text NOT NULL CHECK (kind IN ('message', 'cancel')),
-    payload jsonb NOT NULL CHECK (jsonb_typeof(payload) = 'object'),
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    UNIQUE (session_id, idempotency_key),
-    FOREIGN KEY (session_id, turn_id) REFERENCES turns(session_id, id),
-    CHECK (kind <> 'message' OR turn_id IS NOT NULL)
-);
-CREATE INDEX turn_inputs_turn_sequence_idx ON turn_inputs(turn_id, sequence);
-
--- +goose Down
-DROP TABLE turn_inputs;
-DROP TABLE turns;
diff --git a/services/core/migrations/000004_input_batches.sql b/services/core/migrations/000004_input_batches.sql
deleted file mode 100644
index a6b2845ec..000000000
--- a/services/core/migrations/000004_input_batches.sql
+++ /dev/null
@@ -1,12 +0,0 @@
--- +goose Up
--- Existing single-event requests retain their retry identity at position zero.
-ALTER TABLE turn_inputs ADD COLUMN batch_position integer NOT NULL DEFAULT 0
-    CHECK (batch_position >= 0);
-ALTER TABLE turn_inputs DROP CONSTRAINT turn_inputs_session_id_idempotency_key_key;
-ALTER TABLE turn_inputs ADD UNIQUE (session_id, idempotency_key, batch_position);
-
--- +goose Down
--- A multi-event request cannot be represented by the previous schema without
--- losing inputs or retry identities. Let the uniqueness check stop such a downgrade.
-ALTER TABLE turn_inputs ADD UNIQUE (session_id, idempotency_key);
-ALTER TABLE turn_inputs DROP COLUMN batch_position;
diff --git a/services/core/migrations/000004_session_compute_profiles.sql b/services/core/migrations/000004_session_compute_profiles.sql
new file mode 100644
index 000000000..9664bd2de
--- /dev/null
+++ b/services/core/migrations/000004_session_compute_profiles.sql
@@ -0,0 +1,13 @@
+-- +goose Up
+ALTER TABLE runtime_deployment ADD COLUMN compute_profiles jsonb NOT NULL DEFAULT '{}'
+    CHECK (jsonb_typeof(compute_profiles) = 'object');
+CREATE TABLE session_compute_generations (
+    session_id uuid PRIMARY KEY REFERENCES sessions(id) ON DELETE CASCADE,
+    profile text NOT NULL CHECK (profile ~ '^[a-z][a-z0-9-]{0,47}$'),
+    generation bigint NOT NULL CHECK (generation > 0)
+);
+CREATE INDEX session_compute_generations_generation ON session_compute_generations(generation);
+
+-- +goose Down
+DROP TABLE session_compute_generations;
+ALTER TABLE runtime_deployment DROP COLUMN compute_profiles;
diff --git a/services/core/migrations/000005_devices.sql b/services/core/migrations/000005_devices.sql
deleted file mode 100644
index 514bfc0fe..000000000
--- a/services/core/migrations/000005_devices.sql
+++ /dev/null
@@ -1,20 +0,0 @@
--- +goose Up
-CREATE TABLE devices (
-    id uuid PRIMARY KEY,
-    tenant_id uuid NOT NULL,
-    name text NOT NULL,
-    credential_hash text NOT NULL CHECK (credential_hash ~ '^[0-9a-f]{64}$'),
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    last_seen_at timestamptz,
-    revoked_at timestamptz
-);
-CREATE INDEX devices_tenant_idx ON devices (tenant_id);
-
-CREATE TABLE session_devices (
-    session_id uuid PRIMARY KEY REFERENCES sessions(id),
-    device_id uuid NOT NULL REFERENCES devices(id)
-);
-
--- +goose Down
-DROP TABLE session_devices;
-DROP TABLE devices;
diff --git a/services/core/migrations/000006_native_sessions.sql b/services/core/migrations/000006_native_sessions.sql
deleted file mode 100644
index 05ca6bf5e..000000000
--- a/services/core/migrations/000006_native_sessions.sql
+++ /dev/null
@@ -1,5 +0,0 @@
--- +goose Up
-ALTER TABLE session_devices ADD COLUMN native_session_id text NOT NULL DEFAULT '';
-
--- +goose Down
-ALTER TABLE session_devices DROP COLUMN native_session_id;
diff --git a/services/core/migrations/000007_turn_events.sql b/services/core/migrations/000007_turn_events.sql
deleted file mode 100644
index 2a73d02b9..000000000
--- a/services/core/migrations/000007_turn_events.sql
+++ /dev/null
@@ -1,19 +0,0 @@
--- +goose Up
-ALTER TABLE turns ADD COLUMN event_count integer NOT NULL DEFAULT 0;
-ALTER TABLE turns ADD COLUMN event_bytes bigint NOT NULL DEFAULT 0;
-
-CREATE TABLE turn_events (
-    session_id uuid NOT NULL,
-    turn_id uuid NOT NULL,
-    ordinal integer NOT NULL CHECK (ordinal > 0),
-    kind text NOT NULL,
-    payload jsonb NOT NULL CHECK (jsonb_typeof(payload) = 'object'),
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    PRIMARY KEY (turn_id, ordinal),
-    FOREIGN KEY (session_id, turn_id) REFERENCES turns(session_id, id)
-);
-
--- +goose Down
-DROP TABLE turn_events;
-ALTER TABLE turns DROP COLUMN event_bytes;
-ALTER TABLE turns DROP COLUMN event_count;
diff --git a/services/core/migrations/000008_session_items.sql b/services/core/migrations/000008_session_items.sql
deleted file mode 100644
index c0e680bea..000000000
--- a/services/core/migrations/000008_session_items.sql
+++ /dev/null
@@ -1,26 +0,0 @@
--- +goose Up
-ALTER TABLE turns ADD COLUMN items_indexed boolean NOT NULL DEFAULT false;
-ALTER TABLE turns ALTER COLUMN items_indexed SET DEFAULT true;
-
-CREATE TABLE session_items (
-    id uuid PRIMARY KEY,
-    session_id uuid NOT NULL,
-    turn_id uuid NOT NULL,
-    created_at timestamptz NOT NULL,
-    position integer NOT NULL DEFAULT 0,
-    payload jsonb NOT NULL CHECK (jsonb_typeof(payload) = 'object'),
-    FOREIGN KEY (session_id, turn_id) REFERENCES turns(session_id, id)
-);
-CREATE INDEX session_items_page_idx ON session_items(session_id, created_at, position, id);
-CREATE INDEX session_items_turn_idx ON session_items(turn_id);
-
-CREATE INDEX turns_unindexed_items_idx ON turns(session_id, created_at, id) WHERE NOT items_indexed;
-CREATE INDEX turn_inputs_item_history_idx ON turn_inputs(turn_id, created_at, sequence) WHERE kind = 'message';
-CREATE INDEX turn_events_item_history_idx ON turn_events(turn_id, created_at, ordinal);
-
--- +goose Down
-DROP INDEX turn_events_item_history_idx;
-DROP INDEX turn_inputs_item_history_idx;
-DROP INDEX turns_unindexed_items_idx;
-DROP TABLE session_items;
-ALTER TABLE turns DROP COLUMN items_indexed;
diff --git a/services/core/migrations/000009_execution_queue.sql b/services/core/migrations/000009_execution_queue.sql
deleted file mode 100644
index 60bc6284e..000000000
--- a/services/core/migrations/000009_execution_queue.sql
+++ /dev/null
@@ -1,6 +0,0 @@
--- +goose Up
-CREATE INDEX turns_execution_queue_idx ON turns (status, id)
-WHERE status IN ('queued', 'in_progress', 'waiting');
-
--- +goose Down
-DROP INDEX turns_execution_queue_idx;
diff --git a/services/core/migrations/000010_token_usage.sql b/services/core/migrations/000010_token_usage.sql
deleted file mode 100644
index c9bad6629..000000000
--- a/services/core/migrations/000010_token_usage.sql
+++ /dev/null
@@ -1,5 +0,0 @@
--- +goose Up
-ALTER TABLE turns ADD COLUMN token_usage jsonb;
-
--- +goose Down
-ALTER TABLE turns DROP COLUMN token_usage;
diff --git a/services/core/migrations/000011_item_order.sql b/services/core/migrations/000011_item_order.sql
deleted file mode 100644
index 0b6ac41c2..000000000
--- a/services/core/migrations/000011_item_order.sql
+++ /dev/null
@@ -1,23 +0,0 @@
--- +goose Up
-ALTER TABLE session_items ADD COLUMN output_index integer CHECK (output_index >= 0);
-
-WITH ordered AS (
-    SELECT id,
-        (row_number() OVER (PARTITION BY session_id ORDER BY created_at, position, id) - 1)::integer AS item_position,
-        CASE WHEN payload->>'role' IS DISTINCT FROM 'user' THEN
-            (count(*) FILTER (WHERE payload->>'role' IS DISTINCT FROM 'user') OVER (
-                PARTITION BY turn_id ORDER BY created_at, position, id ROWS UNBOUNDED PRECEDING
-            ) - 1)::integer
-        END AS output_index
-    FROM session_items
-)
-UPDATE session_items i SET position = ordered.item_position, output_index = ordered.output_index
-FROM ordered WHERE i.id = ordered.id;
-
-CREATE UNIQUE INDEX session_items_position_idx ON session_items(session_id, position);
-CREATE UNIQUE INDEX session_items_output_idx ON session_items(turn_id, output_index);
-
--- +goose Down
-DROP INDEX session_items_output_idx;
-DROP INDEX session_items_position_idx;
-ALTER TABLE session_items DROP COLUMN output_index;
diff --git a/services/core/migrations/000012_session_events.sql b/services/core/migrations/000012_session_events.sql
deleted file mode 100644
index a23e6c664..000000000
--- a/services/core/migrations/000012_session_events.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- +goose Up
-ALTER TABLE sessions ADD COLUMN event_sequence bigint NOT NULL DEFAULT 0;
-CREATE TABLE session_events (
-    session_id uuid NOT NULL REFERENCES sessions(id),
-    sequence bigint NOT NULL,
-    payload jsonb NOT NULL,
-    payload_bytes integer GENERATED ALWAYS AS (octet_length(payload::text)) STORED,
-    PRIMARY KEY (session_id, sequence)
-);
-
--- +goose Down
-DROP TABLE session_events;
-ALTER TABLE sessions DROP COLUMN event_sequence;
diff --git a/services/core/migrations/000013_function_calls.sql b/services/core/migrations/000013_function_calls.sql
deleted file mode 100644
index f514e456b..000000000
--- a/services/core/migrations/000013_function_calls.sql
+++ /dev/null
@@ -1,21 +0,0 @@
--- +goose Up
-CREATE TABLE function_calls (
-    session_id uuid NOT NULL,
-    turn_id uuid NOT NULL,
-    call_id text NOT NULL,
-    executor_call_id text NOT NULL,
-    name text NOT NULL,
-    arguments jsonb NOT NULL,
-    result jsonb,
-    applied boolean NOT NULL DEFAULT false,
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    PRIMARY KEY (session_id, turn_id, call_id),
-    UNIQUE (session_id, turn_id, executor_call_id),
-    FOREIGN KEY (session_id, turn_id) REFERENCES turns(session_id, id),
-    CHECK (result IS NULL OR jsonb_typeof(result) = 'object'),
-    CHECK (NOT applied OR result IS NOT NULL)
-);
-CREATE INDEX function_calls_pending_idx ON function_calls(session_id, turn_id) WHERE NOT applied;
-
--- +goose Down
-DROP TABLE function_calls;
diff --git a/services/core/migrations/000014_function_inputs.sql b/services/core/migrations/000014_function_inputs.sql
deleted file mode 100644
index e185df786..000000000
--- a/services/core/migrations/000014_function_inputs.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- +goose Up
-ALTER TABLE turn_inputs DROP CONSTRAINT turn_inputs_kind_check;
-ALTER TABLE turn_inputs ADD CONSTRAINT turn_inputs_kind_check
-    CHECK (kind IN ('message', 'cancel', 'tool_result'));
-ALTER TABLE turn_inputs ADD CONSTRAINT turn_inputs_function_turn_check
-    CHECK (kind <> 'tool_result' OR turn_id IS NOT NULL);
-
--- +goose Down
--- Refuse a downgrade with saved function inputs rather than delete retry history.
-ALTER TABLE turn_inputs DROP CONSTRAINT turn_inputs_kind_check;
-ALTER TABLE turn_inputs ADD CONSTRAINT turn_inputs_kind_check
-    CHECK (kind IN ('message', 'cancel'));
-ALTER TABLE turn_inputs DROP CONSTRAINT turn_inputs_function_turn_check;
diff --git a/services/core/migrations/000015_retire_item_backfill.sql b/services/core/migrations/000015_retire_item_backfill.sql
deleted file mode 100644
index 16ad3e312..000000000
--- a/services/core/migrations/000015_retire_item_backfill.sql
+++ /dev/null
@@ -1,16 +0,0 @@
--- +goose Up
-LOCK TABLE turns IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM turns WHERE NOT items_indexed) THEN
-        RAISE EXCEPTION 'Unindexed Agents API history: prepare all Session Items with release 906069e before upgrading; see services/agents-api/README.md';
-    END IF;
-END
-$$;
--- +goose StatementEnd
-ALTER TABLE turns DROP COLUMN items_indexed;
-
--- +goose Down
-ALTER TABLE turns ADD COLUMN items_indexed boolean NOT NULL DEFAULT true;
-CREATE INDEX turns_unindexed_items_idx ON turns(session_id, created_at, id) WHERE NOT items_indexed;
diff --git a/services/core/migrations/000016_agents.sql b/services/core/migrations/000016_agents.sql
deleted file mode 100644
index 0a72c5b91..000000000
--- a/services/core/migrations/000016_agents.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- +goose Up
-CREATE TABLE agents (
-    id uuid PRIMARY KEY,
-    tenant_id uuid NOT NULL,
-    metadata jsonb NOT NULL CHECK (jsonb_typeof(metadata) = 'object'),
-    configuration jsonb NOT NULL CHECK (jsonb_typeof(configuration) = 'object'),
-    created_at timestamptz NOT NULL DEFAULT statement_timestamp(),
-    updated_at timestamptz NOT NULL DEFAULT statement_timestamp()
-);
-CREATE INDEX agents_tenant_created_idx ON agents (tenant_id, created_at DESC, id DESC);
-
--- +goose Down
-DROP TABLE agents;
diff --git a/services/core/migrations/000017_session_creation_identity.sql b/services/core/migrations/000017_session_creation_identity.sql
deleted file mode 100644
index d2a72e176..000000000
--- a/services/core/migrations/000017_session_creation_identity.sql
+++ /dev/null
@@ -1,6 +0,0 @@
--- +goose Up
-ALTER TABLE sessions ADD COLUMN creation_request_hash text
-    CHECK (creation_request_hash ~ '^[0-9a-f]{64}$');
-
--- +goose Down
-ALTER TABLE sessions DROP COLUMN creation_request_hash;
diff --git a/services/core/migrations/000018_session_agent_filter.sql b/services/core/migrations/000018_session_agent_filter.sql
deleted file mode 100644
index acad6ec8c..000000000
--- a/services/core/migrations/000018_session_agent_filter.sql
+++ /dev/null
@@ -1,6 +0,0 @@
--- +goose Up
-CREATE INDEX sessions_tenant_agent_created_idx
-ON sessions (tenant_id, (configuration #>> '{agent,id}'), created_at DESC, id DESC);
-
--- +goose Down
-DROP INDEX sessions_tenant_agent_created_idx;
diff --git a/services/core/migrations/000019_session_deletion.sql b/services/core/migrations/000019_session_deletion.sql
deleted file mode 100644
index ec0388c3b..000000000
--- a/services/core/migrations/000019_session_deletion.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- +goose Up
-ALTER TABLE sessions ADD COLUMN deleted_at timestamptz;
-
--- +goose Down
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM sessions WHERE deleted_at IS NOT NULL) THEN
-        RAISE EXCEPTION 'Cannot remove Session deletion markers while deleted Sessions exist';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE sessions DROP COLUMN deleted_at;
diff --git a/services/core/migrations/000020_environments.sql b/services/core/migrations/000020_environments.sql
deleted file mode 100644
index 91a41dd7d..000000000
--- a/services/core/migrations/000020_environments.sql
+++ /dev/null
@@ -1,20 +0,0 @@
--- +goose Up
-CREATE TABLE environments (
-    id uuid PRIMARY KEY,
-    session_id uuid NOT NULL UNIQUE REFERENCES sessions(id),
-    status text NOT NULL DEFAULT 'pending'
-        CHECK (status IN ('pending', 'connected', 'disconnected', 'expired', 'failed')),
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp()
-);
-
--- +goose Down
-LOCK TABLE environments IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM environments) THEN
-        RAISE EXCEPTION 'Cannot remove durable Environment identities while Environments exist';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP TABLE environments;
diff --git a/services/core/migrations/000021_environment_executor_credentials.sql b/services/core/migrations/000021_environment_executor_credentials.sql
deleted file mode 100644
index aa2aa38c5..000000000
--- a/services/core/migrations/000021_environment_executor_credentials.sql
+++ /dev/null
@@ -1,10 +0,0 @@
--- +goose Up
-CREATE TABLE environment_executor_credentials (
-    environment_id uuid PRIMARY KEY REFERENCES environments(id),
-    token_sha256 text NOT NULL UNIQUE CHECK (token_sha256 ~ '^[0-9a-f]{64}$'),
-    issued_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    revoked_at timestamptz
-);
-
--- +goose Down
-DROP TABLE environment_executor_credentials;
diff --git a/services/core/migrations/000022_environment_input_reservations.sql b/services/core/migrations/000022_environment_input_reservations.sql
deleted file mode 100644
index ac7ae1dbf..000000000
--- a/services/core/migrations/000022_environment_input_reservations.sql
+++ /dev/null
@@ -1,29 +0,0 @@
--- +goose Up
-CREATE TABLE environment_input_reservations (
-    id uuid PRIMARY KEY,
-    session_id uuid NOT NULL REFERENCES environments(session_id),
-    idempotency_key text NOT NULL,
-    batch jsonb NOT NULL CHECK (CASE WHEN jsonb_typeof(batch) = 'array'
-        THEN jsonb_array_length(batch) BETWEEN 1 AND 64 ELSE false END),
-    state text NOT NULL DEFAULT 'pending'
-        CHECK (state IN ('pending', 'admitted', 'expired', 'cancelled')),
-    created_at timestamptz NOT NULL,
-    deadline timestamptz NOT NULL,
-    settled_at timestamptz,
-    UNIQUE (session_id, idempotency_key),
-    CHECK ((settled_at IS NOT NULL) = (state <> 'pending'))
-);
-CREATE UNIQUE INDEX environment_input_reservations_one_pending_idx
-    ON environment_input_reservations(session_id) WHERE state = 'pending';
-
--- +goose Down
-LOCK TABLE environment_input_reservations IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM environment_input_reservations) THEN
-        RAISE EXCEPTION 'Cannot remove durable Environment input identities while reservations exist';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP TABLE environment_input_reservations;
diff --git a/services/core/migrations/000023_environment_input_expiry_index.sql b/services/core/migrations/000023_environment_input_expiry_index.sql
deleted file mode 100644
index 1054e6d32..000000000
--- a/services/core/migrations/000023_environment_input_expiry_index.sql
+++ /dev/null
@@ -1,6 +0,0 @@
--- +goose Up
-CREATE INDEX environment_input_reservations_pending_deadline_idx
-    ON environment_input_reservations(deadline, id) WHERE state = 'pending';
-
--- +goose Down
-DROP INDEX environment_input_reservations_pending_deadline_idx;
diff --git a/services/core/migrations/000024_execution_project_scopes.sql b/services/core/migrations/000024_execution_project_scopes.sql
deleted file mode 100644
index 479fb3099..000000000
--- a/services/core/migrations/000024_execution_project_scopes.sql
+++ /dev/null
@@ -1,10 +0,0 @@
--- +goose Up
-CREATE TABLE execution_project_scopes (
-    tenant_id uuid PRIMARY KEY CHECK (tenant_id <> '00000000-0000-0000-0000-000000000000'),
-    organization_id text NOT NULL CHECK (organization_id <> ''),
-    project_id text NOT NULL CHECK (project_id <> ''),
-    UNIQUE (organization_id, project_id)
-);
-
--- +goose Down
-DROP TABLE execution_project_scopes;
diff --git a/services/core/migrations/000025_session_creators.sql b/services/core/migrations/000025_session_creators.sql
deleted file mode 100644
index f1b7b60ec..000000000
--- a/services/core/migrations/000025_session_creators.sql
+++ /dev/null
@@ -1,15 +0,0 @@
--- +goose Up
-ALTER TABLE sessions
-    ADD COLUMN creator_kind text,
-    ADD COLUMN creator_id text,
-    ADD CONSTRAINT sessions_creator_complete CHECK (
-        (creator_kind IS NULL AND creator_id IS NULL)
-        OR (creator_kind IS NOT NULL AND creator_id IS NOT NULL
-            AND creator_kind IN ('user', 'service_account') AND creator_id <> '')
-    );
-
--- +goose Down
-ALTER TABLE sessions
-    DROP CONSTRAINT sessions_creator_complete,
-    DROP COLUMN creator_kind,
-    DROP COLUMN creator_id;
diff --git a/services/core/migrations/000026_executor_principals.sql b/services/core/migrations/000026_executor_principals.sql
deleted file mode 100644
index 57699d6db..000000000
--- a/services/core/migrations/000026_executor_principals.sql
+++ /dev/null
@@ -1,43 +0,0 @@
--- +goose Up
-ALTER TABLE environment_executor_credentials
-    ADD COLUMN key_id uuid,
-    ADD COLUMN tenant_id uuid REFERENCES execution_project_scopes(tenant_id),
-    ADD COLUMN subject_kind text,
-    ADD COLUMN subject_id text,
-    ADD COLUMN created_at timestamptz;
-
-UPDATE environment_executor_credentials
-SET key_id = environment_id, revoked_at = COALESCE(revoked_at, clock_timestamp());
-
-ALTER TABLE environment_executor_credentials
-    DROP CONSTRAINT environment_executor_credentials_pkey,
-    ALTER COLUMN environment_id DROP NOT NULL,
-    ALTER COLUMN key_id SET NOT NULL,
-    ADD PRIMARY KEY (key_id),
-    ADD CONSTRAINT executor_principal_complete CHECK (
-        (tenant_id IS NULL AND subject_kind IS NULL AND subject_id IS NULL
-            AND environment_id IS NOT NULL AND revoked_at IS NOT NULL AND created_at IS NULL)
-        OR (tenant_id IS NOT NULL AND subject_kind IS NOT NULL AND subject_id IS NOT NULL
-            AND subject_kind IN ('user', 'service_account') AND subject_id <> '' AND created_at IS NOT NULL)
-    );
-
--- +goose Down
-LOCK TABLE environment_executor_credentials IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM environment_executor_credentials WHERE tenant_id IS NOT NULL) THEN
-        RAISE EXCEPTION 'Cannot remove durable executor principal identities while principal keys exist';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE environment_executor_credentials
-    DROP CONSTRAINT executor_principal_complete,
-    DROP CONSTRAINT environment_executor_credentials_pkey,
-    ALTER COLUMN environment_id SET NOT NULL,
-    ADD PRIMARY KEY (environment_id),
-    DROP COLUMN key_id,
-    DROP COLUMN tenant_id,
-    DROP COLUMN subject_kind,
-    DROP COLUMN subject_id,
-    DROP COLUMN created_at;
diff --git a/services/core/migrations/000027_environment_connections.sql b/services/core/migrations/000027_environment_connections.sql
deleted file mode 100644
index 80633e958..000000000
--- a/services/core/migrations/000027_environment_connections.sql
+++ /dev/null
@@ -1,18 +0,0 @@
--- +goose Up
-CREATE TABLE environment_connections (
-    environment_id uuid PRIMARY KEY REFERENCES environments(id),
-    generation uuid NOT NULL,
-    revision bigint NOT NULL DEFAULT 0 CHECK (revision >= 0)
-);
-
--- +goose Down
-LOCK TABLE environment_connections IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM environment_connections) THEN
-        RAISE EXCEPTION 'Cannot remove active Environment observation fencing';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP TABLE environment_connections;
diff --git a/services/core/migrations/000028_environment_input_activity.sql b/services/core/migrations/000028_environment_input_activity.sql
deleted file mode 100644
index 9de50b52a..000000000
--- a/services/core/migrations/000028_environment_input_activity.sql
+++ /dev/null
@@ -1,6 +0,0 @@
--- +goose Up
-CREATE INDEX environment_input_reservations_latest_idx
-ON environment_input_reservations(session_id, created_at DESC, id DESC);
-
--- +goose Down
-DROP INDEX environment_input_reservations_latest_idx;
diff --git a/services/core/migrations/000029_environment_initial_input.sql b/services/core/migrations/000029_environment_initial_input.sql
deleted file mode 100644
index d846250ba..000000000
--- a/services/core/migrations/000029_environment_initial_input.sql
+++ /dev/null
@@ -1,15 +0,0 @@
--- +goose Up
-ALTER TABLE environment_input_reservations
-ADD COLUMN is_initial boolean NOT NULL DEFAULT false;
-
--- +goose Down
-LOCK TABLE environment_input_reservations IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM environment_input_reservations WHERE is_initial) THEN
-        RAISE EXCEPTION 'Cannot remove initial Environment input origin while initial reservations exist';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE environment_input_reservations DROP COLUMN is_initial;
diff --git a/services/core/migrations/000030_vaults.sql b/services/core/migrations/000030_vaults.sql
deleted file mode 100644
index 5f3f7c439..000000000
--- a/services/core/migrations/000030_vaults.sql
+++ /dev/null
@@ -1,11 +0,0 @@
--- +goose Up
-CREATE TABLE vaults (
-    id uuid PRIMARY KEY,
-    tenant_id uuid NOT NULL,
-    name text CHECK (name IS NULL OR octet_length(name) BETWEEN 1 AND 256),
-    metadata jsonb NOT NULL CHECK (jsonb_typeof(metadata) = 'object'),
-    created_at timestamptz NOT NULL DEFAULT statement_timestamp()
-);
-
--- +goose Down
-DROP TABLE vaults;
diff --git a/services/core/migrations/000031_vault_credentials.sql b/services/core/migrations/000031_vault_credentials.sql
deleted file mode 100644
index 65e87e3bb..000000000
--- a/services/core/migrations/000031_vault_credentials.sql
+++ /dev/null
@@ -1,14 +0,0 @@
--- +goose Up
-CREATE TABLE vault_credentials (
-    id uuid PRIMARY KEY,
-    vault_id uuid NOT NULL REFERENCES vaults(id) ON DELETE CASCADE,
-    name text NOT NULL CHECK (octet_length(name) BETWEEN 1 AND 256),
-    auth_type text NOT NULL CHECK (auth_type = 'static_bearer'),
-    mcp_server_url text NOT NULL,
-    token_ciphertext bytea NOT NULL CHECK (octet_length(token_ciphertext) > 0),
-    created_at timestamptz NOT NULL DEFAULT statement_timestamp(),
-    updated_at timestamptz NOT NULL DEFAULT statement_timestamp()
-);
-
--- +goose Down
-DROP TABLE vault_credentials;
diff --git a/services/core/migrations/000032_vault_status.sql b/services/core/migrations/000032_vault_status.sql
deleted file mode 100644
index 30a2de62b..000000000
--- a/services/core/migrations/000032_vault_status.sql
+++ /dev/null
@@ -1,16 +0,0 @@
--- +goose Up
-ALTER TABLE vaults ADD COLUMN status text NOT NULL DEFAULT 'active'
-    CHECK (status IN ('active', 'archived'));
-CREATE INDEX vaults_tenant_created_id_idx ON vaults (tenant_id, created_at, id);
-
--- +goose Down
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM vaults WHERE status = 'archived') THEN
-        RAISE EXCEPTION 'Cannot remove archived Vault classification';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP INDEX vaults_tenant_created_id_idx;
-ALTER TABLE vaults DROP COLUMN status;
diff --git a/services/core/migrations/000033_credential_status.sql b/services/core/migrations/000033_credential_status.sql
deleted file mode 100644
index d3a315c29..000000000
--- a/services/core/migrations/000033_credential_status.sql
+++ /dev/null
@@ -1,17 +0,0 @@
--- +goose Up
-ALTER TABLE vault_credentials ADD COLUMN status text NOT NULL DEFAULT 'active'
-    CHECK (status IN ('active', 'archived'));
-CREATE INDEX vault_credentials_vault_created_id_idx ON vault_credentials (vault_id, created_at, id);
-
--- +goose Down
--- +goose StatementBegin
-DO $$
-BEGIN
-    LOCK TABLE vault_credentials IN ACCESS EXCLUSIVE MODE;
-    IF EXISTS (SELECT 1 FROM vault_credentials WHERE status = 'archived') THEN
-        RAISE EXCEPTION 'Cannot remove archived Credential classification';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP INDEX vault_credentials_vault_created_id_idx;
-ALTER TABLE vault_credentials DROP COLUMN status;
diff --git a/services/core/migrations/000034_subagent_identities.sql b/services/core/migrations/000034_subagent_identities.sql
deleted file mode 100644
index 300ca88d9..000000000
--- a/services/core/migrations/000034_subagent_identities.sql
+++ /dev/null
@@ -1,19 +0,0 @@
--- +goose Up
-CREATE TABLE subagent_identities (
-    id uuid PRIMARY KEY,
-    session_id uuid NOT NULL REFERENCES sessions(id),
-    device_id uuid NOT NULL REFERENCES devices(id),
-    engine text NOT NULL,
-    native_id text NOT NULL CHECK (native_id <> ''),
-    parent_native_id text NOT NULL CHECK (parent_native_id <> '' AND parent_native_id <> native_id),
-    native_created_at bigint NOT NULL CHECK (native_created_at > 0),
-    first_turn_id uuid NOT NULL,
-    first_event_ordinal integer NOT NULL,
-    UNIQUE (device_id, engine, native_id),
-    UNIQUE (session_id, native_id),
-    FOREIGN KEY (session_id, first_turn_id) REFERENCES turns(session_id, id),
-    FOREIGN KEY (first_turn_id, first_event_ordinal) REFERENCES turn_events(turn_id, ordinal)
-);
-
--- +goose Down
-DROP TABLE subagent_identities;
diff --git a/services/core/migrations/000035_local_environment_devices.sql b/services/core/migrations/000035_local_environment_devices.sql
deleted file mode 100644
index a473681bf..000000000
--- a/services/core/migrations/000035_local_environment_devices.sql
+++ /dev/null
@@ -1,14 +0,0 @@
--- +goose Up
-ALTER TABLE devices ADD COLUMN environment_id uuid UNIQUE REFERENCES environments(id);
-
--- +goose Down
-LOCK TABLE devices IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM devices WHERE environment_id IS NOT NULL) THEN
-        RAISE EXCEPTION 'Cannot discard dedicated Environment device authority';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE devices DROP COLUMN environment_id;
diff --git a/services/core/migrations/000036_environment_file_writes.sql b/services/core/migrations/000036_environment_file_writes.sql
deleted file mode 100644
index 4c8a04f19..000000000
--- a/services/core/migrations/000036_environment_file_writes.sql
+++ /dev/null
@@ -1,25 +0,0 @@
--- +goose Up
-CREATE TABLE environment_file_writes (
-    id uuid PRIMARY KEY,
-    environment_id uuid NOT NULL REFERENCES environments(id),
-    device_id uuid NOT NULL REFERENCES devices(id),
-    request_sha256 text NOT NULL CHECK (request_sha256 ~ '^[0-9a-f]{64}$'),
-    state text NOT NULL DEFAULT 'pending' CHECK (state IN ('pending', 'committed', 'rejected')),
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    settled_at timestamptz,
-    CHECK ((state = 'pending') = (settled_at IS NULL))
-);
-CREATE UNIQUE INDEX environment_file_writes_pending ON environment_file_writes(environment_id)
-    WHERE state = 'pending';
-
--- +goose Down
-LOCK TABLE environment_file_writes IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM environment_file_writes) THEN
-        RAISE EXCEPTION 'Cannot remove durable Environment file write identities while writes exist';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP TABLE environment_file_writes;
diff --git a/services/core/migrations/000037_source_files.sql b/services/core/migrations/000037_source_files.sql
deleted file mode 100644
index 68d1f6220..000000000
--- a/services/core/migrations/000037_source_files.sql
+++ /dev/null
@@ -1,21 +0,0 @@
--- +goose Up
-CREATE TABLE source_files (
-    id uuid PRIMARY KEY,
-    tenant_id uuid NOT NULL,
-    filename text NOT NULL CHECK (octet_length(filename) BETWEEN 1 AND 1024),
-    purpose text NOT NULL CHECK (purpose = 'user_data'),
-    body_oid oid NOT NULL UNIQUE,
-    size_bytes bigint NOT NULL CHECK (size_bytes BETWEEN 0 AND 536870912),
-    sha256 text NOT NULL CHECK (sha256 ~ '^[0-9a-f]{64}$'),
-    created_at timestamptz NOT NULL DEFAULT statement_timestamp()
-);
-
--- +goose Down
--- +goose StatementBegin
-DO $$ BEGIN
-    IF EXISTS (SELECT 1 FROM source_files) THEN
-        RAISE EXCEPTION 'delete source files through the service before downgrade';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP TABLE source_files;
diff --git a/services/core/migrations/000038_runtime_allocations.sql b/services/core/migrations/000038_runtime_allocations.sql
deleted file mode 100644
index 3921fefc5..000000000
--- a/services/core/migrations/000038_runtime_allocations.sql
+++ /dev/null
@@ -1,27 +0,0 @@
--- +goose Up
-CREATE TABLE runtime_allocations (
-    id uuid PRIMARY KEY,
-    environment_id uuid NOT NULL UNIQUE REFERENCES environments(id),
-    device_id uuid NOT NULL UNIQUE REFERENCES devices(id),
-    provider_key uuid NOT NULL,
-    state text NOT NULL DEFAULT 'creating'
-        CHECK (state IN ('creating', 'running', 'cleanup_pending', 'released')),
-    create_settled boolean NOT NULL DEFAULT false,
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    kept_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    released_at timestamptz,
-    CHECK ((state = 'released') = (released_at IS NOT NULL)),
-    CHECK (state <> 'released' OR create_settled)
-);
-
--- +goose Down
-LOCK TABLE runtime_allocations IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_allocations) THEN
-        RAISE EXCEPTION 'Cannot discard managed Runtime allocation and cleanup identities';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP TABLE runtime_allocations;
diff --git a/services/core/migrations/000039_environment_input_failure.sql b/services/core/migrations/000039_environment_input_failure.sql
deleted file mode 100644
index 10b6b24a8..000000000
--- a/services/core/migrations/000039_environment_input_failure.sql
+++ /dev/null
@@ -1,10 +0,0 @@
--- +goose Up
-ALTER TABLE environment_input_reservations DROP CONSTRAINT environment_input_reservations_state_check;
-ALTER TABLE environment_input_reservations ADD CONSTRAINT environment_input_reservations_state_check
-    CHECK (state IN ('pending', 'admitted', 'expired', 'cancelled', 'failed'));
-
--- +goose Down
--- The constraint refuses rollback while failed outcomes still need to be retained.
-ALTER TABLE environment_input_reservations DROP CONSTRAINT environment_input_reservations_state_check;
-ALTER TABLE environment_input_reservations ADD CONSTRAINT environment_input_reservations_state_check
-    CHECK (state IN ('pending', 'admitted', 'expired', 'cancelled'));
diff --git a/services/core/migrations/000040_session_artifacts.sql b/services/core/migrations/000040_session_artifacts.sql
deleted file mode 100644
index ac739682c..000000000
--- a/services/core/migrations/000040_session_artifacts.sql
+++ /dev/null
@@ -1,28 +0,0 @@
--- +goose Up
-ALTER TABLE turns ADD COLUMN artifact_capture_started boolean NOT NULL DEFAULT false;
-CREATE TABLE session_artifacts (
-    id uuid PRIMARY KEY,
-    session_id uuid NOT NULL REFERENCES sessions(id),
-    turn_id uuid NOT NULL,
-    environment_id uuid NOT NULL REFERENCES environments(id),
-    path text NOT NULL CHECK (octet_length(path) BETWEEN 20 AND 4110),
-    size_bytes bigint NOT NULL CHECK (size_bytes BETWEEN 0 AND 209715200),
-    body_oid oid NOT NULL UNIQUE,
-    sha256 text NOT NULL CHECK (sha256 ~ '^[0-9a-f]{64}$'),
-    created_at timestamptz,
-    UNIQUE (turn_id, path),
-    FOREIGN KEY (session_id, turn_id) REFERENCES turns(session_id, id)
-);
-CREATE INDEX session_artifacts_page_idx ON session_artifacts (session_id, created_at DESC, id DESC)
-WHERE created_at IS NOT NULL;
-
--- +goose Down
--- +goose StatementBegin
-DO $$ BEGIN
-    IF EXISTS (SELECT 1 FROM session_artifacts) THEN
-        RAISE EXCEPTION 'delete session artifacts through the service before downgrade';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP TABLE session_artifacts;
-ALTER TABLE turns DROP COLUMN artifact_capture_started;
diff --git a/services/core/migrations/000041_source_files_list.sql b/services/core/migrations/000041_source_files_list.sql
deleted file mode 100644
index 2a645f287..000000000
--- a/services/core/migrations/000041_source_files_list.sql
+++ /dev/null
@@ -1,5 +0,0 @@
--- +goose Up
-CREATE INDEX source_files_page_idx ON source_files (tenant_id, created_at DESC, id DESC);
-
--- +goose Down
-DROP INDEX source_files_page_idx;
diff --git a/services/core/migrations/000042_environment_templates.sql b/services/core/migrations/000042_environment_templates.sql
deleted file mode 100644
index fb772148d..000000000
--- a/services/core/migrations/000042_environment_templates.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- +goose Up
-CREATE TABLE environment_templates (
-    id uuid PRIMARY KEY,
-    tenant_id uuid NOT NULL,
-    name text CHECK (name IS NULL OR char_length(name) BETWEEN 1 AND 256),
-    network_access text NOT NULL CHECK (network_access IN ('enabled', 'disabled')),
-    created_at timestamptz NOT NULL DEFAULT statement_timestamp(),
-    updated_at timestamptz NOT NULL DEFAULT statement_timestamp()
-);
-CREATE INDEX environment_templates_tenant_order ON environment_templates (tenant_id, created_at, id);
-
--- +goose Down
-DROP TABLE environment_templates;
diff --git a/services/core/migrations/000043_environment_initial_files.sql b/services/core/migrations/000043_environment_initial_files.sql
deleted file mode 100644
index 66d29483f..000000000
--- a/services/core/migrations/000043_environment_initial_files.sql
+++ /dev/null
@@ -1,20 +0,0 @@
--- +goose Up
-ALTER TABLE environment_templates ADD COLUMN files jsonb NOT NULL DEFAULT '[]'::jsonb CHECK (jsonb_typeof(files) = 'array');
-ALTER TABLE environment_templates ADD COLUMN file_contents bytea;
-CREATE TABLE initial_environment_files (
-    id uuid PRIMARY KEY,
-    session_id uuid NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
-    position integer NOT NULL CHECK (position BETWEEN 0 AND 49),
-    path text NOT NULL,
-    size_bytes bigint NOT NULL CHECK (size_bytes BETWEEN 0 AND 52428800),
-    contents bytea NOT NULL,
-    UNIQUE (session_id, position),
-    UNIQUE (session_id, path)
-);
-ALTER TABLE runtime_allocations ADD COLUMN initialization text NOT NULL DEFAULT 'complete'
-    CHECK (initialization IN ('pending', 'running', 'complete'));
-
--- +goose Down
-ALTER TABLE runtime_allocations DROP COLUMN initialization;
-DROP TABLE initial_environment_files;
-ALTER TABLE environment_templates DROP COLUMN file_contents, DROP COLUMN files;
diff --git a/services/core/migrations/000044_environment_setup.sql b/services/core/migrations/000044_environment_setup.sql
deleted file mode 100644
index 859a7471d..000000000
--- a/services/core/migrations/000044_environment_setup.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- +goose Up
-ALTER TABLE environment_templates
-    ADD COLUMN packages jsonb NOT NULL DEFAULT '{"npm":[],"python":[],"system":[]}'::jsonb CHECK (jsonb_typeof(packages) = 'object'),
-    ADD COLUMN env_contents bytea,
-    ADD COLUMN setup_contents bytea;
-CREATE TABLE environment_setups (
-    session_id uuid PRIMARY KEY REFERENCES sessions(id) ON DELETE CASCADE,
-    contents bytea NOT NULL
-);
-
--- +goose Down
-DROP TABLE environment_setups;
-ALTER TABLE environment_templates DROP COLUMN packages, DROP COLUMN env_contents, DROP COLUMN setup_contents;
diff --git a/services/core/migrations/000045_environment_skills.sql b/services/core/migrations/000045_environment_skills.sql
deleted file mode 100644
index dae32c831..000000000
--- a/services/core/migrations/000045_environment_skills.sql
+++ /dev/null
@@ -1,7 +0,0 @@
--- +goose Up
-ALTER TABLE environment_templates
- ADD COLUMN skills jsonb NOT NULL DEFAULT '[]'::jsonb,
- ADD COLUMN skill_contents bytea;
-
--- +goose Down
-ALTER TABLE environment_templates DROP COLUMN skill_contents, DROP COLUMN skills;
diff --git a/services/core/migrations/000046_session_model_execution.sql b/services/core/migrations/000046_session_model_execution.sql
deleted file mode 100644
index d43707456..000000000
--- a/services/core/migrations/000046_session_model_execution.sql
+++ /dev/null
@@ -1,8 +0,0 @@
--- +goose Up
-CREATE TABLE session_model_execution (
-  session_id uuid PRIMARY KEY REFERENCES sessions(id) ON DELETE CASCADE,
-  encrypted_config bytea NOT NULL
-);
-
--- +goose Down
-DROP TABLE session_model_execution;
diff --git a/services/core/migrations/000047_environment_network_domains.sql b/services/core/migrations/000047_environment_network_domains.sql
deleted file mode 100644
index b9e953444..000000000
--- a/services/core/migrations/000047_environment_network_domains.sql
+++ /dev/null
@@ -1,21 +0,0 @@
--- +goose Up
-ALTER TABLE environment_templates
-    DROP CONSTRAINT environment_templates_network_access_check,
-    ADD COLUMN network_allowed_domains text[] NOT NULL DEFAULT '{}',
-    ADD CONSTRAINT environment_templates_network_access_check
-        CHECK (network_access IN ('enabled', 'disabled', 'restricted')),
-    ADD CONSTRAINT environment_templates_network_domains_check
-        CHECK ((network_access = 'restricted' AND cardinality(network_allowed_domains) BETWEEN 1 AND 100)
-            OR (network_access IN ('enabled', 'disabled') AND cardinality(network_allowed_domains) = 0));
-
--- +goose Down
--- Refuse rollback while restricted templates exist instead of broadening authority.
-ALTER TABLE environment_templates
-    ADD CONSTRAINT environment_templates_legacy_network_check
-        CHECK (network_access IN ('enabled', 'disabled'));
-ALTER TABLE environment_templates
-    DROP CONSTRAINT environment_templates_network_domains_check,
-    DROP CONSTRAINT environment_templates_network_access_check,
-    DROP COLUMN network_allowed_domains;
-ALTER TABLE environment_templates
-    RENAME CONSTRAINT environment_templates_legacy_network_check TO environment_templates_network_access_check;
diff --git a/services/core/migrations/000048_skills.sql b/services/core/migrations/000048_skills.sql
deleted file mode 100644
index e9adef44d..000000000
--- a/services/core/migrations/000048_skills.sql
+++ /dev/null
@@ -1,37 +0,0 @@
--- +goose Up
-CREATE TABLE skills (
-    id uuid PRIMARY KEY,
-    tenant_id uuid NOT NULL,
-    name text NOT NULL,
-    description text NOT NULL,
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    default_version bigint NOT NULL CHECK (default_version > 0),
-    latest_version bigint NOT NULL CHECK (latest_version > 0),
-    next_version bigint NOT NULL CHECK (next_version > latest_version),
-    UNIQUE (tenant_id, id)
-);
-CREATE INDEX skills_tenant_created ON skills (tenant_id, created_at, id);
-
-CREATE TABLE skill_versions (
-    id uuid PRIMARY KEY,
-    tenant_id uuid NOT NULL,
-    skill_id uuid NOT NULL,
-    version bigint NOT NULL CHECK (version > 0),
-    name text NOT NULL,
-    description text NOT NULL,
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    contents bytea NOT NULL,
-    UNIQUE (skill_id, version),
-    FOREIGN KEY (tenant_id, skill_id) REFERENCES skills (tenant_id, id) ON DELETE CASCADE
-);
-ALTER TABLE skills ADD CONSTRAINT skills_default_version
- FOREIGN KEY (id, default_version) REFERENCES skill_versions (skill_id, version)
- DEFERRABLE INITIALLY DEFERRED;
-ALTER TABLE skills ADD CONSTRAINT skills_latest_version
- FOREIGN KEY (id, latest_version) REFERENCES skill_versions (skill_id, version)
- DEFERRABLE INITIALLY DEFERRED;
-
--- +goose Down
-ALTER TABLE skills DROP CONSTRAINT skills_default_version, DROP CONSTRAINT skills_latest_version;
-DROP TABLE skill_versions;
-DROP TABLE skills;
diff --git a/services/core/migrations/000049_environment_plugins.sql b/services/core/migrations/000049_environment_plugins.sql
deleted file mode 100644
index 36fb04d99..000000000
--- a/services/core/migrations/000049_environment_plugins.sql
+++ /dev/null
@@ -1,11 +0,0 @@
--- +goose Up
-ALTER TABLE environment_templates
- ADD COLUMN plugins jsonb NOT NULL DEFAULT '[]'::jsonb,
- ADD COLUMN plugin_contents bytea,
- ADD COLUMN capability_directories text[] NOT NULL DEFAULT '{}';
-
--- +goose Down
-ALTER TABLE environment_templates
- DROP COLUMN capability_directories,
- DROP COLUMN plugin_contents,
- DROP COLUMN plugins;
diff --git a/services/core/migrations/000050_runtime_enrollment.sql b/services/core/migrations/000050_runtime_enrollment.sql
deleted file mode 100644
index b263e5d79..000000000
--- a/services/core/migrations/000050_runtime_enrollment.sql
+++ /dev/null
@@ -1,40 +0,0 @@
--- +goose Up
-ALTER TABLE devices
-    ADD COLUMN executor_key_id uuid REFERENCES environment_executor_credentials(key_id),
-    ALTER COLUMN credential_hash DROP NOT NULL,
-    ADD CONSTRAINT device_credential_source CHECK (
-        (executor_key_id IS NULL AND credential_hash IS NOT NULL)
-        OR (executor_key_id IS NOT NULL AND credential_hash IS NULL AND environment_id IS NOT NULL)
-    );
-
--- Resolve the current credential once for bootstrap, reconnect and heartbeat.
-CREATE VIEW runtime_device_authority AS
-SELECT d.id, d.tenant_id, d.name, d.environment_id,
-    COALESCE(c.token_sha256, d.credential_hash) AS credential_hash
-FROM devices d
-LEFT JOIN environments e ON e.id = d.environment_id
-LEFT JOIN sessions s ON s.id = e.session_id AND s.tenant_id = d.tenant_id
-LEFT JOIN environment_executor_credentials c ON c.key_id = d.executor_key_id
-WHERE d.revoked_at IS NULL
-    AND (d.environment_id IS NULL OR (s.id IS NOT NULL AND s.deleted_at IS NULL))
-    AND (d.executor_key_id IS NULL OR (
-        c.revoked_at IS NULL AND c.tenant_id = s.tenant_id
-        AND c.subject_kind = s.creator_kind AND c.subject_id = s.creator_id
-        AND (c.environment_id IS NULL OR c.environment_id = e.id)
-        AND s.configuration->'environment'->>'type' = 'self_hosted'
-        AND e.status NOT IN ('failed', 'expired')
-        AND EXISTS (SELECT 1 FROM execution_project_scopes p WHERE p.tenant_id = c.tenant_id)
-    ));
-
--- +goose Down
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM devices WHERE executor_key_id IS NOT NULL) THEN
-        RAISE EXCEPTION 'Cannot remove Runtime enrollment while bound devices exist';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP VIEW runtime_device_authority;
-ALTER TABLE devices DROP CONSTRAINT device_credential_source,
-    DROP COLUMN executor_key_id, ALTER COLUMN credential_hash SET NOT NULL;
diff --git a/services/core/migrations/000051_subagent_resources.sql b/services/core/migrations/000051_subagent_resources.sql
deleted file mode 100644
index da1e7c15e..000000000
--- a/services/core/migrations/000051_subagent_resources.sql
+++ /dev/null
@@ -1,66 +0,0 @@
--- +goose Up
-ALTER TABLE subagent_identities
-    ADD COLUMN name text,
-    ADD COLUMN instructions text,
-    ADD COLUMN public_visible boolean NOT NULL DEFAULT false,
-    ADD COLUMN status text NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'closed')),
-    ADD COLUMN closed_at_ms bigint,
-    ADD COLUMN lifecycle_at_ms bigint NOT NULL DEFAULT 0,
-    ADD CONSTRAINT subagent_closed_state CHECK ((status = 'closed') = (closed_at_ms IS NOT NULL)),
-    ADD CONSTRAINT subagent_session_identity UNIQUE (session_id, id);
-
--- Child work is observed from the native owner; it must never enter the Core queue.
-CREATE TABLE subagent_turns (
-    id uuid PRIMARY KEY,
-    session_id uuid NOT NULL,
-    subagent_id uuid NOT NULL,
-    native_id text NOT NULL CHECK (native_id <> ''),
-    status text NOT NULL CHECK (status IN ('queued', 'in_progress', 'waiting', 'completed', 'failed', 'cancelled')),
-    created_at timestamptz NOT NULL,
-    started_at timestamptz,
-    completed_at timestamptz,
-    token_usage jsonb,
-    FOREIGN KEY (session_id, subagent_id) REFERENCES subagent_identities(session_id, id),
-    UNIQUE (subagent_id, native_id),
-    UNIQUE (session_id, subagent_id, id),
-    CHECK ((completed_at IS NOT NULL) = (status IN ('completed', 'failed', 'cancelled')))
-);
-CREATE TABLE subagent_items (
-    id uuid PRIMARY KEY,
-    session_id uuid NOT NULL,
-    subagent_id uuid NOT NULL,
-    turn_id uuid NOT NULL,
-    position integer NOT NULL CHECK (position >= 0),
-    output_index integer,
-    payload jsonb NOT NULL CHECK (jsonb_typeof(payload) = 'object'),
-    FOREIGN KEY (session_id, subagent_id, turn_id) REFERENCES subagent_turns(session_id, subagent_id, id),
-    UNIQUE (turn_id, position)
-);
-CREATE TABLE subagent_effects (
-    session_id uuid NOT NULL REFERENCES sessions(id),
-    effect_id text NOT NULL,
-    payload jsonb NOT NULL CHECK (jsonb_typeof(payload) = 'object'),
-    PRIMARY KEY (session_id, effect_id)
-);
-
-CREATE VIEW public_execution_turns AS
- SELECT id, session_id, status, created_at, started_at, completed_at, cancel_requested_at, outcome,
-        token_usage, artifact_capture_started, NULL::uuid AS subagent_id FROM turns
- UNION ALL
- SELECT id, session_id, status, created_at, started_at, completed_at, NULL::timestamptz,
-        '{}'::jsonb, token_usage, false, subagent_id FROM subagent_turns;
-
--- +goose Down
-DROP VIEW public_execution_turns;
-DROP TABLE subagent_effects;
-DROP TABLE subagent_items;
-DROP TABLE subagent_turns;
-ALTER TABLE subagent_identities
-    DROP CONSTRAINT subagent_session_identity,
-    DROP CONSTRAINT subagent_closed_state,
-    DROP COLUMN lifecycle_at_ms,
-    DROP COLUMN closed_at_ms,
-    DROP COLUMN status,
-    DROP COLUMN public_visible,
-    DROP COLUMN instructions,
-    DROP COLUMN name;
diff --git a/services/core/migrations/000052_runtime_suspension.sql b/services/core/migrations/000052_runtime_suspension.sql
deleted file mode 100644
index d99902ee0..000000000
--- a/services/core/migrations/000052_runtime_suspension.sql
+++ /dev/null
@@ -1,27 +0,0 @@
--- +goose Up
-ALTER TABLE runtime_allocations
-    ADD COLUMN compute_phase text NOT NULL DEFAULT 'disabled'
-        CHECK (compute_phase IN ('disabled', 'running', 'quiescing', 'suspending', 'suspended', 'restoring', 'waking')),
-    ADD COLUMN compute_revision bigint NOT NULL DEFAULT 0 CHECK (compute_revision >= 0),
-    ADD COLUMN compute_state jsonb NOT NULL DEFAULT '{}'::jsonb CHECK (jsonb_typeof(compute_state) = 'object'),
-    ADD COLUMN compute_activity_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    ADD COLUMN compute_wake_requested boolean NOT NULL DEFAULT false,
-    ADD COLUMN compute_retained_until timestamptz;
-
--- +goose Down
-LOCK TABLE runtime_allocations IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_allocations WHERE compute_phase <> 'disabled') THEN
-        RAISE EXCEPTION 'Cannot discard retained compute and snapshot ownership';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE runtime_allocations
-    DROP COLUMN compute_retained_until,
-    DROP COLUMN compute_wake_requested,
-    DROP COLUMN compute_activity_at,
-    DROP COLUMN compute_state,
-    DROP COLUMN compute_revision,
-    DROP COLUMN compute_phase;
diff --git a/services/core/migrations/000053_runtime_deployment.sql b/services/core/migrations/000053_runtime_deployment.sql
deleted file mode 100644
index 017ae351c..000000000
--- a/services/core/migrations/000053_runtime_deployment.sql
+++ /dev/null
@@ -1,22 +0,0 @@
--- +goose Up
-CREATE TABLE runtime_deployment (
-    singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
-    installation_id uuid,
-    backend_fingerprint text NOT NULL DEFAULT '',
-    maintenance boolean NOT NULL DEFAULT false,
-    updated_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    CHECK ((installation_id IS NULL AND backend_fingerprint = '') OR
-           (installation_id IS NOT NULL AND backend_fingerprint ~ '^[0-9a-f]{64}$'))
-);
-INSERT INTO runtime_deployment (singleton) VALUES (true);
-
--- +goose Down
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_deployment WHERE installation_id IS NOT NULL) THEN
-        RAISE EXCEPTION 'Cannot discard persisted sandbox installation identity';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP TABLE runtime_deployment;
diff --git a/services/core/migrations/000054_oauth_credentials.sql b/services/core/migrations/000054_oauth_credentials.sql
deleted file mode 100644
index 37dd72330..000000000
--- a/services/core/migrations/000054_oauth_credentials.sql
+++ /dev/null
@@ -1,17 +0,0 @@
--- +goose Up
-ALTER TABLE vault_credentials DROP CONSTRAINT vault_credentials_auth_type_check;
-ALTER TABLE vault_credentials ADD COLUMN oauth_metadata jsonb;
-ALTER TABLE vault_credentials ADD CONSTRAINT vault_credentials_auth_type_check
-    CHECK (auth_type IN ('static_bearer', 'mcp_oauth'));
-ALTER TABLE vault_credentials ADD CONSTRAINT vault_credentials_oauth_metadata_check
-    CHECK ((auth_type = 'static_bearer' AND oauth_metadata IS NULL)
-        OR (auth_type = 'mcp_oauth' AND oauth_metadata IS NOT NULL
-            AND jsonb_typeof(oauth_metadata) = 'object'));
-
--- +goose Down
--- Refuse to discard grants when rolling back to static-only storage.
-ALTER TABLE vault_credentials DROP CONSTRAINT vault_credentials_auth_type_check;
-ALTER TABLE vault_credentials ADD CONSTRAINT vault_credentials_auth_type_check
-    CHECK (auth_type = 'static_bearer');
-ALTER TABLE vault_credentials DROP CONSTRAINT vault_credentials_oauth_metadata_check;
-ALTER TABLE vault_credentials DROP COLUMN oauth_metadata;
diff --git a/services/core/migrations/000055_skill_default_metadata.sql b/services/core/migrations/000055_skill_default_metadata.sql
deleted file mode 100644
index 97ab38cd3..000000000
--- a/services/core/migrations/000055_skill_default_metadata.sql
+++ /dev/null
@@ -1,12 +0,0 @@
--- +goose Up
-UPDATE skills s
-SET name = v.name, description = v.description
-FROM skill_versions v
-WHERE v.tenant_id = s.tenant_id
-  AND v.skill_id = s.id
-  AND v.version = s.default_version
-  AND (s.name, s.description) IS DISTINCT FROM (v.name, v.description);
-
--- +goose Down
--- Keep repaired metadata; restoring stale names and descriptions would corrupt it.
-SELECT 1;
diff --git a/services/core/migrations/000056_runtime_history.sql b/services/core/migrations/000056_runtime_history.sql
deleted file mode 100644
index b4737a233..000000000
--- a/services/core/migrations/000056_runtime_history.sql
+++ /dev/null
@@ -1,36 +0,0 @@
--- +goose Up
--- Periodic telemetry is a bounded projection, never execution or Usage authority.
-CREATE TABLE runtime_history_samples (
-    tenant_id uuid NOT NULL,
-    session_id uuid NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
-    environment_id uuid NOT NULL REFERENCES environments(id) ON DELETE CASCADE,
-    resolved_at_ns bigint NOT NULL CHECK (resolved_at_ns >= 0),
-    allocation_id uuid,
-    provider_type text NOT NULL,
-    status text NOT NULL CHECK (status IN ('observed', 'unavailable', 'unsupported')),
-    observed_at_ns bigint,
-    started_at_ns bigint,
-    cpu_usage_seconds double precision,
-    cpu_capacity_cores double precision,
-    memory_usage_bytes bigint,
-    memory_limit_bytes bigint,
-    input_tokens bigint,
-    output_tokens bigint,
-    PRIMARY KEY (tenant_id, session_id, environment_id, resolved_at_ns),
-    CHECK ((input_tokens IS NULL) = (output_tokens IS NULL)),
-    CHECK (input_tokens >= 0 AND input_tokens <= 9007199254740991),
-    CHECK (output_tokens >= 0 AND output_tokens <= 9007199254740991),
-    CHECK (observed_at_ns >= 0 AND observed_at_ns <= resolved_at_ns),
-    CHECK (started_at_ns >= 0 AND started_at_ns <= observed_at_ns),
-    CHECK ((status = 'observed') = (observed_at_ns IS NOT NULL)),
-    CHECK (started_at_ns IS NULL OR observed_at_ns IS NOT NULL),
-    CHECK (cpu_usage_seconds >= 0 AND cpu_usage_seconds < 'Infinity'::double precision),
-    CHECK (cpu_capacity_cores > 0 AND cpu_capacity_cores < 'Infinity'::double precision),
-    CHECK (memory_usage_bytes >= 0 AND memory_usage_bytes <= 9007199254740991),
-    CHECK (memory_limit_bytes > 0 AND memory_limit_bytes <= 9007199254740991),
-    CHECK (started_at_ns IS NOT NULL OR (cpu_usage_seconds IS NULL AND cpu_capacity_cores IS NULL AND memory_usage_bytes IS NULL AND memory_limit_bytes IS NULL))
-);
-CREATE INDEX runtime_history_samples_retention_idx ON runtime_history_samples (resolved_at_ns);
-
--- +goose Down
-DROP TABLE runtime_history_samples;
diff --git a/services/core/migrations/000057_runtime_nodes.sql b/services/core/migrations/000057_runtime_nodes.sql
deleted file mode 100644
index f27652ed1..000000000
--- a/services/core/migrations/000057_runtime_nodes.sql
+++ /dev/null
@@ -1,55 +0,0 @@
--- +goose Up
-ALTER TABLE runtime_deployment ADD COLUMN provider_kind text NOT NULL DEFAULT '' CHECK (provider_kind IN ('', 'docker', 'microsandbox'));
-ALTER TABLE runtime_deployment ADD COLUMN local_node_id uuid;
-ALTER TABLE runtime_deployment ADD COLUMN owner_epoch bigint NOT NULL DEFAULT 0 CHECK (owner_epoch >= 0);
-CREATE TABLE runtime_nodes (
-    id uuid PRIMARY KEY,
-    installation_id uuid NOT NULL,
-    name text NOT NULL CHECK (length(name) BETWEEN 1 AND 128),
-    backend_fingerprint text NOT NULL CHECK (backend_fingerprint ~ '^[0-9a-f]{64}$'),
-    credential_sha256 text NOT NULL CHECK (credential_sha256 ~ '^[0-9a-f]{64}$'),
-    max_active integer NOT NULL CHECK (max_active > 0),
-    max_retained integer NOT NULL CHECK (max_retained >= max_active),
-    connection_id uuid,
-    provider_ready boolean NOT NULL DEFAULT false,
-    health jsonb NOT NULL DEFAULT '{}'::jsonb,
-    connected_epoch bigint NOT NULL DEFAULT 0,
-    last_seen_at timestamptz,
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    removed_at timestamptz
-);
-CREATE TABLE runtime_placements (
-    environment_id uuid PRIMARY KEY REFERENCES environments(id),
-    node_id uuid NOT NULL REFERENCES runtime_nodes(id),
-    reserved_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    released_at timestamptz,
-    UNIQUE(environment_id, node_id)
-);
-ALTER TABLE runtime_allocations ADD COLUMN node_id uuid;
-ALTER TABLE runtime_allocations ADD COLUMN observation_error text NOT NULL DEFAULT '' CHECK (observation_error IN ('','node_unavailable','resource_missing','compute_unconfirmed','ownership_mismatch','provider_unavailable'));
-ALTER TABLE runtime_allocations ADD CONSTRAINT runtime_allocation_placement_fk FOREIGN KEY (environment_id,node_id) REFERENCES runtime_placements(environment_id,node_id);
-CREATE INDEX runtime_placements_node_idx ON runtime_placements(node_id) WHERE released_at IS NULL;
-CREATE TABLE runtime_node_enrollments (
-    token_sha256 text PRIMARY KEY CHECK (token_sha256 ~ '^[0-9a-f]{64}$'),
-    installation_id uuid NOT NULL,
-    expires_at timestamptz NOT NULL,
-    consumed_at timestamptz,
-    node_id uuid REFERENCES runtime_nodes(id)
-);
--- +goose Down
--- +goose StatementBegin
-DO $$ BEGIN
-IF EXISTS (SELECT 1 FROM runtime_nodes) THEN
-    RAISE EXCEPTION 'Cannot discard sandbox node and placement identities';
-END IF;
-END $$;
--- +goose StatementEnd
-DROP TABLE runtime_node_enrollments;
-ALTER TABLE runtime_allocations DROP CONSTRAINT runtime_allocation_placement_fk;
-ALTER TABLE runtime_allocations DROP COLUMN node_id;
-ALTER TABLE runtime_allocations DROP COLUMN observation_error;
-DROP TABLE runtime_placements;
-DROP TABLE runtime_nodes;
-ALTER TABLE runtime_deployment DROP COLUMN owner_epoch;
-ALTER TABLE runtime_deployment DROP COLUMN local_node_id;
-ALTER TABLE runtime_deployment DROP COLUMN provider_kind;
diff --git a/services/core/migrations/000058_sandbox_deployment_setup.sql b/services/core/migrations/000058_sandbox_deployment_setup.sql
deleted file mode 100644
index 80aa81826..000000000
--- a/services/core/migrations/000058_sandbox_deployment_setup.sql
+++ /dev/null
@@ -1,38 +0,0 @@
--- +goose Up
-ALTER TABLE runtime_deployment ADD COLUMN web_managed boolean NOT NULL DEFAULT false;
-ALTER TABLE runtime_deployment ADD COLUMN core_url text NOT NULL DEFAULT '';
-ALTER TABLE runtime_deployment ADD COLUMN idle_seconds bigint NOT NULL DEFAULT 0 CHECK (idle_seconds >= 0);
-ALTER TABLE runtime_deployment ADD COLUMN retention_seconds bigint NOT NULL DEFAULT 0 CHECK (retention_seconds >= 0);
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_identity_check CHECK (
-    (installation_id IS NULL AND backend_fingerprint = '') OR
-    (installation_id IS NOT NULL AND backend_fingerprint ~ '^[0-9a-f]{64}$') OR
-    (web_managed AND installation_id IS NOT NULL AND provider_kind = '' AND backend_fingerprint = '')
-);
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-    NOT web_managed OR (local_node_id IS NULL AND (
-        (provider_kind = '' AND core_url = '' AND idle_seconds = 0 AND retention_seconds = 0) OR
-        (provider_kind = 'docker' AND core_url <> '' AND idle_seconds = 0 AND retention_seconds = 0) OR
-        (provider_kind = 'microsandbox' AND core_url <> '' AND idle_seconds > 0 AND retention_seconds > 0)
-    ))
-);
-
--- +goose Down
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_deployment WHERE web_managed) THEN
-        RAISE EXCEPTION 'Cannot discard Web-managed sandbox deployment setup';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_setup_check;
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_identity_check;
-ALTER TABLE runtime_deployment DROP COLUMN retention_seconds;
-ALTER TABLE runtime_deployment DROP COLUMN idle_seconds;
-ALTER TABLE runtime_deployment DROP COLUMN core_url;
-ALTER TABLE runtime_deployment DROP COLUMN web_managed;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_check CHECK (
-    (installation_id IS NULL AND backend_fingerprint = '') OR
-    (installation_id IS NOT NULL AND backend_fingerprint ~ '^[0-9a-f]{64}$')
-);
diff --git a/services/core/migrations/000059_agent_model_execution.sql b/services/core/migrations/000059_agent_model_execution.sql
deleted file mode 100644
index 22e383591..000000000
--- a/services/core/migrations/000059_agent_model_execution.sql
+++ /dev/null
@@ -1,8 +0,0 @@
--- +goose Up
-CREATE TABLE agent_model_execution (
-  agent_id uuid PRIMARY KEY REFERENCES agents(id) ON DELETE CASCADE,
-  encrypted_config bytea NOT NULL
-);
-
--- +goose Down
-DROP TABLE agent_model_execution;
diff --git a/services/core/migrations/000060_session_execution_configuration.sql b/services/core/migrations/000060_session_execution_configuration.sql
deleted file mode 100644
index d8ded49b5..000000000
--- a/services/core/migrations/000060_session_execution_configuration.sql
+++ /dev/null
@@ -1,8 +0,0 @@
--- +goose Up
-CREATE TABLE session_execution_configuration (
-  session_id uuid PRIMARY KEY REFERENCES sessions(id) ON DELETE CASCADE,
-  configuration jsonb NOT NULL CHECK (jsonb_typeof(configuration) = 'object')
-);
-
--- +goose Down
-DROP TABLE session_execution_configuration;
diff --git a/services/core/migrations/000061_project_api_keys.sql b/services/core/migrations/000061_project_api_keys.sql
deleted file mode 100644
index fdb6ac73c..000000000
--- a/services/core/migrations/000061_project_api_keys.sql
+++ /dev/null
@@ -1,20 +0,0 @@
--- +goose Up
-CREATE TABLE project_api_keys (
-    id uuid PRIMARY KEY,
-    name text NOT NULL CHECK (char_length(name) BETWEEN 1 AND 80),
-    prefix text NOT NULL,
-    token_sha256 text NOT NULL UNIQUE CHECK (token_sha256 ~ '^[0-9a-f]{64}$'),
-    binding_digest text NOT NULL CHECK (binding_digest ~ '^[0-9a-f]{64}$'),
-    tenant_id uuid NOT NULL REFERENCES execution_project_scopes(tenant_id),
-    organization_id text NOT NULL,
-    project_id text NOT NULL,
-    subject_kind text NOT NULL CHECK (subject_kind IN ('user', 'service_account')),
-    subject_id text NOT NULL,
-    created_at timestamptz NOT NULL DEFAULT now(),
-    revoked_at timestamptz
-);
-CREATE INDEX project_api_keys_owner ON project_api_keys
-    (binding_digest, tenant_id, organization_id, project_id, subject_kind, subject_id, created_at DESC, id);
-
--- +goose Down
-DROP TABLE project_api_keys;
diff --git a/services/core/migrations/000062_environment_failure.sql b/services/core/migrations/000062_environment_failure.sql
deleted file mode 100644
index 6a2f3861b..000000000
--- a/services/core/migrations/000062_environment_failure.sql
+++ /dev/null
@@ -1,27 +0,0 @@
--- +goose Up
--- A failed hosted Environment keeps the public reason and time of its
--- provisioning failure. Core composes the reason from a fixed step label and an
--- exit status; Runtime output is never stored. Earlier failures keep NULL.
-ALTER TABLE environments
-    ADD COLUMN failure_reason text,
-    ADD COLUMN failed_at timestamptz,
-    ADD CONSTRAINT environment_failure_recorded CHECK (
-        (failure_reason IS NULL) = (failed_at IS NULL)
-        AND (failed_at IS NULL OR status = 'failed')
-        AND char_length(failure_reason) <= 256
-    );
-
--- +goose Down
-LOCK TABLE environments IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM environments WHERE failure_reason IS NOT NULL) THEN
-        RAISE EXCEPTION 'Cannot remove recorded hosted provisioning failures';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE environments
-    DROP CONSTRAINT environment_failure_recorded,
-    DROP COLUMN failed_at,
-    DROP COLUMN failure_reason;
diff --git a/services/core/migrations/000063_hosted_provider_selection.sql b/services/core/migrations/000063_hosted_provider_selection.sql
deleted file mode 100644
index c7fe69d42..000000000
--- a/services/core/migrations/000063_hosted_provider_selection.sql
+++ /dev/null
@@ -1,46 +0,0 @@
--- +goose Up
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_provider_kind_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_provider_kind_check CHECK (provider_kind IN ('','docker','microsandbox','e2b'));
-ALTER TABLE runtime_deployment ADD COLUMN generation bigint NOT NULL DEFAULT 0 CHECK (generation >= 0);
-ALTER TABLE runtime_deployment ADD COLUMN mode text NOT NULL DEFAULT '' CHECK (mode IN ('','nodes','direct'));
-ALTER TABLE runtime_deployment ADD COLUMN e2b_template text NOT NULL DEFAULT '';
-ALTER TABLE runtime_deployment ADD COLUMN e2b_credential bytea;
-UPDATE runtime_deployment SET generation=1,mode='nodes' WHERE provider_kind<>'';
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_setup_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-    NOT web_managed OR (local_node_id IS NULL AND (
-        (provider_kind='' AND core_url='' AND mode='' AND generation=0 AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='docker' AND core_url<>'' AND mode='nodes' AND generation>0 AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='microsandbox' AND core_url<>'' AND mode='nodes' AND generation>0 AND idle_seconds>0 AND retention_seconds>0) OR
-        (provider_kind='e2b' AND core_url<>'' AND mode='direct' AND generation>0 AND idle_seconds=0 AND retention_seconds=0)
-    ))
-);
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_e2b_check CHECK (
-    (provider_kind='e2b' AND e2b_template<>'' AND e2b_credential IS NOT NULL) OR
-    (provider_kind<>'e2b' AND e2b_template='' AND e2b_credential IS NULL)
-);
-
--- +goose Down
--- +goose StatementBegin
-DO $$ BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_deployment WHERE provider_kind='e2b' OR generation>1) THEN
-        RAISE EXCEPTION 'Cannot discard hosted provider configuration generations';
-    END IF;
-END $$;
--- +goose StatementEnd
-
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_e2b_check;
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_setup_check;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_credential;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_template;
-ALTER TABLE runtime_deployment DROP COLUMN mode;
-ALTER TABLE runtime_deployment DROP COLUMN generation;
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_provider_kind_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_provider_kind_check CHECK (provider_kind IN ('','docker','microsandbox'));
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-    NOT web_managed OR (local_node_id IS NULL AND (
-        (provider_kind='' AND core_url='' AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='docker' AND core_url<>'' AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='microsandbox' AND core_url<>'' AND idle_seconds>0 AND retention_seconds>0)
-    ))
-);
diff --git a/services/core/migrations/000064_write_audit.sql b/services/core/migrations/000064_write_audit.sql
deleted file mode 100644
index 9456502f3..000000000
--- a/services/core/migrations/000064_write_audit.sql
+++ /dev/null
@@ -1,37 +0,0 @@
--- +goose Up
-CREATE TABLE write_audit_operations (
-    id uuid PRIMARY KEY,
-    tenant_id uuid NOT NULL,
-    key_id text NOT NULL,
-    key_name text NOT NULL,
-    key_prefix text NOT NULL,
-    key_kind text NOT NULL CHECK (key_kind IN ('static', 'issued', 'console')),
-    action text NOT NULL,
-    resource_type text NOT NULL,
-    resource_id text NOT NULL,
-    parent_id text NOT NULL DEFAULT '',
-    request_id text NOT NULL,
-    trace_id text NOT NULL,
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    UNIQUE (tenant_id, request_id),
-    UNIQUE (tenant_id, id)
-);
-CREATE INDEX write_audit_operations_history ON write_audit_operations (tenant_id, created_at DESC, id DESC);
-CREATE INDEX write_audit_operations_key_history ON write_audit_operations (tenant_id, key_id, created_at DESC, id DESC);
-CREATE INDEX write_audit_operations_resource_history ON write_audit_operations (tenant_id, resource_type, resource_id, created_at DESC, id DESC);
-CREATE INDEX write_audit_operations_expiry ON write_audit_operations (created_at, id);
-
-CREATE TABLE write_audit_owners (
-    tenant_id uuid NOT NULL,
-    resource_type text NOT NULL,
-    resource_id text NOT NULL,
-    parent_id text NOT NULL DEFAULT '',
-    operation_id uuid NOT NULL,
-    PRIMARY KEY (tenant_id, resource_type, resource_id),
-    FOREIGN KEY (tenant_id, operation_id) REFERENCES write_audit_operations (tenant_id, id)
-);
-CREATE INDEX write_audit_owners_operation ON write_audit_owners (operation_id);
-
--- +goose Down
-DROP TABLE write_audit_owners;
-DROP TABLE write_audit_operations;
diff --git a/services/core/migrations/000065_environment_file_write_audit.sql b/services/core/migrations/000065_environment_file_write_audit.sql
deleted file mode 100644
index 3f355099d..000000000
--- a/services/core/migrations/000065_environment_file_write_audit.sql
+++ /dev/null
@@ -1,8 +0,0 @@
--- +goose Up
--- Safe request identity survives native execution and request detachment.
-ALTER TABLE environment_file_writes ADD COLUMN audit_source jsonb;
-ALTER TABLE environment_file_writes ADD CONSTRAINT environment_file_write_audit_source_object
-    CHECK (audit_source IS NULL OR jsonb_typeof(audit_source) = 'object');
-
--- +goose Down
-ALTER TABLE environment_file_writes DROP COLUMN audit_source;
diff --git a/services/core/migrations/000066_admin_projects.sql b/services/core/migrations/000066_admin_projects.sql
deleted file mode 100644
index 96eff7151..000000000
--- a/services/core/migrations/000066_admin_projects.sql
+++ /dev/null
@@ -1,48 +0,0 @@
--- +goose Up
--- +goose StatementBegin
-DO $$ BEGIN
-    IF EXISTS (SELECT 1 FROM project_api_keys) THEN
-        RAISE EXCEPTION 'Legacy inherited API keys prevent Project catalog installation; use a clean private installation. No existing data has been removed.';
-    END IF;
-END $$;
--- +goose StatementEnd
-CREATE TABLE projects (
-    id uuid PRIMARY KEY,
-    name text NOT NULL CHECK (char_length(name) BETWEEN 1 AND 128),
-    tenant_id uuid NOT NULL UNIQUE REFERENCES execution_project_scopes(tenant_id),
-    subject_kind text NOT NULL CHECK (subject_kind = 'service_account'),
-    subject_id text NOT NULL,
-    created_at timestamptz NOT NULL DEFAULT now(),
-    archived_at timestamptz,
-    UNIQUE (id, tenant_id)
-);
-DROP INDEX project_api_keys_owner;
-ALTER TABLE project_api_keys DROP COLUMN binding_digest,
-    DROP COLUMN tenant_id, DROP COLUMN organization_id, DROP COLUMN project_id,
-    DROP COLUMN subject_kind, DROP COLUMN subject_id;
-ALTER TABLE project_api_keys ADD COLUMN project_id uuid NOT NULL REFERENCES projects(id);
-CREATE INDEX project_api_keys_project ON project_api_keys(project_id,id);
-CREATE TABLE admin_audit_log (
-    id uuid PRIMARY KEY,
-    tenant_id uuid NOT NULL,
-    project_id uuid NOT NULL,
-    admin_credential_id text NOT NULL,
-    actor_label text NOT NULL,
-    action text NOT NULL,
-    resource_type text NOT NULL,
-    resource_id text NOT NULL,
-    result_ids jsonb NOT NULL DEFAULT '[]',
-    request_id text NOT NULL,
-    trace_id text NOT NULL,
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
-    FOREIGN KEY (project_id,tenant_id) REFERENCES projects(id,tenant_id),
-    UNIQUE (tenant_id, request_id, action, resource_type, resource_id)
-);
-CREATE INDEX admin_audit_log_history ON admin_audit_log (project_id, created_at DESC, id DESC);
-
--- +goose Down
--- +goose StatementBegin
-DO $$ BEGIN
-    RAISE EXCEPTION 'Project catalog downgrade is unsupported; restore a complete database backup instead.';
-END $$;
--- +goose StatementEnd
diff --git a/services/core/migrations/000067_admin_asset_copies.sql b/services/core/migrations/000067_admin_asset_copies.sql
deleted file mode 100644
index 2debb9e77..000000000
--- a/services/core/migrations/000067_admin_asset_copies.sql
+++ /dev/null
@@ -1,23 +0,0 @@
--- +goose Up
-CREATE TABLE admin_asset_copies (
-    target_tenant_id uuid NOT NULL,
-    idempotency_key text NOT NULL,
-    request_hash bytea NOT NULL,
-    result jsonb NOT NULL,
-    audit_id uuid NOT NULL REFERENCES admin_audit_log(id),
-    PRIMARY KEY (target_tenant_id, idempotency_key)
-);
-
-CREATE TABLE admin_resource_owners (
-    tenant_id uuid NOT NULL,
-    resource_type text NOT NULL,
-    resource_id text NOT NULL,
-    parent_id text NOT NULL DEFAULT '',
-    audit_id uuid NOT NULL REFERENCES admin_audit_log(id),
-    PRIMARY KEY (tenant_id, resource_type, resource_id)
-);
-CREATE INDEX admin_resource_owners_audit ON admin_resource_owners(audit_id);
-
--- +goose Down
-DROP TABLE admin_resource_owners;
-DROP TABLE admin_asset_copies;
diff --git a/services/core/migrations/000068_core_metrics_indexes.sql b/services/core/migrations/000068_core_metrics_indexes.sql
deleted file mode 100644
index a45fa0f6a..000000000
--- a/services/core/migrations/000068_core_metrics_indexes.sql
+++ /dev/null
@@ -1,9 +0,0 @@
--- +goose Up
-CREATE INDEX turns_metrics_started_idx ON turns(started_at) INCLUDE (created_at)
-    WHERE started_at IS NOT NULL;
-CREATE INDEX turns_metrics_interrupted_idx ON turns(completed_at)
-    WHERE status = 'failed' AND outcome->>'error_code' = 'execution_interrupted';
-
--- +goose Down
-DROP INDEX turns_metrics_interrupted_idx;
-DROP INDEX turns_metrics_started_idx;
diff --git a/services/core/migrations/000069_hosted_specification.sql b/services/core/migrations/000069_hosted_specification.sql
deleted file mode 100644
index f9a76d57d..000000000
--- a/services/core/migrations/000069_hosted_specification.sql
+++ /dev/null
@@ -1,18 +0,0 @@
--- +goose Up
-ALTER TABLE runtime_deployment ADD COLUMN specification jsonb NOT NULL DEFAULT '{}'::jsonb;
-ALTER TABLE runtime_nodes ADD COLUMN specification_digest text NOT NULL DEFAULT '';
-ALTER TABLE runtime_nodes ADD COLUMN deployment_generation bigint NOT NULL DEFAULT 0;
-ALTER TABLE runtime_nodes ADD CONSTRAINT runtime_node_specification_digest CHECK (specification_digest = '' OR specification_digest ~ '^[0-9a-f]{64}$');
-ALTER TABLE runtime_nodes ADD CONSTRAINT runtime_node_deployment_generation CHECK (deployment_generation >= 0);
-
--- +goose Down
--- +goose StatementBegin
-DO $$ BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_deployment WHERE specification <> '{}'::jsonb) THEN
-        RAISE EXCEPTION 'Cannot discard an active sandbox specification';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE runtime_nodes DROP COLUMN deployment_generation;
-ALTER TABLE runtime_nodes DROP COLUMN specification_digest;
-ALTER TABLE runtime_deployment DROP COLUMN specification;
diff --git a/services/core/migrations/000070_node_enrollment_capacity.sql b/services/core/migrations/000070_node_enrollment_capacity.sql
deleted file mode 100644
index 59903de1b..000000000
--- a/services/core/migrations/000070_node_enrollment_capacity.sql
+++ /dev/null
@@ -1,8 +0,0 @@
--- +goose Up
-ALTER TABLE runtime_node_enrollments ADD COLUMN max_active integer NOT NULL DEFAULT 2;
-ALTER TABLE runtime_node_enrollments ADD COLUMN max_retained integer NOT NULL DEFAULT 8;
-ALTER TABLE runtime_node_enrollments ADD CONSTRAINT runtime_enrollment_capacity CHECK (max_active >= 1 AND max_retained >= max_active AND max_retained <= 1000000);
-
--- +goose Down
-ALTER TABLE runtime_node_enrollments DROP COLUMN max_retained;
-ALTER TABLE runtime_node_enrollments DROP COLUMN max_active;
diff --git a/services/core/migrations/000071_node_host_history.sql b/services/core/migrations/000071_node_host_history.sql
deleted file mode 100644
index cbdfe96ca..000000000
--- a/services/core/migrations/000071_node_host_history.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- +goose Up
-CREATE TABLE node_host_history_samples (
-    node_id uuid NOT NULL REFERENCES runtime_nodes(id),
-    observed_at timestamptz NOT NULL,
-    cpu_utilization double precision CHECK (cpu_utilization >= 0 AND cpu_utilization <= 1),
-    memory_used_bytes bigint CHECK (memory_used_bytes >= 0),
-    available_disk_bytes bigint CHECK (available_disk_bytes >= 0),
-    PRIMARY KEY (node_id, observed_at)
-);
-CREATE INDEX node_host_history_retention ON node_host_history_samples(observed_at);
-
--- +goose Down
-DROP TABLE node_host_history_samples;
diff --git a/services/core/migrations/000073_e2b_observation_and_template_build.sql b/services/core/migrations/000073_e2b_observation_and_template_build.sql
deleted file mode 100644
index ba8344e2c..000000000
--- a/services/core/migrations/000073_e2b_observation_and_template_build.sql
+++ /dev/null
@@ -1,26 +0,0 @@
--- +goose Up
--- Providers such as E2B report a current CPU share instead of cumulative time.
-ALTER TABLE runtime_history_samples ADD COLUMN cpu_utilization_ratio double precision
-    CHECK (cpu_utilization_ratio >= 0 AND cpu_utilization_ratio < 'Infinity'::double precision);
-ALTER TABLE runtime_history_samples ADD CONSTRAINT runtime_history_samples_cpu_utilization_incarnation
-    CHECK (started_at_ns IS NOT NULL OR cpu_utilization_ratio IS NULL);
-
--- The fixed E2B template build as read by the validation that admitted the
--- selection. Selections saved before these columns existed keep nulls.
-ALTER TABLE runtime_deployment ADD COLUMN e2b_template_build_status text CHECK (e2b_template_build_status <> '');
-ALTER TABLE runtime_deployment ADD COLUMN e2b_template_cpus integer CHECK (e2b_template_cpus > 0);
-ALTER TABLE runtime_deployment ADD COLUMN e2b_template_memory_mib integer CHECK (e2b_template_memory_mib > 0);
-ALTER TABLE runtime_deployment ADD COLUMN e2b_template_root_disk_mib integer CHECK (e2b_template_root_disk_mib > 0);
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_e2b_template_build_check CHECK (
-    provider_kind = 'e2b' OR (e2b_template_build_status IS NULL AND e2b_template_cpus IS NULL AND
-        e2b_template_memory_mib IS NULL AND e2b_template_root_disk_mib IS NULL)
-);
-
--- +goose Down
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_e2b_template_build_check;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_template_root_disk_mib;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_template_memory_mib;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_template_cpus;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_template_build_status;
-ALTER TABLE runtime_history_samples DROP CONSTRAINT runtime_history_samples_cpu_utilization_incarnation;
-ALTER TABLE runtime_history_samples DROP COLUMN cpu_utilization_ratio;
diff --git a/services/core/migrations/000074_allocation_phase_time.sql b/services/core/migrations/000074_allocation_phase_time.sql
deleted file mode 100644
index caae36a2d..000000000
--- a/services/core/migrations/000074_allocation_phase_time.sql
+++ /dev/null
@@ -1,7 +0,0 @@
--- +goose Up
--- Existing rows keep NULL: the time they entered their current phase is unknown.
-ALTER TABLE runtime_allocations ADD COLUMN compute_phase_changed_at timestamptz;
-ALTER TABLE runtime_allocations ALTER COLUMN compute_phase_changed_at SET DEFAULT clock_timestamp();
-
--- +goose Down
-ALTER TABLE runtime_allocations DROP COLUMN compute_phase_changed_at;
diff --git a/services/core/migrations/000075_public_url_binding.sql b/services/core/migrations/000075_public_url_binding.sql
deleted file mode 100644
index f4bd26275..000000000
--- a/services/core/migrations/000075_public_url_binding.sql
+++ /dev/null
@@ -1,42 +0,0 @@
--- +goose Up
--- Core derives the address nodes and sandboxes use from AGENTS_API_PUBLIC_URL,
--- so the deployment no longer stores one. Each node keeps the address it
--- enrolled with, which tells an administrator which nodes a change affects.
-ALTER TABLE runtime_nodes ADD COLUMN core_url text NOT NULL DEFAULT '';
-UPDATE runtime_nodes n SET core_url = d.core_url FROM runtime_deployment d WHERE d.singleton AND n.removed_at IS NULL;
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_setup_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-    NOT web_managed OR (local_node_id IS NULL AND (
-        (provider_kind='' AND mode='' AND generation=0 AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='docker' AND mode='nodes' AND generation>0 AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='microsandbox' AND mode='nodes' AND generation>0 AND idle_seconds>0 AND retention_seconds>0) OR
-        (provider_kind='e2b' AND mode='direct' AND generation>0 AND idle_seconds=0 AND retention_seconds=0)
-    ))
-);
-ALTER TABLE runtime_deployment DROP COLUMN core_url;
-
--- +goose Down
-ALTER TABLE runtime_deployment ADD COLUMN core_url text NOT NULL DEFAULT '';
-UPDATE runtime_deployment d SET core_url = COALESCE((SELECT n.core_url FROM runtime_nodes n
-    WHERE n.removed_at IS NULL AND n.core_url <> '' ORDER BY n.created_at DESC LIMIT 1), '')
-WHERE d.web_managed AND d.provider_kind <> '';
-
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_deployment WHERE web_managed AND provider_kind <> '' AND core_url = '') THEN
-        RAISE EXCEPTION 'Cannot restore the sandbox deployment Core address: no enrolled node records it';
-    END IF;
-END $$;
--- +goose StatementEnd
-
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_setup_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-    NOT web_managed OR (local_node_id IS NULL AND (
-        (provider_kind='' AND core_url='' AND mode='' AND generation=0 AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='docker' AND core_url<>'' AND mode='nodes' AND generation>0 AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='microsandbox' AND core_url<>'' AND mode='nodes' AND generation>0 AND idle_seconds>0 AND retention_seconds>0) OR
-        (provider_kind='e2b' AND core_url<>'' AND mode='direct' AND generation>0 AND idle_seconds=0 AND retention_seconds=0)
-    ))
-);
-ALTER TABLE runtime_nodes DROP COLUMN core_url;
diff --git a/services/core/migrations/000076_deployment_model_providers.sql b/services/core/migrations/000076_deployment_model_providers.sql
deleted file mode 100644
index 8c6064619..000000000
--- a/services/core/migrations/000076_deployment_model_providers.sql
+++ /dev/null
@@ -1,39 +0,0 @@
--- +goose Up
--- One deployment default model provider per harness. The safe columns serve
--- reads without decryption; encrypted_config holds the complete bundle.
-CREATE TABLE deployment_model_providers (
-  harness text PRIMARY KEY,
-  protocol text NOT NULL,
-  base_url text NOT NULL,
-  context_window integer NOT NULL DEFAULT 0 CHECK (context_window >= 0),
-  max_output_tokens integer NOT NULL DEFAULT 0 CHECK (max_output_tokens >= 0),
-  encrypted_config bytea NOT NULL,
-  updated_at timestamptz NOT NULL DEFAULT clock_timestamp()
-);
-
--- Deployment-wide administrator writes have no Project.
-ALTER TABLE admin_audit_log ALTER COLUMN tenant_id DROP NOT NULL;
-ALTER TABLE admin_audit_log ALTER COLUMN project_id DROP NOT NULL;
-ALTER TABLE admin_audit_log ADD CONSTRAINT admin_audit_log_scope_check CHECK ((tenant_id IS NULL) = (project_id IS NULL));
-
--- Input reserved before providers were required fails with this reason instead
--- of waiting for its deadline.
-ALTER TABLE environment_input_reservations ADD COLUMN failure_code text
-  CHECK (failure_code IS NULL OR (state = 'failed' AND failure_code = 'model_provider_required'));
-
--- +goose Down
--- +goose StatementBegin
-DO $$ BEGIN
-    IF EXISTS (SELECT 1 FROM admin_audit_log WHERE project_id IS NULL) THEN
-        RAISE EXCEPTION 'Deployment-wide audit entries prevent this downgrade; restore a complete database backup instead.';
-    END IF;
-    IF EXISTS (SELECT 1 FROM deployment_model_providers) THEN
-        RAISE EXCEPTION 'Deployment model providers prevent this downgrade; remove them or restore a complete database backup instead.';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE environment_input_reservations DROP COLUMN failure_code;
-ALTER TABLE admin_audit_log DROP CONSTRAINT admin_audit_log_scope_check;
-ALTER TABLE admin_audit_log ALTER COLUMN project_id SET NOT NULL;
-ALTER TABLE admin_audit_log ALTER COLUMN tenant_id SET NOT NULL;
-DROP TABLE deployment_model_providers;
diff --git a/services/core/migrations/000077_node_enrollment_id.sql b/services/core/migrations/000077_node_enrollment_id.sql
deleted file mode 100644
index 2caaf1b15..000000000
--- a/services/core/migrations/000077_node_enrollment_id.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- +goose Up
--- A public, non-secret handle for each node enrollment command, so the console can
--- tell which node a command registered. It never authenticates; the token does.
--- Tokens issued before this migration have none.
-ALTER TABLE runtime_node_enrollments ADD COLUMN id uuid UNIQUE;
--- The enrollment that registered the node, copied at registration. There is no
--- foreign key: runtime_node_enrollments.node_id already references the node, and a
--- reverse key would only add a cycle. Nodes enrolled earlier keep null.
-ALTER TABLE runtime_nodes ADD COLUMN enrollment_id uuid;
-
--- +goose Down
-ALTER TABLE runtime_nodes DROP COLUMN enrollment_id;
-ALTER TABLE runtime_node_enrollments DROP COLUMN id;
diff --git a/services/core/migrations/000078_oac_runtime_names.sql b/services/core/migrations/000078_oac_runtime_names.sql
deleted file mode 100644
index 62bb98455..000000000
--- a/services/core/migrations/000078_oac_runtime_names.sql
+++ /dev/null
@@ -1,29 +0,0 @@
--- +goose Up
--- Admission also locks the deployment first. Keep the drain check and rewrite
--- atomic with respect to allocation creation and cleanup.
-LOCK TABLE runtime_deployment, runtime_allocations IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$ BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_allocations WHERE released_at IS NULL) THEN
-        RAISE EXCEPTION 'Drain the sandbox deployment with the previous release before upgrading to OpenAgentCore: sandboxes created before the rename cannot be managed by this release';
-    END IF;
-END $$;
--- +goose StatementEnd
-UPDATE runtime_deployment
-   SET specification = jsonb_set(specification, '{runtime,microsandbox_ref}',
-       to_jsonb('oac-runtime@' || split_part(specification #>> '{runtime,microsandbox_ref}', '@', 2)), false)
- WHERE specification #>> '{runtime,microsandbox_ref}' LIKE 'parsar-core-runtime@%';
-
--- +goose Down
-LOCK TABLE runtime_deployment, runtime_allocations IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$ BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_allocations WHERE released_at IS NULL) THEN
-        RAISE EXCEPTION 'Drain the sandbox deployment before reverting OpenAgentCore Runtime names: sandboxes created after the rename cannot be managed by the previous release';
-    END IF;
-END $$;
--- +goose StatementEnd
-UPDATE runtime_deployment
-   SET specification = jsonb_set(specification, '{runtime,microsandbox_ref}',
-       to_jsonb('parsar-core-runtime@' || split_part(specification #>> '{runtime,microsandbox_ref}', '@', 2)), false)
- WHERE specification #>> '{runtime,microsandbox_ref}' LIKE 'oac-runtime@%';
diff --git a/services/core/migrations/000079_sandbox_reset.sql b/services/core/migrations/000079_sandbox_reset.sql
deleted file mode 100644
index 7c71dde23..000000000
--- a/services/core/migrations/000079_sandbox_reset.sql
+++ /dev/null
@@ -1,63 +0,0 @@
--- +goose Up
-ALTER TABLE runtime_deployment RENAME COLUMN maintenance TO admission_paused;
--- Old Web-managed maintenance is retired; ordinary upgrades resume admission.
-UPDATE runtime_deployment SET admission_paused = false WHERE web_managed;
-ALTER TABLE runtime_deployment
-    ADD COLUMN reset_clear text,
-    ADD COLUMN reset_requested_at timestamptz,
-    ADD COLUMN reset_deadline_at timestamptz,
-    ADD COLUMN reset_forced_at timestamptz,
-    ADD COLUMN reset_audit jsonb,
-    ADD CONSTRAINT runtime_deployment_reset_check CHECK (
-        (reset_clear IS NULL AND reset_requested_at IS NULL AND reset_deadline_at IS NULL
-            AND reset_forced_at IS NULL AND reset_audit IS NULL)
-        OR (reset_clear IS NOT NULL AND web_managed AND provider_kind <> ''
-            AND reset_requested_at IS NOT NULL AND reset_audit IS NOT NULL
-            AND jsonb_typeof(reset_audit) = 'object'
-            AND ((reset_clear = 'auto' AND reset_deadline_at IS NOT NULL AND reset_forced_at IS NULL)
-                OR (reset_clear = 'force' AND reset_forced_at IS NOT NULL)))
-    ),
-    ADD CONSTRAINT runtime_deployment_reset_admission_check CHECK (
-        NOT web_managed OR admission_paused = (reset_clear IS NOT NULL)
-    );
-
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_setup_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-    NOT web_managed OR (local_node_id IS NULL AND (
-        (provider_kind='' AND mode='' AND generation>=0 AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='docker' AND mode='nodes' AND generation>0 AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='microsandbox' AND mode='nodes' AND generation>0 AND idle_seconds>0 AND retention_seconds>0) OR
-        (provider_kind='e2b' AND mode='direct' AND generation>0 AND idle_seconds=0 AND retention_seconds=0)
-    ))
-);
-
--- +goose Down
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_deployment WHERE reset_clear IS NOT NULL) THEN
-        RAISE EXCEPTION 'Cannot downgrade while a sandbox reset is active';
-    END IF;
-    IF EXISTS (SELECT 1 FROM runtime_deployment WHERE web_managed AND provider_kind = '' AND generation > 0) THEN
-        RAISE EXCEPTION 'Configure a sandbox provider before downgrading a completed reset';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE runtime_deployment
-    DROP CONSTRAINT runtime_deployment_reset_admission_check,
-    DROP CONSTRAINT runtime_deployment_reset_check,
-    DROP COLUMN reset_clear,
-    DROP COLUMN reset_requested_at,
-    DROP COLUMN reset_deadline_at,
-    DROP COLUMN reset_forced_at,
-    DROP COLUMN reset_audit;
-ALTER TABLE runtime_deployment RENAME COLUMN admission_paused TO maintenance;
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_setup_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-    NOT web_managed OR (local_node_id IS NULL AND (
-        (provider_kind='' AND mode='' AND generation=0 AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='docker' AND mode='nodes' AND generation>0 AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='microsandbox' AND mode='nodes' AND generation>0 AND idle_seconds>0 AND retention_seconds>0) OR
-        (provider_kind='e2b' AND mode='direct' AND generation>0 AND idle_seconds=0 AND retention_seconds=0)
-    ))
-);
diff --git a/services/core/migrations/000080_archived_cancellation_receipts.sql b/services/core/migrations/000080_archived_cancellation_receipts.sql
deleted file mode 100644
index 97e0ff974..000000000
--- a/services/core/migrations/000080_archived_cancellation_receipts.sql
+++ /dev/null
@@ -1,17 +0,0 @@
--- +goose Up
--- Only the archive transaction that first revokes the device may retain the
--- existing delivery's cancellation receipt. Old revocations are not adopted.
-ALTER TABLE devices
-    ADD COLUMN archive_cancel_turn_id uuid REFERENCES turns(id) ON DELETE SET NULL;
-
--- +goose Down
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM devices d JOIN runtime_allocations a ON a.device_id = d.id
-               WHERE d.archive_cancel_turn_id IS NOT NULL AND a.state <> 'released') THEN
-        RAISE EXCEPTION 'Cannot remove archived cancellation receipts while cleanup is unsettled';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE devices DROP COLUMN archive_cancel_turn_id;
diff --git a/services/core/migrations/000081_sandbox_generations.sql b/services/core/migrations/000081_sandbox_generations.sql
deleted file mode 100644
index e9655b3ff..000000000
--- a/services/core/migrations/000081_sandbox_generations.sql
+++ /dev/null
@@ -1,67 +0,0 @@
--- +goose Up
-CREATE TABLE runtime_deployment_generations (
-    generation bigint PRIMARY KEY CHECK (generation >= 0),
-    provider_kind text NOT NULL CHECK (provider_kind IN ('docker','microsandbox','e2b')),
-    specification jsonb NOT NULL,
-    e2b_template text NOT NULL DEFAULT '',
-    e2b_template_build_status text,
-    e2b_template_cpus integer,
-    e2b_template_memory_mib integer,
-    e2b_template_root_disk_mib integer,
-    created_at timestamptz NOT NULL DEFAULT clock_timestamp()
-);
-ALTER TABLE runtime_allocations ADD COLUMN deployment_generation bigint;
-ALTER TABLE runtime_placements ADD COLUMN deployment_generation bigint;
-UPDATE runtime_allocations SET deployment_generation=(SELECT generation FROM runtime_deployment) WHERE state <> 'released';
-UPDATE runtime_placements SET deployment_generation=(SELECT generation FROM runtime_deployment) WHERE released_at IS NULL;
-ALTER TABLE runtime_allocations ADD CHECK (deployment_generation >= 0),
-    ADD CHECK (state = 'released' OR deployment_generation IS NOT NULL);
-ALTER TABLE runtime_placements ADD CHECK (deployment_generation >= 0),
-    ADD CHECK (released_at IS NOT NULL OR deployment_generation IS NOT NULL);
-ALTER TABLE runtime_nodes ADD COLUMN ready_generation bigint CHECK (ready_generation >= 0);
--- The serving pin is durable, independent of current connection readiness.
-UPDATE runtime_nodes SET ready_generation=deployment_generation WHERE removed_at IS NULL;
-CREATE INDEX runtime_allocations_generation_live ON runtime_allocations(deployment_generation) WHERE state <> 'released';
-CREATE INDEX runtime_placements_generation_live ON runtime_placements(deployment_generation) WHERE released_at IS NULL;
-CREATE INDEX runtime_nodes_generation_live ON runtime_nodes(ready_generation) WHERE removed_at IS NULL;
--- +goose StatementBegin
-CREATE FUNCTION immutable_runtime_deployment_generation() RETURNS trigger LANGUAGE plpgsql AS $$
-BEGIN
-    IF NEW.deployment_generation IS DISTINCT FROM OLD.deployment_generation THEN
-        RAISE EXCEPTION 'Sandbox ownership generation is immutable';
-    END IF;
-    RETURN NEW;
-END $$;
--- +goose StatementEnd
-CREATE TRIGGER immutable_runtime_allocation_generation BEFORE UPDATE ON runtime_allocations
-FOR EACH ROW EXECUTE FUNCTION immutable_runtime_deployment_generation();
-CREATE TRIGGER immutable_runtime_placement_generation BEFORE UPDATE ON runtime_placements
-FOR EACH ROW EXECUTE FUNCTION immutable_runtime_deployment_generation();
-
--- +goose StatementBegin
-CREATE FUNCTION immutable_sandbox_specification() RETURNS trigger LANGUAGE plpgsql AS $$
-BEGIN
-    RAISE EXCEPTION 'Retained sandbox specifications are immutable';
-END $$;
--- +goose StatementEnd
-CREATE TRIGGER immutable_sandbox_specification BEFORE UPDATE ON runtime_deployment_generations
-FOR EACH ROW EXECUTE FUNCTION immutable_sandbox_specification();
-
--- +goose Down
--- +goose StatementBegin
-DO $$ BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_allocations a CROSS JOIN runtime_deployment d WHERE a.state <> 'released' AND a.deployment_generation <> d.generation)
-       OR EXISTS (SELECT 1 FROM runtime_placements p CROSS JOIN runtime_deployment d WHERE p.released_at IS NULL AND p.deployment_generation <> d.generation)
-       OR EXISTS (SELECT 1 FROM runtime_nodes n CROSS JOIN runtime_deployment d WHERE n.removed_at IS NULL AND n.ready_generation <> d.generation) THEN
-        RAISE EXCEPTION 'Cannot downgrade while retained ownership or node serving pins require generation routing';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP TRIGGER immutable_runtime_allocation_generation ON runtime_allocations;
-DROP TRIGGER immutable_runtime_placement_generation ON runtime_placements;
-DROP FUNCTION immutable_runtime_deployment_generation();
-ALTER TABLE runtime_nodes DROP COLUMN ready_generation;
-ALTER TABLE runtime_placements DROP COLUMN deployment_generation;
-ALTER TABLE runtime_allocations DROP COLUMN deployment_generation;
-DROP TABLE runtime_deployment_generations;
-DROP FUNCTION immutable_sandbox_specification();
diff --git a/services/core/migrations/000082_node_generations.sql b/services/core/migrations/000082_node_generations.sql
deleted file mode 100644
index 1e1485518..000000000
--- a/services/core/migrations/000082_node_generations.sql
+++ /dev/null
@@ -1,30 +0,0 @@
--- +goose Up
-ALTER TABLE runtime_nodes ADD COLUMN protocol_version integer NOT NULL DEFAULT 1 CHECK (protocol_version IN (1,2));
-CREATE TABLE runtime_node_generation_status (
- node_id uuid NOT NULL REFERENCES runtime_nodes(id),
- generation bigint NOT NULL CHECK (generation > 0),
- specification_digest text NOT NULL CHECK (specification_digest ~ '^[0-9a-f]{64}$'),
- connection_id uuid NOT NULL,
- owner_epoch bigint NOT NULL CHECK (owner_epoch > 0),
- state text NOT NULL CHECK (state IN ('ready','preparing','failed')),
- diagnostic text NOT NULL DEFAULT '',
- observed_at timestamptz NOT NULL DEFAULT clock_timestamp(),
- PRIMARY KEY(node_id,generation)
-);
-INSERT INTO runtime_node_generation_status(node_id,generation,specification_digest,connection_id,owner_epoch,state)
-SELECT id,deployment_generation,specification_digest,connection_id,connected_epoch,
- CASE WHEN provider_ready THEN 'ready' ELSE 'failed' END FROM runtime_nodes
-WHERE removed_at IS NULL AND connection_id IS NOT NULL AND connected_epoch>0
-AND deployment_generation>0 AND specification_digest ~ '^[0-9a-f]{64}$';
-
--- +goose Down
--- +goose StatementBegin
-DO $$ BEGIN
- IF EXISTS(SELECT 1 FROM runtime_nodes n CROSS JOIN runtime_deployment d WHERE n.removed_at IS NULL
-   AND (n.protocol_version=2 OR n.deployment_generation<>d.generation OR n.ready_generation<>d.generation)) THEN
-  RAISE EXCEPTION 'Cannot downgrade while protocol v2 or retained-generation nodes remain; remove them after releasing their resources first';
- END IF;
-END $$;
--- +goose StatementEnd
-DROP TABLE runtime_node_generation_status;
-ALTER TABLE runtime_nodes DROP COLUMN protocol_version;
diff --git a/services/core/migrations/000083_session_diagnostics.sql b/services/core/migrations/000083_session_diagnostics.sql
deleted file mode 100644
index 80be75a10..000000000
--- a/services/core/migrations/000083_session_diagnostics.sql
+++ /dev/null
@@ -1,8 +0,0 @@
--- +goose Up
--- Historical terminal Items retain unknown settlement times.
-ALTER TABLE session_items ADD COLUMN settled_at timestamptz;
-ALTER TABLE environments ADD COLUMN failure_detail jsonb CHECK (failure_detail IS NULL OR jsonb_typeof(failure_detail) = 'object');
-
--- +goose Down
-ALTER TABLE environments DROP COLUMN failure_detail;
-ALTER TABLE session_items DROP COLUMN settled_at;
diff --git a/services/core/migrations/000084_deployment_provider_observations.sql b/services/core/migrations/000084_deployment_provider_observations.sql
deleted file mode 100644
index 301a8ef33..000000000
--- a/services/core/migrations/000084_deployment_provider_observations.sql
+++ /dev/null
@@ -1,27 +0,0 @@
--- +goose Up
--- Revision identity is private and independent of content and wall-clock time.
-ALTER TABLE deployment_model_providers
-  ADD COLUMN revision uuid NOT NULL DEFAULT gen_random_uuid(),
-  ADD COLUMN last_used_at timestamptz,
-  ADD COLUMN last_error_code text,
-  ADD COLUMN last_error_at timestamptz,
-  ADD COLUMN recovery_pending boolean NOT NULL DEFAULT false,
-  ADD CONSTRAINT deployment_provider_error_pair CHECK ((last_error_code IS NULL) = (last_error_at IS NULL)),
-  ADD CONSTRAINT deployment_provider_recovery CHECK (NOT recovery_pending OR last_error_at IS NOT NULL),
-  ADD CONSTRAINT deployment_provider_error_code CHECK (last_error_code IN (
-    'authentication_error', 'connection_failed', 'rate_limit_exceeded',
-    'usage_limit_exceeded', 'server_overloaded', 'server_error',
-    'resource_not_found', 'request_timeout', 'invalid_request'));
-ALTER TABLE session_execution_configuration ADD COLUMN deployment_provider_revision uuid;
-
--- +goose Down
-ALTER TABLE session_execution_configuration DROP COLUMN deployment_provider_revision;
-ALTER TABLE deployment_model_providers
-  DROP CONSTRAINT deployment_provider_error_pair,
-  DROP CONSTRAINT deployment_provider_recovery,
-  DROP CONSTRAINT deployment_provider_error_code,
-  DROP COLUMN revision,
-  DROP COLUMN last_used_at,
-  DROP COLUMN last_error_code,
-  DROP COLUMN last_error_at,
-  DROP COLUMN recovery_pending;
diff --git a/services/core/migrations/000085_deployment_model_configuration.sql b/services/core/migrations/000085_deployment_model_configuration.sql
deleted file mode 100644
index 82a3e6140..000000000
--- a/services/core/migrations/000085_deployment_model_configuration.sql
+++ /dev/null
@@ -1,7 +0,0 @@
--- +goose Up
-ALTER TABLE deployment_model_providers ADD COLUMN model text NOT NULL DEFAULT '';
-ALTER TABLE deployment_model_providers ADD COLUMN harness_config jsonb NOT NULL DEFAULT '{}'::jsonb;
-
--- +goose Down
-ALTER TABLE deployment_model_providers DROP COLUMN harness_config;
-ALTER TABLE deployment_model_providers DROP COLUMN model;
diff --git a/services/core/migrations/000086_e2b_custom_endpoint.sql b/services/core/migrations/000086_e2b_custom_endpoint.sql
deleted file mode 100644
index 9644ce087..000000000
--- a/services/core/migrations/000086_e2b_custom_endpoint.sql
+++ /dev/null
@@ -1,26 +0,0 @@
--- +goose Up
-ALTER TABLE runtime_deployment ADD COLUMN IF NOT EXISTS e2b_api_url text NOT NULL DEFAULT '';
-ALTER TABLE runtime_deployment ADD COLUMN IF NOT EXISTS e2b_domain text NOT NULL DEFAULT '';
--- +goose StatementBegin
-DO $$ BEGIN
-IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'runtime_deployment_e2b_endpoint_check') THEN
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_e2b_endpoint_check CHECK (
-    (provider_kind = 'e2b' AND ((e2b_api_url = '' AND e2b_domain = '') OR
-                                 (e2b_api_url <> '' AND e2b_domain <> ''))) OR
-    (provider_kind <> 'e2b' AND e2b_api_url = '' AND e2b_domain = '')
-);
-END IF;
-END $$;
--- +goose StatementEnd
-
--- +goose Down
--- +goose StatementBegin
-DO $$ BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_deployment WHERE e2b_api_url <> '' OR e2b_domain <> '') THEN
-        RAISE EXCEPTION 'cannot remove E2B endpoint columns while a custom endpoint is configured';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_e2b_endpoint_check;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_domain;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_api_url;
diff --git a/services/core/migrations/000087_e2b_generation_endpoints.sql b/services/core/migrations/000087_e2b_generation_endpoints.sql
deleted file mode 100644
index 4f0c5d888..000000000
--- a/services/core/migrations/000087_e2b_generation_endpoints.sql
+++ /dev/null
@@ -1,21 +0,0 @@
--- +goose Up
--- Earlier generation rows predate custom endpoints and use the official defaults.
-ALTER TABLE runtime_deployment_generations ADD COLUMN e2b_api_url text NOT NULL DEFAULT '';
-ALTER TABLE runtime_deployment_generations ADD COLUMN e2b_domain text NOT NULL DEFAULT '';
-ALTER TABLE runtime_deployment_generations ADD CONSTRAINT runtime_deployment_generation_e2b_endpoint_check CHECK (
-    (provider_kind = 'e2b' AND ((e2b_api_url = '' AND e2b_domain = '') OR
-                                 (e2b_api_url <> '' AND e2b_domain <> ''))) OR
-    (provider_kind <> 'e2b' AND e2b_api_url = '' AND e2b_domain = '')
-);
-
--- +goose Down
--- +goose StatementBegin
-DO $$ BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_deployment_generations WHERE e2b_api_url <> '' OR e2b_domain <> '') THEN
-        RAISE EXCEPTION 'cannot remove E2B generation endpoints while a custom endpoint is retained';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE runtime_deployment_generations DROP CONSTRAINT runtime_deployment_generation_e2b_endpoint_check;
-ALTER TABLE runtime_deployment_generations DROP COLUMN e2b_domain;
-ALTER TABLE runtime_deployment_generations DROP COLUMN e2b_api_url;
diff --git a/services/core/migrations/000088_environment_input_preparation_failure.sql b/services/core/migrations/000088_environment_input_preparation_failure.sql
deleted file mode 100644
index 06b57a41d..000000000
--- a/services/core/migrations/000088_environment_input_preparation_failure.sql
+++ /dev/null
@@ -1,11 +0,0 @@
--- +goose Up
-ALTER TABLE environment_input_reservations
-  DROP CONSTRAINT environment_input_reservations_check1,
-  ADD CONSTRAINT environment_input_reservations_check1
-    CHECK (failure_code IS NULL OR (state = 'failed' AND failure_code IN ('model_provider_required', 'runtime_preparation_failed')));
-
--- +goose Down
-ALTER TABLE environment_input_reservations
-  DROP CONSTRAINT environment_input_reservations_check1,
-  ADD CONSTRAINT environment_input_reservations_check1
-    CHECK (failure_code IS NULL OR (state = 'failed' AND failure_code = 'model_provider_required'));
diff --git a/services/core/migrations/000089_provider_registration.sql b/services/core/migrations/000089_provider_registration.sql
deleted file mode 100644
index 4a4e743ed..000000000
--- a/services/core/migrations/000089_provider_registration.sql
+++ /dev/null
@@ -1,82 +0,0 @@
--- +goose Up
--- Provider registration owns supported kinds, modes and native configuration.
--- Persistence enforces shape and ownership without enumerating implementations.
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_provider_kind_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_provider_kind_check
-    CHECK (provider_kind = '' OR provider_kind ~ '^[a-z][a-z0-9_-]{0,63}$');
-ALTER TABLE runtime_deployment_generations DROP CONSTRAINT runtime_deployment_generations_provider_kind_check;
-ALTER TABLE runtime_deployment_generations ADD CONSTRAINT runtime_deployment_generations_provider_kind_check
-    CHECK (provider_kind ~ '^[a-z][a-z0-9_-]{0,63}$');
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_setup_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-    NOT web_managed OR (local_node_id IS NULL AND (
-        (provider_kind = '' AND mode = '' AND generation >= 0 AND idle_seconds = 0 AND retention_seconds = 0) OR
-        (provider_kind <> '' AND mode IN ('nodes','direct') AND generation > 0 AND
-            ((idle_seconds = 0 AND retention_seconds = 0) OR (idle_seconds > 0 AND retention_seconds > 0)))
-    ))
-);
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_e2b_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_e2b_check CHECK (
-    (provider_kind <> '' AND e2b_template <> '' AND e2b_credential IS NOT NULL) OR
-    (e2b_template = '' AND e2b_credential IS NULL)
-);
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_e2b_template_build_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_e2b_template_build_check CHECK (
-    e2b_template <> '' OR (e2b_template_build_status IS NULL AND e2b_template_cpus IS NULL AND
-        e2b_template_memory_mib IS NULL AND e2b_template_root_disk_mib IS NULL)
-);
-ALTER TABLE runtime_deployment DROP CONSTRAINT IF EXISTS runtime_deployment_e2b_endpoint_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_e2b_endpoint_check CHECK (
-    (e2b_api_url = '' AND e2b_domain = '') OR
-    (e2b_template <> '' AND e2b_api_url <> '' AND e2b_domain <> '')
-);
-ALTER TABLE runtime_deployment_generations DROP CONSTRAINT runtime_deployment_generation_e2b_endpoint_check;
-ALTER TABLE runtime_deployment_generations ADD CONSTRAINT runtime_deployment_generation_e2b_endpoint_check CHECK (
-    (e2b_api_url = '' AND e2b_domain = '') OR
-    (e2b_template <> '' AND e2b_api_url <> '' AND e2b_domain <> '')
-);
-
--- +goose Down
--- Restore the previous representation of official endpoints. Custom endpoints
--- remain explicit so older downgrade guards still protect their ownership.
-UPDATE runtime_deployment SET e2b_api_url = '', e2b_domain = ''
-WHERE e2b_api_url = 'https://api.e2b.app' AND e2b_domain = 'e2b.app';
--- This transaction changes representation only, not the endpoint or resource owner.
-ALTER TABLE runtime_deployment_generations DISABLE TRIGGER immutable_sandbox_specification;
-UPDATE runtime_deployment_generations SET e2b_api_url = '', e2b_domain = ''
-WHERE e2b_api_url = 'https://api.e2b.app' AND e2b_domain = 'e2b.app';
-ALTER TABLE runtime_deployment_generations ENABLE TRIGGER immutable_sandbox_specification;
--- Narrowing registration cannot silently invalidate retained resource ownership.
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_provider_kind_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_provider_kind_check CHECK (provider_kind IN ('','docker','microsandbox','e2b'));
-ALTER TABLE runtime_deployment_generations DROP CONSTRAINT runtime_deployment_generations_provider_kind_check;
-ALTER TABLE runtime_deployment_generations ADD CONSTRAINT runtime_deployment_generations_provider_kind_check CHECK (provider_kind IN ('docker','microsandbox','e2b'));
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_setup_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-    NOT web_managed OR (local_node_id IS NULL AND (
-        (provider_kind='' AND mode='' AND generation>=0 AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='docker' AND mode='nodes' AND generation>0 AND idle_seconds=0 AND retention_seconds=0) OR
-        (provider_kind='microsandbox' AND mode='nodes' AND generation>0 AND idle_seconds>0 AND retention_seconds>0) OR
-        (provider_kind='e2b' AND mode='direct' AND generation>0 AND idle_seconds=0 AND retention_seconds=0)
-    ))
-);
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_e2b_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_e2b_check CHECK (
-    (provider_kind='e2b' AND e2b_template<>'' AND e2b_credential IS NOT NULL) OR
-    (provider_kind<>'e2b' AND e2b_template='' AND e2b_credential IS NULL)
-);
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_e2b_template_build_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_e2b_template_build_check CHECK (
-    provider_kind = 'e2b' OR (e2b_template_build_status IS NULL AND e2b_template_cpus IS NULL AND
-        e2b_template_memory_mib IS NULL AND e2b_template_root_disk_mib IS NULL)
-);
-ALTER TABLE runtime_deployment DROP CONSTRAINT runtime_deployment_e2b_endpoint_check;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_e2b_endpoint_check CHECK (
-    (provider_kind = 'e2b' AND ((e2b_api_url = '' AND e2b_domain = '') OR (e2b_api_url <> '' AND e2b_domain <> ''))) OR
-    (provider_kind <> 'e2b' AND e2b_api_url = '' AND e2b_domain = '')
-);
-ALTER TABLE runtime_deployment_generations DROP CONSTRAINT runtime_deployment_generation_e2b_endpoint_check;
-ALTER TABLE runtime_deployment_generations ADD CONSTRAINT runtime_deployment_generation_e2b_endpoint_check CHECK (
-    (provider_kind = 'e2b' AND ((e2b_api_url = '' AND e2b_domain = '') OR (e2b_api_url <> '' AND e2b_domain <> ''))) OR
-    (provider_kind <> 'e2b' AND e2b_api_url = '' AND e2b_domain = '')
-);
diff --git a/services/core/migrations/000090_environment_initialization.sql b/services/core/migrations/000090_environment_initialization.sql
deleted file mode 100644
index ac5354f8d..000000000
--- a/services/core/migrations/000090_environment_initialization.sql
+++ /dev/null
@@ -1,9 +0,0 @@
--- +goose Up
-ALTER TABLE environments ADD COLUMN initialization text NOT NULL DEFAULT 'complete'
-    CHECK (initialization IN ('pending', 'running', 'complete', 'failed'));
-ALTER TABLE runtime_allocations DROP COLUMN initialization;
-
--- +goose Down
-ALTER TABLE runtime_allocations ADD COLUMN initialization text NOT NULL DEFAULT 'complete'
-    CHECK (initialization IN ('pending', 'running', 'complete'));
-ALTER TABLE environments DROP COLUMN initialization;
diff --git a/services/core/migrations/000091_provider_configuration.sql b/services/core/migrations/000091_provider_configuration.sql
deleted file mode 100644
index 9241d3f39..000000000
--- a/services/core/migrations/000091_provider_configuration.sql
+++ /dev/null
@@ -1,117 +0,0 @@
--- +goose Up
--- Copy only public selectors/observations. Ciphertext and its installation/generation
--- associated data are unchanged; credentials are never decoded by SQL.
-ALTER TABLE runtime_deployment RENAME COLUMN e2b_credential TO provider_credential;
-ALTER TABLE runtime_deployment ADD COLUMN provider_config jsonb NOT NULL DEFAULT '{}' CHECK (jsonb_typeof(provider_config)='object');
-ALTER TABLE runtime_deployment ADD COLUMN provider_metadata jsonb NOT NULL DEFAULT '{}' CHECK (jsonb_typeof(provider_metadata)='object');
-UPDATE runtime_deployment SET
-provider_config=jsonb_build_object('template',e2b_template,'api_url',e2b_api_url,'domain',e2b_domain),
-provider_metadata=jsonb_build_object('template_build',jsonb_build_object('status',e2b_template_build_status,'resources',
- jsonb_build_object('cpus',e2b_template_cpus,'memory_mib',e2b_template_memory_mib,'root_disk_mib',e2b_template_root_disk_mib)))
-WHERE e2b_template<>'';
-ALTER TABLE runtime_deployment DROP COLUMN e2b_template;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_api_url;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_domain;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_template_build_status;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_template_cpus;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_template_memory_mib;
-ALTER TABLE runtime_deployment DROP COLUMN e2b_template_root_disk_mib;
-ALTER TABLE runtime_deployment_generations ADD COLUMN provider_config jsonb NOT NULL DEFAULT '{}' CHECK (jsonb_typeof(provider_config)='object');
-ALTER TABLE runtime_deployment_generations ADD COLUMN provider_metadata jsonb NOT NULL DEFAULT '{}' CHECK (jsonb_typeof(provider_metadata)='object');
-ALTER TABLE runtime_deployment_generations DISABLE TRIGGER immutable_sandbox_specification;
-UPDATE runtime_deployment_generations SET
-provider_config=jsonb_build_object('template',e2b_template,'api_url',e2b_api_url,'domain',e2b_domain),
-provider_metadata=jsonb_build_object('template_build',jsonb_build_object('status',e2b_template_build_status,'resources',
- jsonb_build_object('cpus',e2b_template_cpus,'memory_mib',e2b_template_memory_mib,'root_disk_mib',e2b_template_root_disk_mib)))
-WHERE e2b_template<>'';
-ALTER TABLE runtime_deployment_generations ENABLE TRIGGER immutable_sandbox_specification;
-ALTER TABLE runtime_deployment_generations DROP COLUMN e2b_template;
-ALTER TABLE runtime_deployment_generations DROP COLUMN e2b_api_url;
-ALTER TABLE runtime_deployment_generations DROP COLUMN e2b_domain;
-ALTER TABLE runtime_deployment_generations DROP COLUMN e2b_template_build_status;
-ALTER TABLE runtime_deployment_generations DROP COLUMN e2b_template_cpus;
-ALTER TABLE runtime_deployment_generations DROP COLUMN e2b_template_memory_mib;
-ALTER TABLE runtime_deployment_generations DROP COLUMN e2b_template_root_disk_mib;
-
--- +goose Down
--- Reject a lossy downgrade; no unknown provider configuration may be discarded.
--- +goose StatementBegin
-DO $$ BEGIN
-IF EXISTS (SELECT 1 FROM runtime_deployment WHERE provider_kind NOT IN ('','docker','microsandbox','e2b'))
- OR EXISTS (SELECT 1 FROM runtime_deployment_generations WHERE provider_kind NOT IN ('docker','microsandbox','e2b')) THEN
- RAISE EXCEPTION 'Cannot downgrade provider configurations unknown to the previous schema';
-END IF;
-END $$;
--- +goose StatementEnd
--- +goose StatementBegin
-DO $$ BEGIN
-IF EXISTS (SELECT 1 FROM runtime_deployment WHERE
- (provider_kind<>'e2b' AND (provider_config<>'{}'::jsonb OR provider_metadata<>'{}'::jsonb)) OR
- (provider_kind='e2b' AND (provider_config - ARRAY['template','api_url','domain'] <> '{}'::jsonb OR
- provider_metadata - 'template_build' <> '{}'::jsonb OR
- COALESCE(provider_metadata->'template_build','{}'::jsonb) - ARRAY['status','resources'] <> '{}'::jsonb OR
- COALESCE(provider_metadata#>'{template_build,resources}','{}'::jsonb) - ARRAY['cpus','memory_mib','root_disk_mib'] <> '{}'::jsonb))) THEN
- RAISE EXCEPTION 'Cannot downgrade provider configuration without losing fields';
-END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE runtime_deployment ADD COLUMN e2b_template text NOT NULL DEFAULT '';
-ALTER TABLE runtime_deployment ADD COLUMN e2b_api_url text NOT NULL DEFAULT '';
-ALTER TABLE runtime_deployment ADD COLUMN e2b_domain text NOT NULL DEFAULT '';
-ALTER TABLE runtime_deployment ADD COLUMN e2b_template_build_status text;
-ALTER TABLE runtime_deployment ADD COLUMN e2b_template_cpus integer;
-ALTER TABLE runtime_deployment ADD COLUMN e2b_template_memory_mib integer;
-ALTER TABLE runtime_deployment ADD COLUMN e2b_template_root_disk_mib integer;
-UPDATE runtime_deployment SET
- e2b_template=COALESCE(provider_config->>'template',''),e2b_api_url=COALESCE(provider_config->>'api_url',''),e2b_domain=COALESCE(provider_config->>'domain',''),
- e2b_template_build_status=provider_metadata#>>'{template_build,status}',
- e2b_template_cpus=(provider_metadata#>>'{template_build,resources,cpus}')::integer,
- e2b_template_memory_mib=(provider_metadata#>>'{template_build,resources,memory_mib}')::integer,
- e2b_template_root_disk_mib=(provider_metadata#>>'{template_build,resources,root_disk_mib}')::integer;
-ALTER TABLE runtime_deployment DROP COLUMN provider_config, DROP COLUMN provider_metadata;
--- +goose StatementBegin
-DO $$ BEGIN
-IF EXISTS (SELECT 1 FROM runtime_deployment_generations WHERE
- (provider_kind<>'e2b' AND (provider_config<>'{}'::jsonb OR provider_metadata<>'{}'::jsonb)) OR
- (provider_kind='e2b' AND (provider_config - ARRAY['template','api_url','domain'] <> '{}'::jsonb OR
- provider_metadata - 'template_build' <> '{}'::jsonb OR
- COALESCE(provider_metadata->'template_build','{}'::jsonb) - ARRAY['status','resources'] <> '{}'::jsonb OR
- COALESCE(provider_metadata#>'{template_build,resources}','{}'::jsonb) - ARRAY['cpus','memory_mib','root_disk_mib'] <> '{}'::jsonb))) THEN
- RAISE EXCEPTION 'Cannot downgrade provider configuration without losing fields';
-END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE runtime_deployment_generations ADD COLUMN e2b_template text NOT NULL DEFAULT '';
-ALTER TABLE runtime_deployment_generations ADD COLUMN e2b_api_url text NOT NULL DEFAULT '';
-ALTER TABLE runtime_deployment_generations ADD COLUMN e2b_domain text NOT NULL DEFAULT '';
-ALTER TABLE runtime_deployment_generations ADD COLUMN e2b_template_build_status text;
-ALTER TABLE runtime_deployment_generations ADD COLUMN e2b_template_cpus integer;
-ALTER TABLE runtime_deployment_generations ADD COLUMN e2b_template_memory_mib integer;
-ALTER TABLE runtime_deployment_generations ADD COLUMN e2b_template_root_disk_mib integer;
-ALTER TABLE runtime_deployment_generations DISABLE TRIGGER immutable_sandbox_specification;
-UPDATE runtime_deployment_generations SET
- e2b_template=COALESCE(provider_config->>'template',''),e2b_api_url=COALESCE(provider_config->>'api_url',''),e2b_domain=COALESCE(provider_config->>'domain',''),
- e2b_template_build_status=provider_metadata#>>'{template_build,status}',
- e2b_template_cpus=(provider_metadata#>>'{template_build,resources,cpus}')::integer,
- e2b_template_memory_mib=(provider_metadata#>>'{template_build,resources,memory_mib}')::integer,
- e2b_template_root_disk_mib=(provider_metadata#>>'{template_build,resources,root_disk_mib}')::integer;
-ALTER TABLE runtime_deployment_generations ENABLE TRIGGER immutable_sandbox_specification;
-ALTER TABLE runtime_deployment_generations DROP COLUMN provider_config, DROP COLUMN provider_metadata;
-ALTER TABLE runtime_deployment RENAME COLUMN provider_credential TO e2b_credential;
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_e2b_check CHECK (
-    (provider_kind <> '' AND e2b_template <> '' AND e2b_credential IS NOT NULL) OR
-    (e2b_template = '' AND e2b_credential IS NULL)
-);
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_e2b_template_build_check CHECK (
-    e2b_template <> '' OR (e2b_template_build_status IS NULL AND e2b_template_cpus IS NULL AND
-        e2b_template_memory_mib IS NULL AND e2b_template_root_disk_mib IS NULL)
-);
-ALTER TABLE runtime_deployment ADD CONSTRAINT runtime_deployment_e2b_endpoint_check CHECK (
-    (e2b_api_url = '' AND e2b_domain = '') OR
-    (e2b_template <> '' AND e2b_api_url <> '' AND e2b_domain <> '')
-);
-ALTER TABLE runtime_deployment_generations ADD CONSTRAINT runtime_deployment_generation_e2b_endpoint_check CHECK (
-    (e2b_api_url = '' AND e2b_domain = '') OR
-    (e2b_template <> '' AND e2b_api_url <> '' AND e2b_domain <> '')
-);
-
diff --git a/services/core/migrations/000092_delete_admin_copies.sql b/services/core/migrations/000092_delete_admin_copies.sql
deleted file mode 100644
index 046f74a72..000000000
--- a/services/core/migrations/000092_delete_admin_copies.sql
+++ /dev/null
@@ -1,24 +0,0 @@
--- +goose Up
-DROP TABLE admin_resource_owners;
-DROP TABLE admin_asset_copies;
-ALTER TABLE admin_audit_log DROP COLUMN result_ids;
-
--- +goose Down
-ALTER TABLE admin_audit_log ADD COLUMN result_ids jsonb NOT NULL DEFAULT '[]';
-CREATE TABLE admin_asset_copies (
-    target_tenant_id uuid NOT NULL,
-    idempotency_key text NOT NULL,
-    request_hash bytea NOT NULL,
-    result jsonb NOT NULL,
-    audit_id uuid NOT NULL REFERENCES admin_audit_log(id),
-    PRIMARY KEY (target_tenant_id, idempotency_key)
-);
-CREATE TABLE admin_resource_owners (
-    tenant_id uuid NOT NULL,
-    resource_type text NOT NULL,
-    resource_id text NOT NULL,
-    parent_id text NOT NULL DEFAULT '',
-    audit_id uuid NOT NULL REFERENCES admin_audit_log(id),
-    PRIMARY KEY (tenant_id, resource_type, resource_id)
-);
-CREATE INDEX admin_resource_owners_audit ON admin_resource_owners(audit_id);
diff --git a/services/core/migrations/000093_web_deployment_only.sql b/services/core/migrations/000093_web_deployment_only.sql
deleted file mode 100644
index 54886e099..000000000
--- a/services/core/migrations/000093_web_deployment_only.sql
+++ /dev/null
@@ -1,78 +0,0 @@
--- +goose Up
--- Web setup is the only writer of the installation, so a recorded installation
--- is Web-managed, no deployment names a process-configured local node, every
--- node has the Core address it enrolled with, and only a sandbox reset pauses
--- admission.
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_deployment WHERE local_node_id IS NOT NULL OR (installation_id IS NOT NULL AND NOT web_managed)
-        OR admission_paused <> (reset_clear IS NOT NULL))
-        OR EXISTS (SELECT 1 FROM runtime_nodes WHERE removed_at IS NULL AND core_url = '') THEN
-        RAISE EXCEPTION 'Cannot upgrade: the sandbox deployment was configured outside Web setup, or a live node has no Core address. Reset the sandbox in Web, then upgrade';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE runtime_deployment
-    DROP CONSTRAINT runtime_deployment_identity_check,
-    DROP CONSTRAINT runtime_deployment_setup_check,
-    DROP CONSTRAINT runtime_deployment_reset_check,
-    DROP CONSTRAINT runtime_deployment_reset_admission_check,
-    DROP COLUMN web_managed,
-    DROP COLUMN local_node_id,
-    DROP COLUMN admission_paused,
-    ADD CONSTRAINT runtime_deployment_identity_check CHECK (
-        (installation_id IS NULL AND backend_fingerprint = '') OR
-        (installation_id IS NOT NULL AND backend_fingerprint ~ '^[0-9a-f]{64}$') OR
-        (installation_id IS NOT NULL AND provider_kind = '' AND backend_fingerprint = '')
-    ),
-    ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-        installation_id IS NULL OR
-        (provider_kind = '' AND mode = '' AND generation >= 0 AND idle_seconds = 0 AND retention_seconds = 0) OR
-        (provider_kind <> '' AND mode IN ('nodes','direct') AND generation > 0 AND
-            ((idle_seconds = 0 AND retention_seconds = 0) OR (idle_seconds > 0 AND retention_seconds > 0)))
-    ),
-    ADD CONSTRAINT runtime_deployment_reset_check CHECK (
-        (reset_clear IS NULL AND reset_requested_at IS NULL AND reset_deadline_at IS NULL
-            AND reset_forced_at IS NULL AND reset_audit IS NULL)
-        OR (reset_clear IS NOT NULL AND installation_id IS NOT NULL AND provider_kind <> ''
-            AND reset_requested_at IS NOT NULL AND reset_audit IS NOT NULL
-            AND jsonb_typeof(reset_audit) = 'object'
-            AND ((reset_clear = 'auto' AND reset_deadline_at IS NOT NULL AND reset_forced_at IS NULL)
-                OR (reset_clear = 'force' AND reset_forced_at IS NOT NULL)))
-    );
-
--- +goose Down
-ALTER TABLE runtime_deployment
-    DROP CONSTRAINT runtime_deployment_identity_check,
-    DROP CONSTRAINT runtime_deployment_setup_check,
-    DROP CONSTRAINT runtime_deployment_reset_check,
-    ADD COLUMN web_managed boolean NOT NULL DEFAULT false,
-    ADD COLUMN local_node_id uuid,
-    ADD COLUMN admission_paused boolean NOT NULL DEFAULT false;
-UPDATE runtime_deployment SET web_managed = installation_id IS NOT NULL, admission_paused = reset_clear IS NOT NULL;
-ALTER TABLE runtime_deployment
-    ADD CONSTRAINT runtime_deployment_identity_check CHECK (
-        (installation_id IS NULL AND backend_fingerprint = '') OR
-        (installation_id IS NOT NULL AND backend_fingerprint ~ '^[0-9a-f]{64}$') OR
-        (web_managed AND installation_id IS NOT NULL AND provider_kind = '' AND backend_fingerprint = '')
-    ),
-    ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-        NOT web_managed OR (local_node_id IS NULL AND (
-            (provider_kind = '' AND mode = '' AND generation >= 0 AND idle_seconds = 0 AND retention_seconds = 0) OR
-            (provider_kind <> '' AND mode IN ('nodes','direct') AND generation > 0 AND
-                ((idle_seconds = 0 AND retention_seconds = 0) OR (idle_seconds > 0 AND retention_seconds > 0)))
-        ))
-    ),
-    ADD CONSTRAINT runtime_deployment_reset_check CHECK (
-        (reset_clear IS NULL AND reset_requested_at IS NULL AND reset_deadline_at IS NULL
-            AND reset_forced_at IS NULL AND reset_audit IS NULL)
-        OR (reset_clear IS NOT NULL AND web_managed AND provider_kind <> ''
-            AND reset_requested_at IS NOT NULL AND reset_audit IS NOT NULL
-            AND jsonb_typeof(reset_audit) = 'object'
-            AND ((reset_clear = 'auto' AND reset_deadline_at IS NOT NULL AND reset_forced_at IS NULL)
-                OR (reset_clear = 'force' AND reset_forced_at IS NOT NULL)))
-    ),
-    ADD CONSTRAINT runtime_deployment_reset_admission_check CHECK (
-        NOT web_managed OR admission_paused = (reset_clear IS NOT NULL)
-    );
diff --git a/services/core/migrations/000094_suspension_from_declaration.sql b/services/core/migrations/000094_suspension_from_declaration.sql
deleted file mode 100644
index 67bd968aa..000000000
--- a/services/core/migrations/000094_suspension_from_declaration.sql
+++ /dev/null
@@ -1,26 +0,0 @@
--- +goose Up
--- Core derives the idle suspension policy from the Provider's checkpoint
--- declaration, so the deployment no longer stores it.
-ALTER TABLE runtime_deployment
-    DROP CONSTRAINT runtime_deployment_setup_check,
-    DROP COLUMN idle_seconds,
-    DROP COLUMN retention_seconds,
-    ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-        installation_id IS NULL OR
-        (provider_kind = '' AND mode = '' AND generation >= 0) OR
-        (provider_kind <> '' AND mode IN ('nodes','direct') AND generation > 0)
-    );
-
--- +goose Down
-ALTER TABLE runtime_deployment
-    DROP CONSTRAINT runtime_deployment_setup_check,
-    ADD COLUMN idle_seconds bigint NOT NULL DEFAULT 0 CHECK (idle_seconds >= 0),
-    ADD COLUMN retention_seconds bigint NOT NULL DEFAULT 0 CHECK (retention_seconds >= 0);
-UPDATE runtime_deployment SET idle_seconds = 300, retention_seconds = 86400 WHERE provider_kind = 'microsandbox';
-ALTER TABLE runtime_deployment
-    ADD CONSTRAINT runtime_deployment_setup_check CHECK (
-        installation_id IS NULL OR
-        (provider_kind = '' AND mode = '' AND generation >= 0 AND idle_seconds = 0 AND retention_seconds = 0) OR
-        (provider_kind <> '' AND mode IN ('nodes','direct') AND generation > 0 AND
-            ((idle_seconds = 0 AND retention_seconds = 0) OR (idle_seconds > 0 AND retention_seconds > 0)))
-    );
diff --git a/services/core/migrations/000095_node_readiness_classes.sql b/services/core/migrations/000095_node_readiness_classes.sql
deleted file mode 100644
index 36cc27afb..000000000
--- a/services/core/migrations/000095_node_readiness_classes.sql
+++ /dev/null
@@ -1,19 +0,0 @@
--- +goose Up
--- Node readiness diagnostics are Provider-neutral classes. An offline node keeps
--- its last report, so rewrite every stored vendor code to its class.
-UPDATE runtime_nodes SET health = jsonb_set(health, '{diagnostic}', to_jsonb(CASE health->>'diagnostic'
-        WHEN 'docker_unavailable' THEN 'provider_unavailable'
-        WHEN 'microsandbox_artifacts_unavailable' THEN 'artifacts_unavailable'
-        ELSE 'host_unsupported' END::text))
-WHERE health->>'diagnostic' IN ('docker_unavailable', 'docker_limits_unsupported', 'kvm_unavailable', 'microsandbox_artifacts_unavailable');
-UPDATE runtime_node_generation_status SET diagnostic = CASE diagnostic
-        WHEN 'docker_unavailable' THEN 'provider_unavailable'
-        WHEN 'microsandbox_artifacts_unavailable' THEN 'artifacts_unavailable'
-        ELSE 'host_unsupported' END
-WHERE diagnostic IN ('docker_unavailable', 'docker_limits_unsupported', 'kvm_unavailable', 'microsandbox_artifacts_unavailable');
-
--- +goose Down
-UPDATE runtime_nodes SET health = jsonb_set(health, '{diagnostic}', '"provider_unavailable"')
-WHERE health->>'diagnostic' IN ('host_unsupported', 'artifacts_unavailable');
-UPDATE runtime_node_generation_status SET diagnostic = 'provider_unavailable'
-WHERE diagnostic IN ('host_unsupported', 'artifacts_unavailable');
diff --git a/services/core/migrations/000096_configured_admission.sql b/services/core/migrations/000096_configured_admission.sql
deleted file mode 100644
index 0d2c98c4c..000000000
--- a/services/core/migrations/000096_configured_admission.sql
+++ /dev/null
@@ -1,20 +0,0 @@
--- +goose Up
--- Only a claimed deployment with a provider admits hosted work, so every
--- allocation runs on a node or belongs to a direct deployment, and none needs
--- a keepalive lease.
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM runtime_allocations a CROSS JOIN runtime_deployment d
-            WHERE a.state <> 'released' AND a.node_id IS NULL AND d.mode <> 'direct')
-        OR EXISTS (SELECT 1 FROM environments e JOIN sessions s ON s.id = e.session_id CROSS JOIN runtime_deployment d
-            WHERE d.installation_id IS NULL AND s.deleted_at IS NULL AND e.status = 'pending'
-            AND s.configuration->'environment'->>'type' = 'openai_hosted') THEN
-        RAISE EXCEPTION 'Cannot upgrade: hosted Sessions hold sandbox work that no configured sandbox deployment admitted. Delete those Sessions and release their runtime allocations, then upgrade';
-    END IF;
-END $$;
--- +goose StatementEnd
-ALTER TABLE runtime_allocations DROP COLUMN kept_at;
-
--- +goose Down
-ALTER TABLE runtime_allocations ADD COLUMN kept_at timestamptz NOT NULL DEFAULT clock_timestamp();
diff --git a/services/core/migrations/000097_workspace_storage.sql b/services/core/migrations/000097_workspace_storage.sql
deleted file mode 100644
index 99cc822a1..000000000
--- a/services/core/migrations/000097_workspace_storage.sql
+++ /dev/null
@@ -1,56 +0,0 @@
--- +goose Up
-CREATE TABLE workspace_fs_configurations (
-    id uuid PRIMARY KEY,
-    adapter text NOT NULL CHECK (adapter <> ''),
-    parameters jsonb NOT NULL CHECK (jsonb_typeof(parameters) = 'object'),
-    active boolean NOT NULL DEFAULT false
-);
-CREATE UNIQUE INDEX workspace_fs_active_idx ON workspace_fs_configurations (active) WHERE active;
-
--- +goose StatementBegin
-CREATE FUNCTION immutable_workspace_configuration() RETURNS trigger LANGUAGE plpgsql AS $$
-BEGIN
-    IF (NEW.id, NEW.adapter, NEW.parameters) IS DISTINCT FROM (OLD.id, OLD.adapter, OLD.parameters) THEN
-        RAISE EXCEPTION 'Workspace filesystem configuration is immutable';
-    END IF;
-    RETURN NEW;
-END $$;
--- +goose StatementEnd
-CREATE TRIGGER immutable_workspace_configuration BEFORE UPDATE ON workspace_fs_configurations
-FOR EACH ROW EXECUTE FUNCTION immutable_workspace_configuration();
-
-CREATE TABLE environment_workspaces (
-    object_id uuid PRIMARY KEY,
-    environment_id uuid NOT NULL UNIQUE REFERENCES environments(id),
-    configuration_id uuid NOT NULL REFERENCES workspace_fs_configurations(id),
-    state text NOT NULL DEFAULT 'creating' CHECK (state IN ('creating', 'ready', 'deleting', 'deleted')),
-    attachment jsonb CHECK (attachment IS NULL OR jsonb_typeof(attachment) = 'object'),
-    CHECK (state <> 'ready' OR attachment IS NOT NULL)
-);
-
--- +goose StatementBegin
-CREATE FUNCTION immutable_workspace_identity() RETURNS trigger LANGUAGE plpgsql AS $$
-BEGIN
-    IF (NEW.object_id, NEW.environment_id, NEW.configuration_id) IS DISTINCT FROM (OLD.object_id, OLD.environment_id, OLD.configuration_id) THEN
-        RAISE EXCEPTION 'Environment workspace identity is immutable';
-    END IF;
-    RETURN NEW;
-END $$;
--- +goose StatementEnd
-CREATE TRIGGER immutable_workspace_identity BEFORE UPDATE ON environment_workspaces
-FOR EACH ROW EXECUTE FUNCTION immutable_workspace_identity();
-
--- +goose Down
-LOCK TABLE environment_workspaces, workspace_fs_configurations IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM environment_workspaces) THEN
-        RAISE EXCEPTION 'Cannot discard durable workspace ownership, including deleted identities';
-    END IF;
-END $$;
--- +goose StatementEnd
-DROP TABLE environment_workspaces;
-DROP TABLE workspace_fs_configurations;
-DROP FUNCTION immutable_workspace_identity();
-DROP FUNCTION immutable_workspace_configuration();
diff --git a/services/core/migrations/000098_compute_incarnations.sql b/services/core/migrations/000098_compute_incarnations.sql
deleted file mode 100644
index 7fb951331..000000000
--- a/services/core/migrations/000098_compute_incarnations.sql
+++ /dev/null
@@ -1,40 +0,0 @@
--- +goose Up
-ALTER TABLE runtime_allocations DROP CONSTRAINT runtime_allocations_environment_id_key;
-CREATE UNIQUE INDEX runtime_allocations_current_environment ON runtime_allocations(environment_id) WHERE state <> 'released';
-CREATE INDEX runtime_allocations_environment_receipts ON runtime_allocations(environment_id, created_at DESC, id DESC);
-ALTER TABLE runtime_allocations DROP CONSTRAINT runtime_allocation_placement_fk;
-ALTER TABLE runtime_allocations ADD CONSTRAINT runtime_allocation_node_fk FOREIGN KEY(node_id) REFERENCES runtime_nodes(id);
-ALTER TABLE devices DROP CONSTRAINT devices_environment_id_key;
-CREATE UNIQUE INDEX devices_environment_authority ON devices(environment_id) WHERE revoked_at IS NULL OR executor_key_id IS NOT NULL;
-
-ALTER TABLE devices ADD COLUMN supported_agent_kinds jsonb NOT NULL DEFAULT '[]' CHECK (jsonb_typeof(supported_agent_kinds) = 'array');
-
--- Cold retained Sessions own no compute, but a reset must end their execution lifetime.
-CREATE VIEW runtime_reset_retained_environments AS
-SELECT e.id AS environment_id, s.id AS session_id, s.tenant_id, a.deployment_generation
-FROM environments e JOIN sessions s ON s.id = e.session_id
-JOIN environment_workspaces w ON w.environment_id = e.id AND w.state = 'ready'
-JOIN LATERAL (
-    SELECT allocation.* FROM runtime_allocations allocation
-    WHERE allocation.environment_id = e.id
-    ORDER BY allocation.created_at DESC, allocation.id DESC LIMIT 1
-) a ON true
-CROSS JOIN runtime_deployment d
-WHERE d.reset_clear IS NOT NULL AND d.reset_requested_at IS NOT NULL
-  AND s.deleted_at IS NULL AND s.created_at <= d.reset_requested_at
-  AND e.status NOT IN ('failed','expired') AND e.initialization = 'complete'
-  AND s.configuration->'environment'->>'type' = 'openai_hosted'
-  AND a.state = 'released' AND a.provider_key = d.installation_id
-  AND a.deployment_generation <= d.generation AND a.created_at <= d.reset_requested_at
-  AND NOT EXISTS (SELECT 1 FROM runtime_placements p WHERE p.environment_id = e.id AND p.released_at IS NULL);
-
--- +goose Down
-DROP VIEW runtime_reset_retained_environments;
-ALTER TABLE devices DROP COLUMN supported_agent_kinds;
-DROP INDEX devices_environment_authority;
-ALTER TABLE devices ADD CONSTRAINT devices_environment_id_key UNIQUE(environment_id);
-ALTER TABLE runtime_allocations DROP CONSTRAINT runtime_allocation_node_fk;
-ALTER TABLE runtime_allocations ADD CONSTRAINT runtime_allocation_placement_fk FOREIGN KEY(environment_id,node_id) REFERENCES runtime_placements(environment_id,node_id);
-DROP INDEX runtime_allocations_environment_receipts;
-DROP INDEX runtime_allocations_current_environment;
-ALTER TABLE runtime_allocations ADD CONSTRAINT runtime_allocations_environment_id_key UNIQUE(environment_id);
diff --git a/services/core/migrations/000099_checkpoint_compatibility.sql b/services/core/migrations/000099_checkpoint_compatibility.sql
deleted file mode 100644
index 0e9b0b490..000000000
--- a/services/core/migrations/000099_checkpoint_compatibility.sql
+++ /dev/null
@@ -1,6 +0,0 @@
--- +goose Up
-ALTER TABLE runtime_node_generation_status ADD COLUMN checkpoint jsonb
-    CHECK (checkpoint IS NULL OR jsonb_typeof(checkpoint) = 'object');
-
--- +goose Down
-ALTER TABLE runtime_node_generation_status DROP COLUMN checkpoint;
diff --git a/services/core/migrations/000100_workspace_capacity.sql b/services/core/migrations/000100_workspace_capacity.sql
deleted file mode 100644
index a8c6fdd7d..000000000
--- a/services/core/migrations/000100_workspace_capacity.sql
+++ /dev/null
@@ -1,68 +0,0 @@
--- +goose Up
--- Adapter-encoded private credential, sealed with the installation and
--- configuration ID. Existing configurations require none.
-ALTER TABLE workspace_fs_configurations ADD COLUMN credential bytea
-    CHECK (credential IS NULL OR length(credential) > 0);
--- The admitted per-workspace capacity. Existing workspaces were admitted without one.
-ALTER TABLE environment_workspaces ADD COLUMN capacity_mib bigint NOT NULL DEFAULT 0
-    CHECK (capacity_mib BETWEEN 0 AND 4294967295);
--- The installation's single tenant capacity policy; zero disables admission.
-CREATE TABLE workspace_storage_admission (
-    singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
-    tenant_capacity_mib bigint NOT NULL DEFAULT 0 CHECK (tenant_capacity_mib BETWEEN 0 AND 4294967295)
-);
-INSERT INTO workspace_storage_admission DEFAULT VALUES;
-
--- +goose StatementBegin
-CREATE OR REPLACE FUNCTION immutable_workspace_configuration() RETURNS trigger LANGUAGE plpgsql AS $$
-BEGIN
-    IF (NEW.id, NEW.adapter, NEW.parameters, NEW.credential) IS DISTINCT FROM (OLD.id, OLD.adapter, OLD.parameters, OLD.credential) THEN
-        RAISE EXCEPTION 'Workspace filesystem configuration is immutable';
-    END IF;
-    RETURN NEW;
-END $$;
--- +goose StatementEnd
-
--- +goose StatementBegin
-CREATE OR REPLACE FUNCTION immutable_workspace_identity() RETURNS trigger LANGUAGE plpgsql AS $$
-BEGIN
-    IF (NEW.object_id, NEW.environment_id, NEW.configuration_id, NEW.capacity_mib) IS DISTINCT FROM (OLD.object_id, OLD.environment_id, OLD.configuration_id, OLD.capacity_mib) THEN
-        RAISE EXCEPTION 'Environment workspace identity is immutable';
-    END IF;
-    RETURN NEW;
-END $$;
--- +goose StatementEnd
-
--- +goose Down
-LOCK TABLE environment_workspaces, workspace_fs_configurations, workspace_storage_admission IN ACCESS EXCLUSIVE MODE;
--- +goose StatementBegin
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM workspace_fs_configurations WHERE credential IS NOT NULL)
-        OR EXISTS (SELECT 1 FROM environment_workspaces WHERE capacity_mib <> 0)
-        OR EXISTS (SELECT 1 FROM workspace_storage_admission WHERE tenant_capacity_mib <> 0) THEN
-        RAISE EXCEPTION 'Cannot discard workspace credentials, admitted capacities or tenant capacity policy';
-    END IF;
-END $$;
--- +goose StatementEnd
--- +goose StatementBegin
-CREATE OR REPLACE FUNCTION immutable_workspace_configuration() RETURNS trigger LANGUAGE plpgsql AS $$
-BEGIN
-    IF (NEW.id, NEW.adapter, NEW.parameters) IS DISTINCT FROM (OLD.id, OLD.adapter, OLD.parameters) THEN
-        RAISE EXCEPTION 'Workspace filesystem configuration is immutable';
-    END IF;
-    RETURN NEW;
-END $$;
--- +goose StatementEnd
--- +goose StatementBegin
-CREATE OR REPLACE FUNCTION immutable_workspace_identity() RETURNS trigger LANGUAGE plpgsql AS $$
-BEGIN
-    IF (NEW.object_id, NEW.environment_id, NEW.configuration_id) IS DISTINCT FROM (OLD.object_id, OLD.environment_id, OLD.configuration_id) THEN
-        RAISE EXCEPTION 'Environment workspace identity is immutable';
-    END IF;
-    RETURN NEW;
-END $$;
--- +goose StatementEnd
-DROP TABLE workspace_storage_admission;
-ALTER TABLE environment_workspaces DROP COLUMN capacity_mib;
-ALTER TABLE workspace_fs_configurations DROP COLUMN credential;
diff --git a/services/core/migrations/000101_sandbox_idle_policy.sql b/services/core/migrations/000101_sandbox_idle_policy.sql
deleted file mode 100644
index 65c64bc99..000000000
--- a/services/core/migrations/000101_sandbox_idle_policy.sql
+++ /dev/null
@@ -1,5 +0,0 @@
--- +goose Up
-ALTER TABLE runtime_deployment ADD COLUMN idle_seconds bigint NOT NULL DEFAULT 300 CHECK (idle_seconds BETWEEN 30 AND 86400);
-
--- +goose Down
-ALTER TABLE runtime_deployment DROP COLUMN idle_seconds;
diff --git a/services/core/migrations/beta_upgrade_test.go b/services/core/migrations/beta_upgrade_test.go
deleted file mode 100644
index a56b80c78..000000000
--- a/services/core/migrations/beta_upgrade_test.go
+++ /dev/null
@@ -1,213 +0,0 @@
-package migrations
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"fmt"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/pgconn"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-// A dedicated disposable database exercises the real 91-to-101 SQL, never a
-// product database. No provider or native sandbox is contacted by this test.
-func TestBeta91UpgradePreservesRetainedAllocations(t *testing.T) {
-	dsn := os.Getenv("OAC_TEST_DATABASE_URL")
-	if dsn == "" {
-		t.Skip("dedicated PostgreSQL required")
-	}
-	cfg, err := pgx.ParseConfig(dsn)
-	if err != nil {
-		t.Fatal("invalid test database configuration")
-	}
-	if !strings.HasPrefix(cfg.Database, "oac_") || !strings.HasSuffix(cfg.Database, "_tests") {
-		t.Fatal("dedicated oac_*_tests database required")
-	}
-	admin, err := sql.Open("pgx", cfg.ConnString())
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer admin.Close()
-	name := "oac_upgrade_" + strings.ReplaceAll(uuid.NewString(), "-", "") + "_tests"
-	if _, err = admin.ExecContext(t.Context(), "CREATE DATABASE "+pgx.Identifier{name}.Sanitize()); err != nil {
-		t.Fatal(err)
-	}
-	defer func() {
-		if _, err := admin.ExecContext(context.Background(), "DROP DATABASE "+pgx.Identifier{name}.Sanitize()+" WITH (FORCE)"); err != nil {
-			t.Error(err)
-		}
-	}()
-	cfg.Database = name
-	db := stdlib.OpenDB(*cfg)
-	defer db.Close()
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, files, goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err = provider.UpTo(t.Context(), 91); err != nil {
-		t.Fatal(err)
-	}
-	installation := uuid.NewString()
-	if _, err = db.ExecContext(t.Context(), `UPDATE runtime_deployment SET installation_id=$1,backend_fingerprint=repeat('a',64),provider_kind='e2b',mode='direct',generation=4,web_managed=true,idle_seconds=300,retention_seconds=86400`, installation); err != nil {
-		t.Fatal(err)
-	}
-	for i := 0; i < 107; i++ {
-		session, environment, device, allocation, tenant := uuid.NewString(), uuid.NewString(), uuid.NewString(), uuid.NewString(), uuid.NewString()
-		if _, err = db.ExecContext(t.Context(), `INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash,configuration) VALUES($1::uuid,$2,'codex',$1::uuid::text,'fixture','{"environment":{"type":"openai_hosted"}}')`, session, tenant); err != nil {
-			t.Fatal(err)
-		}
-		if _, err = db.ExecContext(t.Context(), `INSERT INTO environments(id,session_id,status) VALUES($1,$2,'disconnected')`, environment, session); err != nil {
-			t.Fatal(err)
-		}
-		if _, err = db.ExecContext(t.Context(), `INSERT INTO devices(id,tenant_id,name,credential_hash,environment_id) VALUES($1,$2,'fixture',repeat('b',64),$3)`, device, tenant, environment); err != nil {
-			t.Fatal(err)
-		}
-		state := "running"
-		if i >= 17 {
-			state = "released"
-		}
-		retained := fmt.Sprintf(`{"protocol_version":"1","current":{"Generation":0,"Name":"allocation-%d","ID":"sandbox-%d","RestoredFrom":null},"retained":{"Reference":"fixture-%d","ID":"sandbox-%d","Data":"{\"version\":1,\"sandbox_id\":\"sandbox-%d\"}","OperationID":"pause-%d","SourceGeneration":0,"SourceName":"allocation-%d","SourceID":"sandbox-%d"},"suspend_id":"pause-%d"}`, i, i, i, i, i, i, i, i, i)
-		if _, err = db.ExecContext(t.Context(), `INSERT INTO runtime_allocations(id,environment_id,device_id,provider_key,state,create_settled,compute_phase,compute_state,compute_retained_until,deployment_generation,released_at) VALUES($1,$2,$3,$4,$5,true,'suspended',$6,clock_timestamp()+interval '24 hours',4,CASE WHEN $5='released' THEN clock_timestamp() END)`, allocation, environment, device, installation, state, retained); err != nil {
-			t.Fatal(err)
-		}
-	}
-	// Retained bytes as represented by PostgreSQL, bindings, phase and deadlines
-	// must be exactly unchanged, including released records.
-	snapshot := func() string {
-		var v string
-		err := db.QueryRowContext(t.Context(), `SELECT jsonb_agg(to_jsonb(a)-'kept_at' ORDER BY id)::text FROM runtime_allocations a`).Scan(&v)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return v
-	}
-	before := snapshot()
-	if _, err = provider.Up(t.Context()); err != nil {
-		t.Fatal(err)
-	}
-	if snapshot() != before {
-		t.Fatal("migration changed retained state, ownership or deadline")
-	}
-	var idlePolicy int
-	if err = db.QueryRowContext(t.Context(), `SELECT idle_seconds FROM runtime_deployment`).Scan(&idlePolicy); err != nil || idlePolicy != 300 {
-		t.Fatal("mutable idle policy default", idlePolicy, err)
-	}
-	var version, live, workspaces int
-	if err = db.QueryRowContext(t.Context(), `SELECT max(version_id) FROM agents_api_schema_version WHERE is_applied`).Scan(&version); err != nil || version != 101 {
-		t.Fatal(version, err)
-	}
-	if err = db.QueryRowContext(t.Context(), `SELECT count(*) FROM runtime_allocations WHERE state<>'released' AND compute_phase='suspended' AND compute_state->>'protocol_version'='1'`).Scan(&live); err != nil || live != 17 {
-		t.Fatal(live, err)
-	}
-	if err = db.QueryRowContext(t.Context(), `SELECT count(*) FROM environment_workspaces`).Scan(&workspaces); err != nil || workspaces != 0 {
-		t.Fatal(workspaces, err)
-	}
-	checkBeta99CheckpointConstraint(t, db, installation)
-	checkBeta98HistoricalAllocationDowngrade(t, db, provider)
-	if snapshot() != before {
-		t.Fatal("constraint checks changed retained ownership")
-	}
-	// Empty workspace ownership permits Down, but it does not restore removed
-	// values. Verify the documented E2B-policy rollback incompatibility.
-	if _, err = provider.DownTo(t.Context(), 91); err != nil {
-		t.Fatal(err)
-	}
-	var idle, retention int
-	if err = db.QueryRowContext(t.Context(), `SELECT idle_seconds,retention_seconds FROM runtime_deployment`).Scan(&idle, &retention); err != nil || idle != 0 || retention != 0 {
-		t.Fatal(idle, retention, err)
-	}
-	if snapshot() != before {
-		t.Fatal("down migration changed retained ownership")
-	}
-}
-
-// Migration 99 accepts only structured compatibility evidence. It does not
-// manufacture a token for existing nodes or reinterpret adapter-private state.
-func checkBeta99CheckpointConstraint(t *testing.T, db *sql.DB, installation string) {
-	t.Helper()
-	node, connection := uuid.NewString(), uuid.NewString()
-	if _, err := db.ExecContext(t.Context(), `INSERT INTO runtime_nodes(id,installation_id,name,backend_fingerprint,credential_sha256,max_active,max_retained) VALUES($1,$2,'migration-fixture',repeat('c',64),repeat('d',64),1,2)`, node, installation); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(t.Context(), `INSERT INTO runtime_node_generation_status(node_id,generation,specification_digest,connection_id,owner_epoch,state) VALUES($1,1,repeat('e',64),$2,1,'ready')`, node, connection); err != nil {
-		t.Fatal(err)
-	}
-	var absent bool
-	if err := db.QueryRowContext(t.Context(), `SELECT checkpoint IS NULL FROM runtime_node_generation_status WHERE node_id=$1`, node).Scan(&absent); err != nil || !absent {
-		t.Fatal("checkpoint default", absent, err)
-	}
-	if _, err := db.ExecContext(t.Context(), `UPDATE runtime_node_generation_status SET checkpoint='{"artifact_domain":"fixture","execution_class":"fixture"}' WHERE node_id=$1`, node); err != nil {
-		t.Fatal(err)
-	}
-	for _, invalid := range []string{`[]`, `"opaque"`, `1`, `null`} {
-		_, err := db.ExecContext(t.Context(), `UPDATE runtime_node_generation_status SET checkpoint=$2 WHERE node_id=$1`, node, invalid)
-		var pgerr *pgconn.PgError
-		if !errors.As(err, &pgerr) || pgerr.Code != "23514" {
-			t.Fatalf("checkpoint shape %s: %v", invalid, err)
-		}
-	}
-	if _, err := db.ExecContext(t.Context(), `DELETE FROM runtime_node_generation_status WHERE node_id=$1`, node); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(t.Context(), `DELETE FROM runtime_nodes WHERE id=$1`, node); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// Migration 98 keeps multiple historical receipts but one active allocation
-// and one live device authority. Down must fail rather than erase history.
-func checkBeta98HistoricalAllocationDowngrade(t *testing.T, db *sql.DB, provider *goose.Provider) {
-	t.Helper()
-	device, allocation := uuid.NewString(), uuid.NewString()
-	var environment, tenant, installation string
-	if err := db.QueryRowContext(t.Context(), `SELECT a.environment_id,s.tenant_id,a.provider_key FROM runtime_allocations a JOIN environments e ON e.id=a.environment_id JOIN sessions s ON s.id=e.session_id WHERE a.state='running' ORDER BY a.id LIMIT 1`).Scan(&environment, &tenant, &installation); err != nil {
-		t.Fatal(err)
-	}
-	_, err := db.ExecContext(t.Context(), `INSERT INTO devices(id,tenant_id,name,credential_hash,environment_id) VALUES($1,$2,'duplicate-authority',repeat('f',64),$3)`, device, tenant, environment)
-	requireBetaUniqueViolation(t, err, "devices_environment_authority")
-	if _, err := db.ExecContext(t.Context(), `INSERT INTO devices(id,tenant_id,name,credential_hash,environment_id,revoked_at) VALUES($1,$2,'historical-device',repeat('f',64),$3,clock_timestamp())`, device, tenant, environment); err != nil {
-		t.Fatal(err)
-	}
-	_, err = db.ExecContext(t.Context(), `INSERT INTO runtime_allocations(id,environment_id,device_id,provider_key,state,create_settled,deployment_generation) VALUES($1,$2,$3,$4,'running',true,4)`, allocation, environment, device, installation)
-	requireBetaUniqueViolation(t, err, "runtime_allocations_current_environment")
-	if _, err := db.ExecContext(t.Context(), `INSERT INTO runtime_allocations(id,environment_id,device_id,provider_key,state,create_settled,released_at,deployment_generation) VALUES($1,$2,$3,$4,'released',true,clock_timestamp(),4)`, allocation, environment, device, installation); err != nil {
-		t.Fatal(err)
-	}
-	_, err = provider.DownTo(t.Context(), 97)
-	requireBetaUniqueViolation(t, err, "devices_environment_id_key")
-	// Isolate the allocation downgrade guard after proving device history also
-	// prevents Down. This fixture never grants the unbound old device authority.
-	if _, err := db.ExecContext(t.Context(), `UPDATE devices SET environment_id=NULL WHERE id=$1`, device); err != nil {
-		t.Fatal(err)
-	}
-	_, err = provider.DownTo(t.Context(), 97)
-	requireBetaUniqueViolation(t, err, "runtime_allocations_environment_id_key")
-	var count int
-	if err := db.QueryRowContext(t.Context(), `SELECT count(*) FROM runtime_allocations WHERE environment_id=$1`, environment).Scan(&count); err != nil || count != 2 {
-		t.Fatal("failed downgrade lost history", count, err)
-	}
-	if _, err := db.ExecContext(t.Context(), `DELETE FROM runtime_allocations WHERE id=$1`, allocation); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(t.Context(), `DELETE FROM devices WHERE id=$1`, device); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.Up(t.Context()); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func requireBetaUniqueViolation(t *testing.T, err error, constraint string) {
-	t.Helper()
-	var pgerr *pgconn.PgError
-	if !errors.As(err, &pgerr) || pgerr.Code != "23505" || pgerr.ConstraintName != constraint {
-		t.Fatalf("expected %s uniqueness fence: %v", constraint, err)
-	}
-}
diff --git a/services/core/migrations/compute_profiles_test.go b/services/core/migrations/compute_profiles_test.go
new file mode 100644
index 000000000..1f7b6fb36
--- /dev/null
+++ b/services/core/migrations/compute_profiles_test.go
@@ -0,0 +1,87 @@
+package migrations
+
+import (
+	"context"
+	"database/sql"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/stdlib"
+	"github.com/pressly/goose/v3"
+)
+
+// Exercise the current development baseline; historical releases are reinstalled,
+// not upgraded through the retired migration chain.
+func TestComputeProfilesPreserveDefaultSelection(t *testing.T) {
+	dsn := os.Getenv("OAC_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("dedicated PostgreSQL required")
+	}
+	cfg, err := pgx.ParseConfig(dsn)
+	if err != nil {
+		t.Fatal("invalid test database configuration")
+	}
+	if !strings.HasPrefix(cfg.Database, "oac_") || !strings.HasSuffix(cfg.Database, "_tests") {
+		t.Fatal("dedicated oac_*_tests database required")
+	}
+	admin, err := sql.Open("pgx", cfg.ConnString())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer admin.Close()
+	name := "oac_profiles_" + strings.ReplaceAll(uuid.NewString(), "-", "") + "_tests"
+	if _, err = admin.ExecContext(t.Context(), "CREATE DATABASE "+pgx.Identifier{name}.Sanitize()); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		if _, err := admin.ExecContext(context.Background(), "DROP DATABASE "+pgx.Identifier{name}.Sanitize()+" WITH (FORCE)"); err != nil {
+			t.Error(err)
+		}
+	}()
+	cfg.Database = name
+	db := stdlib.OpenDB(*cfg)
+	defer db.Close()
+	provider, err := goose.NewProvider(goose.DialectPostgres, db, files, goose.WithTableName("oac_schema_version"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = provider.UpTo(t.Context(), 3); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = db.ExecContext(t.Context(), `UPDATE runtime_deployment SET provider_kind='e2b', mode='direct', generation=7, provider_config='{"template":"fixture:build"}', specification='{"resources":{"cpus":2,"memory_mib":2048}}'`); err != nil {
+		t.Fatal(err)
+	}
+	session := uuid.NewString()
+	if _, err = db.ExecContext(t.Context(), `INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash,configuration) VALUES($1,$2,'codex','default-session','fixture','{"environment":{"type":"openai_hosted"}}')`, session, uuid.NewString()); err != nil {
+		t.Fatal(err)
+	}
+	snapshot := func() string {
+		var s string
+		if err := db.QueryRowContext(t.Context(), `SELECT (to_jsonb(d)-'compute_profiles')::text FROM runtime_deployment d`).Scan(&s); err != nil {
+			t.Fatal(err)
+		}
+		return s
+	}
+	before := snapshot()
+	if _, err = provider.Up(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+	if snapshot() != before {
+		t.Fatal("migration changed the existing default selection")
+	}
+	var empty bool
+	if err = db.QueryRowContext(t.Context(), `SELECT compute_profiles='{}'::jsonb FROM runtime_deployment`).Scan(&empty); err != nil || !empty {
+		t.Fatal("nonempty profile default", empty, err)
+	}
+	var count int
+	if err = db.QueryRowContext(t.Context(), `SELECT count(*) FROM session_compute_generations`).Scan(&count); err != nil || count != 0 {
+		t.Fatal("existing Session was assigned a profile", count, err)
+	}
+	var version int
+	if err = db.QueryRowContext(t.Context(), `SELECT max(version_id) FROM oac_schema_version WHERE is_applied`).Scan(&version); err != nil || version != 4 {
+		t.Fatal(version, err)
+	}
+}
diff --git a/services/core/migrations/migrations.go b/services/core/migrations/migrations.go
index 121ba1a84..33a59d9d3 100644
--- a/services/core/migrations/migrations.go
+++ b/services/core/migrations/migrations.go
@@ -1,11 +1,10 @@
-// Package migrations owns only the Agents API database schema.
+// Package migrations owns only the OpenAgentCore database schema.
 package migrations
 
 import (
 	"context"
 	"database/sql"
 	"embed"
-	"fmt"
 
 	_ "github.com/jackc/pgx/v5/stdlib"
 	"github.com/pressly/goose/v3"
@@ -15,9 +14,9 @@ import (
 //go:embed *.sql
 var files embed.FS
 
-// Apply upgrades the dedicated execution database without consulting product
-// data and refuses a schema newer than its migrations. A session advisory lock
-// serializes concurrent Core starts.
+// Apply creates the schema in the dedicated execution database without
+// consulting product data. A session advisory lock serializes concurrent Core
+// starts.
 func Apply(ctx context.Context, databaseURL string) error {
 	db, err := sql.Open("pgx", databaseURL)
 	if err != nil {
@@ -29,21 +28,10 @@ func Apply(ctx context.Context, databaseURL string) error {
 		return err
 	}
 	provider, err := goose.NewProvider(goose.DialectPostgres, db, files,
-		goose.WithTableName("agents_api_schema_version"), goose.WithSessionLocker(locker))
+		goose.WithTableName("oac_schema_version"), goose.WithSessionLocker(locker))
 	if err != nil {
 		return err
 	}
-	if _, err = provider.Up(ctx); err != nil {
-		return err
-	}
-	// Up ignores versions above the embedded ones, so an older Core would start
-	// on a schema it does not know.
-	current, target, err := provider.GetVersions(ctx)
-	if err != nil {
-		return err
-	}
-	if current > target {
-		return fmt.Errorf("Agents API database schema version %d is newer than this Core supports (%d). Downgrades are not supported: run the release that upgraded this database or a newer one, or restore the backup taken before the upgrade.", current, target)
-	}
-	return nil
+	_, err = provider.Up(ctx)
+	return err
 }
diff --git a/services/core/migrations/migrations_test.go b/services/core/migrations/migrations_test.go
deleted file mode 100644
index bf176591c..000000000
--- a/services/core/migrations/migrations_test.go
+++ /dev/null
@@ -1,24 +0,0 @@
-package migrations_test
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/jackc/pgx/v5/stdlib"
-
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/pgtest"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/migrations"
-)
-
-func TestApplyRefusesANewerSchema(t *testing.T) {
-	pool := pgtest.OpenIsolated(t, nil)
-	if _, err := pool.Exec(t.Context(), "INSERT INTO agents_api_schema_version (version_id, is_applied) VALUES (999999, true)"); err != nil {
-		t.Fatal(err)
-	}
-	connection := stdlib.RegisterConnConfig(pool.Config().ConnConfig)
-	defer stdlib.UnregisterConnConfig(connection)
-	err := migrations.Apply(t.Context(), connection)
-	if err == nil || !strings.HasPrefix(err.Error(), "Agents API database schema version 999999 is newer than this Core supports (") {
-		t.Fatalf("err = %v", err)
-	}
-}
diff --git a/services/core/tests/integration/admin_session_archive_race_test.go b/services/core/tests/integration/admin_session_archive_race_test.go
index 177dc8ecb..d932eee93 100644
--- a/services/core/tests/integration/admin_session_archive_race_test.go
+++ b/services/core/tests/integration/admin_session_archive_race_test.go
@@ -25,7 +25,7 @@ func TestManagedSessionArchiveReleasesPendingNodePlacement(t *testing.T) {
 		t.Fatal(err)
 	}
 	nodes := deploymentService(t, s)
-	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 1, MaxRetained: 1}))
+	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: new(1)}))
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/tests/integration/archived_cancellation_migration_test.go b/services/core/tests/integration/archived_cancellation_migration_test.go
deleted file mode 100644
index 805bc4591..000000000
--- a/services/core/tests/integration/archived_cancellation_migration_test.go
+++ /dev/null
@@ -1,59 +0,0 @@
-package integration
-
-import (
-	"database/sql"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestArchivedCancellationMigrationDoesNotAdoptOldRevocations(t *testing.T) {
-	s, w, installation := managedArchiveFixture(t)
-	tenant, session := managedArchiveSession(t, s, managerSessionInput(uuid.NewString()))
-	owner := archiveAllocation(t, w, tenant, session, installation)
-	input := submitMessage(t, s, tenant, session.ID, "waiting")
-	transition(t, w, tenant, session.ID, input.TurnID, sessions.TurnQueued, sessions.TurnInProgress)
-	transition(t, w, tenant, session.ID, input.TurnID, sessions.TurnInProgress, sessions.TurnWaiting)
-	if _, err := deploymentExecution(t, w).ArchiveSession(adminDeleteContext(t.Context(), tenant, uuid.NewString()), tenant, session.ID, 1); err != nil {
-		t.Fatal(err)
-	}
-	// Exercise the historical migration with the target schema's disabled
-	// suspension policy, independently of the current provider defaults.
-	db := sql.OpenDB(stdlib.GetConnector(*s.pool.Config().ConnConfig))
-	defer db.Close()
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.DownTo(t.Context(), 79); err == nil {
-		t.Fatal("downgrade discarded unsettled cancellation marker")
-	} else if !strings.Contains(err.Error(), "Cannot remove archived cancellation receipts while cleanup is unsettled") {
-		t.Fatal("downgrade failed before checking the cancellation marker", err)
-	}
-	// Later migrations can already have been reverted before migration 80
-	// refuses. Restore the current schema before using current generated queries.
-	if _, err := provider.Up(t.Context()); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := deploymentExecution(t, w).SettleCreation(t.Context(), owner); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := deploymentExecution(t, w).ReleaseAllocation(t.Context(), owner); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.DownTo(t.Context(), 79); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.Up(t.Context()); err != nil {
-		t.Fatal(err)
-	}
-	var marker *string
-	if err := s.pool.QueryRow(t.Context(), "SELECT archive_cancel_turn_id::text FROM devices WHERE id=$1", owner.DeviceID).Scan(&marker); err != nil || marker != nil {
-		t.Fatal("upgrade adopted historical revoked device", marker, err)
-	}
-}
diff --git a/services/core/tests/integration/claude_execution_test.go b/services/core/tests/integration/claude_execution_test.go
index c5c718d74..e0d8bb086 100644
--- a/services/core/tests/integration/claude_execution_test.go
+++ b/services/core/tests/integration/claude_execution_test.go
@@ -30,7 +30,7 @@ func claudeSession(t *testing.T, h *dispatchHarness, configuration string, prebo
 
 func claudeHeartbeat(t *testing.T, h *dispatchHarness, ready bool) {
 	t.Helper()
-	caps := prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilityFromBool(ready), ExecutionControls: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, FunctionTools: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, Preparation: proto.CapabilitySupported})
+	caps := prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilityFromBool(ready), ExecutionControls: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, FunctionTools: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, Preparation: proto.CapabilitySupported})
 	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "claude_sdk", Available: true, Capabilities: caps}}})
 	deadline := time.Now().Add(3 * time.Second)
 	for {
@@ -85,7 +85,7 @@ func TestClaudeWorkerSelectsStoredEngineAndRestrictiveCapabilities(t *testing.T)
 			if h.read(testExecutionRequest).DecodePayload(&prompt) != nil {
 				t.Fatal("invalid prompt")
 			}
-			if prompt.AgentKind != "claude_sdk" || len(prompt.FunctionTools) != 1 || !prompt.DisableExecutionEnvironment || !prompt.DisableSubagents || prompt.ExecutionControls == nil || *prompt.ExecutionControls != (proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}) {
+			if prompt.AgentKind != "claude_sdk" || len(prompt.FunctionTools) != 1 || !prompt.DisableExecutionEnvironment || !prompt.DisableSubagents || prompt.ExecutionControls == nil || *prompt.ExecutionControls != (proto.ExecutionControls{TextVerbosity: "medium"}) {
 				t.Fatal(prompt)
 			}
 			h.write(input.TurnID, proto.TypeDone, proto.DonePayload{Content: "done", Metadata: map[string]any{proto.DoneMetaAgentSessionID: "claude-native"}})
@@ -139,7 +139,7 @@ func TestClaudeInvalidImageResultRejectsWholeBatchBeforePersistence(t *testing.T
 		}
 		return sessions.Input{Kind: "tool_result", Payload: payload}
 	}
-	batch := []sessions.Input{messageInput("Follow up"), result(`{"success":true,"output":[{"type":"input_image","image_url":"data:image/png;base64,AA=="}]}`), {Kind: "cancel", Payload: json.RawMessage(`{}`)}}
+	batch := []sessions.Input{messageInput("Follow up"), result(`{"success":true,"output":[{"type":"input_image","image_url":"https://example.com/a.png"}]}`), {Kind: "cancel", Payload: json.RawMessage(`{}`)}}
 	if _, err := worker.SubmitInputs(t.Context(), h.tenant, h.session.ID, "batch", batch); !errors.Is(err, sessions.ErrInvalidInput) {
 		t.Fatal(err)
 	}
diff --git a/services/core/tests/integration/claude_mcp_test.go b/services/core/tests/integration/claude_mcp_test.go
index 32a18777a..9956f5700 100644
--- a/services/core/tests/integration/claude_mcp_test.go
+++ b/services/core/tests/integration/claude_mcp_test.go
@@ -28,7 +28,7 @@ func TestClaudeMCPWaitsForCapableRuntime(t *testing.T) {
 				}
 				claudeSession(t, h, configuration, prebound)
 				// Base MCP support does not imply authentication or required initialization.
-				caps := prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, MCPHTTPTools: proto.CapabilityFromBool(authenticated || required), Preparation: proto.CapabilitySupported})
+				caps := prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, MCPHTTPTools: proto.CapabilityFromBool(authenticated || required), Preparation: proto.CapabilitySupported})
 				h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "claude_sdk", Available: true, Capabilities: caps}}})
 				awaitDaemonRemoteCondition(t, t.Context(), 3*time.Second, "Claude MCP heartbeat", func() bool {
 					peer, _ := h.registry.LookupDevice(h.device.ID)
@@ -101,7 +101,7 @@ func TestClaudeMCPUnsupportedSnapshotRejectedBeforeClaim(t *testing.T) {
 				configuration = strings.Replace(configuration, `"tickets"`, `"functions"`, 1)
 			}
 			claudeSession(t, h, configuration, true)
-			caps := prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, MCPHTTPTools: proto.CapabilitySupported, MCPHTTPRequired: proto.CapabilitySupported, MCPHTTPBearerAuth: proto.CapabilitySupported, Preparation: proto.CapabilitySupported})
+			caps := prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, MCPHTTPTools: proto.CapabilitySupported, MCPHTTPRequired: proto.CapabilitySupported, MCPHTTPBearerAuth: proto.CapabilitySupported, Preparation: proto.CapabilitySupported})
 			if profile == "missing required capability" {
 				caps.MCPHTTPRequired = proto.CapabilityUnsupported
 			}
diff --git a/services/core/tests/integration/configuration_validation_public_test.go b/services/core/tests/integration/configuration_validation_public_test.go
index 8e29098dc..4847f3af8 100644
--- a/services/core/tests/integration/configuration_validation_public_test.go
+++ b/services/core/tests/integration/configuration_validation_public_test.go
@@ -7,7 +7,6 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/agents"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimedevice"
 	"github.com/google/uuid"
 )
@@ -32,15 +31,6 @@ func TestAgentConfigurationValidationRejectsWithoutWritesPostgres(t *testing.T)
 	client := pathIDClient{t: t, server: server}
 	const lookup = `{"type":"function","name":"lookup","description":"Look up a value.","parameters":{"type":"object","properties":{"q":{"type":"string"}},"required":["q"]}}`
 	agent := client.created(owner, "/v1/agents", `{"model":"config-model","tools":[`+lookup+`]}`)
-	// A record saved before the protocol checks existed.
-	saved := func(tools string) string {
-		return `{"model":"config-model","name":null,"instructions":null,"multi_agent":{"enabled":false,"max_concurrent_subagents":null},"reasoning":{},"service_tier":"auto","text":{"format":{"type":"text"},"verbosity":"medium"},"tools":` + tools + `}`
-	}
-	_, agentService := fixtureAgents(t, s)
-	legacy, err := agentService.Create(t.Context(), agents.CreateCommand{TenantID: ownerTenant, Metadata: map[string]string{}, Configuration: json.RawMessage(saved(`[{"type":"function","name":"lookup","description":"","parameters":{"type":"string"},"defer_loading":false}]`))})
-	if err != nil {
-		t.Fatal(err)
-	}
 	before := databaseDigest(t, pool)
 
 	const tools = `'function', 'tool_search', 'programmatic_tool_calling', 'mcp', and 'web_search'.`
@@ -110,21 +100,10 @@ func TestAgentConfigurationValidationRejectsWithoutWritesPostgres(t *testing.T)
 			}
 		}
 	}
-	// A saved record from before the checks cannot execute; another tenant cannot see it.
-	schema := `{"error":{"message":"Invalid schema for function 'lookup': schema must be a JSON Schema of 'type: \"object\"', got 'type: \"string\"'.","type":"invalid_request_error","code":"invalid_request_error","param":null}}` + "\n"
-	if status, body := client.do(owner, http.MethodPost, "/v1/agents/sessions", "application/json", []byte(`{"agent_id":"`+legacy.ID+`","environment":{"type":"none"},"input":"hi"}`)); status != http.StatusBadRequest || body != schema {
-		t.Errorf("legacy saved Agent: %d %s", status, body)
-	}
-	if status, body := client.do(foreign, http.MethodPost, "/v1/agents/sessions", "application/json", []byte(`{"agent_id":"`+legacy.ID+`","environment":{"type":"none"},"input":"hi"}`)); status != http.StatusNotFound {
-		t.Errorf("foreign legacy saved Agent: %d %s", status, body)
-	}
 	// K2 keeps the local configuration code; saved enabled web_search (TV-05) is
 	// covered by TestSavedWebSearchPostgres.
 	for _, request := range []struct{ path, body, message string }{
-		{"/v1/agents/sessions", `{"agent":{"model":"m","tools":[{"type":"web_search","mode":"live"}]},"environment":{"type":"none"},"input":"hi"}`, "Only disabled web_search is qualified for execution."},
-		{"/v1/agents/sessions", `{"agent":{"model":"m","tools":[{"type":"web_search"}]},"environment":{"type":"none"},"input":"hi"}`, "Only disabled web_search is qualified for execution."},
-		{"/v1/agents/sessions", `{"agent":{"model":"m","tools":[{"type":"programmatic_tool_calling","enabled":true}]},"environment":{"type":"none"},"input":"hi"}`, "Programmatic tool calling is not qualified for execution."},
-		{"/v1/agents/sessions", `{"agent":{"model":"m","text":{"format":{"type":"json_schema","schema":{"type":"object"}}}},"environment":{"type":"none"},"input":"hi"}`, "Harness codex does not support the requested Agent/environment configuration: Structured output is not qualified for this engine."},
+		{"/v1/agents/sessions", `{"agent":{"model":"m","multi_agent":{"enabled":true},"tools":[{"type":"programmatic_tool_calling","enabled":true}]},"environment":{"type":"none"},"input":"hi"}`, "Harness codex does not support the requested Agent/environment configuration: programmatic_tool_calling.enabled=true is not supported with multi_agent by this Harness."},
 	} {
 		encoded, _ := json.Marshal(request.message)
 		want := `{"error":{"message":` + string(encoded) + `,"type":"invalid_request_error","code":"unsupported_or_invalid_configuration","param":null}}` + "\n"
diff --git a/services/core/tests/integration/credential_matrix_http_test.go b/services/core/tests/integration/credential_matrix_http_test.go
index 96e630f29..61d4ef3d6 100644
--- a/services/core/tests/integration/credential_matrix_http_test.go
+++ b/services/core/tests/integration/credential_matrix_http_test.go
@@ -113,7 +113,7 @@ func TestCredentialNamespaceMatrix(t *testing.T) {
 		t.Fatal(err)
 	}
 	var enrollment api.SandboxEnrollmentToken
-	created("POST", "/core/v1/sandbox/enrollment-tokens", coreKey, `{}`, &enrollment)
+	created("POST", "/core/v1/sandbox/enrollment-tokens", coreKey, `{"max_active":2,"max_retained":2}`, &enrollment)
 	nodeID, nodeCredential := uuid.NewString(), strings.Repeat("n", 64)
 	enroll, _ := json.Marshal(deployment.Enrollment{NodeID: nodeID, Credential: nodeCredential, Name: "Matrix node", Provider: "docker", BackendFingerprint: strings.Repeat("b", 64),
 		DeploymentGeneration: 1, SpecificationDigest: specification.Digest("docker"), CoreURL: "https://core.example"})
diff --git a/services/core/tests/integration/credential_oauth_migration_test.go b/services/core/tests/integration/credential_oauth_migration_test.go
deleted file mode 100644
index 6c607c388..000000000
--- a/services/core/tests/integration/credential_oauth_migration_test.go
+++ /dev/null
@@ -1,79 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"os"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestOAuthMigrationPreservesStaticGrantsAndRefusesLossyRollback(t *testing.T) {
-	_, pool := testStore(t)
-	schema := "oauth_migration_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(t.Context(), "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(context.Background(), "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(t.Context(), 53); err != nil {
-		t.Fatal(err)
-	}
-	vault, id := uuid.NewString(), uuid.NewString()
-	if _, err := db.ExecContext(t.Context(), "INSERT INTO vaults(id,tenant_id,metadata) VALUES ($1,$2,'{}')", vault, uuid.NewString()); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(t.Context(), "INSERT INTO vault_credentials(id,vault_id,name,auth_type,mcp_server_url,token_ciphertext) VALUES ($1,$2,'Existing','static_bearer','https://mcp.example/tools',$3)", id, vault, []byte{1, 2, 3}); err != nil {
-		t.Fatal(err)
-	}
-	snapshot := func() string {
-		t.Helper()
-		var value string
-		if err := db.QueryRowContext(t.Context(), "SELECT (to_jsonb(c)-'oauth_metadata')::text FROM vault_credentials c WHERE id=$1", id).Scan(&value); err != nil {
-			t.Fatal(err)
-		}
-		return value
-	}
-	before := snapshot()
-	if _, err := provider.UpTo(t.Context(), 54); err != nil || snapshot() != before {
-		t.Fatal("OAuth migration changed static grant", err)
-	}
-	if _, err := provider.DownTo(t.Context(), 53); err != nil || snapshot() != before {
-		t.Fatal("static-only rollback failed", err)
-	}
-	if _, err := provider.UpTo(t.Context(), 54); err != nil {
-		t.Fatal(err)
-	}
-	oauthID := uuid.NewString()
-	if _, err := db.ExecContext(t.Context(), "INSERT INTO vault_credentials(id,vault_id,name,auth_type,mcp_server_url,token_ciphertext,oauth_metadata) VALUES ($1,$2,'OAuth','mcp_oauth','https://mcp.example/tools',$3,'{}')", oauthID, vault, []byte{4, 5, 6}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.DownTo(t.Context(), 53); err == nil {
-		t.Fatal("rollback discarded OAuth support with existing grants")
-	}
-	var count int
-	if err := db.QueryRowContext(t.Context(), "SELECT count(*) FROM vault_credentials WHERE id=$1 AND auth_type='mcp_oauth' AND oauth_metadata='{}'::jsonb", oauthID).Scan(&count); err != nil || count != 1 || snapshot() != before {
-		t.Fatal("failed rollback altered grants", err)
-	}
-	for _, mutation := range []string{"oauth_metadata=NULL", "oauth_metadata='[]'::jsonb", "auth_type='static_bearer'"} {
-		if _, err := db.ExecContext(t.Context(), "UPDATE vault_credentials SET "+mutation+" WHERE id=$1", oauthID); err == nil {
-			t.Fatal("invalid OAuth metadata constraint admitted")
-		}
-	}
-}
diff --git a/services/core/tests/integration/credential_status_migration_test.go b/services/core/tests/integration/credential_status_migration_test.go
deleted file mode 100644
index 1bbea5ef6..000000000
--- a/services/core/tests/integration/credential_status_migration_test.go
+++ /dev/null
@@ -1,86 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestCredentialStatusMigrationPreservesMetadataAndCiphertext(t *testing.T) {
-	_, pool := testStore(t)
-	ctx := t.Context()
-	schema := "credential_status_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(ctx, "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(context.Background(), "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 32); err != nil {
-		t.Fatal(err)
-	}
-	id, vault, tenant := uuid.NewString(), uuid.NewString(), uuid.NewString()
-	if _, err := db.ExecContext(ctx, "INSERT INTO vaults(id,tenant_id,metadata) VALUES ($1,$2,'{}')", vault, tenant); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, "INSERT INTO vault_credentials(id,vault_id,name,auth_type,mcp_server_url,token_ciphertext) VALUES ($1,$2,'Existing Credential','static_bearer','https://example.invalid/mcp',$3)", id, vault, []byte{1, 2, 3}); err != nil {
-		t.Fatal(err)
-	}
-	snapshot := func() string {
-		t.Helper()
-		var value string
-		if err := db.QueryRowContext(ctx, "SELECT (to_jsonb(v)-'status')::text FROM vault_credentials v WHERE id=$1", id).Scan(&value); err != nil {
-			t.Fatal(err)
-		}
-		return value
-	}
-	before := snapshot()
-	if _, err := provider.UpTo(ctx, 33); err != nil {
-		t.Fatal(err)
-	}
-	var status string
-	if err := db.QueryRowContext(ctx, "SELECT status FROM vault_credentials WHERE id=$1", id).Scan(&status); err != nil || status != "active" || snapshot() != before {
-		t.Fatal("migration changed historical resource", status, err)
-	}
-	if err := db.QueryRowContext(ctx, "INSERT INTO vault_credentials(id,vault_id,name,auth_type,mcp_server_url,token_ciphertext) VALUES ($1,$2,'New Credential','static_bearer','https://example.invalid/mcp',$3) RETURNING status", uuid.NewString(), vault, []byte{4, 5, 6}).Scan(&status); err != nil || status != "active" {
-		t.Fatal("new Credential default", status, err)
-	}
-	for _, invalid := range []any{nil, "deleted"} {
-		if _, err := db.ExecContext(ctx, "UPDATE vault_credentials SET status=$1 WHERE id=$2", invalid, id); err == nil {
-			t.Fatal("invalid classification accepted")
-		}
-	}
-	if _, err := provider.DownTo(ctx, 32); err != nil || snapshot() != before {
-		t.Fatal("reversible active-only migration", err)
-	}
-	if _, err := provider.UpTo(ctx, 33); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, "UPDATE vault_credentials SET status='archived' WHERE id=$1", id); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.DownTo(ctx, 32); err == nil || !strings.Contains(err.Error(), "Cannot remove archived Credential classification") {
-		t.Fatal("downgrade lost archived classification", err)
-	}
-	if err := db.QueryRowContext(ctx, "SELECT status FROM vault_credentials WHERE id=$1", id).Scan(&status); err != nil || status != "archived" || snapshot() != before {
-		t.Fatal("failed downgrade changed data", status, err)
-	}
-}
diff --git a/services/core/tests/integration/deployment_fixture_test.go b/services/core/tests/integration/deployment_fixture_test.go
index 2073a5b60..ffce51e69 100644
--- a/services/core/tests/integration/deployment_fixture_test.go
+++ b/services/core/tests/integration/deployment_fixture_test.go
@@ -53,15 +53,22 @@ func deploymentExecution(t testing.TB, w *Store) *deployment.ExecutionOperations
 	return operations
 }
 
-func fixtureNodeHeartbeat(ctx context.Context, store *Store, service *deployment.Service, nodeID, connection string, epoch uint64, health deployment.NodeHealth) error {
+func fixtureNodeHeartbeat(ctx context.Context, store *Store, service *deployment.Service, nodeID, connection string, epoch uint64, ready bool) error {
 	var generation uint64
 	var digest, provider string
 	if err := store.pool.QueryRow(ctx, "SELECT n.deployment_generation,n.specification_digest,d.provider_kind FROM runtime_nodes n CROSS JOIN runtime_deployment d WHERE n.id=$1", nodeID).Scan(&generation, &digest, &provider); err != nil {
 		return err
 	}
 	var statuses []sandbox.GenerationStatus
-	if health.ProviderReady && provider == "microsandbox" {
-		statuses = []sandbox.GenerationStatus{{Generation: generation, SpecificationDigest: digest, State: "ready", Checkpoint: &sandbox.CheckpointCompatibility{ArtifactDomain: "fixture-store", ExecutionClass: "fixture-runtime"}}}
+	{
+		status := sandbox.GenerationStatus{Generation: generation, SpecificationDigest: digest, State: "ready"}
+		if !ready {
+			status.State = "failed"
+		}
+		if provider == "microsandbox" && ready {
+			status.Checkpoint = &sandbox.CheckpointCompatibility{ArtifactDomain: "fixture-store", ExecutionClass: "fixture-runtime"}
+		}
+		statuses = []sandbox.GenerationStatus{status}
 	}
-	return service.Heartbeat(ctx, nodeID, connection, epoch, health, statuses)
+	return service.Heartbeat(ctx, nodeID, connection, epoch, deployment.NodeHealth{}, statuses)
 }
diff --git a/services/core/tests/integration/deployment_model_providers_http_test.go b/services/core/tests/integration/deployment_model_providers_http_test.go
index f0d3d3727..c66aacbae 100644
--- a/services/core/tests/integration/deployment_model_providers_http_test.go
+++ b/services/core/tests/integration/deployment_model_providers_http_test.go
@@ -112,7 +112,6 @@ func TestDeploymentModelProvidersHTTP(t *testing.T) {
 	} {
 		call("PUT", path, coreKey, `{"model":"fixture","model_provider":`+invalid+`}`, 400)
 	}
-	call("PUT", "/core/v1/harnesses/mcode/model-configuration", coreKey, `{"model":"fixture","model_provider":{"protocol":"anthropic","base_url":"https://deployment.example/anthropic","api_key":"invalid-canary"}}`, 400)
 
 	// Without any provider, hosted and self-hosted creation fail before any write.
 	hosted := `{"agent":{"model":"hosted-model"},"environment":{"type":"openai_hosted"}}`
diff --git a/services/core/tests/integration/deployment_public_fixture_test.go b/services/core/tests/integration/deployment_public_fixture_test.go
index 565cdab05..e4033dfa0 100644
--- a/services/core/tests/integration/deployment_public_fixture_test.go
+++ b/services/core/tests/integration/deployment_public_fixture_test.go
@@ -1,7 +1,7 @@
 package integration
 
 import (
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
@@ -35,6 +35,6 @@ func fixtureDeploymentExecution(s *Store, lease *pgunit.Lease) (*deployment.Serv
 	if err != nil {
 		return nil, nil, err
 	}
-	changes, err := deployment.NewExecutionOperations(service, deploymentpg.NewExecution(lease, s.credentialCipher), engine.Catalog{})
+	changes, err := deployment.NewExecutionOperations(service, deploymentpg.NewExecution(lease, s.credentialCipher), builtin.Registry())
 	return service, changes, err
 }
diff --git a/services/core/tests/integration/device_bootstrap_binding_test.go b/services/core/tests/integration/device_bootstrap_binding_test.go
index f6187833c..e0295490b 100644
--- a/services/core/tests/integration/device_bootstrap_binding_test.go
+++ b/services/core/tests/integration/device_bootstrap_binding_test.go
@@ -14,7 +14,7 @@ import (
 func TestDeviceCredentialCarriesPersistedAllocationNode(t *testing.T) {
 	s, writer, d := managerFixture(t, 4, 8)
 	nodes := deploymentService(t, s)
-	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 4, MaxRetained: 8}))
+	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(4), MaxRetained: new(8)}))
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/tests/integration/dispatch_test.go b/services/core/tests/integration/dispatch_test.go
index 8bbd3612b..c0871bd57 100644
--- a/services/core/tests/integration/dispatch_test.go
+++ b/services/core/tests/integration/dispatch_test.go
@@ -103,7 +103,7 @@ func newDispatchHarnessForSession(t *testing.T, configuration []byte, local bool
 		t.Fatal("device connection failed")
 	}
 	t.Cleanup(func() { h.conn.Close() })
-	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, Resume: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, WebSearchControl: proto.CapabilitySupported, TextVerbosity: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, SubagentObservations: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, NativeSessionRecovery: proto.CapabilitySupported, Preparation: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported})}}})
+	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Resume: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, SubagentObservations: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, NativeSessionRecovery: proto.CapabilitySupported, Preparation: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported})}}})
 	deadline := time.Now().Add(3 * time.Second)
 	for {
 		peer, e := h.registry.LookupDevice(h.device.ID)
@@ -231,7 +231,7 @@ func TestExecutionDispatchSteeringAndNativeContinuity(t *testing.T) {
 	request := h.read(testExecutionRequest)
 	var prompt proto.PromptRequestPayload
 	_ = request.DecodePayload(&prompt)
-	if inputTextForTest(t, prompt.Input) != "Initial input" || prompt.AgentStateKey != "agents-api-"+h.session.ID || prompt.AgentOptions["model"] != "test-model" || prompt.AgentOptions["system_prompt"] != "Keep this instruction." {
+	if inputTextForTest(t, prompt.Input) != "Initial input" || prompt.AgentStateKey != h.session.ID || prompt.AgentOptions["model"] != "test-model" || prompt.AgentOptions["system_prompt"] != "Keep this instruction." {
 		t.Fatalf("wrong resolved request: %+v", prompt)
 	}
 	if _, err := h.bound().Run(ctx, uuid.NewString(), h.session.ID, first.TurnID); !errors.Is(err, sessions.ErrNotFound) {
@@ -276,7 +276,7 @@ func TestExecutionDispatchSteeringAndNativeContinuity(t *testing.T) {
 	result = h.run(ctx, next.TurnID)
 	request = h.read(testExecutionRequest)
 	_ = request.DecodePayload(&prompt)
-	if prompt.AgentSessionID != "native-thread-1" || prompt.AgentStateKey != "agents-api-"+h.session.ID {
+	if prompt.AgentSessionID != "native-thread-1" || prompt.AgentStateKey != h.session.ID {
 		t.Fatal("native continuity lost")
 	}
 	h.write(next.TurnID, proto.TypeDone, proto.DonePayload{Content: "Continued"})
@@ -419,12 +419,10 @@ func TestExecutionOutcomeAndNativeBindingCommitTogether(t *testing.T) {
 
 func TestExecutionRejectsRuntimeMissingCapabilityBeforeClaim(t *testing.T) {
 	for _, tc := range []struct{ missing, message string }{
-		{"durable_turns", "device must advertise streaming, steering and durable turns for this engine"},
-		{"durable_input_receipts", "device must advertise streaming, steering and durable turns for this engine"},
+		{"durable_turns", "device must advertise streaming, durable input receipts and durable turns for this engine"},
+		{"durable_input_receipts", "device must advertise streaming, durable input receipts and durable turns for this engine"},
 		{"preparation", "device must advertise executor preparation"},
 		{"execution_controls", "device must advertise execution_controls"},
-		{"web_search_control", "device must advertise web_search_control"},
-		{"text_verbosity", "device must advertise text_verbosity"},
 		{"tool_observations", "device must advertise tool_observations"},
 		{"subagent_control", "device must advertise subagent_control"},
 		{"environment_none", "device must advertise environment_none"},
@@ -432,12 +430,12 @@ func TestExecutionRejectsRuntimeMissingCapabilityBeforeClaim(t *testing.T) {
 		missing := tc.missing
 		t.Run(missing, func(t *testing.T) {
 			h := newDispatchHarness(t)
-			h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, Resume: proto.CapabilitySupported, DurableTurns: proto.CapabilityFromBool(missing != "durable_turns"), DurableInputReceipts: proto.CapabilityFromBool(missing != "durable_input_receipts"), Preparation: proto.CapabilityFromBool(missing != "preparation"), WebSearchControl: proto.CapabilityFromBool(missing != "web_search_control"), TextVerbosity: proto.CapabilityFromBool(missing != "text_verbosity"), ExecutionControls: proto.CapabilityFromBool(missing != "execution_controls"), SubagentControl: proto.CapabilityFromBool(missing != "subagent_control"), ToolObservations: proto.CapabilityFromBool(missing != "tool_observations"), EnvironmentNone: proto.CapabilityFromBool(missing != "environment_none")})}}})
+			h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Resume: proto.CapabilitySupported, DurableTurns: proto.CapabilityFromBool(missing != "durable_turns"), DurableInputReceipts: proto.CapabilityFromBool(missing != "durable_input_receipts"), Preparation: proto.CapabilityFromBool(missing != "preparation"), ExecutionControls: proto.CapabilityFromBool(missing != "execution_controls"), SubagentControl: proto.CapabilityFromBool(missing != "subagent_control"), ToolObservations: proto.CapabilityFromBool(missing != "tool_observations"), EnvironmentNone: proto.CapabilityFromBool(missing != "environment_none")})}}})
 			deadline := time.Now().Add(3 * time.Second)
 			for {
 				peer, _ := h.registry.LookupDevice(h.device.ID)
 				info, _, _ := peer.AgentKindStatus("codex")
-				if info.Capabilities.DurableInputReceipts == (missing != "durable_input_receipts") && info.Capabilities.Preparation == (missing != "preparation") && info.Capabilities.ExecutionControls == (missing != "execution_controls") && info.Capabilities.DurableTurns == (missing != "durable_turns") && info.Capabilities.WebSearchControl == (missing != "web_search_control") && info.Capabilities.TextVerbosity == (missing != "text_verbosity") && info.Capabilities.SubagentControl == (missing != "subagent_control") && info.Capabilities.ToolObservations == (missing != "tool_observations") && info.Capabilities.EnvironmentNone == (missing != "environment_none") {
+				if info.Capabilities.DurableInputReceipts == (missing != "durable_input_receipts") && info.Capabilities.Preparation == (missing != "preparation") && info.Capabilities.ExecutionControls == (missing != "execution_controls") && info.Capabilities.DurableTurns == (missing != "durable_turns") && info.Capabilities.SubagentControl == (missing != "subagent_control") && info.Capabilities.ToolObservations == (missing != "tool_observations") && info.Capabilities.EnvironmentNone == (missing != "environment_none") {
 					break
 				}
 				if time.Now().After(deadline) {
diff --git a/services/core/tests/integration/environment_admission_test.go b/services/core/tests/integration/environment_admission_test.go
index cfbc778fb..3c5917e97 100644
--- a/services/core/tests/integration/environment_admission_test.go
+++ b/services/core/tests/integration/environment_admission_test.go
@@ -164,7 +164,7 @@ func TestEnvironmentAdmissionWaitsForPreparedClaimAndRetainsRetry(t *testing.T)
 }
 
 func TestEnvironmentAdmissionSettlementDoesNotCreateTurn(t *testing.T) {
-	for _, name := range []string{"expired", "cancelled", "deleted", "disconnected", "ownership_lost"} {
+	for _, name := range []string{"expired", "cancelled", "disconnected", "ownership_lost"} {
 		t.Run(name, func(t *testing.T) {
 			h, worker := newEnvironmentAdmission(t)
 			ctx, cancel := context.WithCancel(t.Context())
@@ -183,14 +183,6 @@ func TestEnvironmentAdmissionSettlementDoesNotCreateTurn(t *testing.T) {
 				if _, err := cancelEnvironmentInput(t.Context(), h.s, h.tenant, h.session.ID, pending.ID); err != nil {
 					t.Fatal(err)
 				}
-			case "deleted":
-				expected = sessions.ErrNotFound
-				if err := sessionService(t, h.s).DeleteSession(t.Context(), sessions.DeleteSessionCommand{TenantID: h.tenant, SessionID: h.session.ID}); !errors.Is(err, sessions.ErrNotIdle) {
-					t.Fatal("pending input deleted", err)
-				}
-				if err := h.s.commitLegacyDeletion(t.Context(), h.tenant, h.session.ID); err != nil {
-					t.Fatal(err)
-				}
 			case "disconnected":
 				expected = context.Canceled
 				cancel()
@@ -216,9 +208,6 @@ func TestEnvironmentAdmissionSettlementDoesNotCreateTurn(t *testing.T) {
 			if turns != 0 || inputs != 0 {
 				t.Fatal("settlement created work", turns, inputs)
 			}
-			if name == "deleted" {
-				return
-			}
 			retained, err := sessionAdapter(h.s).GetEnvironmentInputReservation(t.Context(), h.tenant, h.session.ID, pending.ID)
 			if err != nil {
 				t.Fatal(err)
diff --git a/services/core/tests/integration/environment_claim_worker_test.go b/services/core/tests/integration/environment_claim_worker_test.go
index 522f5230a..2dc6b700a 100644
--- a/services/core/tests/integration/environment_claim_worker_test.go
+++ b/services/core/tests/integration/environment_claim_worker_test.go
@@ -13,66 +13,50 @@ import (
 )
 
 func TestWorkerReconcilesEnvironmentPromotionBeforeStart(t *testing.T) {
-	for _, deleted := range []bool{false, true} {
-		t.Run(map[bool]string{false: "unbound", true: "deleted"}[deleted], func(t *testing.T) {
-			s, _ := testStore(t)
-			tenant, pending := newEnvironmentExpiryReservation(t, s)
-			owner := executionOwner(t, s)
-			got, err := owner.Sessions.PromoteEnvironmentInput(t.Context(), tenant, pending.SessionID, pending.ID)
-			if err != nil || len(got.Receipts) != 1 || got.Receipts[0].Replayed {
-				t.Fatal(got, err)
-			}
-			turnID := got.Receipts[0].TurnID
-			if deleted {
-				if err := sessionService(t, s).DeleteSession(t.Context(), sessions.DeleteSessionCommand{TenantID: tenant, SessionID: pending.SessionID}); !errors.Is(err, sessions.ErrNotIdle) {
-					t.Fatal("claimed Session deleted", err)
-				}
-				if err := s.commitLegacyDeletion(t.Context(), tenant, pending.SessionID); err != nil {
-					t.Fatal(err)
-				}
-			}
-			turn, err := sessionAdapter(s).GetTurn(t.Context(), tenant, pending.SessionID, turnID)
-			if err != nil || turn.Status != sessions.TurnInProgress || (deleted && turn.CancelRequestedAt.IsZero()) {
-				t.Fatal("promotion did not retain the active claim", turn, err)
-			}
-			// Simulate owner loss after commit, without sending any daemon Start.
-			awaitRelease := pgtest.ObserveExecutionLeaseRelease(t, s.pool)
-			if err := owner.Lease.Close(t.Context()); err != nil {
-				t.Fatal(err)
-			}
-			awaitRelease()
-			restarted := startWorker(t, t.Context(), s, &execution.Dispatcher{Registry: runtimegateway.NewRegistry()})
-			stopped, cancel := context.WithCancel(t.Context())
-			cancel()
-			awaitRelease = pgtest.ObserveExecutionLeaseRelease(t, s.pool)
-			if err := restarted.Run(stopped); !errors.Is(err, context.Canceled) {
-				t.Fatal(err)
-			}
-			awaitRelease()
-			turn, err = sessionAdapter(s).GetTurn(t.Context(), tenant, pending.SessionID, turnID)
-			var outcome struct {
-				ErrorCode string `json:"error_code"`
-			}
-			if err != nil || turn.Status != sessions.TurnFailed || json.Unmarshal(turn.Outcome, &outcome) != nil || outcome.ErrorCode != "execution_interrupted" {
-				t.Fatal("restart failed to settle the original claim", turn, err)
-			}
-			var turns, inputs, queued int
-			err = s.pool.QueryRow(t.Context(), `SELECT
-				(SELECT count(*) FROM turns WHERE session_id=$1),
-				(SELECT count(*) FROM turn_inputs WHERE session_id=$1),
-				(SELECT count(*) FROM turns WHERE session_id=$1 AND status='queued')`, pending.SessionID).Scan(&turns, &inputs, &queued)
-			if err != nil || turns != 1 || inputs != 1 || queued != 0 {
-				t.Fatal("restart duplicated or requeued prepared work", turns, inputs, queued, err)
-			}
-			successor := executionOwner(t, s).Sessions
-			retry, err := successor.PromoteEnvironmentInput(t.Context(), tenant, pending.SessionID, pending.ID)
-			if deleted {
-				if !errors.Is(err, sessions.ErrNotFound) {
-					t.Fatal("deleted reservation was exposed", err)
-				}
-			} else if err != nil || len(retry.Receipts) != 1 || !retry.Receipts[0].Replayed || retry.Receipts[0].Sequence != got.Receipts[0].Sequence || retry.Receipts[0].TurnID != turnID {
-				t.Fatal("recovery retry authorized another start", retry, err)
-			}
-		})
+	s, _ := testStore(t)
+	tenant, pending := newEnvironmentExpiryReservation(t, s)
+	owner := executionOwner(t, s)
+	got, err := owner.Sessions.PromoteEnvironmentInput(t.Context(), tenant, pending.SessionID, pending.ID)
+	if err != nil || len(got.Receipts) != 1 || got.Receipts[0].Replayed {
+		t.Fatal(got, err)
+	}
+	turnID := got.Receipts[0].TurnID
+	turn, err := sessionAdapter(s).GetTurn(t.Context(), tenant, pending.SessionID, turnID)
+	if err != nil || turn.Status != sessions.TurnInProgress {
+		t.Fatal("promotion did not retain the active claim", turn, err)
+	}
+	// Simulate owner loss after commit, without sending any daemon Start.
+	awaitRelease := pgtest.ObserveExecutionLeaseRelease(t, s.pool)
+	if err := owner.Lease.Close(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+	awaitRelease()
+	restarted := startWorker(t, t.Context(), s, &execution.Dispatcher{Registry: runtimegateway.NewRegistry()})
+	stopped, cancel := context.WithCancel(t.Context())
+	cancel()
+	awaitRelease = pgtest.ObserveExecutionLeaseRelease(t, s.pool)
+	if err := restarted.Run(stopped); !errors.Is(err, context.Canceled) {
+		t.Fatal(err)
+	}
+	awaitRelease()
+	turn, err = sessionAdapter(s).GetTurn(t.Context(), tenant, pending.SessionID, turnID)
+	var outcome struct {
+		ErrorCode string `json:"error_code"`
+	}
+	if err != nil || turn.Status != sessions.TurnFailed || json.Unmarshal(turn.Outcome, &outcome) != nil || outcome.ErrorCode != "execution_interrupted" {
+		t.Fatal("restart failed to settle the original claim", turn, err)
+	}
+	var turns, inputs, queued int
+	err = s.pool.QueryRow(t.Context(), `SELECT
+		(SELECT count(*) FROM turns WHERE session_id=$1),
+		(SELECT count(*) FROM turn_inputs WHERE session_id=$1),
+		(SELECT count(*) FROM turns WHERE session_id=$1 AND status='queued')`, pending.SessionID).Scan(&turns, &inputs, &queued)
+	if err != nil || turns != 1 || inputs != 1 || queued != 0 {
+		t.Fatal("restart duplicated or requeued prepared work", turns, inputs, queued, err)
+	}
+	successor := executionOwner(t, s).Sessions
+	retry, err := successor.PromoteEnvironmentInput(t.Context(), tenant, pending.SessionID, pending.ID)
+	if err != nil || len(retry.Receipts) != 1 || !retry.Receipts[0].Replayed || retry.Receipts[0].Sequence != got.Receipts[0].Sequence || retry.Receipts[0].TurnID != turnID {
+		t.Fatal("recovery retry authorized another start", retry, err)
 	}
 }
diff --git a/services/core/tests/integration/environment_connection_migration_test.go b/services/core/tests/integration/environment_connection_migration_test.go
deleted file mode 100644
index f48ba3360..000000000
--- a/services/core/tests/integration/environment_connection_migration_test.go
+++ /dev/null
@@ -1,89 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestEnvironmentConnectionMigrationPreservesStateAndGuardsFencing(t *testing.T) {
-	_, pool := testStore(t)
-	ctx := t.Context()
-	schema := "connection_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(ctx, "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(context.Background(), "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 26); err != nil {
-		t.Fatal(err)
-	}
-	session, environment, tenant := uuid.NewString(), uuid.NewString(), uuid.NewString()
-	if _, err := db.ExecContext(ctx, `INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash,configuration) VALUES ($1,$2,'codex','historical','historical','{"environment":{"type":"self_hosted"}}')`, session, tenant); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, "INSERT INTO environments(id,session_id) VALUES ($1,$2)", environment, session); err != nil {
-		t.Fatal(err)
-	}
-	snapshot := func() string {
-		t.Helper()
-		var value string
-		if err := db.QueryRowContext(ctx, "SELECT to_jsonb(e)::text FROM environments e WHERE id=$1", environment).Scan(&value); err != nil {
-			t.Fatal(err)
-		}
-		return value
-	}
-	before := snapshot()
-	if _, err := provider.UpTo(ctx, 27); err != nil {
-		t.Fatal(err)
-	}
-	if snapshot() != before {
-		t.Fatal("migration invented connection state")
-	}
-	var count int
-	if err := db.QueryRowContext(ctx, "SELECT count(*) FROM environment_connections").Scan(&count); err != nil || count != 0 {
-		t.Fatal(count, err)
-	}
-	if _, err := provider.DownTo(ctx, 26); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 27); err != nil {
-		t.Fatal(err)
-	}
-	generation := uuid.NewString()
-	if _, err := db.ExecContext(ctx, "INSERT INTO environment_connections(environment_id,generation) VALUES ($1,$2)", environment, generation); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, "UPDATE environment_connections SET revision=-1 WHERE environment_id=$1", environment); err == nil {
-		t.Fatal("negative observation revision accepted")
-	}
-	if _, err := provider.DownTo(ctx, 26); err == nil || !strings.Contains(err.Error(), "Cannot remove active Environment observation fencing") {
-		t.Fatal("downgrade lost generation", err)
-	}
-	var retained string
-	if err := db.QueryRowContext(ctx, "SELECT generation::text FROM environment_connections WHERE environment_id=$1", environment).Scan(&retained); err != nil || retained != generation {
-		t.Fatal(retained, err)
-	}
-	if snapshot() != before {
-		t.Fatal("migration changed Environment ownership")
-	}
-}
diff --git a/services/core/tests/integration/environment_directory_test.go b/services/core/tests/integration/environment_directory_test.go
index 91293a431..5b02797ef 100644
--- a/services/core/tests/integration/environment_directory_test.go
+++ b/services/core/tests/integration/environment_directory_test.go
@@ -83,7 +83,7 @@ func prepareDirectoryRead(t *testing.T, h *dispatchHarness, environment sessions
 	t.Helper()
 	frame := h.read(proto.TypeExecutionPrepare)
 	var request proto.ExecutionPreparePayload
-	if frame.DecodePayload(&request) != nil || !proto.ValidWorkspaceReadPreparation(request.Configuration) || request.Configuration.LocalEnvironment == nil || request.Configuration.LocalEnvironment.ID != environment.ID || request.Configuration.AgentStateKey != "agents-api-"+h.session.ID {
+	if frame.DecodePayload(&request) != nil || !proto.ValidWorkspaceReadPreparation(request.Configuration) || request.Configuration.LocalEnvironment == nil || request.Configuration.LocalEnvironment.ID != environment.ID || request.Configuration.AgentStateKey != h.session.ID {
 		t.Fatal("read did not use the closed preparation profile")
 	}
 	handle := acknowledgePreparation(h, frame.ID)
diff --git a/services/core/tests/integration/environment_expiry_dispatch_test.go b/services/core/tests/integration/environment_expiry_dispatch_test.go
index 4bc66594b..ee2881caf 100644
--- a/services/core/tests/integration/environment_expiry_dispatch_test.go
+++ b/services/core/tests/integration/environment_expiry_dispatch_test.go
@@ -10,7 +10,7 @@ import (
 
 func enableEnvironmentExpiryDispatch(h *dispatchHarness) {
 	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{
-		Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, WebSearchControl: proto.CapabilitySupported, TextVerbosity: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported,
+		Streaming: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported,
 		Preparation: proto.CapabilitySupported})}}})
 }
 
diff --git a/services/core/tests/integration/environment_failure_migration_test.go b/services/core/tests/integration/environment_failure_migration_test.go
deleted file mode 100644
index d6e094324..000000000
--- a/services/core/tests/integration/environment_failure_migration_test.go
+++ /dev/null
@@ -1,85 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-// The failure columns are additive for existing Environments, and a rollback
-// refuses to discard a recorded hosted provisioning failure.
-func TestEnvironmentFailureMigrationGuardsRecordedFailures(t *testing.T) {
-	_, pool := testStore(t)
-	ctx := t.Context()
-	schema := "environment_failure_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(ctx, "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(context.Background(), "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 61); err != nil {
-		t.Fatal(err)
-	}
-	session, environment := uuid.NewString(), uuid.NewString()
-	if _, err := db.ExecContext(ctx, `INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash,configuration)
-		VALUES ($1,$2,'codex','historical','historical','{"environment":{"type":"openai_hosted"}}')`, session, uuid.NewString()); err != nil {
-		t.Fatal(err)
-	}
-	// A failure recorded before this migration keeps no reason.
-	if _, err := db.ExecContext(ctx, "INSERT INTO environments(id,session_id,status) VALUES ($1,$2,'failed')", environment, session); err != nil {
-		t.Fatal(err)
-	}
-	upgrade := func() {
-		t.Helper()
-		if _, err := provider.UpTo(ctx, 62); err != nil {
-			t.Fatal(err)
-		}
-		var reason, failedAt sql.NullString
-		if err := db.QueryRowContext(ctx, "SELECT failure_reason, failed_at::text FROM environments WHERE id=$1", environment).Scan(&reason, &failedAt); err != nil || reason.Valid || failedAt.Valid {
-			t.Fatal("migration invented a failure reason", reason, failedAt, err)
-		}
-	}
-	upgrade()
-	for _, statement := range []string{
-		"UPDATE environments SET failure_reason='reason' WHERE id=$1",
-		"UPDATE environments SET status='connected', failure_reason='reason', failed_at=clock_timestamp() WHERE id=$1",
-		"UPDATE environments SET failure_reason=repeat('x', 257), failed_at=clock_timestamp() WHERE id=$1",
-	} {
-		if _, err := db.ExecContext(ctx, statement, environment); err == nil || !strings.Contains(err.Error(), "environment_failure_recorded") {
-			t.Fatal("inconsistent failure accepted", statement, err)
-		}
-	}
-	if _, err := provider.DownTo(ctx, 61); err != nil {
-		t.Fatal("rollback without recorded failures failed", err)
-	}
-	upgrade()
-	if _, err := db.ExecContext(ctx, "UPDATE environments SET failure_reason='Failed to provision environment', failed_at=clock_timestamp() WHERE id=$1", environment); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.DownTo(ctx, 61); err == nil || !strings.Contains(err.Error(), "Cannot remove recorded hosted provisioning failures") {
-		t.Fatal("rollback discarded a recorded failure", err)
-	}
-	var reason string
-	if err := db.QueryRowContext(ctx, "SELECT failure_reason FROM environments WHERE id=$1", environment).Scan(&reason); err != nil || reason != "Failed to provision environment" {
-		t.Fatal("refused rollback changed the failure", reason, err)
-	}
-}
diff --git a/services/core/tests/integration/environment_file_write_migration_test.go b/services/core/tests/integration/environment_file_write_migration_test.go
deleted file mode 100644
index a1124e313..000000000
--- a/services/core/tests/integration/environment_file_write_migration_test.go
+++ /dev/null
@@ -1,90 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"os"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestEnvironmentFileWriteMigrationRetainsUnresolvedIdentity(t *testing.T) {
-	_, pool := testStore(t)
-	ctx := t.Context()
-	schema := "file_write_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(ctx, "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		cleanup, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-		if _, err := pool.Exec(cleanup, "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 35); err != nil {
-		t.Fatal(err)
-	}
-	session, tenant, environment, device, write := uuid.NewString(), uuid.NewString(), uuid.NewString(), uuid.NewString(), uuid.NewString()
-	if _, err := db.ExecContext(ctx, `INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash,configuration)
-		VALUES ($1,$2,'codex','old','old','{}')`, session, tenant); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, `INSERT INTO environments(id,session_id) VALUES ($1,$2)`, environment, session); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, `INSERT INTO devices(id,tenant_id,name,credential_hash) VALUES ($1,$2,'old',$3)`, device, tenant, strings.Repeat("a", 64)); err != nil {
-		t.Fatal(err)
-	}
-	var before, after string
-	if err := db.QueryRowContext(ctx, `SELECT to_jsonb(e)::text FROM environments e WHERE id=$1`, environment).Scan(&before); err != nil {
-		t.Fatal(err)
-	}
-	for range 2 {
-		if _, err := provider.UpTo(ctx, 36); err != nil {
-			t.Fatal(err)
-		}
-		var count int
-		if err := db.QueryRowContext(ctx, "SELECT count(*) FROM environment_file_writes").Scan(&count); err != nil || count != 0 {
-			t.Fatal("migration manufactured write authority", count, err)
-		}
-		if _, err := provider.DownTo(ctx, 35); err != nil {
-			t.Fatal("empty downgrade", err)
-		}
-	}
-	if _, err := provider.UpTo(ctx, 36); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, `INSERT INTO environment_file_writes(id,environment_id,device_id,request_sha256)
-		VALUES ($1,$2,$3,$4)`, write, environment, device, strings.Repeat("b", 64)); err != nil {
-		t.Fatal(err)
-	}
-	var original, retained string
-	if err := db.QueryRowContext(ctx, `SELECT to_jsonb(w)::text FROM environment_file_writes w WHERE id=$1`, write).Scan(&original); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.DownTo(ctx, 35); err == nil || !strings.Contains(err.Error(), "Cannot remove durable Environment file write identities") {
-		t.Fatal("downgrade removed unresolved identity", err)
-	}
-	if err := db.QueryRowContext(ctx, `SELECT to_jsonb(w)::text FROM environment_file_writes w WHERE id=$1`, write).Scan(&retained); err != nil || retained != original {
-		t.Fatal("failed downgrade changed write", err)
-	}
-	if err := db.QueryRowContext(ctx, `SELECT to_jsonb(e)::text FROM environments e WHERE id=$1`, environment).Scan(&after); err != nil || after != before {
-		t.Fatal("migration changed Environment", err)
-	}
-}
diff --git a/services/core/tests/integration/environment_initial_migration_test.go b/services/core/tests/integration/environment_initial_migration_test.go
deleted file mode 100644
index 21a7524de..000000000
--- a/services/core/tests/integration/environment_initial_migration_test.go
+++ /dev/null
@@ -1,86 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestEnvironmentInitialMigrationPreservesLaterInputOrigin(t *testing.T) {
-	_, pool := testStore(t)
-	ctx := t.Context()
-	schema := "initial_origin_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(ctx, "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(context.Background(), "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 28); err != nil {
-		t.Fatal(err)
-	}
-	session, later := uuid.NewString(), uuid.NewString()
-	if _, err := db.ExecContext(ctx, `INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash) VALUES ($1,$2,'codex','historical','historical')`, session, uuid.NewString()); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, "INSERT INTO environments(id,session_id) VALUES ($1,$2)", uuid.NewString(), session); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, `INSERT INTO environment_input_reservations(id,session_id,idempotency_key,batch,created_at,deadline)
-		VALUES ($1,$2,'later','[{"kind":"message","payload":{"text":"historical"}}]',clock_timestamp(),clock_timestamp()+interval '5 minutes')`, later, session); err != nil {
-		t.Fatal(err)
-	}
-	snapshot := func() string {
-		t.Helper()
-		var result string
-		if err := db.QueryRowContext(ctx, "SELECT (to_jsonb(r)-'is_initial')::text FROM environment_input_reservations r WHERE id=$1", later).Scan(&result); err != nil {
-			t.Fatal(err)
-		}
-		return result
-	}
-	before := snapshot()
-	for i := 0; i < 2; i++ {
-		if _, err := provider.UpTo(ctx, 29); err != nil {
-			t.Fatal(err)
-		}
-		var initial bool
-		if err := db.QueryRowContext(ctx, "SELECT is_initial FROM environment_input_reservations WHERE id=$1", later).Scan(&initial); err != nil || initial || snapshot() != before {
-			t.Fatal("migration inferred origin or changed historical data", initial, err)
-		}
-		if i == 0 {
-			if _, err := provider.DownTo(ctx, 28); err != nil {
-				t.Fatal("later-only downgrade failed", err)
-			}
-		}
-	}
-	initial := uuid.NewString()
-	if _, err := db.ExecContext(ctx, `INSERT INTO environment_input_reservations(id,session_id,idempotency_key,batch,is_initial,state,created_at,deadline,settled_at)
-		VALUES ($1,$2,'initial','[{"kind":"message","payload":{"text":"initial"}}]',true,'expired',clock_timestamp()-interval '6 minutes',clock_timestamp()-interval '1 minute',clock_timestamp())`, initial, session); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.DownTo(ctx, 28); err == nil || !strings.Contains(err.Error(), "Cannot remove initial Environment input origin") {
-		t.Fatal("downgrade discarded initial failure meaning", err)
-	}
-	var retained bool
-	if err := db.QueryRowContext(ctx, "SELECT is_initial FROM environment_input_reservations WHERE id=$1", initial).Scan(&retained); err != nil || !retained || snapshot() != before {
-		t.Fatal("rejected downgrade changed origin/history", retained, err)
-	}
-}
diff --git a/services/core/tests/integration/environment_input_activity_test.go b/services/core/tests/integration/environment_input_activity_test.go
index a6e9b9bf3..7f83ee2b1 100644
--- a/services/core/tests/integration/environment_input_activity_test.go
+++ b/services/core/tests/integration/environment_input_activity_test.go
@@ -245,13 +245,4 @@ func TestEnvironmentInputActivityRecoversWaitingActionAndHidesDeletion(t *testin
 	if err := sessionService(t, s).DeleteSession(t.Context(), sessions.DeleteSessionCommand{TenantID: tenant, SessionID: session.ID}); !errors.Is(err, sessions.ErrNotIdle) {
 		t.Fatal("waiting input deleted", err)
 	}
-	if err := s.commitLegacyDeletion(t.Context(), tenant, session.ID); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := sessionAdapter(s).GetSession(t.Context(), tenant, session.ID); !errors.Is(err, sessions.ErrNotFound) {
-		t.Fatal("deleted activity remained visible", err)
-	}
-	if _, err := sessionAdapter(s).ListSessionEvents(t.Context(), tenant, session.ID, 0); !errors.Is(err, sessions.ErrNotFound) {
-		t.Fatal("deleted activity events remained visible", err)
-	}
 }
diff --git a/services/core/tests/integration/environment_input_migration_test.go b/services/core/tests/integration/environment_input_migration_test.go
deleted file mode 100644
index 8e57ded17..000000000
--- a/services/core/tests/integration/environment_input_migration_test.go
+++ /dev/null
@@ -1,92 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestEnvironmentInputMigrationRetainsHistoryAndRetryIdentity(t *testing.T) {
-	_, pool := testStore(t)
-	ctx := context.Background()
-	schema := "environment_input_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(ctx, "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(ctx, "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 21); err != nil {
-		t.Fatal(err)
-	}
-	tenant, session := uuid.NewString(), uuid.NewString()
-	// Historical schemas must be seeded without the current Store's creation contract.
-	input := environmentInput("session", "self_hosted", "/workspace")
-	if _, err := db.ExecContext(ctx, `INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash,configuration)
-		VALUES ($1,$2,'codex','session','historical',$3)`, session, tenant, input.Configuration); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, "INSERT INTO environments(id,session_id) VALUES ($1,$2)", uuid.NewString(), session); err != nil {
-		t.Fatal(err)
-	}
-	var before, after string
-	if err := db.QueryRowContext(ctx, "SELECT to_jsonb(s)::text FROM sessions s WHERE id=$1", session).Scan(&before); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 22); err != nil {
-		t.Fatal(err)
-	}
-	var count int
-	if err := db.QueryRowContext(ctx, "SELECT count(*) FROM environment_input_reservations").Scan(&count); err != nil || count != 0 {
-		t.Fatal("migration manufactured reservations", count, err)
-	}
-	if _, err := provider.DownTo(ctx, 21); err != nil {
-		t.Fatal("empty downgrade", err)
-	}
-	if _, err := provider.UpTo(ctx, 22); err != nil {
-		t.Fatal(err)
-	}
-	if err := db.QueryRowContext(ctx, "SELECT to_jsonb(s)::text FROM sessions s WHERE id=$1", session).Scan(&after); err != nil || before != after {
-		t.Fatal("migration changed Session", err)
-	}
-	// Seed the historical schema directly; current queries require later columns.
-	pending := uuid.NewString()
-	if _, err := db.ExecContext(ctx, `INSERT INTO environment_input_reservations(id,session_id,idempotency_key,batch,created_at,deadline)
-		VALUES ($1,$2,'pending','[{"kind":"message","payload":{"text":"pending"}}]',clock_timestamp(),clock_timestamp()+interval '5 minutes')`, pending, session); err != nil {
-		t.Fatal(err)
-	}
-	var original, retained string
-	if err := db.QueryRowContext(ctx, "SELECT to_jsonb(r)::text FROM environment_input_reservations r WHERE id=$1", pending).Scan(&original); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.DownTo(ctx, 21); err == nil || !strings.Contains(err.Error(), "Cannot remove durable Environment input identities") {
-		t.Fatal("downgrade discarded retry identity", err)
-	}
-	if err := db.QueryRowContext(ctx, "SELECT to_jsonb(r)::text FROM environment_input_reservations r WHERE id=$1", pending).Scan(&retained); err != nil || retained != original {
-		t.Fatal("downgrade lost reservation", retained, err)
-	}
-	if err := db.QueryRowContext(ctx, "SELECT to_jsonb(s)::text FROM sessions s WHERE id=$1", session).Scan(&after); err != nil || before != after {
-		t.Fatal("migration changed Session", err)
-	}
-	if err := db.QueryRowContext(ctx, "SELECT count(*) FROM turns WHERE session_id=$1", session).Scan(&count); err != nil || count != 0 {
-		t.Fatal("migration manufactured a Turn", count, err)
-	}
-}
diff --git a/services/core/tests/integration/environment_input_settlement_test.go b/services/core/tests/integration/environment_input_settlement_test.go
deleted file mode 100644
index d5e8f4472..000000000
--- a/services/core/tests/integration/environment_input_settlement_test.go
+++ /dev/null
@@ -1,67 +0,0 @@
-package integration
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
-)
-
-func TestEnvironmentInputDeletionSettlesPendingAndFencesPromotion(t *testing.T) {
-	for _, concurrent := range []bool{false, true} {
-		t.Run(map[bool]string{false: "pending", true: "racing-promotion"}[concurrent], func(t *testing.T) {
-			s, pool := testStore(t)
-			writer := executionWriter(t, s)
-			tenant, session := environmentInputSession(t, s)
-			ctx := context.Background()
-			pending := reserveEnvironmentInput(t, s, tenant, session.ID, "pending")
-			done := make(chan error, 1)
-			if concurrent {
-				go func() {
-					_, err := sessionExecution(t, writer.lease).PromoteEnvironmentInput(ctx, tenant, session.ID, pending.ID)
-					done <- err
-				}()
-			}
-			if !concurrent {
-				if err := sessionService(t, s).DeleteSession(ctx, sessions.DeleteSessionCommand{TenantID: tenant, SessionID: session.ID}); !errors.Is(err, sessions.ErrNotIdle) {
-					t.Fatal("pending input deleted", err)
-				}
-			}
-			// A marker from an earlier release still settles and fences the input.
-			if err := s.commitLegacyDeletion(ctx, tenant, session.ID); err != nil {
-				t.Fatal(err)
-			}
-			if concurrent {
-				if err := <-done; err != nil && !errors.Is(err, sessions.ErrNotFound) {
-					t.Fatal(err)
-				}
-			}
-			for _, action := range []func(context.Context, string, string, string) (sessions.EnvironmentInputReservation, error){
-				sessionAdapter(s).GetEnvironmentInputReservation,
-				sessionExecution(t, writer.lease).PromoteEnvironmentInput,
-				func(ctx context.Context, tenant, session, id string) (sessions.EnvironmentInputReservation, error) {
-					return cancelEnvironmentInput(ctx, s, tenant, session, id)
-				},
-			} {
-				if _, err := action(ctx, tenant, session.ID, pending.ID); !errors.Is(err, sessions.ErrNotFound) {
-					t.Fatal("deleted reservation remained accessible", err)
-				}
-			}
-			if _, err := sessionService(t, s).ReserveEnvironmentInput(ctx, tenant, session.ID, "late", pending.Inputs); !errors.Is(err, sessions.ErrNotFound) {
-				t.Fatal("deleted Session accepted reservation", err)
-			}
-			var state string
-			var active int
-			if err := pool.QueryRow(ctx, "SELECT state FROM environment_input_reservations WHERE id=$1", pending.ID).Scan(&state); err != nil {
-				t.Fatal(err)
-			}
-			if state != sessions.EnvironmentInputCancelled && (!concurrent || state != sessions.EnvironmentInputAdmitted) {
-				t.Fatal("deletion lost pending settlement", state)
-			}
-			if err := pool.QueryRow(ctx, "SELECT count(*) FROM turns WHERE session_id=$1 AND (status='queued' OR (status IN ('in_progress','waiting') AND cancel_requested_at IS NULL))", session.ID).Scan(&active); err != nil || active != 0 {
-				t.Fatal("deleted reservation retained unclaimed or uncancelled work", active, err)
-			}
-		})
-	}
-}
diff --git a/services/core/tests/integration/environment_work_test.go b/services/core/tests/integration/environment_work_test.go
index fae8b6abc..9497d2d8a 100644
--- a/services/core/tests/integration/environment_work_test.go
+++ b/services/core/tests/integration/environment_work_test.go
@@ -1,10 +1,8 @@
 package integration
 
 import (
-	"errors"
 	"testing"
 
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 	"github.com/google/uuid"
 )
 
@@ -16,7 +14,7 @@ func TestEnvironmentInputWorkFiltersAndPagesDevices(t *testing.T) {
 		pending := workerEnvironmentReservation(t, h)
 		wanted[pending.ID] = pending.SessionID
 	}
-	for _, state := range []string{"expired", "cancelled", "deleted", "unbound", "revoked", "disconnected"} {
+	for _, state := range []string{"expired", "cancelled", "unbound", "revoked", "disconnected"} {
 		pending := workerEnvironmentReservation(t, h)
 		switch state {
 		case "expired":
@@ -25,13 +23,6 @@ func TestEnvironmentInputWorkFiltersAndPagesDevices(t *testing.T) {
 			if _, err := cancelEnvironmentInput(t.Context(), h.s, h.tenant, pending.SessionID, pending.ID); err != nil {
 				t.Fatal(err)
 			}
-		case "deleted":
-			if err := sessionService(t, h.s).DeleteSession(t.Context(), sessions.DeleteSessionCommand{TenantID: h.tenant, SessionID: pending.SessionID}); !errors.Is(err, sessions.ErrNotIdle) {
-				t.Fatal("pending input deleted", err)
-			}
-			if err := h.s.commitLegacyDeletion(t.Context(), h.tenant, pending.SessionID); err != nil {
-				t.Fatal(err)
-			}
 		case "unbound":
 			wanted[pending.ID] = pending.SessionID
 			if _, err := pool.Exec(t.Context(), "DELETE FROM session_devices WHERE session_id=$1", pending.SessionID); err != nil {
diff --git a/services/core/tests/integration/environment_worker_helpers_test.go b/services/core/tests/integration/environment_worker_helpers_test.go
index 3ddd0529c..c69afb4e7 100644
--- a/services/core/tests/integration/environment_worker_helpers_test.go
+++ b/services/core/tests/integration/environment_worker_helpers_test.go
@@ -27,7 +27,7 @@ func enableWorkerEnvironment(t *testing.T, h *dispatchHarness) {
 }
 
 func workerEnvironmentCapabilities() proto.AgentKindCapabilities {
-	return prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, WebSearchControl: proto.CapabilitySupported, TextVerbosity: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, Preparation: proto.CapabilitySupported, LocalEnvironment: proto.CapabilitySupported, WorkspaceReadPreparation: proto.CapabilitySupported, WorkspaceOutputExport: proto.CapabilitySupported})
+	return prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, Preparation: proto.CapabilitySupported, LocalEnvironment: proto.CapabilitySupported, WorkspaceReadPreparation: proto.CapabilitySupported, WorkspaceOutputExport: proto.CapabilitySupported})
 }
 
 func workerEnvironmentReservation(t *testing.T, h *dispatchHarness) sessions.EnvironmentInputReservation {
@@ -87,7 +87,7 @@ func workerRuntimeForPreparation(t *testing.T, h *dispatchHarness, frame proto.E
 		t.Fatal("invalid worker preparation")
 	}
 	for _, candidate := range h.environments {
-		if input.Configuration.AgentStateKey == "agents-api-"+candidate.session.ID && input.Configuration.LocalEnvironment != nil && input.Configuration.LocalEnvironment.ID == candidate.device.EnvironmentID {
+		if input.Configuration.AgentStateKey == candidate.session.ID && input.Configuration.LocalEnvironment != nil && input.Configuration.LocalEnvironment.ID == candidate.device.EnvironmentID {
 			return candidate
 		}
 	}
diff --git a/services/core/tests/integration/environment_worker_test.go b/services/core/tests/integration/environment_worker_test.go
index 3ba10d5ce..9f6af2dba 100644
--- a/services/core/tests/integration/environment_worker_test.go
+++ b/services/core/tests/integration/environment_worker_test.go
@@ -2,7 +2,6 @@ package integration
 
 import (
 	"encoding/json"
-	"strings"
 	"testing"
 	"time"
 
@@ -69,7 +68,7 @@ func TestWorkerEnvironmentSharesCapacityThroughClaimAndCleanup(t *testing.T) {
 	if second.DecodePayload(&prepare) != nil {
 		t.Fatal("invalid Prepare")
 	}
-	waiting := pending[strings.TrimPrefix(prepare.Configuration.AgentStateKey, "agents-api-")]
+	waiting := pending[prepare.Configuration.AgentStateKey]
 	if waiting.ID == "" {
 		t.Fatal("wrong waiting Session")
 	}
diff --git a/services/core/tests/integration/environments_migration_test.go b/services/core/tests/integration/environments_migration_test.go
deleted file mode 100644
index 2645ed971..000000000
--- a/services/core/tests/integration/environments_migration_test.go
+++ /dev/null
@@ -1,133 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"os"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/pgxpool"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestEnvironmentMigrationPreservesHistoryAndGuardsIdentity(t *testing.T) {
-	_, pool := testStore(t)
-	ctx := context.Background()
-	schema := "environment_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(ctx, "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(ctx, "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 19); err != nil {
-		t.Fatal(err)
-	}
-	tenant := uuid.NewString()
-	for _, kind := range []string{"none", "self_hosted"} {
-		if _, err := db.ExecContext(ctx, `INSERT INTO sessions (id,tenant_id,engine,idempotency_key,request_hash,configuration)
-            VALUES ($1,$2,'codex',$3,'historical',jsonb_build_object('environment',jsonb_build_object('type',$3::text)))`, uuid.NewString(), tenant, kind); err != nil {
-			t.Fatal(err)
-		}
-	}
-	history := func() string {
-		t.Helper()
-		var snapshot string
-		if err := db.QueryRowContext(ctx, "SELECT jsonb_agg(to_jsonb(s) ORDER BY id)::text FROM sessions s").Scan(&snapshot); err != nil {
-			t.Fatal(err)
-		}
-		return snapshot
-	}
-	before := history()
-	if _, err := provider.UpTo(ctx, 20); err != nil {
-		t.Fatal(err)
-	}
-	if after := history(); after != before {
-		t.Fatal("migration changed historical Sessions")
-	}
-	var count int
-	if err := db.QueryRowContext(ctx, "SELECT count(*) FROM environments").Scan(&count); err != nil || count != 0 {
-		t.Fatal("manufactured historical ownership", count, err)
-	}
-	if _, err := provider.DownTo(ctx, 19); err != nil {
-		t.Fatal("empty downgrade failed", err)
-	}
-	if _, err := provider.UpTo(ctx, 20); err != nil {
-		t.Fatal(err)
-	}
-	poolConfig := pool.Config()
-	poolConfig.ConnConfig = cfg
-	migrated, err := pgxpool.NewWithConfig(ctx, poolConfig)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(migrated.Close)
-
-	sessionID, environmentID := uuid.NewString(), uuid.NewString()
-	tx, err := migrated.Begin(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = tx.Rollback(ctx) }()
-	input := environmentInput("new", "self_hosted", "/workspace")
-	if _, err := tx.Exec(ctx, `INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash,configuration)
-        VALUES ($1,$2,'codex','new','new',$3)`, sessionID, tenant, input.Configuration); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := tx.Exec(ctx, "INSERT INTO environments(id,session_id) VALUES ($1,$2)", environmentID, sessionID); err != nil {
-		t.Fatal(err)
-	}
-	downgradeCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
-	defer cancel()
-	outcome := make(chan error, 1)
-	go func() { _, err := provider.DownTo(downgradeCtx, 19); outcome <- err }()
-	// The uncommitted creator must block the downgrade before its emptiness decision.
-	for {
-		var blocked bool
-		err := pool.QueryRow(downgradeCtx, `SELECT EXISTS (
-            SELECT 1 FROM pg_locks WHERE relation=$1::regclass
-              AND mode='AccessExclusiveLock' AND NOT granted)`, quoted+".environments").Scan(&blocked)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if blocked {
-			break
-		}
-		select {
-		case err := <-outcome:
-			t.Fatal("downgrade did not wait for creator", err)
-		case <-downgradeCtx.Done():
-			t.Fatal("downgrade lock was not observed")
-		case <-time.After(5 * time.Millisecond):
-		}
-	}
-	if err := tx.Commit(ctx); err != nil {
-		t.Fatal(err)
-	}
-	if err := <-outcome; err == nil || !strings.Contains(err.Error(), "Cannot remove durable Environment identities") {
-		t.Fatal("concurrent downgrade discarded identity", err)
-	}
-	// Read the version-20 row directly: current Store queries select columns
-	// that later migrations add to environments.
-	var retained string
-	if err := migrated.QueryRow(ctx, `SELECT e.session_id::text FROM environments e JOIN sessions s ON s.id = e.session_id
-        WHERE s.tenant_id = $1 AND e.id = $2 AND s.deleted_at IS NULL`, tenant, environmentID).Scan(&retained); err != nil || retained != sessionID {
-		t.Fatal("downgrade destroyed ownership", retained, err)
-	}
-}
diff --git a/services/core/tests/integration/environments_test.go b/services/core/tests/integration/environments_test.go
index 7dce3a10e..3628aea25 100644
--- a/services/core/tests/integration/environments_test.go
+++ b/services/core/tests/integration/environments_test.go
@@ -262,7 +262,7 @@ func TestEnvironmentDeletionHidesWithoutDestroyingOwnership(t *testing.T) {
 	}
 }
 
-func TestEnvironmentAbsentForNoneAndLegacySnapshots(t *testing.T) {
+func TestEnvironmentAbsentForNoneAndEmptyConfigurations(t *testing.T) {
 	s, _ := testStore(t)
 	ctx := context.Background()
 	tenant := uuid.NewString()
diff --git a/services/core/tests/integration/execution_messages_test.go b/services/core/tests/integration/execution_messages_test.go
index 860192ca2..b84787a72 100644
--- a/services/core/tests/integration/execution_messages_test.go
+++ b/services/core/tests/integration/execution_messages_test.go
@@ -11,20 +11,10 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 )
 
-func TestExecutionNegotiatesAndPersistsMessageObservations(t *testing.T) {
+func TestExecutionPersistsMessageObservations(t *testing.T) {
 	h := newDispatchHarness(t)
 	ctx := context.Background()
-	first := h.message("legacy", "legacy observation policy")
-	result := h.run(ctx, first.TurnID)
-	var request proto.PromptRequestPayload
-	env := h.read(testExecutionRequest)
-	_ = env.DecodePayload(&request)
-	if request.ObserveMessages {
-		t.Fatal("unadvertised observation capability requested")
-	}
-	h.write(first.TurnID, proto.TypeDone, proto.DonePayload{})
-	h.finished(result, sessions.TurnCompleted)
-	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, Resume: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, WebSearchControl: proto.CapabilitySupported, TextVerbosity: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, MessageItems: proto.CapabilitySupported, NativeSessionRecovery: proto.CapabilitySupported, Preparation: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported})}}})
+	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Resume: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, MessageItems: proto.CapabilitySupported, NativeSessionRecovery: proto.CapabilitySupported, Preparation: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported})}}})
 	deadline := time.Now().Add(3 * time.Second)
 	for {
 		peer, err := h.registry.LookupDevice(h.device.ID)
@@ -41,12 +31,8 @@ func TestExecutionNegotiatesAndPersistsMessageObservations(t *testing.T) {
 		time.Sleep(10 * time.Millisecond)
 	}
 	input := h.message("observed", "stream separate messages")
-	result = h.run(ctx, input.TurnID)
-	env = h.read(testExecutionRequest)
-	_ = env.DecodePayload(&request)
-	if !request.ObserveMessages {
-		t.Fatal("advertised capability was not requested")
-	}
+	result := h.run(ctx, input.TurnID)
+	h.read(testExecutionRequest)
 	text := "complete"
 	h.write(input.TurnID, proto.TypeOutputMessage, proto.OutputMessagePayload{ID: "a", Status: "in_progress", Phase: "commentary"})
 	h.write(input.TurnID, proto.TypeDelta, proto.DeltaPayload{ItemID: "a", Delta: text, Sequence: 1})
@@ -56,7 +42,7 @@ func TestExecutionNegotiatesAndPersistsMessageObservations(t *testing.T) {
 	if _, err := requestCancel(ctx, h.s, h.tenant, h.session.ID, "cancel"); err != nil {
 		t.Fatal(err)
 	}
-	env = h.read(proto.TypePromptCancel)
+	env := h.read(proto.TypePromptCancel)
 	var cancel proto.PromptCancelPayload
 	_ = env.DecodePayload(&cancel)
 	h.write(input.TurnID, proto.TypeInteractionDecisionAck, proto.InteractionDecisionAckPayload{DeliveryID: cancel.DeliveryID, Applied: true, Outcome: &proto.DonePayload{}})
diff --git a/services/core/tests/integration/execution_tools_test.go b/services/core/tests/integration/execution_tools_test.go
index 77cf4c88f..9cd17ef96 100644
--- a/services/core/tests/integration/execution_tools_test.go
+++ b/services/core/tests/integration/execution_tools_test.go
@@ -16,12 +16,7 @@ func TestExecutionNegotiatesAndPersistsToolObservations(t *testing.T) {
 	ctx := context.Background()
 	input := h.message("observed", "run tools")
 	result := h.run(ctx, input.TurnID)
-	env := h.read(testExecutionRequest)
-	var request proto.PromptRequestPayload
-	_ = env.DecodePayload(&request)
-	if request.ObserveMessages {
-		t.Fatal("unadvertised message items were requested")
-	}
+	h.read(testExecutionRequest)
 	start := json.RawMessage(`{"kind":"mcp","server":"reference","name":"lookup","arguments":{"key":"value"},"status":"in_progress","output":null,"error":null}`)
 	complete := json.RawMessage(`{"kind":"mcp","server":"reference","name":"lookup","arguments":{"key":"value"},"status":"completed","output":{"content":[{"type":"text","text":"answer"}],"structuredContent":{"version":9007199254740993}},"error":null}`)
 	partial := json.RawMessage(`{"kind":"command","command":"long-running","status":"in_progress"}`)
@@ -42,7 +37,7 @@ func TestExecutionNegotiatesAndPersistsToolObservations(t *testing.T) {
 	if _, err := requestCancel(ctx, h.s, h.tenant, h.session.ID, "cancel"); err != nil {
 		t.Fatal(err)
 	}
-	env = h.read(proto.TypePromptCancel)
+	env := h.read(proto.TypePromptCancel)
 	var cancel proto.PromptCancelPayload
 	_ = env.DecodePayload(&cancel)
 	h.write(input.TurnID, proto.TypeInteractionDecisionAck, proto.InteractionDecisionAckPayload{DeliveryID: cancel.DeliveryID, Applied: true, Outcome: &proto.DonePayload{}})
diff --git a/services/core/tests/integration/executor_principals_migration_test.go b/services/core/tests/integration/executor_principals_migration_test.go
deleted file mode 100644
index 4157d1422..000000000
--- a/services/core/tests/integration/executor_principals_migration_test.go
+++ /dev/null
@@ -1,131 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/pgxpool"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
-)
-
-func TestExecutorPrincipalMigrationRetiresUnknownAuthority(t *testing.T) {
-	_, pool := testStore(t)
-	ctx := t.Context()
-	schema := "executor_principal_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(ctx, "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(context.Background(), "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 25); err != nil {
-		t.Fatal(err)
-	}
-	tenant, session, environment := uuid.NewString(), uuid.NewString(), uuid.NewString()
-	input := environmentInput("legacy", "self_hosted", "/workspace")
-	if _, err := db.ExecContext(ctx, `INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash,configuration)
-		VALUES ($1,$2,'codex','legacy','historical',$3)`, session, tenant, input.Configuration); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, "INSERT INTO environments(id,session_id) VALUES ($1,$2)", environment, session); err != nil {
-		t.Fatal(err)
-	}
-	_, digest, err := newExecutorSecret()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, `INSERT INTO environment_executor_credentials(environment_id,token_sha256,issued_at)
-		VALUES ($1,$2,now()-interval '2 days')`, environment, digest); err != nil {
-		t.Fatal(err)
-	}
-	var oldSession, oldCredential, after string
-	if err := db.QueryRowContext(ctx, "SELECT to_jsonb(s)::text FROM sessions s WHERE id=$1", session).Scan(&oldSession); err != nil {
-		t.Fatal(err)
-	}
-	if err := db.QueryRowContext(ctx, "SELECT (to_jsonb(c)-'revoked_at')::text FROM environment_executor_credentials c WHERE environment_id=$1", environment).Scan(&oldCredential); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 26); err != nil {
-		t.Fatal(err)
-	}
-	if err := db.QueryRowContext(ctx, "SELECT to_jsonb(s)::text FROM sessions s WHERE id=$1", session).Scan(&after); err != nil || oldSession != after {
-		t.Fatal("migration changed Session", err)
-	}
-	if err := db.QueryRowContext(ctx, `SELECT (to_jsonb(c)-ARRAY['key_id','tenant_id','subject_kind','subject_id','created_at','revoked_at'])::text
-		FROM environment_executor_credentials c WHERE key_id=$1`, environment).Scan(&after); err != nil || oldCredential != after {
-		t.Fatal("migration changed legacy digest/restriction/issuance", err)
-	}
-	var retired bool
-	if err := db.QueryRowContext(ctx, `SELECT key_id=environment_id AND tenant_id IS NULL AND subject_kind IS NULL
-		AND subject_id IS NULL AND created_at IS NULL AND revoked_at IS NOT NULL FROM environment_executor_credentials WHERE key_id=$1`, environment).Scan(&retired); err != nil || !retired {
-		t.Fatal("migration inferred authority", err)
-	}
-	var mappings int
-	if err := db.QueryRowContext(ctx, "SELECT count(*) FROM execution_project_scopes").Scan(&mappings); err != nil || mappings != 0 {
-		t.Fatal("migration invented project", err)
-	}
-	if _, err := db.ExecContext(ctx, "UPDATE environment_executor_credentials SET revoked_at=NULL WHERE key_id=$1", environment); err == nil {
-		t.Fatal("unknown principal regained authority")
-	}
-	if _, err := provider.DownTo(ctx, 25); err != nil {
-		t.Fatal("legacy-only downgrade", err)
-	}
-	if err := db.QueryRowContext(ctx, "SELECT revoked_at IS NOT NULL FROM environment_executor_credentials WHERE environment_id=$1", environment).Scan(&retired); err != nil || !retired {
-		t.Fatal("downgrade undid revocation", err)
-	}
-	if _, err := provider.UpTo(ctx, 26); err != nil {
-		t.Fatal(err)
-	}
-	poolConfig := pool.Config()
-	poolConfig.ConnConfig = cfg
-	migrated, err := pgxpool.NewWithConfig(ctx, poolConfig)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(migrated.Close)
-	s := New(t, migrated)
-	p := FixtureExecutorPrincipal(t, s, tenant)
-	credentials := sessionService(t, s)
-	if _, err := sessionAdapter(s).AuthenticateEnvironmentExecutor(ctx, environment, digest); !errors.Is(err, sessions.ErrNotFound) {
-		t.Fatal("legacy credential accepted", err)
-	}
-	if _, err := credentials.IssueExecutorCredential(ctx, p, environment, ""); !errors.Is(err, sessions.ErrExecutorCredentialExists) {
-		t.Fatal("legacy key ID claimed", err)
-	}
-	if _, err := credentials.RotateExecutorCredential(ctx, p, environment); !errors.Is(err, sessions.ErrNotFound) {
-		t.Fatal("legacy principal claimed", err)
-	}
-	if err := credentials.RevokeExecutorCredential(ctx, p, environment); !errors.Is(err, sessions.ErrNotFound) {
-		t.Fatal("legacy principal manufactured", err)
-	}
-	key, err := credentials.IssueExecutorCredential(ctx, p, uuid.NewString(), "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.DownTo(ctx, 25); err == nil || !strings.Contains(err.Error(), "Cannot remove durable executor principal identities") {
-		t.Fatal("downgrade lost principal keys", err)
-	}
-	if _, err := credentials.RotateExecutorCredential(ctx, p, key.KeyID); err != nil {
-		t.Fatal("failed downgrade damaged identity", err)
-	}
-}
diff --git a/services/core/tests/integration/function_execution_test.go b/services/core/tests/integration/function_execution_test.go
index 16b67e438..0e8c78d98 100644
--- a/services/core/tests/integration/function_execution_test.go
+++ b/services/core/tests/integration/function_execution_test.go
@@ -17,17 +17,22 @@ import (
 const functionConfiguration = `{"agent":{"model":"gpt-5.5","tools":[{"type":"function","name":"lookup_ticket","description":"Read a synthetic ticket","parameters":{"type":"object","properties":{"ticket":{"type":"string"}},"required":["ticket"],"additionalProperties":false},"defer_loading":false}]},"environment":{"type":"none"}}`
 
 func newFunctionHarness(t *testing.T) *dispatchHarness {
+	t.Helper()
+	return newFunctionHarnessWith(t, functionConfiguration)
+}
+
+func newFunctionHarnessWith(t *testing.T, configuration string) *dispatchHarness {
 	t.Helper()
 	h := newDispatchHarness(t)
 	var err error
-	h.session, err = h.s.CreateSession(t.Context(), h.tenant, sessions.CreateSession{Creator: FixtureCreator(), Engine: "codex", IdempotencyKey: "functions", Configuration: json.RawMessage(functionConfiguration)})
+	h.session, err = h.s.CreateSession(t.Context(), h.tenant, sessions.CreateSession{Creator: FixtureCreator(), Engine: "codex", IdempotencyKey: "functions", Configuration: json.RawMessage(configuration)})
 	if err != nil {
 		t.Fatal(err)
 	}
 	if err := bindSessionDevice(t, h.s, h.tenant, h.session.ID, h.device.ID); err != nil {
 		t.Fatal(err)
 	}
-	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, Resume: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, WebSearchControl: proto.CapabilitySupported, TextVerbosity: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, FunctionTools: proto.CapabilitySupported, FunctionResultImages: proto.CapabilitySupported, Preparation: proto.CapabilitySupported})}}})
+	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Resume: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, FunctionTools: proto.CapabilitySupported, FunctionResultImages: proto.CapabilitySupported, Preparation: proto.CapabilitySupported, SubagentObservations: proto.CapabilitySupported})}}})
 	deadline := time.Now().Add(time.Second)
 	for {
 		peer, _ := h.registry.LookupDevice(h.device.ID)
@@ -116,6 +121,69 @@ func TestExecutionFunctionsWaitForEveryApplicationReceipt(t *testing.T) {
 	h.finished(result, sessions.TurnCompleted)
 }
 
+func TestExecutionSubagentFunctionCallIsARequiredActionOfTheRootTurn(t *testing.T) {
+	h := newFunctionHarnessWith(t, strings.Replace(functionConfiguration, `"tools"`, `"id":"agent_root","multi_agent":{"enabled":true},"tools"`, 1))
+	input := h.message("start", "Run a child")
+	result := h.run(t.Context(), input.TurnID)
+	h.read(testExecutionRequest)
+	h.write(input.TurnID, proto.TypeSubagentIdentity, proto.SubagentIdentityPayload{NativeID: "child", ParentNativeID: "root", NativeCreatedAt: 100, ParentTurnID: "native-turn", SourceItemID: "spawn-item"})
+	h.write(input.TurnID, proto.TypeSubagentTurn, proto.SubagentTurnPayload{NativeID: "child", TurnID: "child-turn", Status: sessions.TurnInProgress, CreatedAtMS: 100000})
+	h.write(input.TurnID, proto.TypeSubagentItem, proto.SubagentItemPayload{NativeID: "child", TurnID: "child-turn", ItemID: "a", Position: 0, Kind: proto.TypeToolCall,
+		Payload: json.RawMessage(`{"id":"a","stage":"before","observation":{"status":"in_progress","kind":"function","name":"lookup_ticket","arguments":{"ticket":"42"}}}`)})
+	h.write(input.TurnID, proto.TypeFunctionCall, proto.FunctionCallPayload{CallID: "a", NativeID: "child", TurnID: "child-turn", Name: "lookup_ticket", Arguments: json.RawMessage(`{"ticket":"42"}`)})
+	state := functionState(t, h, 1)
+	child, err := h.s.GetSubagentIdentity(t.Context(), h.tenant, h.session.ID, "child")
+	if err != nil {
+		t.Fatal(err)
+	}
+	action := state.RequiredActions[0]
+	childItems, err := sessionAdapter(h.s).ListSubagentItems(t.Context(), h.tenant, h.session.ID, child.ID, "", 20, true)
+	if err != nil || state.LastTurn.ID != input.TurnID || state.LastTurn.Status != sessions.TurnWaiting || len(childItems.Data) != 1 || childItems.Data[0].CallID != action.CallID {
+		t.Fatal(state, childItems, err)
+	}
+	// The child Turn is not a Session Turn, so only the root Turn answers the call.
+	answer := json.RawMessage(`{"success":true,"output":"saved"}`)
+	if err := SubmitFixtureFunctionResult(t.Context(), h.s, h.tenant, h.session.ID, items.Identity(child.ID, "turn:child-turn"), action.CallID, answer); !errors.Is(err, sessions.ErrFunctionCallTurnMismatch) {
+		t.Fatal("the child Turn answered the call", err)
+	}
+	if err := SubmitFixtureFunctionResult(t.Context(), h.s, h.tenant, h.session.ID, input.TurnID, action.CallID, answer); err != nil {
+		t.Fatal(err)
+	}
+	var reply proto.FunctionResultPayload
+	if err := h.read(proto.TypeFunctionResult).DecodePayload(&reply); err != nil || reply.CallID != "a" {
+		t.Fatal(reply, err)
+	}
+	h.write(input.TurnID, proto.TypeInteractionDecisionAck, proto.InteractionDecisionAckPayload{DeliveryID: reply.DeliveryID, Applied: true})
+	h.write(input.TurnID, proto.TypeDone, proto.DonePayload{Content: "done"})
+	h.finished(result, sessions.TurnCompleted)
+}
+
+func TestExecutionWithdrawnFunctionCallStopsBeingARequiredAction(t *testing.T) {
+	h := newFunctionHarnessWith(t, strings.Replace(functionConfiguration, `"tools"`, `"id":"agent_root","multi_agent":{"enabled":true},"tools"`, 1))
+	input := h.message("start", "Run a child")
+	result := h.run(t.Context(), input.TurnID)
+	h.read(testExecutionRequest)
+	h.write(input.TurnID, proto.TypeSubagentIdentity, proto.SubagentIdentityPayload{NativeID: "child", ParentNativeID: "root", NativeCreatedAt: 100, ParentTurnID: "native-turn", SourceItemID: "spawn-item"})
+	h.write(input.TurnID, proto.TypeSubagentTurn, proto.SubagentTurnPayload{NativeID: "child", TurnID: "child-turn", Status: sessions.TurnInProgress, CreatedAtMS: 100000})
+	call := proto.FunctionCallPayload{CallID: "a", NativeID: "child", TurnID: "child-turn", Name: "lookup_ticket", Arguments: json.RawMessage(`{"ticket":"42"}`)}
+	h.write(input.TurnID, proto.TypeFunctionCall, call)
+	action := functionState(t, h, 1).RequiredActions[0]
+	withdrawn := proto.FunctionCallWithdrawnPayload{CallID: call.CallID, NativeID: call.NativeID, TurnID: call.TurnID}
+	for range 2 {
+		h.write(input.TurnID, proto.TypeFunctionCallWithdrawn, withdrawn)
+	}
+	state := functionState(t, h, 0)
+	if state.LastTurn.Status != sessions.TurnInProgress {
+		t.Fatal(state.LastTurn)
+	}
+	answer := json.RawMessage(`{"success":true,"output":"late"}`)
+	if err := SubmitFixtureFunctionResult(t.Context(), h.s, h.tenant, h.session.ID, input.TurnID, action.CallID, answer); !errors.Is(err, sessions.ErrTurnConflict) {
+		t.Fatal(err)
+	}
+	h.write(input.TurnID, proto.TypeDone, proto.DonePayload{Content: "done"})
+	h.finished(result, sessions.TurnCompleted)
+}
+
 func TestExecutionFunctionsCancellationAndUnconfirmedResults(t *testing.T) {
 	for _, cancel := range []bool{false, true} {
 		t.Run(map[bool]string{false: "unconfirmed", true: "cancel"}[cancel], func(t *testing.T) {
@@ -134,7 +202,7 @@ func TestExecutionFunctionsCancellationAndUnconfirmedResults(t *testing.T) {
 			if reply.Success || len(reply.Content) != 1 || *reply.Content[0].Text != "tool failed" {
 				t.Fatal(reply)
 			}
-			status := sessions.TurnFailed
+			status := sessions.TurnCompleted
 			if cancel {
 				if _, err := requestCancel(t.Context(), h.s, h.tenant, h.session.ID, "cancel"); err != nil {
 					t.Fatal(err)
@@ -151,6 +219,8 @@ func TestExecutionFunctionsCancellationAndUnconfirmedResults(t *testing.T) {
 				status = sessions.TurnCancelled
 			} else {
 				h.write(input.TurnID, proto.TypeInteractionDecisionAck, proto.InteractionDecisionAckPayload{DeliveryID: reply.DeliveryID, ErrorCode: "not_pending"})
+				h.write(input.TurnID, proto.TypeFunctionCallWithdrawn, proto.FunctionCallWithdrawnPayload{CallID: "a"})
+				h.write(input.TurnID, proto.TypeDone, proto.DonePayload{Content: "done"})
 			}
 			h.finished(result, status)
 			if cancel {
diff --git a/services/core/tests/integration/function_worker_test.go b/services/core/tests/integration/function_worker_test.go
index d15c24f79..035c1f51f 100644
--- a/services/core/tests/integration/function_worker_test.go
+++ b/services/core/tests/integration/function_worker_test.go
@@ -45,7 +45,7 @@ func TestWorkerWaitsForToolCapabilities(t *testing.T) {
 						t.Fatal(err)
 					}
 				}
-				caps := prototest.Capabilities(proto.AgentKindCapabilities{Preparation: proto.CapabilityFromBool(missing != "preparation"), Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilityFromBool(missing != "durable_input_receipts"), EnvironmentNone: proto.CapabilitySupported, WebSearchControl: proto.CapabilitySupported, TextVerbosity: proto.CapabilitySupported, ExecutionControls: proto.CapabilityFromBool(missing != "execution_controls"), SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilityFromBool(missing != "tool_observations"), MCPHTTPTools: proto.CapabilityFromBool(missing != "mcp_http_tools"), MCPHTTPRequired: proto.CapabilityFromBool(missing != "mcp_http_required"), MCPHTTPBearerAuth: proto.CapabilityFromBool(missing != "mcp_http_bearer_auth"), FunctionTools: proto.CapabilityFromBool(missing != "function_tools" && !isMCP)})
+				caps := prototest.Capabilities(proto.AgentKindCapabilities{Preparation: proto.CapabilityFromBool(missing != "preparation"), Streaming: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilityFromBool(missing != "durable_input_receipts"), EnvironmentNone: proto.CapabilitySupported, ExecutionControls: proto.CapabilityFromBool(missing != "execution_controls"), SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilityFromBool(missing != "tool_observations"), MCPHTTPTools: proto.CapabilityFromBool(missing != "mcp_http_tools"), MCPHTTPRequired: proto.CapabilityFromBool(missing != "mcp_http_required"), MCPHTTPBearerAuth: proto.CapabilityFromBool(missing != "mcp_http_bearer_auth"), FunctionTools: proto.CapabilityFromBool(missing != "function_tools" && !isMCP)})
 				heartbeat := func() {
 					h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: caps}}})
 				}
diff --git a/services/core/tests/integration/harness_onboarding_test.go b/services/core/tests/integration/harness_onboarding_test.go
index e98e2934a..b83de3901 100644
--- a/services/core/tests/integration/harness_onboarding_test.go
+++ b/services/core/tests/integration/harness_onboarding_test.go
@@ -15,10 +15,9 @@ import (
 	"testing"
 	"time"
 
-	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine/enginetest"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/harnesstest"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/execution"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimedevice"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
@@ -27,22 +26,21 @@ import (
 
 func TestThirdHarnessPublicOnboarding(t *testing.T) {
 	h := newDispatchHarness(t)
-	profile := enginetest.Profile(nil)
-	profile.ConfigurationValidation = engine.AdditionalValidation
-	profile.ToolsValidation = engine.AdditionalValidation
-	profile.ValidateConfiguration = func(a v1.Agent, _ *v1.Environment) error {
-		if a.Text.Verbosity != "medium" || a.Text.Format.Type != "text" || a.MultiAgent.Enabled || a.Reasoning.Effort != nil || a.Reasoning.Summary != nil || a.ServiceTier != "auto" {
-			return engine.ErrInvalidInput
+	fixture := harnesstest.Declaration("fixture_harness", func(d *harnessconfig.Declaration) {
+		d.ValidateConfiguration = func(a harnessconfig.Admission) error {
+			if a.TextFormat != "text" || a.MultiAgent {
+				return harnessconfig.ErrInvalidInput
+			}
+			return nil
 		}
-		return nil
-	}
-	profile.ValidateTools = func(_ *v1.Environment, f []proto.FunctionTool, m []proto.MCPHTTPServer) error {
-		if len(f)+len(m) > 0 {
-			return engine.ErrInvalidInput
+		d.ValidateTools = func(f []proto.FunctionTool, m []proto.MCPHTTPServer) error {
+			if len(f)+len(m) > 0 {
+				return harnessconfig.ErrInvalidInput
+			}
+			return nil
 		}
-		return nil
-	}
-	policy := execution.Policy{Engines: engine.NewCatalog(map[string]engine.Profile{"fixture_harness": profile})}
+	})
+	policy := execution.Policy{Declarations: harnessconfig.NewRegistry(fixture)}
 	h.d.Policy = policy
 	// The fixture only supplies an adapter and registration to the real daemon router.
 	// Core sees its ordinary authenticated gateway connection and neutral frames.
diff --git a/services/core/tests/integration/item_order_migration_test.go b/services/core/tests/integration/item_order_migration_test.go
deleted file mode 100644
index f47deb1d8..000000000
--- a/services/core/tests/integration/item_order_migration_test.go
+++ /dev/null
@@ -1,163 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"os"
-	"reflect"
-	"strings"
-	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/items"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/pgtype"
-	"github.com/jackc/pgx/v5/pgxpool"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestItemOrderMigrationPreservesIndexedHistory(t *testing.T) {
-	ctx := context.Background()
-	_, pool := testStore(t)
-	schema := "item_order_" + uuid.New().String()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(ctx, "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(ctx, "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err = provider.UpTo(ctx, 10); err != nil {
-		t.Fatal(err)
-	}
-	session, turn, tenant := uuid.NewString(), uuid.NewString(), uuid.NewString()
-	if _, err = db.ExecContext(ctx, "INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash) VALUES ($1,$2,'codex','legacy','legacy')", session, tenant); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = db.ExecContext(ctx, "INSERT INTO turns(id,session_id) VALUES ($1,$2)", turn, session); err != nil {
-		t.Fatal(err)
-	}
-	for i, id := range []string{
-		"00000000-0000-0000-0000-000000000003",
-		"00000000-0000-0000-0000-000000000001",
-		"00000000-0000-0000-0000-000000000002",
-	} {
-		payload := `{"type":"function_call_output"}`
-		if i == 1 {
-			payload = `{"type":"message","role":"user"}`
-		}
-		if _, err = db.ExecContext(ctx, "INSERT INTO session_items(id,session_id,turn_id,created_at,position,payload) VALUES ($1,$2,$3,'2026-01-01',0,$4)", id, session, turn, payload); err != nil {
-			t.Fatal(err)
-		}
-	}
-	readIDs := func() []string {
-		t.Helper()
-		rows, err := db.QueryContext(ctx, "SELECT id FROM session_items ORDER BY created_at,position,id")
-		if err != nil {
-			t.Fatal(err)
-		}
-		defer rows.Close()
-		var ids []string
-		for rows.Next() {
-			var id string
-			if err = rows.Scan(&id); err != nil {
-				t.Fatal(err)
-			}
-			ids = append(ids, id)
-		}
-		if err = rows.Err(); err != nil {
-			t.Fatal(err)
-		}
-		return ids
-	}
-	want := readIDs()
-	if _, err = provider.UpTo(ctx, 11); err != nil {
-		t.Fatal(err)
-	}
-	if got := readIDs(); !reflect.DeepEqual(got, want) {
-		t.Fatalf("migration reordered history: %v; want %v", got, want)
-	}
-	for i, id := range want {
-		var position int
-		var output pgtype.Int4
-		if err = db.QueryRowContext(ctx, "SELECT position,output_index FROM session_items WHERE id=$1", id).Scan(&position, &output); err != nil {
-			t.Fatal(err)
-		}
-		if position != i || output.Valid != (i > 0) || (output.Valid && int(output.Int32) != i-1) {
-			t.Fatalf("migrated item %d: position=%d output=%+v", i, position, output)
-		}
-	}
-	if _, err = provider.UpTo(ctx, 14); err != nil {
-		t.Fatal(err)
-	}
-	var before string
-	if err = db.QueryRowContext(ctx, "SELECT jsonb_agg(to_jsonb(i) ORDER BY id)::text FROM session_items i").Scan(&before); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = db.ExecContext(ctx, "UPDATE turns SET items_indexed=false WHERE id=$1", turn); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = provider.Up(ctx); err == nil || !strings.Contains(err.Error(), "Unindexed Agents API history") {
-		t.Fatalf("unprepared upgrade: %v", err)
-	}
-	var indexed bool
-	if err = db.QueryRowContext(ctx, "SELECT items_indexed FROM turns WHERE id=$1", turn).Scan(&indexed); err != nil || indexed {
-		t.Fatal("failed migration changed preparation state", err)
-	}
-	// Simulate the previous release finishing its index before retrying the upgrade.
-	if _, err = db.ExecContext(ctx, "UPDATE turns SET items_indexed=true WHERE id=$1", turn); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = provider.UpTo(ctx, 65); err != nil {
-		t.Fatal(err)
-	}
-	var after string
-	if err = db.QueryRowContext(ctx, "SELECT jsonb_agg(to_jsonb(i) ORDER BY id)::text FROM session_items i").Scan(&after); err != nil || after != before {
-		t.Fatal("upgrade changed indexed history", err)
-	}
-
-	// Exercise the reversible history migrations before the Project catalog,
-	// whose schema intentionally cannot be downgraded.
-	if _, err = provider.DownTo(ctx, 10); err != nil {
-		t.Fatal(err)
-	}
-	if got := readIDs(); !reflect.DeepEqual(got, want) {
-		t.Fatalf("downgrade reordered history: %v", got)
-	}
-	if _, err = provider.Up(ctx); err != nil {
-		t.Fatal(err)
-	}
-
-	poolConfig := pool.Config()
-	poolConfig.ConnConfig = cfg
-	migratedPool, err := pgxpool.NewWithConfig(ctx, poolConfig)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(migratedPool.Close)
-	s := New(t, migratedPool)
-	if _, err = transitionTurn(ctx, s, tenant, session, turn, sessions.TurnTransition{ExpectedStatus: sessions.TurnQueued, Status: sessions.TurnInProgress}); err != nil {
-		t.Fatal(err)
-	}
-	if err = executionOwner(t, New(t, migratedPool)).Sessions.AppendTurnEvents(ctx, tenant, session, turn, 1, []sessions.ExecutionEvent{{Kind: "delta", Payload: json.RawMessage(`{"item_id":"after-upgrade","delta":"continued"}`)}}); err != nil {
-		t.Fatal(err)
-	}
-	addedID := items.Identity(turn, "message:after-upgrade")
-	var position, output int
-	if err = db.QueryRowContext(ctx, "SELECT position,output_index FROM session_items WHERE id=$1", addedID).Scan(&position, &output); err != nil || position != 3 || output != 2 {
-		t.Fatalf("post-upgrade append: position=%d output=%d err=%v", position, output, err)
-	}
-}
diff --git a/services/core/tests/integration/item_reads_test.go b/services/core/tests/integration/item_reads_test.go
index 27585bf45..372e7920a 100644
--- a/services/core/tests/integration/item_reads_test.go
+++ b/services/core/tests/integration/item_reads_test.go
@@ -121,7 +121,7 @@ func TestItemProjectionFailureRollsBackJournalAndAggregateRecovers(t *testing.T)
 	s, _ := testStore(t)
 	journal := executionOwner(t, s).Sessions
 	tenant := uuid.NewString()
-	session, _ := s.CreateSession(ctx, tenant, sessions.CreateSession{Creator: FixtureCreator(), Engine: "codex", IdempotencyKey: "legacy"})
+	session, _ := s.CreateSession(ctx, tenant, sessions.CreateSession{Creator: FixtureCreator(), Engine: "codex", IdempotencyKey: "aggregate"})
 	input, err := sendMessage(ctx, s, tenant, session.ID, "input", messageText("test"))
 	if err != nil {
 		t.Fatal(err)
@@ -142,12 +142,12 @@ func TestItemProjectionFailureRollsBackJournalAndAggregateRecovers(t *testing.T)
 	if err != nil || len(page.Items) != 1 {
 		t.Fatal(page, err)
 	}
-	_, err = transitionTurn(ctx, s, tenant, session.ID, input.TurnID, sessions.TurnTransition{ExpectedStatus: sessions.TurnInProgress, Status: sessions.TurnCompleted, Outcome: json.RawMessage(`{"done":{"content":"legacy answer","metadata":{"private":"SECRET"}}}`)})
+	_, err = transitionTurn(ctx, s, tenant, session.ID, input.TurnID, sessions.TurnTransition{ExpectedStatus: sessions.TurnInProgress, Status: sessions.TurnCompleted, Outcome: json.RawMessage(`{"done":{"content":"aggregate answer","metadata":{"private":"SECRET"}}}`)})
 	if err != nil {
 		t.Fatal(err)
 	}
 	current, err := sessionAdapter(s).ListItems(ctx, tenant, session.ID, "", 100, true)
-	if err != nil || len(current.Items) != 2 || *current.Items[1].Content[0].Text != "legacy answer" {
+	if err != nil || len(current.Items) != 2 || *current.Items[1].Content[0].Text != "aggregate answer" {
 		t.Fatal(current, err)
 	}
 }
@@ -184,7 +184,7 @@ func TestReceiptOnlyTextRecoversWithoutInventingCompletion(t *testing.T) {
 	}
 }
 
-func TestLegacyFailureRetainsPartialAnswerAcrossRecovery(t *testing.T) {
+func TestFailedTurnRetainsPartialAnswerAcrossRecovery(t *testing.T) {
 	ctx := context.Background()
 	s, _ := testStore(t)
 	journal := executionOwner(t, s).Sessions
diff --git a/services/core/tests/integration/local_environment_worker_test.go b/services/core/tests/integration/local_environment_worker_test.go
index 35699205b..24af7917e 100644
--- a/services/core/tests/integration/local_environment_worker_test.go
+++ b/services/core/tests/integration/local_environment_worker_test.go
@@ -26,8 +26,8 @@ func localWorker(t *testing.T, scoped, execute bool) (*dispatchHarness, *executi
 	caps := prototest.Capabilities(proto.AgentKindCapabilities{LocalEnvironment: proto.CapabilitySupported, Preparation: proto.CapabilitySupported, WorkspaceReadPreparation: proto.CapabilitySupported})
 	if execute {
 		caps.WorkspaceOutputExport = proto.CapabilitySupported
-		caps.Streaming, caps.Steering, caps.DurableTurns, caps.DurableInputReceipts = proto.CapabilitySupported, proto.CapabilitySupported, proto.CapabilitySupported, proto.CapabilitySupported
-		caps.WebSearchControl, caps.TextVerbosity, caps.ExecutionControls = proto.CapabilitySupported, proto.CapabilitySupported, proto.CapabilitySupported
+		caps.Streaming, caps.DurableTurns, caps.DurableInputReceipts = proto.CapabilitySupported, proto.CapabilitySupported, proto.CapabilitySupported
+		caps.ExecutionControls = proto.CapabilitySupported
 		caps.SubagentControl, caps.ToolObservations = proto.CapabilitySupported, proto.CapabilitySupported
 	}
 	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: caps}}})
diff --git a/services/core/tests/integration/message_image_admission_test.go b/services/core/tests/integration/message_image_admission_test.go
index 1cf450a41..9cb4a0c1e 100644
--- a/services/core/tests/integration/message_image_admission_test.go
+++ b/services/core/tests/integration/message_image_admission_test.go
@@ -7,7 +7,8 @@ import (
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/execution"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 )
@@ -25,9 +26,9 @@ func TestUnqualifiedImageAdmissionIsAtomic(t *testing.T) {
 			h := newDispatchHarness(t)
 			// A registered text-only profile must stay closed regardless of the
 			// adapters currently qualified by the built-in catalog.
-			profile, _ := (engine.Catalog{}).Lookup("codex")
-			profile.MessageImages = proto.CapabilityUnsupported
-			h.d.Policy = execution.Policy{Engines: engine.NewCatalog(map[string]engine.Profile{"codex": profile})}
+			declaration, _ := builtin.Registry().Lookup("codex")
+			declaration.Capabilities.MessageImages = proto.CapabilityUnsupported
+			h.d.Policy = execution.Policy{Declarations: harnessconfig.NewRegistry(declaration)}
 			worker := startWorker(t, t.Context(), h.s, h.d)
 			defer func() { ctx, cancel := context.WithCancel(context.Background()); cancel(); _ = worker.Run(ctx) }()
 			configuration := json.RawMessage(`{"agent":{"model":"fixture"},"environment":{"type":"` + placement + `","workspace_directory":"/workspace"}}`)
diff --git a/services/core/tests/integration/node_diagnostic_contract_test.go b/services/core/tests/integration/node_diagnostic_contract_test.go
index 88cb7ce96..da595b00c 100644
--- a/services/core/tests/integration/node_diagnostic_contract_test.go
+++ b/services/core/tests/integration/node_diagnostic_contract_test.go
@@ -29,7 +29,7 @@ func TestNodeDiagnosticSchemaContract(t *testing.T) {
 			t.Errorf("%s diagnostic enum = %v, want shared fixture %v", name, values, codes)
 		}
 	}
-	for _, model := range []reflect.Type{reflect.TypeFor[deployment.NodeHealth](), reflect.TypeFor[deployment.NodeRollout]()} {
+	for _, model := range []reflect.Type{reflect.TypeFor[deployment.NodeRollout]()} {
 		field, ok := model.FieldByName("Diagnostic")
 		if !ok {
 			t.Fatalf("%s has no Diagnostic field", model.Name())
@@ -57,7 +57,7 @@ func TestNodeDiagnosticSchemaContract(t *testing.T) {
 		t.Fatal(err)
 	}
 	check("sandbox.NodeDiagnosticCode", document.Definitions["sandbox.NodeDiagnosticCode"].Enum)
-	for _, name := range []string{"deployment.Node", "deployment.NodeDetail", "deployment.NodeRollout"} {
+	for _, name := range []string{"deployment.NodeRollout"} {
 		field := document.Definitions[name].Properties["diagnostic"]
 		ref := field.Ref
 		if len(field.AllOf) == 1 {
diff --git a/services/core/tests/integration/oac_runtime_names_migration_test.go b/services/core/tests/integration/oac_runtime_names_migration_test.go
deleted file mode 100644
index d4d7122c7..000000000
--- a/services/core/tests/integration/oac_runtime_names_migration_test.go
+++ /dev/null
@@ -1,142 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func runtimeNamesMigrationSchema(t *testing.T) (*sql.DB, *goose.Provider) {
-	t.Helper()
-	_, pool := testStore(t)
-	schema := "runtime_names_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(t.Context(), "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(context.Background(), "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err = provider.UpTo(t.Context(), 77); err != nil {
-		t.Fatal(err)
-	}
-	return db, provider
-}
-
-func TestRuntimeNamesMigrationRequiresReleasedAllocationsBothDirections(t *testing.T) {
-	db, provider := runtimeNamesMigrationSchema(t)
-	ctx := t.Context()
-	exec := func(query string, args ...any) {
-		t.Helper()
-		if _, err := db.ExecContext(ctx, query, args...); err != nil {
-			t.Fatal(err)
-		}
-	}
-	read := func(query string) string {
-		t.Helper()
-		var value string
-		if err := db.QueryRowContext(ctx, query).Scan(&value); err != nil {
-			t.Fatal(err)
-		}
-		return value
-	}
-	digest := strings.Repeat("a", 64)
-	oldRef, newRef := "parsar-core-runtime@sha256:"+digest, "oac-runtime@sha256:"+digest
-	specification := `{"runtime":{"microsandbox_ref":"` + oldRef + `","image_id":"sha256:` + digest + `"},"resources":{"cpus":2}}`
-	exec("UPDATE runtime_deployment SET specification=$1", specification)
-	session, tenant, environment, device, allocation := uuid.NewString(), uuid.NewString(), uuid.NewString(), uuid.NewString(), uuid.NewString()
-	exec(`INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash,configuration) VALUES ($1,$2,'codex','old','old','{"history":"parsar_worker /home/runtime/.parsar"}')`, session, tenant)
-	exec("INSERT INTO environments(id,session_id) VALUES ($1,$2)", environment, session)
-	exec("INSERT INTO devices(id,tenant_id,name,credential_hash) VALUES ($1,$2,'old',$3)", device, tenant, digest)
-	exec("INSERT INTO runtime_allocations(id,environment_id,device_id,provider_key) VALUES ($1,$2,$3,$4)", allocation, environment, device, uuid.NewString())
-	history := read("SELECT to_jsonb(s)::text FROM sessions s")
-	for _, direction := range []string{"up", "down"} {
-		before := read("SELECT specification::text FROM runtime_deployment")
-		for _, state := range []string{"creating", "running", "cleanup_pending", "suspended"} {
-			phase, stored := "disabled", state
-			if state == "suspended" {
-				phase, stored = "suspended", "running"
-			}
-			exec("UPDATE runtime_allocations SET state=$1,released_at=NULL,create_settled=true,compute_phase=$2", stored, phase)
-			allocationBefore := read("SELECT to_jsonb(a)::text FROM runtime_allocations a")
-			var err error
-			if direction == "up" {
-				_, err = provider.UpTo(ctx, 78)
-			} else {
-				_, err = provider.DownTo(ctx, 77)
-			}
-			if err == nil || !strings.Contains(err.Error(), "Drain the sandbox deployment") {
-				t.Fatalf("%s with %s allocation did not refuse: %v", direction, state, err)
-			}
-			if got := read("SELECT specification::text FROM runtime_deployment"); got != before {
-				t.Fatal("refused migration changed specification")
-			}
-			if got := read("SELECT to_jsonb(a)::text FROM runtime_allocations a"); got != allocationBefore {
-				t.Fatal("refused migration changed allocation")
-			}
-		}
-		exec("UPDATE runtime_allocations SET state='released',released_at=clock_timestamp(),create_settled=true")
-		released := read("SELECT to_jsonb(a)::text FROM runtime_allocations a")
-		var err error
-		expected := strings.Replace(before, oldRef, newRef, 1)
-		if direction == "up" {
-			_, err = provider.UpTo(ctx, 78)
-		} else {
-			_, err = provider.DownTo(ctx, 77)
-			expected = strings.Replace(before, newRef, oldRef, 1)
-		}
-		if err != nil {
-			t.Fatal("released allocation blocked migration", err)
-		}
-		if got := read("SELECT specification::text FROM runtime_deployment"); got != expected {
-			t.Fatalf("migration changed fields beyond reference: %s", got)
-		}
-		if got := read("SELECT to_jsonb(a)::text FROM runtime_allocations a"); got != released {
-			t.Fatal("migration changed released allocation")
-		}
-		if got := read("SELECT to_jsonb(s)::text FROM sessions s"); got != history {
-			t.Fatal("migration rewrote historical Session content")
-		}
-	}
-}
-
-func TestRuntimeNamesMigrationPreservesAbsentAndOtherReferences(t *testing.T) {
-	db, provider := runtimeNamesMigrationSchema(t)
-	for _, spec := range []string{`{}`, `{"runtime":null}`, `{"runtime":{"microsandbox_ref":"custom-runtime@sha256:` + strings.Repeat("b", 64) + `"}}`} {
-		if _, err := db.ExecContext(t.Context(), "UPDATE runtime_deployment SET specification=$1", spec); err != nil {
-			t.Fatal(err)
-		}
-		for _, up := range []bool{true, false} {
-			var err error
-			if up {
-				_, err = provider.UpTo(t.Context(), 78)
-			} else {
-				_, err = provider.DownTo(t.Context(), 77)
-			}
-			if err != nil {
-				t.Fatal(err)
-			}
-			var equal bool
-			if err = db.QueryRowContext(t.Context(), "SELECT specification=$1::jsonb FROM runtime_deployment", spec).Scan(&equal); err != nil || !equal {
-				t.Fatal("migration changed unrelated reference", err)
-			}
-		}
-	}
-}
diff --git a/services/core/tests/integration/prepared_dispatch_failure_test.go b/services/core/tests/integration/prepared_dispatch_failure_test.go
index 6f486bf47..12c4c0c1f 100644
--- a/services/core/tests/integration/prepared_dispatch_failure_test.go
+++ b/services/core/tests/integration/prepared_dispatch_failure_test.go
@@ -14,7 +14,7 @@ import (
 )
 
 func TestPreparedDispatchSettlesOnlyReadyInput(t *testing.T) {
-	for _, action := range []string{"cancel", "expire", "delete", "prepare-failure", "disconnect"} {
+	for _, action := range []string{"cancel", "expire", "prepare-failure", "disconnect"} {
 		t.Run(action, func(t *testing.T) {
 			h, pending := preparedDispatchHarness(t)
 			_, pool := testStore(t)
@@ -30,13 +30,6 @@ func TestPreparedDispatchSettlesOnlyReadyInput(t *testing.T) {
 				if _, err := pool.Exec(t.Context(), "UPDATE environment_input_reservations SET deadline=clock_timestamp()-interval '1 second' WHERE id=$1", pending.ID); err != nil {
 					t.Fatal(err)
 				}
-			case "delete":
-				if err := sessionService(t, h.s).DeleteSession(t.Context(), sessions.DeleteSessionCommand{TenantID: h.tenant, SessionID: h.session.ID}); !errors.Is(err, sessions.ErrNotIdle) {
-					t.Fatal("pending input deleted", err)
-				}
-				if err := h.s.commitLegacyDeletion(t.Context(), h.tenant, h.session.ID); err != nil {
-					t.Fatal(err)
-				}
 			case "prepare-failure":
 				h.write(frame.ID, proto.TypePreparationStatus, proto.PreparationStatusPayload{Handle: handle, Revision: 2, State: "failed", ErrorCode: "preparation_failed"})
 			case "disconnect":
@@ -57,9 +50,6 @@ func TestPreparedDispatchSettlesOnlyReadyInput(t *testing.T) {
 			} else if got.err == nil {
 				t.Fatal("preparation failure was hidden")
 			}
-			if action == "delete" && !errors.Is(got.err, sessions.ErrNotFound) {
-				t.Fatal("deleted reservation remained accessible", got.err)
-			}
 			if action != "disconnect" {
 				assertPreparationReleased(t, h, frame.ID, handle)
 			}
diff --git a/services/core/tests/integration/prepared_dispatch_test.go b/services/core/tests/integration/prepared_dispatch_test.go
index 08cfbdf04..4f3ac479b 100644
--- a/services/core/tests/integration/prepared_dispatch_test.go
+++ b/services/core/tests/integration/prepared_dispatch_test.go
@@ -94,7 +94,7 @@ func TestPreparedDispatchPromotesOriginalBatchAndPersistsCompletion(t *testing.T
 	h.write(frame.ID, proto.TypePreparationStatus, proto.PreparationStatusPayload{Handle: handle, Revision: 3, State: "started", RunID: start.RunID})
 	steering := h.read(proto.TypePromptSteer)
 	var steer proto.PromptSteerPayload
-	if steering.ID != start.RunID || steering.DecodePayload(&steer) != nil || inputTextForTest(t, steer.Input) != "third" || !steer.DurableReceipt {
+	if steering.ID != start.RunID || steering.DecodePayload(&steer) != nil || inputTextForTest(t, steer.Input) != "third" {
 		t.Fatal("later input bypassed ordinary steering", steer)
 	}
 	h.write(start.RunID, proto.TypePromptSteerAck, proto.PromptSteerAckPayload{InputID: steer.InputID, Accepted: true})
diff --git a/services/core/tests/integration/project_scopes_fixture_test.go b/services/core/tests/integration/project_scopes_fixture_test.go
index 574f876f9..461fab0ed 100644
--- a/services/core/tests/integration/project_scopes_fixture_test.go
+++ b/services/core/tests/integration/project_scopes_fixture_test.go
@@ -13,7 +13,7 @@ import (
 
 var ErrProjectScopeConflict = errors.New("fixture project conflicts with a persisted execution scope")
 
-// EnsureProjectScopes establishes execution scopes for legacy resource fixtures.
+// EnsureProjectScopes establishes execution scopes for resource fixtures.
 func (s *Store) EnsureProjectScopes(ctx context.Context, scopes []identity.ProjectScope) error {
 	validated, err := identity.ProjectScopes(scopes)
 	if err != nil {
diff --git a/services/core/tests/integration/provider_configuration_migration_test.go b/services/core/tests/integration/provider_configuration_migration_test.go
deleted file mode 100644
index 1e9d06f5c..000000000
--- a/services/core/tests/integration/provider_configuration_migration_test.go
+++ /dev/null
@@ -1,83 +0,0 @@
-package integration
-
-import (
-	"bytes"
-	"database/sql"
-	"encoding/json"
-	"os"
-	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/e2b"
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestProviderConfigurationMigrationPreservesCiphertextAndRetainedOwnership(t *testing.T) {
-	s, w, view, input := webSpecificationFixture(t, "e2b")
-	tenant, session := managedArchiveSession(t, s, managerSessionInput(uuid.NewString()))
-	archiveAllocation(t, w, tenant, session, view.InstallationID)
-	input.Configuration.(*e2b.DeploymentConfiguration).Template = "next:" + uuid.NewString()
-	input.ExpectedGeneration = 1
-	if _, err := deploymentExecution(t, w).Update(SandboxResetTestContext(t.Context()), view.InstallationID, input); err != nil {
-		t.Fatal(err)
-	}
-	db := sql.OpenDB(stdlib.GetConnector(*s.pool.Config().ConnConfig))
-	defer db.Close()
-	migration, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err = migration.DownTo(t.Context(), 90); err != nil {
-		t.Fatal(err)
-	}
-	// A valid old record can have only part of its observation populated.
-	if _, err = db.ExecContext(t.Context(), "UPDATE runtime_deployment SET e2b_template_cpus=2"); err != nil {
-		t.Fatal(err)
-	}
-	var before, after []byte
-	var generation int64
-	if err = db.QueryRowContext(t.Context(), "SELECT e2b_credential,generation FROM runtime_deployment").Scan(&before, &generation); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = migration.Up(t.Context()); err != nil {
-		t.Fatal(err)
-	}
-	if err = db.QueryRowContext(t.Context(), "SELECT provider_credential FROM runtime_deployment").Scan(&after); err != nil || !bytes.Equal(before, after) {
-		t.Fatal("ciphertext rewritten", err)
-	}
-	restored, err := deploymentService(t, s).Setup(t.Context())
-	if err != nil || restored.Generation != uint64(generation) || restored.Configuration.(*e2b.DeploymentConfiguration).APIKey != input.Configuration.(*e2b.DeploymentConfiguration).APIKey {
-		t.Fatal("ownership or credential changed", err)
-	}
-	public, err := deploymentService(t, s).View(t.Context())
-	if err != nil {
-		t.Fatal(err)
-	}
-	var metadata struct {
-		TemplateBuild struct {
-			Resources struct {
-				CPUs   *int `json:"cpus"`
-				Memory *int `json:"memory_mib"`
-			} `json:"resources"`
-		} `json:"template_build"`
-	}
-	if err = json.Unmarshal(public.Metadata, &metadata); err != nil || metadata.TemplateBuild.Resources.CPUs == nil || *metadata.TemplateBuild.Resources.CPUs != 2 || metadata.TemplateBuild.Resources.Memory != nil {
-		t.Fatal("partial metadata lost", string(public.Metadata), err)
-	}
-	var retained int
-	if err = db.QueryRowContext(t.Context(), "SELECT count(*) FROM runtime_deployment_generations WHERE generation=1 AND provider_config->>'template'<>$1", input.Configuration.(*e2b.DeploymentConfiguration).Template).Scan(&retained); err != nil || retained != 1 {
-		t.Fatal("retained ownership lost", err)
-	}
-	if _, err = db.ExecContext(t.Context(), "UPDATE runtime_deployment_generations SET provider_config='{}'"); err == nil {
-		t.Fatal("migration removed immutability")
-	}
-	if _, err = migration.DownTo(t.Context(), 90); err != nil {
-		t.Fatal(err)
-	}
-	var cpu int
-	var memory *int
-	if err = db.QueryRowContext(t.Context(), "SELECT e2b_credential,e2b_template_cpus,e2b_template_memory_mib FROM runtime_deployment").Scan(&after, &cpu, &memory); err != nil || !bytes.Equal(before, after) || cpu != 2 || memory != nil {
-		t.Fatal("downgrade lost valid data", err)
-	}
-}
diff --git a/services/core/tests/integration/provider_operations_fixture_test.go b/services/core/tests/integration/provider_operations_fixture_test.go
index 7f207632c..de2cf2e2f 100644
--- a/services/core/tests/integration/provider_operations_fixture_test.go
+++ b/services/core/tests/integration/provider_operations_fixture_test.go
@@ -10,22 +10,24 @@ import (
 
 func (*lifecycleProvider) ProviderOperations() providercontract.Operations {
 	return providercontract.Operations{
-		"Create":            {State: providercontract.Supported},
-		"GetInfo":           {State: providercontract.Supported},
-		"Renew":             {State: providercontract.Supported},
-		"Kill":              {State: providercontract.Supported},
-		"RunCommand":        {State: providercontract.Supported},
-		"Initial":           {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"NewCompute":        {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"RenewCompute":      {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"GetCompute":        {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"Suspend":           {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"Resume":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"KillCompute":       {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"DeleteRetained":    {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"RunCommandCompute": {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"ResumeCompute":     {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
-		"Observe":           {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Create":             {State: providercontract.Supported},
+		"GetInfo":            {State: providercontract.Supported},
+		"Renew":              {State: providercontract.Supported},
+		"Kill":               {State: providercontract.Supported},
+		"RunCommand":         {State: providercontract.Supported},
+		"Initial":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"NewCompute":         {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"RenewCompute":       {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"GetCompute":         {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Suspend":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Resume":             {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"KillCompute":        {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"DeleteRetained":     {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"RunCommandCompute":  {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"ResumeCompute":      {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"RestorePreparation": {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"SavePreparation":    {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Observe":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
 	}
 }
 func (*lifecycleProvider) Initial(context.Context, sandbox.Reference) (sandbox.Compute, error) {
@@ -60,25 +62,33 @@ func (*lifecycleProvider) Observe(context.Context, runtimeobs.Target) (runtimeob
 }
 func (*fakeSuspensionProvider) ProviderOperations() providercontract.Operations {
 	return providercontract.Operations{
-		"Create":            {State: providercontract.Supported},
-		"GetInfo":           {State: providercontract.Supported},
-		"Renew":             {State: providercontract.Supported},
-		"Kill":              {State: providercontract.Supported},
-		"RunCommand":        {State: providercontract.Supported},
-		"Initial":           {State: providercontract.Supported},
-		"NewCompute":        {State: providercontract.Supported},
-		"RenewCompute":      {State: providercontract.Supported},
-		"GetCompute":        {State: providercontract.Supported},
-		"Suspend":           {State: providercontract.Supported},
-		"Resume":            {State: providercontract.Supported},
-		"KillCompute":       {State: providercontract.Supported},
-		"DeleteRetained":    {State: providercontract.Supported},
-		"RunCommandCompute": {State: providercontract.Supported},
-		"ResumeCompute":     {State: providercontract.Supported},
-		"Observe":           {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Create":             {State: providercontract.Supported},
+		"GetInfo":            {State: providercontract.Supported},
+		"Renew":              {State: providercontract.Supported},
+		"Kill":               {State: providercontract.Supported},
+		"RunCommand":         {State: providercontract.Supported},
+		"Initial":            {State: providercontract.Supported},
+		"NewCompute":         {State: providercontract.Supported},
+		"RenewCompute":       {State: providercontract.Supported},
+		"GetCompute":         {State: providercontract.Supported},
+		"Suspend":            {State: providercontract.Supported},
+		"Resume":             {State: providercontract.Supported},
+		"KillCompute":        {State: providercontract.Supported},
+		"DeleteRetained":     {State: providercontract.Supported},
+		"RunCommandCompute":  {State: providercontract.Supported},
+		"ResumeCompute":      {State: providercontract.Supported},
+		"RestorePreparation": {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"SavePreparation":    {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
+		"Observe":            {State: providercontract.Unsupported, Reason: "fixture_operation_not_supported"},
 	}
 }
 
 func (*lifecycleProvider) RenewCompute(context.Context, sandbox.Reference, sandbox.Compute) (sandbox.ComputeState, error) {
 	return sandbox.ComputeState{}, &providercontract.UnsupportedError{Operation: "RenewCompute", Reason: "fixture_operation_not_supported"}
 }
+func (*lifecycleProvider) RestorePreparation(context.Context, sandbox.Reference, string) (bool, error) {
+	return false, &providercontract.UnsupportedError{Operation: "RestorePreparation", Reason: "fixture_operation_not_supported"}
+}
+func (*lifecycleProvider) SavePreparation(context.Context, sandbox.Reference, string) error {
+	return &providercontract.UnsupportedError{Operation: "SavePreparation", Reason: "fixture_operation_not_supported"}
+}
diff --git a/services/core/tests/integration/provider_registration_migration_test.go b/services/core/tests/integration/provider_registration_migration_test.go
deleted file mode 100644
index 1f10e1aea..000000000
--- a/services/core/tests/integration/provider_registration_migration_test.go
+++ /dev/null
@@ -1,59 +0,0 @@
-package integration
-
-import (
-	"database/sql"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/e2b"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestProviderRegistrationDowngradePreservesCustomEndpoints(t *testing.T) {
-	s, w, view, input := webSpecificationFixture(t, "e2b")
-	tenant, session := managedArchiveSession(t, s, managerSessionInput(uuid.NewString()))
-	archiveAllocation(t, w, tenant, session, view.InstallationID)
-	input.Configuration.(*e2b.DeploymentConfiguration).APIURL, input.Configuration.(*e2b.DeploymentConfiguration).Domain = "https://api.example.test", "example.test"
-	input.ExpectedGeneration = view.Generation
-	if _, err := deploymentExecution(t, w).Update(SandboxResetTestContext(t.Context()), view.InstallationID, input); err != nil {
-		t.Fatal(err)
-	}
-	tenant, session = managedArchiveSession(t, s, managerSessionInput(uuid.NewString()))
-	archiveAllocation(t, w, tenant, session, view.InstallationID)
-	input.Configuration.(*e2b.DeploymentConfiguration).Template = "next:" + uuid.NewString()
-	input.ExpectedGeneration = 2
-	if _, err := deploymentExecution(t, w).Update(SandboxResetTestContext(t.Context()), view.InstallationID, input); err != nil {
-		t.Fatal(err)
-	}
-	// Exercise the historical migration with the target schema's disabled
-	// suspension policy, independently of the current provider defaults.
-	db := sql.OpenDB(stdlib.GetConnector(*s.pool.Config().ConnConfig))
-	defer db.Close()
-	migrations, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := migrations.DownTo(t.Context(), 88); err != nil {
-		t.Fatal(err)
-	}
-	for generation, want := range map[int]string{1: "", 2: input.Configuration.(*e2b.DeploymentConfiguration).APIURL} {
-		var endpoint string
-		if err := db.QueryRowContext(t.Context(), "SELECT e2b_api_url FROM runtime_deployment_generations WHERE generation=$1", generation).Scan(&endpoint); err != nil || endpoint != want {
-			t.Fatal("downgrade changed endpoint identity", generation, endpoint, err)
-		}
-	}
-	var endpoint string
-	if err := db.QueryRowContext(t.Context(), "SELECT e2b_api_url FROM runtime_deployment").Scan(&endpoint); err != nil || endpoint != input.Configuration.(*e2b.DeploymentConfiguration).APIURL {
-		t.Fatal("downgrade changed current endpoint", endpoint, err)
-	}
-	if _, err := db.ExecContext(t.Context(), "UPDATE runtime_deployment_generations SET e2b_domain='changed.test' WHERE generation=1"); err == nil || !strings.Contains(err.Error(), "Retained sandbox specifications are immutable") {
-		t.Fatal("downgrade left specifications mutable", err)
-	}
-	if _, err := migrations.DownTo(t.Context(), 86); err == nil || !strings.Contains(err.Error(), "custom endpoint is retained") {
-		t.Fatal("downgrade discarded a custom endpoint", err)
-	}
-}
diff --git a/services/core/tests/integration/public_execution_test.go b/services/core/tests/integration/public_execution_test.go
index e52ee9dc5..8dcfc4b46 100644
--- a/services/core/tests/integration/public_execution_test.go
+++ b/services/core/tests/integration/public_execution_test.go
@@ -23,7 +23,7 @@ func publicSession(t *testing.T, h *dispatchHarness, key string) sessions.Sessio
 
 func TestExecutionWorkerAdmissionBindingAndRecovery(t *testing.T) {
 	h := newDispatchHarness(t)
-	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, WebSearchControl: proto.CapabilitySupported, TextVerbosity: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, Preparation: proto.CapabilitySupported})}}})
+	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, Preparation: proto.CapabilitySupported})}}})
 	h.session = publicSession(t, h, "public")
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -60,7 +60,7 @@ func TestExecutionWorkerAdmissionBindingAndRecovery(t *testing.T) {
 	if err := request.DecodePayload(&prompt); err != nil {
 		t.Fatal(err)
 	}
-	if inputTextForTest(t, prompt.Input) != "First\n\nSecond" || !prompt.DisableExecutionEnvironment || !prompt.DisableSubagents || prompt.ExecutionControls == nil || *prompt.ExecutionControls != (proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}) || prompt.AgentOptions["web_search"] != nil || prompt.AgentOptions["model_verbosity"] != nil {
+	if inputTextForTest(t, prompt.Input) != "First\n\nSecond" || !prompt.DisableExecutionEnvironment || !prompt.DisableSubagents || prompt.ExecutionControls == nil || *prompt.ExecutionControls != (proto.ExecutionControls{TextVerbosity: "medium"}) || prompt.AgentOptions["web_search"] != nil || prompt.AgentOptions["model_verbosity"] != nil {
 		t.Fatal(prompt)
 	}
 	bound, err := sessionAdapter(h.s).GetSessionDevice(ctx, h.tenant, h.session.ID)
diff --git a/services/core/tests/integration/public_url_migration_test.go b/services/core/tests/integration/public_url_migration_test.go
deleted file mode 100644
index d2e6e522d..000000000
--- a/services/core/tests/integration/public_url_migration_test.go
+++ /dev/null
@@ -1,102 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-// publicURLMigrationSchema migrates an isolated schema up to version 74.
-func publicURLMigrationSchema(t *testing.T) (*sql.DB, *goose.Provider) {
-	t.Helper()
-	_, pool := testStore(t)
-	ctx := t.Context()
-	schema := "public_url_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(ctx, "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(context.Background(), "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 74); err != nil {
-		t.Fatal(err)
-	}
-	return db, provider
-}
-
-// The deployment's saved Core address moves to each node it enrolled, and a
-// rollback takes it back from them.
-func TestPublicURLMigrationMovesTheAddressToNodes(t *testing.T) {
-	ctx := t.Context()
-	db, provider := publicURLMigrationSchema(t)
-	installation, active, removed := uuid.NewString(), uuid.NewString(), uuid.NewString()
-	if _, err := db.ExecContext(ctx, `UPDATE runtime_deployment SET installation_id=$1, web_managed=true, provider_kind='docker', mode='nodes', generation=1,
-		core_url='https://core.example', backend_fingerprint=$2`, installation, strings.Repeat("a", 64)); err != nil {
-		t.Fatal(err)
-	}
-	for _, node := range []struct {
-		id      string
-		removed bool
-	}{{active, false}, {removed, true}} {
-		if _, err := db.ExecContext(ctx, `INSERT INTO runtime_nodes(id,installation_id,name,backend_fingerprint,credential_sha256,max_active,max_retained,removed_at)
-			VALUES ($1,$2,'node',$3,$4,2,8,CASE WHEN $5 THEN clock_timestamp() END)`, node.id, installation, strings.Repeat("a", 64), strings.Repeat("c", 64), node.removed); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if _, err := provider.UpTo(ctx, 75); err != nil {
-		t.Fatal(err)
-	}
-	address := func(id string) string {
-		t.Helper()
-		var value string
-		if err := db.QueryRowContext(ctx, "SELECT core_url FROM runtime_nodes WHERE id=$1", id).Scan(&value); err != nil {
-			t.Fatal(err)
-		}
-		return value
-	}
-	if address(active) != "https://core.example" || address(removed) != "" {
-		t.Fatal("migration did not record the enrolled address on the active node only")
-	}
-	if _, err := provider.DownTo(ctx, 74); err != nil {
-		t.Fatal(err)
-	}
-	var restored string
-	if err := db.QueryRowContext(ctx, "SELECT core_url FROM runtime_deployment").Scan(&restored); err != nil || restored != "https://core.example" {
-		t.Fatal("rollback lost the deployment address", restored, err)
-	}
-}
-
-// An E2B deployment has no node to take its address back from, so the
-// rollback refuses instead of leaving the deployment without one.
-func TestPublicURLMigrationRollbackRefusesE2B(t *testing.T) {
-	ctx := t.Context()
-	db, provider := publicURLMigrationSchema(t)
-	if _, err := db.ExecContext(ctx, `UPDATE runtime_deployment SET installation_id=$1, web_managed=true, provider_kind='e2b', mode='direct', generation=1,
-		core_url='https://core.example', backend_fingerprint=$2, e2b_template='runtime:build', e2b_credential='\x01'`, uuid.NewString(), strings.Repeat("a", 64)); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 75); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.DownTo(ctx, 74); err == nil || !strings.Contains(err.Error(), "Cannot restore the sandbox deployment Core address") {
-		t.Fatal("rollback discarded the E2B deployment address", err)
-	}
-}
diff --git a/services/core/tests/integration/root_fixture_test.go b/services/core/tests/integration/root_fixture_test.go
index a29b67530..4d4367215 100644
--- a/services/core/tests/integration/root_fixture_test.go
+++ b/services/core/tests/integration/root_fixture_test.go
@@ -8,6 +8,7 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/jackc/pgx/v5/pgxpool"
 
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/builtin"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/credentialcrypto"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/db/sqlc"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment/placement"
@@ -60,12 +61,15 @@ func (s *Store) CreateSession(ctx context.Context, tenant string, input sessions
 }
 
 // createSession runs Session creation as cmd/server does, on s's database,
-// credential key and placement rules.
+// credential key and placement rules, with the built-in Harness declarations.
 func createSession(ctx context.Context, s *Store, tenant string, input sessions.CreateSession) (sessions.Creation, error) {
 	service, err := newSessionService(s)
 	if err != nil {
 		return sessions.Creation{}, err
 	}
+	if declaration, ok := builtin.Registry().Lookup(input.Engine); ok {
+		input.SupportsRetainedNativeHistory = declaration.Capabilities.RetainedNativeHistory.IsSupported()
+	}
 	return service.CreateSession(ctx, tenant, input)
 }
 
diff --git a/services/core/tests/integration/runtime_compute_lifecycle_test.go b/services/core/tests/integration/runtime_compute_lifecycle_test.go
index ce3a1cde3..25751e698 100644
--- a/services/core/tests/integration/runtime_compute_lifecycle_test.go
+++ b/services/core/tests/integration/runtime_compute_lifecycle_test.go
@@ -196,7 +196,7 @@ func (p *fakeSuspensionProvider) connect(ctx context.Context, b sandbox.Bootstra
 	if err != nil {
 		return err
 	}
-	heartbeat, _ := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}}})
+	heartbeat, _ := proto.NewEnvelope(proto.TypeHeartbeat, "", proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{RetainedNativeHistory: proto.CapabilitySupported})}}})
 	if err := conn.WriteJSON(heartbeat); err != nil {
 		conn.Close()
 		return err
diff --git a/services/core/tests/integration/runtime_lifecycle_nodes_test.go b/services/core/tests/integration/runtime_lifecycle_nodes_test.go
index b87368a27..e8ecfa47c 100644
--- a/services/core/tests/integration/runtime_lifecycle_nodes_test.go
+++ b/services/core/tests/integration/runtime_lifecycle_nodes_test.go
@@ -16,7 +16,7 @@ import (
 func lifecycleTestNode(t *testing.T, s *Store) string {
 	t.Helper()
 	nodes := deploymentService(t, s)
-	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 100, MaxRetained: 100}))
+	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(100), MaxRetained: new(100)}))
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/tests/integration/runtime_node_capacity_test.go b/services/core/tests/integration/runtime_node_capacity_test.go
index c53bc8c00..2e52f89f2 100644
--- a/services/core/tests/integration/runtime_node_capacity_test.go
+++ b/services/core/tests/integration/runtime_node_capacity_test.go
@@ -16,10 +16,10 @@ func TestRuntimeEnrollmentCapacityPrecedesResetConflict(t *testing.T) {
 	if err := deploymentExecution(t, w).StartReset(SandboxResetTestContext(t.Context()), view.InstallationID, deployment.ResetRequest{ExpectedGeneration: view.Generation, Clear: "auto"}); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := nodes.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 1, MaxRetained: 3}); !errors.Is(err, deployment.ErrResetInProgress) {
+	if _, err := nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: new(3)}); !errors.Is(err, deployment.ErrResetInProgress) {
 		t.Fatal("valid capacity did not reach the reset guard", err)
 	}
-	if _, err := nodes.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 3, MaxRetained: 2}); !errors.Is(err, deployment.ErrInvalidInput) {
+	if _, err := nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(3), MaxRetained: new(2)}); !errors.Is(err, deployment.ErrInvalidInput) {
 		t.Fatal("invalid capacity reported as a conflict", err)
 	}
 }
diff --git a/services/core/tests/integration/runtime_node_generations_test.go b/services/core/tests/integration/runtime_node_generations_test.go
index 3197a00c7..9a8a5e86a 100644
--- a/services/core/tests/integration/runtime_node_generations_test.go
+++ b/services/core/tests/integration/runtime_node_generations_test.go
@@ -33,7 +33,7 @@ func generationHeartbeat(t *testing.T, s *Store, node deployment.Enrollment, con
 	if state == "ready" && view.Provider == "microsandbox" {
 		status.Checkpoint = &sandbox.CheckpointCompatibility{ArtifactDomain: "fixture-store", ExecutionClass: "fixture-runtime"}
 	}
-	err := deploymentService(t, s).HeartbeatGenerations(t.Context(), node.NodeID, connection, view.OwnerEpoch, deployment.NodeHealth{}, []sandbox.GenerationStatus{status})
+	err := deploymentService(t, s).Heartbeat(t.Context(), node.NodeID, connection, view.OwnerEpoch, deployment.NodeHealth{}, []sandbox.GenerationStatus{status})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -67,7 +67,7 @@ func TestNodeGenerationsCapacityFallbackAndImmutablePending(t *testing.T) {
 				t.Fatal(err)
 			}
 			pendingNode, pendingGeneration := placedGeneration(t, s, w, pending)
-			token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 1, MaxRetained: 2}))
+			token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(1), MaxRetained: new(2)}))
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -146,24 +146,24 @@ func TestNodeGenerationsCapacityFallbackAndImmutablePending(t *testing.T) {
 	}
 }
 
-func TestNodeGenerationsReconnectAndV1Fallback(t *testing.T) {
+func TestNodeGenerationsReconnectKeepsServingPin(t *testing.T) {
 	s, w, first, input := webSpecificationFixture(t, "docker")
 	service := deploymentService(t, s)
 	node := specificationNode(t, s, first)
 	old := onlineManagerNode(t, s, node.NodeID)
 	second, _ := changeNodeTarget(t, w, first, input)
 	nodes, err := service.ListNodes(t.Context())
-	if err != nil || !nodes[0].ProviderReady || nodes[0].Rollout.State != "update_required" {
+	if err != nil || !nodes[0].ProviderReady || nodes[0].Rollout.State != "unknown" {
 		t.Fatal(nodes, err)
 	}
 	if _, err = s.CreateSession(t.Context(), uuid.NewString(), managerSessionInput(uuid.NewString())); err != nil {
-		t.Fatal("v1 lost fallback", err)
+		t.Fatal("serving pin lost fallback", err)
 	}
 	connection := uuid.NewString()
 	if err = service.ConnectNode(t.Context(), node.NodeID, connection, first.OwnerEpoch); err != nil {
 		t.Fatal(err)
 	}
-	if err = service.HeartbeatGenerations(t.Context(), node.NodeID, old, first.OwnerEpoch, deployment.NodeHealth{}, []sandbox.GenerationStatus{{Generation: second.Generation, SpecificationDigest: second.SpecificationDigest, State: "ready"}}); !errors.Is(err, deployment.ErrNodeCredential) {
+	if err = service.Heartbeat(t.Context(), node.NodeID, old, first.OwnerEpoch, deployment.NodeHealth{}, []sandbox.GenerationStatus{{Generation: second.Generation, SpecificationDigest: second.SpecificationDigest, State: "ready"}}); !errors.Is(err, deployment.ErrNodeCredential) {
 		t.Fatal("old connection qualified", err)
 	}
 	nodes, err = service.ListNodes(t.Context())
@@ -177,11 +177,11 @@ func TestNodeGenerationsReconnectAndV1Fallback(t *testing.T) {
 	if err := reserveSessionPlacement(t, s, w, queued); !errors.Is(err, placement.ErrNodeUnavailable) {
 		t.Fatal("unconfirmed connection admitted", err)
 	}
-	if err = service.Heartbeat(t.Context(), node.NodeID, connection, first.OwnerEpoch, deployment.NodeHealth{ProviderReady: true}, nil); err != nil {
+	if err = fixtureNodeHeartbeat(t.Context(), s, service, node.NodeID, connection, first.OwnerEpoch, true); err != nil {
 		t.Fatal(err)
 	}
 	if _, err = s.CreateSession(t.Context(), uuid.NewString(), managerSessionInput(uuid.NewString())); err != nil {
-		t.Fatal("fresh v1 readiness did not restore fallback", err)
+		t.Fatal("fresh pin readiness did not restore fallback", err)
 	}
 }
 
diff --git a/services/core/tests/integration/runtime_node_lifecycle_fixture_test.go b/services/core/tests/integration/runtime_node_lifecycle_fixture_test.go
index 0ed9234d9..1ae29326f 100644
--- a/services/core/tests/integration/runtime_node_lifecycle_fixture_test.go
+++ b/services/core/tests/integration/runtime_node_lifecycle_fixture_test.go
@@ -134,7 +134,7 @@ func newNodeIsolationFixture(t *testing.T, mode string) *nodeIsolationFixture {
 }
 func (f *nodeIsolationFixture) enroll(id string) {
 	f.t.Helper()
-	token, err := EnrollmentTestToken(f.nodes.CreateEnrollment(f.t.Context(), deployment.Capacity{MaxActive: 100, MaxRetained: 100}))
+	token, err := EnrollmentTestToken(f.nodes.CreateEnrollment(f.t.Context(), deployment.EnrollmentLimits{MaxActive: new(100), MaxRetained: new(100)}))
 	if err != nil {
 		f.t.Fatal(err)
 	}
@@ -149,7 +149,7 @@ func (f *nodeIsolationFixture) online(id string) {
 	if err := f.nodes.ConnectNode(f.t.Context(), id, connection, f.epoch); err != nil {
 		f.t.Fatal(err)
 	}
-	if err := fixtureNodeHeartbeat(f.t.Context(), f.store, f.nodes, id, connection, f.epoch, deployment.NodeHealth{ProviderReady: true}); err != nil {
+	if err := fixtureNodeHeartbeat(f.t.Context(), f.store, f.nodes, id, connection, f.epoch, true); err != nil {
 		f.t.Fatal(err)
 	}
 }
@@ -161,12 +161,12 @@ func (f *nodeIsolationFixture) session(node string, initialize bool) (string, se
 		input.InitialFiles = []environmentconfig.InitialFile{{Type: "inline", Path: "/workspace/seed", Data: []byte("retained")}}
 	}
 	// Placement is automatic and generation readiness is current-connection
-	// authority. Do not merely change the legacy provider_ready projection.
+	// authority. Do not merely change the provider_ready projection.
 	type presence struct {
 		id, connection string
 		epoch          uint64
 	}
-	rows, err := f.pool.Query(f.t.Context(), "SELECT id::text, connection_id::text, connected_epoch FROM runtime_nodes WHERE provider_ready AND id<>$1 AND connection_id IS NOT NULL AND removed_at IS NULL", node)
+	rows, err := f.pool.Query(f.t.Context(), "SELECT id::text, connection_id::text, connected_epoch FROM runtime_nodes WHERE id<>$1 AND connection_id IS NOT NULL AND removed_at IS NULL", node)
 	if err != nil {
 		f.t.Fatal(err)
 	}
@@ -184,7 +184,7 @@ func (f *nodeIsolationFixture) session(node string, initialize bool) (string, se
 		f.t.Fatal(err)
 	}
 	for _, value := range others {
-		if err := fixtureNodeHeartbeat(f.t.Context(), f.store, f.nodes, value.id, value.connection, value.epoch, deployment.NodeHealth{ProviderReady: false}); err != nil {
+		if err := fixtureNodeHeartbeat(f.t.Context(), f.store, f.nodes, value.id, value.connection, value.epoch, false); err != nil {
 			f.t.Fatal(err)
 		}
 	}
@@ -193,7 +193,7 @@ func (f *nodeIsolationFixture) session(node string, initialize bool) (string, se
 		_, err = f.placement.EnsurePlacement(f.t.Context(), deployment.AllocationKey{TenantID: tenant, EnvironmentID: session.Environment.ID}, f.key)
 	}
 	for _, value := range others {
-		if err := fixtureNodeHeartbeat(context.WithoutCancel(f.t.Context()), f.store, f.nodes, value.id, value.connection, value.epoch, deployment.NodeHealth{ProviderReady: true}); err != nil {
+		if err := fixtureNodeHeartbeat(context.WithoutCancel(f.t.Context()), f.store, f.nodes, value.id, value.connection, value.epoch, true); err != nil {
 			f.t.Fatal(err)
 		}
 	}
diff --git a/services/core/tests/integration/runtime_nodes_test.go b/services/core/tests/integration/runtime_nodes_test.go
index 2d83b955e..ad231d148 100644
--- a/services/core/tests/integration/runtime_nodes_test.go
+++ b/services/core/tests/integration/runtime_nodes_test.go
@@ -34,7 +34,7 @@ func onlineManagerNode(t *testing.T, s *Store, id string) string {
 	if err := nodes.ConnectNode(t.Context(), id, connection, managerEpoch(t, s)); err != nil {
 		t.Fatal(err)
 	}
-	if err := fixtureNodeHeartbeat(t.Context(), s, nodes, id, connection, managerEpoch(t, s), deployment.NodeHealth{ProviderReady: true}); err != nil {
+	if err := fixtureNodeHeartbeat(t.Context(), s, nodes, id, connection, managerEpoch(t, s), true); err != nil {
 		t.Fatal(err)
 	}
 	return connection
@@ -53,7 +53,7 @@ func createSessionOnNode(t *testing.T, s, w *Store, tenant string, input session
 		id, connection string
 		epoch          uint64
 	}
-	rows, err := s.pool.Query(t.Context(), "SELECT id::text, connection_id::text, connected_epoch FROM runtime_nodes WHERE provider_ready AND id<>$1 AND connection_id IS NOT NULL AND removed_at IS NULL", node)
+	rows, err := s.pool.Query(t.Context(), "SELECT id::text, connection_id::text, connected_epoch FROM runtime_nodes WHERE id<>$1 AND connection_id IS NOT NULL AND removed_at IS NULL", node)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -72,13 +72,13 @@ func createSessionOnNode(t *testing.T, s, w *Store, tenant string, input session
 	}
 	nodes := deploymentService(t, s)
 	for _, value := range others {
-		if err := fixtureNodeHeartbeat(t.Context(), s, nodes, value.id, value.connection, value.epoch, deployment.NodeHealth{ProviderReady: false}); err != nil {
+		if err := fixtureNodeHeartbeat(t.Context(), s, nodes, value.id, value.connection, value.epoch, false); err != nil {
 			t.Fatal(err)
 		}
 	}
 	defer func() {
 		for _, value := range others {
-			if err := fixtureNodeHeartbeat(context.WithoutCancel(t.Context()), s, nodes, value.id, value.connection, value.epoch, deployment.NodeHealth{ProviderReady: true}); err != nil {
+			if err := fixtureNodeHeartbeat(context.WithoutCancel(t.Context()), s, nodes, value.id, value.connection, value.epoch, true); err != nil {
 				t.Fatal(err)
 			}
 		}
@@ -229,7 +229,7 @@ func TestRuntimeNodesAtomicPlacementAndRetry(t *testing.T) {
 func TestRuntimeNodesEnrollmentAndEpoch(t *testing.T) {
 	s, w, d := managerFixture(t, 2, 4)
 	nodes := deploymentService(t, s)
-	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 2, MaxRetained: 4}))
+	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(2), MaxRetained: new(4)}))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -268,7 +268,7 @@ func TestRuntimeNodesEnrollmentAndEpoch(t *testing.T) {
 	if next := managerEpoch(t, s); next != epoch+1 {
 		t.Fatal(next)
 	}
-	if err := fixtureNodeHeartbeat(t.Context(), s, nodes, input.NodeID, connection, epoch, deployment.NodeHealth{ProviderReady: true}); !errors.Is(err, deployment.ErrNodeCredential) {
+	if err := fixtureNodeHeartbeat(t.Context(), s, nodes, input.NodeID, connection, epoch, true); !errors.Is(err, deployment.ErrNodeCredential) {
 		t.Fatal("old epoch heartbeat revived node", err)
 	}
 	queued, err := s.CreateSession(t.Context(), uuid.NewString(), managerSessionInput("stale"))
diff --git a/services/core/tests/integration/sandbox_deployment_audit_http_test.go b/services/core/tests/integration/sandbox_deployment_audit_http_test.go
index 1f2ee5ba7..09890735f 100644
--- a/services/core/tests/integration/sandbox_deployment_audit_http_test.go
+++ b/services/core/tests/integration/sandbox_deployment_audit_http_test.go
@@ -38,7 +38,7 @@ func TestSandboxDeploymentUpdateHTTPCommitsWithAdministratorAudit(t *testing.T)
 		t.Helper()
 		resources := input.Resources
 		resources.CPUs = cpus
-		body, err := json.Marshal(map[string]any{"expected_generation": generation, "provider": "docker", "configuration": map[string]any{}, "resources": resources, "runtime": input.Runtime})
+		body, err := json.Marshal(map[string]any{"expected_generation": generation, "provider": "docker", "configuration": map[string]any{}, "resources": resources})
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/services/core/tests/integration/sandbox_deployment_switch_test.go b/services/core/tests/integration/sandbox_deployment_switch_test.go
index e1f96a4e4..00216b66f 100644
--- a/services/core/tests/integration/sandbox_deployment_switch_test.go
+++ b/services/core/tests/integration/sandbox_deployment_switch_test.go
@@ -91,7 +91,7 @@ func TestSandboxDirectDeploymentOwnershipAndCleanSwitch(t *testing.T) {
 	if err != nil || setup.Configuration.(*e2b.DeploymentConfiguration).APIKey != input.Configuration.(*e2b.DeploymentConfiguration).APIKey {
 		t.Fatal("internal credential unavailable", err)
 	}
-	if _, err := deploymentService(t, s).CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 2, MaxRetained: 8}); !errors.Is(err, deployment.ErrConflict) {
+	if _, err := deploymentService(t, s).CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(2), MaxRetained: new(8)}); !errors.Is(err, deployment.ErrConflict) {
 		t.Fatal("cloud enrolled a machine", err)
 	}
 	tenant := uuid.NewString()
@@ -155,7 +155,7 @@ func TestSandboxSwitchRetiresNodesAndEnrollment(t *testing.T) {
 	if _, err := changes.Initialize(t.Context(), id, sandbox.Selection{DeploymentSpec: SandboxDeploymentTestSpec("docker"), Provider: "docker"}); err != nil {
 		t.Fatal(err)
 	}
-	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 2, MaxRetained: 4}))
+	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(2), MaxRetained: new(4)}))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -163,7 +163,7 @@ func TestSandboxSwitchRetiresNodesAndEnrollment(t *testing.T) {
 	if _, err := nodes.Enroll(t.Context(), token, node); err != nil {
 		t.Fatal(err)
 	}
-	unused, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 2, MaxRetained: 8}))
+	unused, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(2), MaxRetained: new(8)}))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -355,7 +355,7 @@ func TestUnspecifiedNodeDeploymentRejectedWithoutMutation(t *testing.T) {
 	if _, err := changes.Initialize(t.Context(), id, selection); err != nil {
 		t.Fatal(err)
 	}
-	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 2, MaxRetained: 4}))
+	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(2), MaxRetained: new(4)}))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -382,7 +382,7 @@ func TestUnspecifiedNodeDeploymentRejectedWithoutMutation(t *testing.T) {
 	if _, err := s.CreateSession(t.Context(), uuid.NewString(), managerSessionInput(uuid.NewString())); !errors.Is(err, placement.ErrAdmissionClosed) {
 		t.Fatal("unspecified deployment admitted a fresh sandbox", err)
 	}
-	if _, err := nodes.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 2, MaxRetained: 4}); !errors.Is(err, deployment.ErrConflict) {
+	if _, err := nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(2), MaxRetained: new(4)}); !errors.Is(err, deployment.ErrConflict) {
 		t.Fatal("unspecified deployment issued an enrollment token", err)
 	}
 
diff --git a/services/core/tests/integration/sandbox_deployment_switch_worker_test.go b/services/core/tests/integration/sandbox_deployment_switch_worker_test.go
index 212751f8c..bb4e39edd 100644
--- a/services/core/tests/integration/sandbox_deployment_switch_worker_test.go
+++ b/services/core/tests/integration/sandbox_deployment_switch_worker_test.go
@@ -67,7 +67,7 @@ func TestSandboxWorkerSwitchesAndRecoversFailedActivation(t *testing.T) {
 	if _, err := w.InitializeSandboxDeployment(t.Context(), sandbox.Selection{DeploymentSpec: SandboxDeploymentTestSpec("docker"), Provider: "docker"}); err == nil || preparations.Load() != prepared {
 		t.Fatal("stale identical POST reached provider preparation", err)
 	}
-	enrollment, err := EnrollmentTestToken(deployments.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 2, MaxRetained: 4}))
+	enrollment, err := EnrollmentTestToken(deployments.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(2), MaxRetained: new(4)}))
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/tests/integration/sandbox_deployment_worker_test.go b/services/core/tests/integration/sandbox_deployment_worker_test.go
index 528a351c1..e67932b5f 100644
--- a/services/core/tests/integration/sandbox_deployment_worker_test.go
+++ b/services/core/tests/integration/sandbox_deployment_worker_test.go
@@ -57,7 +57,7 @@ func TestSandboxDeploymentWorkerActivatesWithoutRestart(t *testing.T) {
 	if _, err := w.ProvisionEnvironment(t.Context(), queued.TenantID, queued.Environment.ID, id); !errors.Is(err, placement.ErrNodeUnavailable) {
 		t.Fatal("zero-node deployment provisioned compute", err)
 	}
-	token, err := EnrollmentTestToken(deployments.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 4, MaxRetained: 16}))
+	token, err := EnrollmentTestToken(deployments.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(4), MaxRetained: new(16)}))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -72,7 +72,7 @@ func TestSandboxDeploymentWorkerActivatesWithoutRestart(t *testing.T) {
 		if err := deployments.ConnectNode(t.Context(), nodeID, connection, epoch); err != nil {
 			t.Fatal(err)
 		}
-		if err := deployments.Heartbeat(t.Context(), nodeID, connection, epoch, deployment.NodeHealth{ProviderReady: true}, nil); err != nil {
+		if err := fixtureNodeHeartbeat(t.Context(), s, deployments, nodeID, connection, epoch, true); err != nil {
 			t.Fatal(err)
 		}
 	}
diff --git a/services/core/tests/integration/sandbox_generations_test.go b/services/core/tests/integration/sandbox_generations_test.go
index 9932151e8..8ee2ea69a 100644
--- a/services/core/tests/integration/sandbox_generations_test.go
+++ b/services/core/tests/integration/sandbox_generations_test.go
@@ -1,17 +1,12 @@
 package integration
 
 import (
-	"database/sql"
-	"os"
-	"strings"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/e2b"
 	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
 )
 
 func TestE2BGenerationsRetainOwnershipAndUseCurrentCredential(t *testing.T) {
@@ -150,105 +145,6 @@ func TestPendingPlacementGenerationSurvivesRepeatedUpdates(t *testing.T) {
 	}
 }
 
-func TestGenerationMigrationBackfillsAndRejectsLossyDowngrade(t *testing.T) {
-	db, migrations := runtimeNamesMigrationSchema(t)
-	ctx := t.Context()
-	if _, err := migrations.UpTo(ctx, 80); err != nil {
-		t.Fatal(err)
-	}
-	installation, node := uuid.NewString(), uuid.NewString()
-	if _, err := db.ExecContext(ctx, `UPDATE runtime_deployment SET installation_id=$1,backend_fingerprint=repeat('a',64),provider_kind='docker',mode='nodes',generation=1`, installation); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, `INSERT INTO runtime_nodes(id,installation_id,name,backend_fingerprint,credential_sha256,max_active,max_retained,deployment_generation) VALUES($1,$2,'old',repeat('a',64),repeat('b',64),1,1,1)`, node, installation); err != nil {
-		t.Fatal(err)
-	}
-	session, tenant, environment, device, allocation := uuid.NewString(), uuid.NewString(), uuid.NewString(), uuid.NewString(), uuid.NewString()
-	exec := func(query string, args ...any) {
-		t.Helper()
-		if _, err := db.ExecContext(ctx, query, args...); err != nil {
-			t.Fatal(err)
-		}
-	}
-	exec(`INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash,configuration) VALUES($1,$2,'codex','old','old','{}')`, session, tenant)
-	exec(`INSERT INTO environments(id,session_id) VALUES($1,$2)`, environment, session)
-	exec(`INSERT INTO devices(id,tenant_id,name,credential_hash) VALUES($1,$2,'old',repeat('b',64))`, device, tenant)
-	exec(`INSERT INTO runtime_placements(environment_id,node_id) VALUES($1,$2)`, environment, node)
-	exec(`INSERT INTO runtime_allocations(id,environment_id,device_id,provider_key,node_id) VALUES($1,$2,$3,$4,$5)`, allocation, environment, device, installation, node)
-	if _, err := migrations.UpTo(ctx, 81); err != nil {
-		t.Fatal(err)
-	}
-	for _, table := range []string{"runtime_allocations", "runtime_placements"} {
-		var generation int64
-		if err := db.QueryRowContext(ctx, `SELECT deployment_generation FROM `+table).Scan(&generation); err != nil || generation != 1 {
-			t.Fatal("inexact migration backfill", table, generation, err)
-		}
-	}
-	var pin int64
-	if err := db.QueryRowContext(ctx, `SELECT ready_generation FROM runtime_nodes WHERE id=$1`, node).Scan(&pin); err != nil || pin != 1 {
-		t.Fatal(pin, err)
-	}
-	if _, err := db.ExecContext(ctx, `UPDATE runtime_deployment SET generation=2`); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := migrations.DownTo(ctx, 80); err == nil {
-		t.Fatal("downgrade erased offline serving pin")
-	}
-	if _, err := db.ExecContext(ctx, `UPDATE runtime_nodes SET removed_at=clock_timestamp(),ready_generation=NULL`); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := migrations.DownTo(ctx, 80); err == nil {
-		t.Fatal("downgrade discarded held allocation/placement after pin removal")
-	}
-	exec(`UPDATE runtime_allocations SET state='released',released_at=clock_timestamp(),create_settled=true`)
-	if _, err := migrations.DownTo(ctx, 80); err == nil {
-		t.Fatal("downgrade discarded unreleased placement")
-	}
-	exec(`UPDATE runtime_placements SET released_at=clock_timestamp()`)
-	if _, err := migrations.DownTo(ctx, 80); err != nil {
-		t.Fatal("settled downgrade failed", err)
-	}
-}
-
-func TestGenerationDowngradeRefusesOldAllocation(t *testing.T) {
-	s, w, view, input := webSpecificationFixture(t, "e2b")
-	tenant, session := managedArchiveSession(t, s, managerSessionInput(uuid.NewString()))
-	owner := archiveAllocation(t, w, tenant, session, view.InstallationID)
-	input.Configuration.(*e2b.DeploymentConfiguration).Template = "next:" + uuid.NewString()
-	input.ExpectedGeneration = 1
-	if _, err := deploymentExecution(t, w).Update(SandboxResetTestContext(t.Context()), view.InstallationID, input); err != nil {
-		t.Fatal(err)
-	}
-	// Isolate the generation downgrade guard using the target schema's disabled
-	// suspension policy. Active suspension itself is not representable there.
-	db := sql.OpenDB(stdlib.GetConnector(*s.pool.Config().ConnConfig))
-	defer db.Close()
-	migrations, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err = migrations.DownTo(t.Context(), 80); err == nil || !strings.Contains(err.Error(), "Cannot downgrade while retained ownership") {
-		t.Fatal("generation ownership guard did not reject downgrade", err)
-	}
-	// Earlier down migrations can commit before the generation guard vetoes
-	// downgrade. Restore the current schema before invoking current Store code.
-	if _, err = migrations.Up(t.Context()); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = deploymentExecution(t, w).RequestCleanup(t.Context(), owner); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = deploymentExecution(t, w).SettleCreation(t.Context(), owner); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = deploymentExecution(t, w).ReleaseAllocation(t.Context(), owner); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = migrations.DownTo(t.Context(), 80); err != nil {
-		t.Fatal("released history prevented safe downgrade", err)
-	}
-}
-
 func TestGenerationUpdateSerializesWithAllocationAdmission(t *testing.T) {
 	s, w, view, input := webSpecificationFixture(t, "e2b")
 	changes, deployments := deploymentExecution(t, w), deploymentService(t, s)
@@ -282,16 +178,16 @@ func TestGenerationUpdateSerializesWithAllocationAdmission(t *testing.T) {
 }
 
 func TestSandboxSnapshotRolloutEquivalence(t *testing.T) {
-	s, w, view, input := webSpecificationFixture(t, "docker")
+	s, _, view, _ := webSpecificationFixture(t, "docker")
 	node := specificationNode(t, s, view)
 	deployments := deploymentService(t, s)
 	heartbeat := func(connection, state string) {
 		t.Helper()
-		if err := deployments.HeartbeatGenerations(t.Context(), node.NodeID, connection, view.OwnerEpoch, deployment.NodeHealth{}, []sandbox.GenerationStatus{{Generation: view.Generation, SpecificationDigest: view.SpecificationDigest, State: state}}); err != nil {
+		if err := deployments.Heartbeat(t.Context(), node.NodeID, connection, view.OwnerEpoch, deployment.NodeHealth{}, []sandbox.GenerationStatus{{Generation: view.Generation, SpecificationDigest: view.SpecificationDigest, State: state}}); err != nil {
 			t.Fatal(err)
 		}
 	}
-	for _, state := range []string{"ready", "preparing", "failed", "unconfirmed", "offline", "update_required"} {
+	for _, state := range []string{"ready", "preparing", "failed", "unconfirmed", "offline"} {
 		t.Run(state, func(t *testing.T) {
 			connection := onlineManagerNode(t, s, node.NodeID)
 			want := deployment.RolloutNodes{}
@@ -311,24 +207,13 @@ func TestSandboxSnapshotRolloutEquivalence(t *testing.T) {
 				if err := deployments.ConnectNode(t.Context(), node.NodeID, connection, view.OwnerEpoch); err != nil {
 					t.Fatal(err)
 				}
-				if err := deployments.HeartbeatGenerations(t.Context(), node.NodeID, connection, view.OwnerEpoch, deployment.NodeHealth{}, nil); err != nil {
+				if err := deployments.Heartbeat(t.Context(), node.NodeID, connection, view.OwnerEpoch, deployment.NodeHealth{}, nil); err != nil {
 					t.Fatal(err)
 				}
 				want.Unknown = 1
 			case "offline":
 				runtimeSuspensionSQL(t, s.pool, `UPDATE runtime_nodes SET last_seen_at=clock_timestamp()-interval '46 seconds',health='{"diagnostic":"provider_unavailable"}' WHERE id=$1`, node.NodeID)
 				want.Unknown = 1
-			case "update_required":
-				// Change the target on the same backend so the node's enrolled
-				// generation falls behind.
-				change := input
-				change.Resources.CPUs++
-				change.ExpectedGeneration = view.Generation
-				next, err := deploymentExecution(t, w).Update(SandboxResetTestContext(t.Context()), view.InstallationID, change)
-				if err != nil || next.Generation != view.Generation+1 || next.OwnerEpoch != view.OwnerEpoch {
-					t.Fatal("target change replaced execution ownership", next, err)
-				}
-				want.UpdateRequired = 1
 			}
 			assertSandboxSnapshotEquivalent(t, s.pool)
 			got, err := deployments.View(t.Context())
diff --git a/services/core/tests/integration/sandbox_reset_migration_test.go b/services/core/tests/integration/sandbox_reset_migration_test.go
deleted file mode 100644
index 4ca85d199..000000000
--- a/services/core/tests/integration/sandbox_reset_migration_test.go
+++ /dev/null
@@ -1,52 +0,0 @@
-package integration
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestSandboxResetMigrationResumesAdmissionAndGuardsDowngrade(t *testing.T) {
-	db, provider := runtimeNamesMigrationSchema(t)
-	ctx := t.Context()
-	if _, err := provider.UpTo(ctx, 78); err != nil {
-		t.Fatal(err)
-	}
-	exec := func(q string, args ...any) {
-		t.Helper()
-		if _, err := db.ExecContext(ctx, q, args...); err != nil {
-			t.Fatal(err)
-		}
-	}
-	for _, paused := range []bool{false, true} {
-		exec(`UPDATE runtime_deployment SET web_managed=true,provider_kind='docker',mode='nodes',generation=1,maintenance=$1`, paused)
-		if _, err := provider.UpTo(ctx, 79); err != nil {
-			t.Fatal(err)
-		}
-		var resumed bool
-		if err := db.QueryRowContext(ctx, `SELECT NOT admission_paused AND reset_clear IS NULL AND generation=1 FROM runtime_deployment`).Scan(&resumed); err != nil || !resumed {
-			t.Fatal("migration invented a reset or kept maintenance", err)
-		}
-		if _, err := provider.DownTo(ctx, 78); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if _, err := provider.UpTo(ctx, 79); err != nil {
-		t.Fatal(err)
-	}
-	exec(`UPDATE runtime_deployment SET admission_paused=true,reset_clear='auto',reset_requested_at=clock_timestamp(),reset_deadline_at=clock_timestamp()+interval '1 hour',reset_audit='{}'`)
-	if _, err := provider.DownTo(ctx, 78); err == nil || !strings.Contains(err.Error(), "reset is active") {
-		t.Fatal("active reset downgrade", err)
-	}
-	exec(`UPDATE runtime_deployment SET admission_paused=false,reset_clear=NULL,reset_requested_at=NULL,reset_deadline_at=NULL,reset_audit=NULL,provider_kind='',mode='',generation=2`)
-	if _, err := provider.DownTo(ctx, 78); err == nil || !strings.Contains(err.Error(), "Configure a sandbox provider") {
-		t.Fatal("completed reset lost generation", err)
-	}
-	var generation int64
-	if err := db.QueryRowContext(ctx, `SELECT generation FROM runtime_deployment`).Scan(&generation); err != nil || generation != 2 {
-		t.Fatal(generation, err)
-	}
-	exec(`UPDATE runtime_deployment SET provider_kind='docker',mode='nodes',generation=3`)
-	if _, err := provider.DownTo(ctx, 78); err != nil {
-		t.Fatal("configured downgrade", err)
-	}
-}
diff --git a/services/core/tests/integration/sandbox_reset_test.go b/services/core/tests/integration/sandbox_reset_test.go
index 18936ec6b..146a5c086 100644
--- a/services/core/tests/integration/sandbox_reset_test.go
+++ b/services/core/tests/integration/sandbox_reset_test.go
@@ -277,7 +277,7 @@ func TestSandboxResetSnapshotCountsOfflineOwnershipOnce(t *testing.T) {
 		onlineManagerNode(t, s, d.NodeID)
 		switch state {
 		case "preparing":
-			runtimeSuspensionSQL(t, s.pool, `UPDATE runtime_nodes SET provider_ready=false`)
+			runtimeSuspensionSQL(t, s.pool, `UPDATE runtime_nodes SET ready_generation=NULL`)
 		case "stale":
 			runtimeSuspensionSQL(t, s.pool, `UPDATE runtime_nodes SET last_seen_at=clock_timestamp()-interval '46 seconds'`)
 		case "epoch":
diff --git a/services/core/tests/integration/sandbox_snapshot_plan_test.go b/services/core/tests/integration/sandbox_snapshot_plan_test.go
index c488917ab..10e5340b9 100644
--- a/services/core/tests/integration/sandbox_snapshot_plan_test.go
+++ b/services/core/tests/integration/sandbox_snapshot_plan_test.go
@@ -83,23 +83,23 @@ func TestSandboxSnapshotFreshPlan(t *testing.T) {
 func assertSandboxSnapshotEquivalent(t *testing.T, pool *pgxpool.Pool) {
 	t.Helper()
 	query := sandboxSnapshotSQL(t)
-	legacy := strings.Replace(query, "WITH deployment AS MATERIALIZED (SELECT * FROM runtime_deployment WHERE singleton = true LIMIT 1),\nobserved AS", "WITH observed AS", 1)
-	legacy = strings.ReplaceAll(legacy, "CROSS JOIN deployment d", "CROSS JOIN runtime_deployment d")
-	legacy = strings.TrimSuffix(legacy, "\nWHERE d.singleton = true\nLIMIT 1")
+	direct := strings.Replace(query, "WITH deployment AS MATERIALIZED (SELECT * FROM runtime_deployment WHERE singleton = true LIMIT 1),\nobserved AS", "WITH observed AS", 1)
+	direct = strings.ReplaceAll(direct, "CROSS JOIN deployment d", "CROSS JOIN runtime_deployment d")
+	direct = strings.TrimSuffix(direct, "\nWHERE d.singleton = true\nLIMIT 1")
 	query = strings.Replace(query, "clock_timestamp() AS as_of", "(SELECT as_of FROM snapshot_time) AS as_of", 1)
-	legacy = strings.Replace(legacy, "clock_timestamp() AS as_of", "(SELECT as_of FROM snapshot_time) AS as_of", 1)
+	direct = strings.Replace(direct, "clock_timestamp() AS as_of", "(SELECT as_of FROM snapshot_time) AS as_of", 1)
 	tx, err := pool.Begin(t.Context())
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer tx.Rollback(t.Context())
-	// Avoid paying the legacy planner's JIT cost in this result-equivalence check.
+	// Avoid paying the direct planner's JIT cost in this result-equivalence check.
 	// The separate fresh-plan test keeps JIT enabled.
 	if _, err = tx.Exec(t.Context(), "SET LOCAL jit=off"); err != nil {
 		t.Fatal(err)
 	}
 	var same bool
-	err = tx.QueryRow(t.Context(), "WITH snapshot_time AS MATERIALIZED (SELECT clock_timestamp() AS as_of) SELECT (SELECT to_jsonb(s) FROM ("+query+") s) IS NOT DISTINCT FROM (SELECT to_jsonb(s) FROM ("+legacy+") s)").Scan(&same)
+	err = tx.QueryRow(t.Context(), "WITH snapshot_time AS MATERIALIZED (SELECT clock_timestamp() AS as_of) SELECT (SELECT to_jsonb(s) FROM ("+query+") s) IS NOT DISTINCT FROM (SELECT to_jsonb(s) FROM ("+direct+") s)").Scan(&same)
 	if err != nil || !same {
 		t.Fatal("singleton annotation changed snapshot", same, err)
 	}
diff --git a/services/core/tests/integration/sandbox_specification_lifecycle_test.go b/services/core/tests/integration/sandbox_specification_lifecycle_test.go
index f3a87dc6c..a157d6004 100644
--- a/services/core/tests/integration/sandbox_specification_lifecycle_test.go
+++ b/services/core/tests/integration/sandbox_specification_lifecycle_test.go
@@ -22,6 +22,9 @@ func webSpecificationFixture(t *testing.T, provider string) (*Store, *Store, dep
 	w := executionWriter(t, s)
 	id := uuid.NewString()
 	changes := deploymentExecution(t, w)
+	if provider == "microsandbox" {
+		selectWorkspaceStorage(t, fixtureWorkspaces(w, w.lease))
+	}
 	if err := changes.Claim(t.Context(), id); err != nil {
 		t.Fatal(err)
 	}
@@ -45,7 +48,7 @@ func specificationNode(t *testing.T, s *Store, view deployment.View) deployment.
 func enrollNode(t *testing.T, s *Store, view deployment.View, capacity deployment.Capacity) deployment.Enrollment {
 	t.Helper()
 	nodes := deploymentService(t, s)
-	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), capacity))
+	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: &capacity.MaxActive, MaxRetained: &capacity.MaxRetained}))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -61,7 +64,7 @@ func enrollNode(t *testing.T, s *Store, view deployment.View, capacity deploymen
 func TestSandboxSpecificationBootstrapReadDoesNotConsumeEnrollment(t *testing.T) {
 	s, w, view, input := webSpecificationFixture(t, "docker")
 	nodes := deploymentService(t, s)
-	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.Capacity{MaxActive: 2, MaxRetained: 4}))
+	token, err := EnrollmentTestToken(nodes.CreateEnrollment(t.Context(), deployment.EnrollmentLimits{MaxActive: new(2), MaxRetained: new(4)}))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -181,25 +184,17 @@ func TestSandboxSpecificationChangesPreserveEveryRetainedResource(t *testing.T)
 					t.Fatal(err)
 				}
 			}
-			for _, field := range []string{"resources", "runtime"} {
-				changed := input
-				if field == "resources" {
-					changed.Resources.MemoryMiB *= 2
-				} else {
-					runtime := *input.Runtime
-					runtime.SourceCommit = strings.Repeat("1", 40)
-					changed.Runtime = &runtime
-				}
-				changed.ExpectedGeneration = view.Generation
-				if _, _, err := changes.ClassifyChange(t.Context(), view.InstallationID, changed); err != nil {
-					t.Fatal(field, err)
-				}
-				next, err := changes.Update(SandboxResetTestContext(t.Context()), view.InstallationID, changed)
-				if err != nil || next.Generation != view.Generation+1 || next.OwnerEpoch != view.OwnerEpoch {
-					t.Fatal(field, next, err)
-				}
-				view = next
+			changed := input
+			changed.Resources.MemoryMiB *= 2
+			changed.ExpectedGeneration = view.Generation
+			if _, _, err := changes.ClassifyChange(t.Context(), view.InstallationID, changed); err != nil {
+				t.Fatal(err)
+			}
+			next, err := changes.Update(SandboxResetTestContext(t.Context()), view.InstallationID, changed)
+			if err != nil || next.Generation != view.Generation+1 || next.OwnerEpoch != view.OwnerEpoch {
+				t.Fatal(next, err)
 			}
+			view = next
 			after, err := deployments.View(t.Context())
 			if err != nil || before.Resources != after.Resources {
 				t.Fatal("online specification change altered ownership", err)
@@ -226,11 +221,8 @@ func TestSandboxSpecificationChangesPreserveEveryRetainedResource(t *testing.T)
 			} else if err := sessionService(t, s).DeleteSession(t.Context(), sessions.DeleteSessionCommand{TenantID: tenant, SessionID: session.ID}); err != nil {
 				t.Fatal(err)
 			}
-			changed := input
-			changed.Resources.MemoryMiB *= 2
-			runtime := *input.Runtime
-			runtime.SourceCommit = strings.Repeat("2", 40)
-			changed.Runtime = &runtime
+			changed = input
+			changed.Resources.MemoryMiB *= 4
 			changed.ExpectedGeneration = view.Generation
 			committed, err := changes.Update(SandboxResetTestContext(t.Context()), view.InstallationID, changed)
 			if err != nil || committed.Generation != view.Generation+1 || committed.Reset != nil || committed.Resources != (deployment.Resources{}) || committed.Specification == nil || !reflect.DeepEqual(*committed.Specification, changed.DeploymentSpec) {
diff --git a/services/core/tests/integration/sandbox_specification_test.go b/services/core/tests/integration/sandbox_specification_test.go
index e69631350..3ba03726c 100644
--- a/services/core/tests/integration/sandbox_specification_test.go
+++ b/services/core/tests/integration/sandbox_specification_test.go
@@ -1,21 +1,16 @@
 package integration
 
 import (
-	"strings"
-
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/workspacefs"
 )
 
 func SandboxDeploymentTestSpec(provider string) sandbox.DeploymentSpec {
 	s := sandbox.DeploymentSpec{Resources: sandbox.Resources{CPUs: 2, MemoryMiB: 2048}}
-	if provider == "e2b" {
-		return s
-	}
-	s.Runtime = &sandbox.RuntimeRelease{SourceCommit: strings.Repeat("a", 40), ImageID: "sha256:" + strings.Repeat("b", 64), ImageManifestDigest: "sha256:" + strings.Repeat("c", 64), MicrosandboxRef: "oac-runtime@sha256:" + strings.Repeat("d", 64), RuntimeSHA256: strings.Repeat("e", 64), FirmwareSHA256: strings.Repeat("f", 64)}
 	if provider == "microsandbox" {
 		s.Resources.RootDiskMiB = 8192
-		s.Resources.EnvironmentDiskMiB = 8192
+		s.Workspace = &workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}
 	}
 	return s
 }
diff --git a/services/core/tests/integration/saved_web_search_public_test.go b/services/core/tests/integration/saved_web_search_public_test.go
index a509660f3..630513dde 100644
--- a/services/core/tests/integration/saved_web_search_public_test.go
+++ b/services/core/tests/integration/saved_web_search_public_test.go
@@ -14,9 +14,9 @@ import (
 )
 
 // TV-05: saved Agents keep every pinned web_search mode with the official
-// projection (W1/W2), while Session admission still rejects enabled search
-// before any write on every creation mode (W4), admits a tools replacement (W5)
-// and keeps tenant isolation (W8).
+// projection (W1/W2). Codex declares cached and live search, so saved and inline
+// search reach the Session unchanged (W4/W6); a tools replacement replaces it
+// (W5) and tenant isolation holds (W8).
 func TestSavedWebSearchPostgres(t *testing.T) {
 	// An isolated database keeps the no-write digest independent of other tests.
 	s, _ := newManagedTestStore(t)
@@ -73,6 +73,7 @@ func TestSavedWebSearchPostgres(t *testing.T) {
 	}
 	const defaults = `"context_size":"medium","allowed_domains":null,"location":null}`
 	live := `{"type":"web_search","mode":"live",` + defaults
+	cached := `{"type":"web_search","mode":"cached",` + defaults
 
 	// W1: Agent create with every pinned mode (official create 201).
 	agentIDs := map[string]string{}
@@ -80,7 +81,7 @@ func TestSavedWebSearchPostgres(t *testing.T) {
 		{"type-only", `{"type":"web_search"}`, live},
 		{"mode-null", `{"type":"web_search","mode":null}`, live},
 		{"mode-live", `{"type":"web_search","mode":"live"}`, live},
-		{"mode-cached", `{"type":"web_search","mode":"cached"}`, `{"type":"web_search","mode":"cached",` + defaults},
+		{"mode-cached", `{"type":"web_search","mode":"cached"}`, cached},
 		{"mode-cached-full", `{"type":"web_search","mode":"cached","context_size":"high","allowed_domains":["example.com"],"location":{"city":"Paris","country":"FR","region":null,"timezone":null}}`,
 			`{"type":"web_search","mode":"cached","context_size":"high","allowed_domains":["example.com"],"location":{"country":"FR","region":null,"city":"Paris","timezone":null}}`},
 		// A supplied location projects all four keys, with null for omitted ones
@@ -113,17 +114,17 @@ func TestSavedWebSearchPostgres(t *testing.T) {
 		readBack(tc.name, updated, body)
 	}
 
-	// A disabled record saved before this batch reads unchanged and is admitted with
-	// the same frozen Session tool (W7).
+	// A saved disabled search reads unchanged and is admitted with the same frozen
+	// Session tool (W7).
 	_, agentService := fixtureAgents(t, s)
-	legacy, err := agentService.Create(t.Context(), agents.CreateCommand{TenantID: ownerTenant, Metadata: map[string]string{}, Configuration: json.RawMessage(
+	savedDisabled, err := agentService.Create(t.Context(), agents.CreateCommand{TenantID: ownerTenant, Metadata: map[string]string{}, Configuration: json.RawMessage(
 		`{"model":"search-model","name":null,"instructions":null,"multi_agent":{"enabled":false,"max_concurrent_subagents":null},"reasoning":{},"service_tier":"auto","text":{"format":{"type":"text"},"verbosity":"medium"},"tools":[{"type":"web_search","mode":"disabled","context_size":"medium","allowed_domains":[],"location":null}]}`)})
 	if err != nil {
 		t.Fatal(err)
 	}
-	status, body := client.do(owner, http.MethodGet, "/v1/agents/"+legacy.ID, "", nil)
-	legacyTool := tools("legacy", status, body, http.StatusOK, `{"type":"web_search","mode":"disabled","context_size":"medium","allowed_domains":[],"location":null}`)
-	readBack("legacy", legacy.ID, body)
+	status, body := client.do(owner, http.MethodGet, "/v1/agents/"+savedDisabled.ID, "", nil)
+	disabledTool := tools("disabled", status, body, http.StatusOK, `{"type":"web_search","mode":"disabled","context_size":"medium","allowed_domains":[],"location":null}`)
+	readBack("disabled", savedDisabled.ID, body)
 	// sessionTool returns the first frozen Session tool in canonical form; Session
 	// snapshots keep their own key order.
 	sessionTool := func(name, session string) string {
@@ -140,8 +141,8 @@ func TestSavedWebSearchPostgres(t *testing.T) {
 		}
 		return canonicalTool(t, value.Agent.Tools[0])
 	}
-	if got := sessionTool("legacy", client.created(owner, "/v1/agents/sessions", `{"agent_id":"`+legacy.ID+`","environment":{"type":"none"},"input":"hi"}`)); got != canonicalTool(t, json.RawMessage(legacyTool)) {
-		t.Fatalf("legacy Session tool %s, want %s", got, legacyTool)
+	if got := sessionTool("disabled", client.created(owner, "/v1/agents/sessions", `{"agent_id":"`+savedDisabled.ID+`","environment":{"type":"none"},"input":"hi"}`)); got != canonicalTool(t, json.RawMessage(disabledTool)) {
+		t.Fatalf("disabled Session tool %s, want %s", got, disabledTool)
 	}
 
 	// A same-key retry of a Session that recorded its creation request recovers it
@@ -169,41 +170,35 @@ func TestSavedWebSearchPostgres(t *testing.T) {
 		t.Fatalf("retry fixture: %d", status)
 	}
 	client.created(owner, "/v1/agents/"+agentIDs["mode-disabled"], `{"tools":[{"type":"web_search","mode":"live"}]}`)
-	enabledTools := map[string]string{"mode-live": agentIDs["mode-live"], "mode-cached": agentIDs["mode-cached"], "type-only": agentIDs["type-only"], "updated-to-live": agentIDs["mode-disabled"]}
+	enabledTools := map[string]struct{ id, tool string }{"mode-live": {agentIDs["mode-live"], live}, "mode-cached": {agentIDs["mode-cached"], cached}, "type-only": {agentIDs["type-only"], live}, "updated-to-live": {agentIDs["mode-disabled"], live}}
 
-	// W4: every creation mode rejects enabled saved search without writes.
-	before := databaseDigest(t, s.pool)
-	const rejection = `{"error":{"message":"Only disabled web_search is qualified for execution.","type":"invalid_request_error","code":"unsupported_or_invalid_configuration","param":null}}` + "\n"
-	for name, id := range enabledTools {
-		for _, suffix := range []string{
-			`"environment":{"type":"none"},"input":"hi"}`,
-			`"environment":{"type":"none"},"input":"hi","stream":true}`,
-			`"environment":{"type":"self_hosted","workspace_directory":"/workspace"},"input":"hi"}`,
-			`"environment":{"type":"self_hosted","workspace_directory":"/workspace"}}`,
-			`"environment":{"type":"openai_hosted"}}`,
-			`"agent":{"instructions":"Keep the saved tools."},"environment":{"type":"none"},"input":"hi"}`,
-		} {
-			if status, body := client.do(owner, http.MethodPost, "/v1/agents/sessions", "application/json", []byte(`{"agent_id":"`+id+`",`+suffix)); status != http.StatusBadRequest || body != rejection {
-				t.Errorf("%s %s: %d %s", name, suffix, status, body)
-			}
-		}
-		// C4: the input requirement precedes execution admission.
-		const input = `{"error":{"message":"conversation-only sessions currently require initial input","type":"invalid_request_error","code":"invalid_request_error","param":null}}` + "\n"
-		if status, body := client.do(owner, http.MethodPost, "/v1/agents/sessions", "application/json", []byte(`{"agent_id":"`+id+`","environment":{"type":"none"}}`)); status != http.StatusBadRequest || body != input {
-			t.Errorf("%s without input: %d %s", name, status, body)
+	// W4: each saved search reaches a new Session unchanged.
+	for name, saved := range enabledTools {
+		session := client.created(owner, "/v1/agents/sessions", `{"agent_id":"`+saved.id+`","environment":{"type":"none"},"input":"hi"}`)
+		if got := sessionTool(name, session); got != canonicalTool(t, json.RawMessage(saved.tool)) {
+			t.Errorf("%s Session tool %s, want %s", name, got, saved.tool)
 		}
 	}
-	// W6: inline enabled or omitted-mode search keeps its rejection.
-	for _, tool := range []string{`{"type":"web_search"}`, `{"type":"web_search","mode":null}`, `{"type":"web_search","mode":"cached"}`} {
+	// W6: inline enabled or omitted-mode search is admitted the same way.
+	for tool, want := range map[string]string{`{"type":"web_search"}`: live, `{"type":"web_search","mode":null}`: live, `{"type":"web_search","mode":"cached"}`: cached} {
 		for _, request := range []string{
 			`{"agent":{"model":"m","tools":[` + tool + `]},"environment":{"type":"none"},"input":"hi"}`,
-			`{"agent_id":"` + legacy.ID + `","agent":{"tools":[` + tool + `]},"environment":{"type":"none"},"input":"hi"}`,
+			`{"agent_id":"` + savedDisabled.ID + `","agent":{"tools":[` + tool + `]},"environment":{"type":"none"},"input":"hi"}`,
 		} {
-			if status, body := client.do(owner, http.MethodPost, "/v1/agents/sessions", "application/json", []byte(request)); status != http.StatusBadRequest || body != rejection {
-				t.Errorf("inline %s: %d %s", request, status, body)
+			if got := sessionTool(request, client.created(owner, "/v1/agents/sessions", request)); got != canonicalTool(t, json.RawMessage(want)) {
+				t.Errorf("inline %s: Session tool %s, want %s", request, got, want)
 			}
 		}
 	}
+
+	before := databaseDigest(t, s.pool)
+	// C4: the input requirement still applies to a saved search Agent.
+	const input = `{"error":{"message":"conversation-only sessions currently require initial input","type":"invalid_request_error","code":"invalid_request_error","param":null}}` + "\n"
+	for name, saved := range enabledTools {
+		if status, body := client.do(owner, http.MethodPost, "/v1/agents/sessions", "application/json", []byte(`{"agent_id":"`+saved.id+`","environment":{"type":"none"}}`)); status != http.StatusBadRequest || body != input {
+			t.Errorf("%s without input: %d %s", name, status, body)
+		}
+	}
 	// W8: another tenant sees the same 404 as a missing Agent and writes nothing.
 	missing := uuid.NewString()
 	for _, request := range []struct{ method, path, body string }{
@@ -236,11 +231,11 @@ func TestSavedWebSearchPostgres(t *testing.T) {
 	if got := sessionTool("retry", original); got != disabled {
 		t.Fatalf("recovered Session tool %s", got)
 	}
-	if status, _ := retry("after-search"); status != http.StatusBadRequest {
-		t.Fatalf("new key after enabling search: %d", status)
+	if status, session := retry("after-search"); status != http.StatusCreated || session == original {
+		t.Fatalf("new key after enabling search: %d %s", status, session)
 	}
 
-	// W5: a per-Session tools replacement admits the saved Agent without its search.
+	// W5: a per-Session tools replacement replaces the saved search.
 	for _, replacement := range []string{`[]`, `[{"type":"web_search","mode":"disabled"}]`} {
 		session := client.created(owner, "/v1/agents/sessions", `{"agent_id":"`+agentIDs["mode-live"]+`","agent":{"tools":`+replacement+`},"environment":{"type":"none"},"input":"hi"}`)
 		if got := sessionTool("replacement", session); got != "" && got != disabled {
diff --git a/services/core/tests/integration/session_artifacts_test.go b/services/core/tests/integration/session_artifacts_test.go
index 9cb471cc6..0263510b1 100644
--- a/services/core/tests/integration/session_artifacts_test.go
+++ b/services/core/tests/integration/session_artifacts_test.go
@@ -210,47 +210,31 @@ func TestSessionArtifactsDiscardTerminalPrivateCapture(t *testing.T) {
 	}
 }
 
-func TestSessionArtifactTransferDoesNotBlockDeletionOrCancellation(t *testing.T) {
-	for _, operation := range []string{"delete", "cancel"} {
-		t.Run(operation, func(t *testing.T) {
-			s, _ := configuredStore(t)
-			pool := s.pool
-			tenant, session, environment, turn := artifactTurn(t, s, "openai_hosted")
-			before := largeObjectCount(t, pool)
-			reader, writer := io.Pipe()
-			defer reader.Close()
-			defer writer.Close()
-			result := make(chan error, 1)
-			go func() { result <- stageTurnArtifacts(t.Context(), s, tenant, session, turn, environment, reader) }()
-			// A complete TAR arrives, but transport has not acknowledged success yet.
-			if _, err := writer.Write(artifactArchive(t, map[string][]byte{"outputs/a": []byte("partial")})); err != nil {
-				t.Fatal(err)
-			}
-			ctx, cancel := context.WithTimeout(t.Context(), 2*time.Second)
-			defer cancel()
-			want := sessions.ErrNotFound
-			if operation == "delete" {
-				// The idle-only decision itself is not blocked by the transfer.
-				if err := sessionService(t, s).DeleteSession(ctx, sessions.DeleteSessionCommand{TenantID: tenant, SessionID: session}); !errors.Is(err, sessions.ErrNotIdle) {
-					t.Fatalf("transfer blocked or bypassed the deletion rule: %v", err)
-				}
-				if err := s.commitLegacyDeletion(ctx, tenant, session); err != nil {
-					t.Fatalf("transfer blocked deletion: %v", err)
-				}
-			} else {
-				if _, err := requestCancel(ctx, s, tenant, session, "cancel-capture"); err != nil {
-					t.Fatalf("transfer blocked cancellation: %v", err)
-				}
-				want = sessions.ErrTurnConflict
-			}
-			writer.Close()
-			if err := <-result; !errors.Is(err, want) {
-				t.Fatalf("late publication after %s: %v", operation, err)
-			}
-			if count := largeObjectCount(t, pool); count != before {
-				t.Fatalf("late capture leaked objects: %d -> %d", before, count)
-			}
-		})
+func TestSessionArtifactTransferDoesNotBlockCancellation(t *testing.T) {
+	s, _ := configuredStore(t)
+	pool := s.pool
+	tenant, session, environment, turn := artifactTurn(t, s, "openai_hosted")
+	before := largeObjectCount(t, pool)
+	reader, writer := io.Pipe()
+	defer reader.Close()
+	defer writer.Close()
+	result := make(chan error, 1)
+	go func() { result <- stageTurnArtifacts(t.Context(), s, tenant, session, turn, environment, reader) }()
+	// A complete TAR arrives, but transport has not acknowledged success yet.
+	if _, err := writer.Write(artifactArchive(t, map[string][]byte{"outputs/a": []byte("partial")})); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(t.Context(), 2*time.Second)
+	defer cancel()
+	if _, err := requestCancel(ctx, s, tenant, session, "cancel-capture"); err != nil {
+		t.Fatalf("transfer blocked cancellation: %v", err)
+	}
+	writer.Close()
+	if err := <-result; !errors.Is(err, sessions.ErrTurnConflict) {
+		t.Fatalf("late publication after cancellation: %v", err)
+	}
+	if count := largeObjectCount(t, pool); count != before {
+		t.Fatalf("late capture leaked objects: %d -> %d", before, count)
 	}
 }
 
diff --git a/services/core/tests/integration/session_deletion_execution_test.go b/services/core/tests/integration/session_deletion_execution_test.go
index fb1872d74..c46ef1220 100644
--- a/services/core/tests/integration/session_deletion_execution_test.go
+++ b/services/core/tests/integration/session_deletion_execution_test.go
@@ -11,87 +11,6 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 )
 
-func TestDeletedSessionWaitingTurnSettlesWithoutStoppingWorker(t *testing.T) {
-	h := newFunctionHarness(t)
-	ctx, cancel := context.WithCancel(t.Context())
-	defer cancel()
-	worker := startOwnedWorker(t, ctx, h.s, h.d, h.owner())
-	done := make(chan error, 1)
-	go func() { done <- worker.Run(ctx) }()
-	defer func() {
-		cancel()
-		select {
-		case <-done:
-		case <-time.After(10 * time.Second):
-			t.Error("worker did not stop")
-		}
-	}()
-	input := h.message("start", "Run")
-	h.read(testExecutionRequest)
-	h.write(input.TurnID, proto.TypeFunctionCall, proto.FunctionCallPayload{CallID: "pending", Name: "lookup_ticket", Arguments: json.RawMessage(`{}`)})
-	state := functionState(t, h, 1)
-	if err := sessionService(t, h.s).DeleteSession(ctx, sessions.DeleteSessionCommand{TenantID: h.tenant, SessionID: h.session.ID}); !errors.Is(err, sessions.ErrNotIdle) {
-		t.Fatal("waiting Session deleted", err)
-	}
-	// A marker committed by an earlier release still cancels and settles work.
-	if err := h.s.commitLegacyDeletion(ctx, h.tenant, h.session.ID); err != nil {
-		t.Fatal(err)
-	}
-	var request proto.PromptCancelPayload
-	if err := h.read(proto.TypePromptCancel).DecodePayload(&request); err != nil {
-		t.Fatal(err)
-	}
-	raw, _ := json.Marshal(sessions.FunctionResultInput{TurnID: input.TurnID, CallID: state.RequiredActions[0].CallID, Result: json.RawMessage(`{"success":true,"output":"late"}`)})
-	if _, err := worker.SubmitInputs(ctx, h.tenant, h.session.ID, "late", []sessions.Input{{Kind: "tool_result", Payload: raw}}); !errors.Is(err, sessions.ErrNotFound) {
-		t.Fatal(err)
-	}
-	h.write(input.TurnID, proto.TypeInteractionDecisionAck, proto.InteractionDecisionAckPayload{DeliveryID: request.DeliveryID, Applied: true, Outcome: &proto.DonePayload{Metadata: map[string]any{proto.DoneMetaAgentSessionID: "deleted-native"}}})
-	waitTurn(t, h, input.TurnID, sessions.TurnCancelled)
-	bound, err := sessionAdapter(h.s).GetSessionExecutionBinding(ctx, h.tenant, h.session.ID)
-	if err != nil || bound.NativeSessionID != "deleted-native" {
-		t.Fatal(bound, err)
-	}
-	if _, err := sessionAdapter(h.s).GetSession(ctx, h.tenant, h.session.ID); !errors.Is(err, sessions.ErrNotFound) {
-		t.Fatal(err)
-	}
-	if _, err := h.bound().Run(ctx, h.tenant, h.session.ID, input.TurnID); !errors.Is(err, sessions.ErrNotFound) {
-		t.Fatal("deleted Session must be unavailable to new dispatch", err)
-	}
-	h.session = publicSession(t, h, "unrelated")
-	next := h.message("next", "Unrelated work")
-	h.read(testExecutionRequest)
-	h.write(next.TurnID, proto.TypeDone, proto.DonePayload{Content: "unaffected"})
-	waitTurn(t, h, next.TurnID, sessions.TurnCompleted)
-}
-
-func TestDeletedSessionRestartStillReconcilesHiddenClaim(t *testing.T) {
-	h := newDispatchHarness(t)
-	input := h.message("interrupted", "Run")
-	ctx := t.Context()
-	if _, err := transitionTurn(ctx, h.s, h.tenant, h.session.ID, input.TurnID, sessions.TurnTransition{ExpectedStatus: sessions.TurnQueued, Status: sessions.TurnInProgress}); err != nil {
-		t.Fatal(err)
-	}
-	if err := sessionService(t, h.s).DeleteSession(ctx, sessions.DeleteSessionCommand{TenantID: h.tenant, SessionID: h.session.ID}); !errors.Is(err, sessions.ErrNotIdle) {
-		t.Fatal("running Session deleted", err)
-	}
-	if err := h.s.commitLegacyDeletion(ctx, h.tenant, h.session.ID); err != nil {
-		t.Fatal(err)
-	}
-	worker := startWorker(t, ctx, h.s, h.d)
-	stopped, cancel := context.WithCancel(ctx)
-	cancel()
-	if err := worker.Run(stopped); !errors.Is(err, context.Canceled) {
-		t.Fatal(err)
-	}
-	turn, err := sessionAdapter(h.s).GetTurn(ctx, h.tenant, h.session.ID, input.TurnID)
-	if err != nil || turn.Status != sessions.TurnFailed {
-		t.Fatal(turn, err)
-	}
-	if _, err := sessionAdapter(h.s).GetSession(ctx, h.tenant, h.session.ID); !errors.Is(err, sessions.ErrNotFound) {
-		t.Fatal(err)
-	}
-}
-
 // A caller deletes running work by cancelling first, waiting for the Session to
 // settle and then deleting. The rejected deletion leaves the waiting Turn intact.
 func TestWaitingSessionCancelsThenDeletesThroughWorker(t *testing.T) {
diff --git a/services/core/tests/integration/session_deletion_test.go b/services/core/tests/integration/session_deletion_test.go
index f58924b7d..13f8f8020 100644
--- a/services/core/tests/integration/session_deletion_test.go
+++ b/services/core/tests/integration/session_deletion_test.go
@@ -8,8 +8,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/db/sqlc"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/sessionpg"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
@@ -17,29 +15,6 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 )
 
-// commitLegacyDeletion reproduces the deletion transaction of releases before
-// the idle-only rule: it requested cancellation of pending work and committed
-// the marker together. Upgraded databases can retain such markers, so hidden
-// work must still settle; tests use this to reach that state.
-func (s *Store) commitLegacyDeletion(ctx context.Context, tenantID, sessionID string) error {
-	tenant, err := parseID(tenantID)
-	if err != nil {
-		return err
-	}
-	return s.withPublicSession(ctx, tenantID, sessionID, func(ctx context.Context, q *sqlc.Queries, session pgtype.UUID) error {
-		if err := sessions.CancelWork(ctx, sessionpg.BindSession(q, tenant, session)); err != nil {
-			return err
-		}
-		if err := q.DeleteSessionArtifacts(ctx, session); err != nil {
-			return err
-		}
-		if err := q.ReleaseUnallocatedRuntimePlacement(ctx, session); err != nil {
-			return err
-		}
-		return q.MarkSessionDeleted(ctx, session)
-	})
-}
-
 // sessionDeletedAt reads the internal marker, which public reads never expose.
 func sessionDeletedAt(t *testing.T, pool *pgxpool.Pool, session string) pgtype.Timestamptz {
 	t.Helper()
diff --git a/services/core/tests/integration/session_diagnostics_test.go b/services/core/tests/integration/session_diagnostics_test.go
index 6a21d8671..7f097b231 100644
--- a/services/core/tests/integration/session_diagnostics_test.go
+++ b/services/core/tests/integration/session_diagnostics_test.go
@@ -52,7 +52,7 @@ func TestDiagnosticItemReceiptSettlementAndReplay(t *testing.T) {
 	if err := journal.AppendTurnEvents(t.Context(), tenant, session.ID, receipt.TurnID, 2, []sessions.ExecutionEvent{after}); err != nil {
 		t.Fatal(err)
 	}
-	// A terminal legacy Item with unknown settlement must remain unknown even on a repeated upsert.
+	// A terminal Item with unknown settlement must remain unknown even on a repeated upsert.
 	runtimeSuspensionSQL(t, s.pool, "UPDATE session_items SET settled_at=NULL WHERE id=$1", item.ItemID)
 	if err := journal.AppendTurnEvents(t.Context(), tenant, session.ID, receipt.TurnID, 3, []sessions.ExecutionEvent{after}); err != nil {
 		t.Fatal(err)
diff --git a/services/core/tests/integration/session_write_audit_test.go b/services/core/tests/integration/session_write_audit_test.go
index eb5b167d6..907dea345 100644
--- a/services/core/tests/integration/session_write_audit_test.go
+++ b/services/core/tests/integration/session_write_audit_test.go
@@ -209,16 +209,16 @@ func TestSessionWriteAuditInitialInputAndHistoricalReplay(t *testing.T) {
 				t.Fatal(created, err)
 			}
 			sessionAuditCount(t, s, tenant, 1)
-			input.IdempotencyKey = "legacy"
-			legacy, err := s.CreateSession(t.Context(), tenant, input)
+			input.IdempotencyKey = "second"
+			second, err := s.CreateSession(t.Context(), tenant, input)
 			if err != nil {
 				t.Fatal(err)
 			}
-			if err := sessionService(t, s).AuditSessionOperation(sessionAuditContext(t, tenant, "b"), sessions.AuditSessionOperationCommand{TenantID: tenant, SessionID: legacy.ID, Action: "create"}); err != nil {
+			if err := sessionService(t, s).AuditSessionOperation(sessionAuditContext(t, tenant, "b"), sessions.AuditSessionOperationCommand{TenantID: tenant, SessionID: second.ID, Action: "create"}); err != nil {
 				t.Fatal(err)
 			}
 			var owners int
-			if err := s.pool.QueryRow(t.Context(), "SELECT count(*) FROM write_audit_owners WHERE tenant_id=$1 AND resource_id=$2", tenant, legacy.ID).Scan(&owners); err != nil || owners != 0 {
+			if err := s.pool.QueryRow(t.Context(), "SELECT count(*) FROM write_audit_owners WHERE tenant_id=$1 AND resource_id=$2", tenant, second.ID).Scan(&owners); err != nil || owners != 0 {
 				t.Fatal("replay attributed historical resource", owners, err)
 			}
 			sessionAuditCount(t, s, tenant, 2)
diff --git a/services/core/tests/integration/skill_default_metadata_migration_test.go b/services/core/tests/integration/skill_default_metadata_migration_test.go
deleted file mode 100644
index 1fe748407..000000000
--- a/services/core/tests/integration/skill_default_metadata_migration_test.go
+++ /dev/null
@@ -1,118 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"os"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestSkillDefaultMetadataMigrationRepairsOnlyResourceMetadata(t *testing.T) {
-	_, pool := testStore(t)
-	ctx := t.Context()
-	schema := "skill_metadata_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(ctx, "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(context.Background(), "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 54); err != nil {
-		t.Fatal(err)
-	}
-	tenant, foreign := uuid.NewString(), uuid.NewString()
-	bad, valid := uuid.NewString(), uuid.NewString()
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer tx.Rollback()
-	for _, fixture := range []struct {
-		id, tenant     string
-		defaultVersion int
-	}{{bad, tenant, 2}, {valid, foreign, 1}} {
-		if _, err := tx.ExecContext(ctx, `INSERT INTO skills(id,tenant_id,name,description,default_version,latest_version,next_version)
-			VALUES ($1,$2,'first','First description.', $3,2,3)`, fixture.id, fixture.tenant, fixture.defaultVersion); err != nil {
-			t.Fatal(err)
-		}
-		for i, name := range []string{"first", "second"} {
-			description := []string{"First description.", "Second description."}[i]
-			if _, err := tx.ExecContext(ctx, `INSERT INTO skill_versions(id,tenant_id,skill_id,version,name,description,contents)
-				VALUES ($1,$2,$3,$4,$5,$6,$7)`, uuid.NewString(), fixture.tenant, fixture.id, i+1, name, description, []byte{73, byte(i + 1), 29}); err != nil {
-				t.Fatal(err)
-			}
-		}
-	}
-	session := uuid.NewString()
-	if _, err := tx.ExecContext(ctx, `INSERT INTO sessions(id,tenant_id,engine,idempotency_key,request_hash,configuration)
-		VALUES ($1,$2,'codex','historical','historical',jsonb_set('{"environment":{"skills":[{"type":"skill_reference","version":"1","name":"first","description":"First description."}]}}', '{environment,skills,0,skill_id}', to_jsonb($3::text)))`, session, tenant, "skill_"+bad); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := tx.ExecContext(ctx, "INSERT INTO environment_setups(session_id,contents) VALUES ($1,$2)", session, []byte{94, 17, 28}); err != nil {
-		t.Fatal(err)
-	}
-	if err := tx.Commit(); err != nil {
-		t.Fatal(err)
-	}
-	snapshot := func(query string) string {
-		t.Helper()
-		var result string
-		if err := db.QueryRowContext(ctx, query).Scan(&result); err != nil {
-			t.Fatal(err)
-		}
-		return result
-	}
-	const preserved = `SELECT jsonb_build_object(
-		'skills', (SELECT jsonb_agg(to_jsonb(s)-'name'-'description' ORDER BY id) FROM skills s),
-		'versions', (SELECT jsonb_agg(to_jsonb(v) ORDER BY id) FROM skill_versions v),
-		'sessions', (SELECT jsonb_agg(to_jsonb(s) ORDER BY id) FROM sessions s),
-		'setups', (SELECT jsonb_agg(to_jsonb(e) ORDER BY session_id) FROM environment_setups e))::text`
-	before := snapshot(preserved)
-	assertMetadata := func() {
-		t.Helper()
-		for _, fixture := range []struct{ id, name, description string }{
-			{bad, "second", "Second description."}, {valid, "first", "First description."},
-		} {
-			var name, description string
-			if err := db.QueryRowContext(ctx, "SELECT name,description FROM skills WHERE id=$1", fixture.id).Scan(&name, &description); err != nil || name != fixture.name || description != fixture.description {
-				t.Fatal("incorrect repaired/control metadata", name, description, err)
-			}
-		}
-		if snapshot(preserved) != before {
-			t.Fatal("migration changed pointers, immutable versions or frozen Session data")
-		}
-	}
-	if _, err := provider.UpTo(ctx, 55); err != nil {
-		t.Fatal(err)
-	}
-	assertMetadata()
-	const skillRows = `SELECT jsonb_agg(to_jsonb(s) || jsonb_build_object('row_version', xmin::text) ORDER BY id)::text FROM skills s`
-	repaired := snapshot(skillRows)
-	if _, err := provider.DownTo(ctx, 54); err != nil {
-		t.Fatal(err)
-	}
-	assertMetadata()
-	if _, err := provider.UpTo(ctx, 55); err != nil {
-		t.Fatal(err)
-	}
-	assertMetadata()
-	if snapshot(skillRows) != repaired {
-		t.Fatal("reapplying data repair rewrote already correct rows")
-	}
-}
diff --git a/services/core/tests/integration/steering_receipts_test.go b/services/core/tests/integration/steering_receipts_test.go
index 71c63dc04..5a5fb8ff8 100644
--- a/services/core/tests/integration/steering_receipts_test.go
+++ b/services/core/tests/integration/steering_receipts_test.go
@@ -22,7 +22,7 @@ func TestExecutionDurableInputReceiptLifetime(t *testing.T) {
 			h.read(testExecutionRequest)
 			extra := h.message("extra", "additional")
 			var input proto.PromptSteerPayload
-			if err := h.read(proto.TypePromptSteer).DecodePayload(&input); err != nil || !input.DurableReceipt {
+			if err := h.read(proto.TypePromptSteer).DecodePayload(&input); err != nil {
 				t.Fatal("durable receipt was not requested", err)
 			}
 			h.write(first.TurnID, proto.TypePromptSteerAck, proto.PromptSteerAckPayload{InputID: input.InputID, Written: true})
diff --git a/services/core/tests/integration/structured_output_dispatch_test.go b/services/core/tests/integration/structured_output_dispatch_test.go
index 2ae4b27be..06ad11e44 100644
--- a/services/core/tests/integration/structured_output_dispatch_test.go
+++ b/services/core/tests/integration/structured_output_dispatch_test.go
@@ -8,8 +8,8 @@ import (
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine/enginetest"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/harnesstest"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/execution"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 )
@@ -17,8 +17,8 @@ import (
 func TestStructuredOutputDispatchRechecksOperationQualification(t *testing.T) {
 	h := newDispatchHarness(t)
 	configuration := json.RawMessage(`{"agent":{"model":"fixture","text":{"format":{"type":"json_schema","schema":{"type":"object"}}}},"environment":{"type":"none"}}`)
-	profile := enginetest.Profile(func(p *engine.Profile) { p.StructuredOutput = proto.CapabilitySupported })
-	policy := execution.Policy{Engines: engine.NewCatalog(map[string]engine.Profile{"fixture_harness": profile})}
+	declaration := harnesstest.Declaration("fixture_harness", func(d *harnessconfig.Declaration) { d.Capabilities.StructuredOutput = proto.CapabilitySupported })
+	policy := execution.Policy{Declarations: harnessconfig.NewRegistry(declaration)}
 	if err := policy.ValidateSessionConfiguration("fixture_harness", configuration); err != nil {
 		t.Fatal(err)
 	}
@@ -30,7 +30,7 @@ func TestStructuredOutputDispatchRechecksOperationQualification(t *testing.T) {
 	if err = bindSessionDevice(t, h.s, h.tenant, h.session.ID, h.device.ID); err != nil {
 		t.Fatal(err)
 	}
-	caps := prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, StructuredOutput: proto.CapabilitySupported, MessageItems: proto.CapabilitySupported, Preparation: proto.CapabilitySupported})
+	caps := prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, StructuredOutput: proto.CapabilitySupported, MessageItems: proto.CapabilitySupported, Preparation: proto.CapabilitySupported})
 	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "fixture_harness", Available: true, Capabilities: caps}}})
 	peer, _ := h.registry.LookupDevice(h.device.ID)
 	for deadline := time.Now().Add(3 * time.Second); ; {
@@ -46,8 +46,8 @@ func TestStructuredOutputDispatchRechecksOperationQualification(t *testing.T) {
 	input := h.message("start", "Run")
 	// A restart can remove qualification while admitted work remains queued.
 	// Runtime advertisements cannot qualify an operation on their own.
-	profile.StructuredOutput = proto.CapabilityUnsupported
-	h.d.Policy = execution.Policy{Engines: engine.NewCatalog(map[string]engine.Profile{"fixture_harness": profile})}
+	declaration.Capabilities.StructuredOutput = proto.CapabilityUnsupported
+	h.d.Policy = execution.Policy{Declarations: harnessconfig.NewRegistry(declaration)}
 	ctx, cancel := context.WithTimeout(t.Context(), time.Second)
 	defer cancel()
 	if result := <-h.run(ctx, input.TurnID); result.err == nil {
diff --git a/services/core/tests/integration/subagent_identities_test.go b/services/core/tests/integration/subagent_identities_test.go
index 4a7fccf6d..980e4cdcc 100644
--- a/services/core/tests/integration/subagent_identities_test.go
+++ b/services/core/tests/integration/subagent_identities_test.go
@@ -135,12 +135,6 @@ func TestSubagentIdentityIsAtomicScopedAndImmutable(t *testing.T) {
 	if err = sessionService(t, reopened).DeleteSession(ctx, sessions.DeleteSessionCommand{TenantID: tenant, SessionID: session.ID}); !errors.Is(err, sessions.ErrNotIdle) {
 		t.Fatal("running Session deleted", err)
 	}
-	if err = reopened.commitLegacyDeletion(ctx, tenant, session.ID); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = reopened.GetSubagentIdentity(ctx, tenant, session.ID, "child-a"); !errors.Is(err, sessions.ErrNotFound) {
-		t.Fatal("deleted Session exposed identity", err)
-	}
 }
 
 func TestSubagentIdentityRejectsLostLease(t *testing.T) {
diff --git a/services/core/tests/integration/unified_model_configuration_http_test.go b/services/core/tests/integration/unified_model_configuration_http_test.go
index 3fa13586f..90d56ed19 100644
--- a/services/core/tests/integration/unified_model_configuration_http_test.go
+++ b/services/core/tests/integration/unified_model_configuration_http_test.go
@@ -21,7 +21,7 @@ func TestUnifiedModelConfigurationHTTP(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	handler, err := publicHandler(t, st, auth, "codex", withCoreKeys(admin), withHarnesses([]string{"codex", "claude_sdk"}))
+	handler, err := publicHandler(t, st, auth, "claude_sdk", withCoreKeys(admin), withHarnesses([]string{"codex", "claude_sdk"}))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -69,10 +69,10 @@ func TestUnifiedModelConfigurationHTTP(t *testing.T) {
 			t.Fatalf("JSON mismatch: %s; want %s", got, want)
 		}
 	}
-	const path = "/core/v1/harnesses/codex/model-configuration"
-	const high = `{"model_reasoning_effort":"high"}`
-	const low = `{"model_reasoning_effort":"low"}`
-	const provider = `{"protocol":"responses","base_url":"https://deployment.example/v1","api_key":"deployment-canary"}`
+	const path = "/core/v1/harnesses/claude_sdk/model-configuration"
+	const high = `{"thinking":{"type":"enabled","budgetTokens":3000}}`
+	const low = `{"thinking":{"type":"enabled","budgetTokens":1000}}`
+	const provider = `{"protocol":"anthropic","base_url":"https://deployment.example/v1","api_key":"deployment-canary"}`
 	setDefault := func(model, native string) {
 		t.Helper()
 		body := `{"model":"` + model + `","harness_config":` + native + `,"model_provider":` + provider + `}`
@@ -84,7 +84,7 @@ func TestUnifiedModelConfigurationHTTP(t *testing.T) {
 			t.Fatal("model configuration identity changed")
 		}
 		equalJSON(view["harness_config"], native)
-		equalJSON(view["model_provider"], `{"protocol":"responses","base_url":"https://deployment.example/v1","api_key_configured":true}`)
+		equalJSON(view["model_provider"], `{"protocol":"anthropic","base_url":"https://deployment.example/v1","api_key_configured":true}`)
 	}
 	create := func(body, retry string) string {
 		t.Helper()
@@ -134,7 +134,7 @@ func TestUnifiedModelConfigurationHTTP(t *testing.T) {
 	}
 	assertSession(fresh, "model-replacement", low, "deployment", "deployment", "deployment", "deployment-canary")
 
-	const explicitProvider = `{"protocol":"responses","base_url":"https://explicit.example/v1","api_key":"explicit-canary"}`
+	const explicitProvider = `{"protocol":"anthropic","base_url":"https://explicit.example/v1","api_key":"explicit-canary"}`
 	for _, tc := range []struct{ name, body, model, modelSource, providerSource, key string }{
 		{"model replaces native defaults", `{"agent":{"model":"explicit-model"},"environment":{"type":"openai_hosted"}}`, "explicit-model", "session", "deployment", "deployment-canary"},
 		{"provider replaces native defaults", `{"agent":{},"environment":{"type":"openai_hosted"},"x_agents_core":{"model_provider":` + explicitProvider + `}}`, "model-replacement", "deployment", "session", "explicit-canary"},
@@ -161,10 +161,10 @@ func TestUnifiedModelConfigurationHTTP(t *testing.T) {
 	for _, tc := range []struct{ name, update string }{
 		{"model", `{"model":"another-model"}`},
 		{"provider", `{"x_agents_core":{"model_provider":` + explicitProvider + `}}`},
-		{"harness", `{"x_agents_core":{"harness":"claude_sdk","model_provider":` + strings.Replace(provider, `"protocol":"responses"`, `"protocol":"anthropic"`, 1) + `}}`},
+		{"harness", `{"x_agents_core":{"harness":"codex","model_provider":` + strings.Replace(provider, `"protocol":"anthropic"`, `"protocol":"responses"`, 1) + `}}`},
 	} {
 		t.Run("saved Agent "+tc.name, func(t *testing.T) {
-			body := `{"model":"saved-model","x_agents_core":{"harness":"codex","harness_config":` + high + `,"model_provider":` + provider + `}}`
+			body := `{"model":"saved-model","x_agents_core":{"harness":"claude_sdk","harness_config":` + high + `,"model_provider":` + provider + `}}`
 			id := text(object(call("POST", "/v1/agents", token, body, "", 201))["id"])
 			call("POST", "/v1/agents/"+id, token, tc.update, "", 200)
 			saved := object(call("GET", "/v1/agents/"+id, token, "", "", 200))
@@ -181,12 +181,12 @@ func TestUnifiedModelConfigurationHTTP(t *testing.T) {
 		})
 	}
 	// Disabling tools cannot enable a non-native model protocol.
-	for _, protocol := range []string{"anthropic", "chat_completions"} {
+	for _, protocol := range []string{"responses", "chat_completions"} {
 		t.Run("non-native protocol "+protocol, func(t *testing.T) {
 			incompatible := `{"protocol":"` + protocol + `","base_url":"https://model.example/v1","api_key":"rejected-canary"}`
 			agent := `{"model":"fixed-model","tools":[{"type":"web_search","mode":"disabled"}]}`
 			call("POST", "/v1/agents/sessions", token, `{"agent":`+agent+`,"environment":{"type":"openai_hosted"},"x_agents_core":{"model_provider":`+incompatible+`}}`, uuid.NewString(), 400)
-			saved := strings.TrimSuffix(agent, "}") + `,"x_agents_core":{"harness":"codex","model_provider":` + incompatible + `}}`
+			saved := strings.TrimSuffix(agent, "}") + `,"x_agents_core":{"harness":"claude_sdk","model_provider":` + incompatible + `}}`
 			call("POST", "/v1/agents", token, saved, "", 400)
 		})
 	}
diff --git a/services/core/tests/integration/vault_status_migration_test.go b/services/core/tests/integration/vault_status_migration_test.go
deleted file mode 100644
index 671568940..000000000
--- a/services/core/tests/integration/vault_status_migration_test.go
+++ /dev/null
@@ -1,83 +0,0 @@
-package integration
-
-import (
-	"context"
-	"database/sql"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/stdlib"
-	"github.com/pressly/goose/v3"
-)
-
-func TestVaultStatusMigrationPreservesResources(t *testing.T) {
-	_, pool := testStore(t)
-	ctx := t.Context()
-	schema := "vault_status_" + uuid.NewString()[:8]
-	quoted := pgx.Identifier{schema}.Sanitize()
-	if _, err := pool.Exec(ctx, "CREATE SCHEMA "+quoted); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(context.Background(), "DROP SCHEMA "+quoted+" CASCADE"); err != nil {
-			t.Error(err)
-		}
-	})
-	cfg := pool.Config().ConnConfig.Copy()
-	cfg.RuntimeParams["search_path"] = schema
-	db := sql.OpenDB(stdlib.GetConnector(*cfg))
-	t.Cleanup(func() { _ = db.Close() })
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, os.DirFS("../../migrations"), goose.WithTableName("agents_api_schema_version"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 31); err != nil {
-		t.Fatal(err)
-	}
-	id, tenant := uuid.NewString(), uuid.NewString()
-	if _, err := db.ExecContext(ctx, `INSERT INTO vaults(id,tenant_id,name,metadata) VALUES ($1,$2,'Existing Vault','{"purpose":"retained"}')`, id, tenant); err != nil {
-		t.Fatal(err)
-	}
-	snapshot := func() string {
-		t.Helper()
-		var value string
-		if err := db.QueryRowContext(ctx, "SELECT (to_jsonb(v)-'status')::text FROM vaults v WHERE id=$1", id).Scan(&value); err != nil {
-			t.Fatal(err)
-		}
-		return value
-	}
-	before := snapshot()
-	if _, err := provider.UpTo(ctx, 32); err != nil {
-		t.Fatal(err)
-	}
-	var status string
-	if err := db.QueryRowContext(ctx, "SELECT status FROM vaults WHERE id=$1", id).Scan(&status); err != nil || status != "active" || snapshot() != before {
-		t.Fatal("migration changed historical resource", status, err)
-	}
-	if err := db.QueryRowContext(ctx, "INSERT INTO vaults(id,tenant_id,metadata) VALUES ($1,$2,'{}') RETURNING status", uuid.NewString(), tenant).Scan(&status); err != nil || status != "active" {
-		t.Fatal("new Vault default", status, err)
-	}
-	for _, invalid := range []any{nil, "deleted"} {
-		if _, err := db.ExecContext(ctx, "UPDATE vaults SET status=$1 WHERE id=$2", invalid, id); err == nil {
-			t.Fatal("invalid classification accepted")
-		}
-	}
-	if _, err := provider.DownTo(ctx, 31); err != nil || snapshot() != before {
-		t.Fatal("reversible active-only migration", err)
-	}
-	if _, err := provider.UpTo(ctx, 32); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := db.ExecContext(ctx, "UPDATE vaults SET status='archived' WHERE id=$1", id); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.DownTo(ctx, 31); err == nil || !strings.Contains(err.Error(), "Cannot remove archived Vault classification") {
-		t.Fatal("downgrade lost archived classification", err)
-	}
-	if err := db.QueryRowContext(ctx, "SELECT status FROM vaults WHERE id=$1", id).Scan(&status); err != nil || status != "archived" || snapshot() != before {
-		t.Fatal("failed downgrade changed data", status, err)
-	}
-}
diff --git a/services/core/tests/integration/web_deployment_only_migration_test.go b/services/core/tests/integration/web_deployment_only_migration_test.go
deleted file mode 100644
index 1bbec6ad9..000000000
--- a/services/core/tests/integration/web_deployment_only_migration_test.go
+++ /dev/null
@@ -1,39 +0,0 @@
-package integration
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-)
-
-// A process-configured deployment refuses the upgrade; a Web-managed one
-// keeps its installation and reset in both directions.
-func TestWebDeploymentOnlyMigrationRefusesProcessDeployment(t *testing.T) {
-	db, provider := runtimeNamesMigrationSchema(t)
-	ctx := t.Context()
-	if _, err := provider.UpTo(ctx, 92); err != nil {
-		t.Fatal(err)
-	}
-	installation := uuid.NewString()
-	if _, err := db.ExecContext(ctx, `UPDATE runtime_deployment SET installation_id=$1, backend_fingerprint=$2`, installation, strings.Repeat("a", 64)); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 93); err == nil || !strings.Contains(err.Error(), "configured outside Web setup") {
-		t.Fatal("process deployment upgraded", err)
-	}
-	if _, err := db.ExecContext(ctx, `UPDATE runtime_deployment SET web_managed=true, provider_kind='docker', mode='nodes', generation=1,
-		admission_paused=true, reset_clear='force', reset_requested_at=now(), reset_forced_at=now(), reset_audit='{}'`); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.UpTo(ctx, 93); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := provider.DownTo(ctx, 92); err != nil {
-		t.Fatal(err)
-	}
-	var restored bool
-	if err := db.QueryRowContext(ctx, `SELECT web_managed AND local_node_id IS NULL AND admission_paused AND installation_id=$1 FROM runtime_deployment`, installation).Scan(&restored); err != nil || !restored {
-		t.Fatal("downgrade lost the Web installation", err)
-	}
-}
diff --git a/services/core/tests/integration/whitespace_input_public_test.go b/services/core/tests/integration/whitespace_input_public_test.go
index 8229359e7..b52379f05 100644
--- a/services/core/tests/integration/whitespace_input_public_test.go
+++ b/services/core/tests/integration/whitespace_input_public_test.go
@@ -120,20 +120,22 @@ func TestWhitespaceOnlyTextHarnessAdmissionPostgres(t *testing.T) {
 	const cancel = `{"events":[{"type":"agent.session.input.cancel"}]}`
 	const whitespace = `{"events":[{"type":"agent.session.input.message","input":[{"role":"user","content":[{"type":"input_text","text":"   "}]},{"role":"user","content":[{"type":"input_text","text":"\n\t"}]}]}]}`
 
-	codex := serve("codex")
-	admitted := codex.created(token, "/v1/agents/sessions", `{"agent":{"model":"m"},"environment":{"type":"none"},"input":"   "}`)
-	if status, body := events(codex, admitted, cancel); status != http.StatusAccepted {
-		t.Fatalf("codex cancel: %d %s", status, body)
-	}
-	if status, body := events(codex, admitted, whitespace); status != http.StatusAccepted {
-		t.Fatalf("codex events: %d %s", status, body)
-	}
-	if got := userTexts(t, codex, token, admitted); !reflect.DeepEqual(got, [][]string{{"   "}, {"   "}, {"\n\t"}}) {
-		t.Errorf("codex Items %q", got)
+	for _, engine := range []string{"codex", "claude_sdk"} {
+		client := serve(engine)
+		admitted := client.created(token, "/v1/agents/sessions", `{"agent":{"model":"m"},"environment":{"type":"none"},"input":"   "}`)
+		if status, body := events(client, admitted, cancel); status != http.StatusAccepted {
+			t.Fatalf("%s cancel: %d %s", engine, status, body)
+		}
+		if status, body := events(client, admitted, whitespace); status != http.StatusAccepted {
+			t.Fatalf("%s events: %d %s", engine, status, body)
+		}
+		if got := userTexts(t, client, token, admitted); !reflect.DeepEqual(got, [][]string{{"   "}, {"   "}, {"\n\t"}}) {
+			t.Errorf("%s Items %q", engine, got)
+		}
 	}
 
 	const rejection = `{"error":{"message":"This Session's harness does not accept a message whose text is only whitespace. Include non-whitespace text or an image, or use a harness that supports whitespace-only text.","type":"invalid_request_error","code":"unsupported_or_invalid_configuration","param":null}}` + "\n"
-	for _, engine := range []string{"claude_sdk", "mcode"} {
+	for _, engine := range []string{"mcode"} {
 		client := serve(engine)
 		session := client.created(token, "/v1/agents/sessions", `{"agent":{"model":"m"},"environment":{"type":"none"},"input":"Start."}`)
 		if status, body := events(client, session, cancel); status != http.StatusAccepted {
diff --git a/services/core/tests/integration/worker_fixture_test.go b/services/core/tests/integration/worker_fixture_test.go
index 590936407..e3c7f3679 100644
--- a/services/core/tests/integration/worker_fixture_test.go
+++ b/services/core/tests/integration/worker_fixture_test.go
@@ -17,6 +17,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/sessionpg"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimegateway"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/providers"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
 )
 
@@ -145,6 +146,7 @@ func fixtureOwner(s *Store, lease *pgunit.Lease) (execution.Owner, error) {
 		return execution.Owner{}, err
 	}
 	return execution.Owner{
+		Workspaces: fixtureWorkspaces(s, lease),
 		Lease:      lease,
 		Deployment: changes,
 		Sessions:   sessionExecution,
@@ -165,6 +167,9 @@ func webDeployment(t *testing.T, s *Store, provider string) string {
 	if err != nil {
 		t.Fatal(err)
 	}
+	if provider == "microsandbox" {
+		selectWorkspaceStorage(t, owner.Workspaces)
+	}
 	installation := uuid.NewString()
 	input := sandbox.Selection{Provider: provider, DeploymentSpec: SandboxDeploymentTestSpec(provider)}
 	if provider == "e2b" {
@@ -188,8 +193,13 @@ func webRuntimes(t testing.TB, s *Store, installation string, p sandbox.SandboxP
 		if err != nil || setup.Provider == "" {
 			return nil, err
 		}
+		adapter, err := providers.Builtin().Lookup(setup.Provider)
+		if err != nil {
+			return nil, err
+		}
 		return &execution.RuntimeProvider{InstallationID: setup.InstallationID, ProviderKind: setup.Provider, Mode: setup.Mode, Generation: setup.Generation,
-			CoreURL: "http://core.invalid/api/v1", BackendFingerprint: setup.BackendFingerprint, Provider: p, Suspension: suspension}, nil
+			CoreURL: "http://core.invalid/api/v1", BackendFingerprint: setup.BackendFingerprint, Provider: p, Suspension: suspension,
+			Resources: setup.Specification.Resources, WorkspaceRequirements: adapter.Policy.Workspace, Workspace: setup.Specification.Workspace}, nil
 	}, unusedPreparation(t))
 }
 
diff --git a/services/core/tests/integration/worker_input_race_test.go b/services/core/tests/integration/worker_input_race_test.go
index f828ce90f..cda676054 100644
--- a/services/core/tests/integration/worker_input_race_test.go
+++ b/services/core/tests/integration/worker_input_race_test.go
@@ -30,77 +30,63 @@ func (h *beforeInputRead) TraceQueryStart(ctx context.Context, _ *pgx.Conn, data
 func (*beforeInputRead) TraceQueryEnd(context.Context, *pgx.Conn, pgx.TraceQueryEndData) {}
 
 func TestWorkerInputReadSkipsConcurrentlyCancelledCandidate(t *testing.T) {
-	for _, deleted := range []bool{false, true} {
-		name := "cancel"
-		if deleted {
-			name = "delete"
+	h := newDispatchHarness(t)
+	candidate := h.message("candidate", "queued")
+	candidateSession := h.session.ID
+	_, pool := testStore(t)
+	cfg := pool.Config()
+	mutated := make(chan error, 1)
+	cfg.ConnConfig.Tracer = &beforeInputRead{run: func() {
+		_, err := submitInputs(t.Context(), h.s, h.tenant, candidateSession, "cancel", []sessions.Input{{Kind: "cancel", Payload: json.RawMessage(`{}`)}})
+		mutated <- err
+	}}
+	instrumented, err := pgxpool.NewWithConfig(t.Context(), cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer instrumented.Close()
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	worker := startWorker(t, ctx, New(t, instrumented), h.d)
+	done := make(chan error, 1)
+	go func() { done <- worker.Run(ctx) }()
+	defer func() {
+		cancel()
+		select {
+		case <-done:
+		case <-time.After(10 * time.Second):
+			t.Error("worker did not stop")
+		}
+	}()
+	select {
+	case err := <-mutated:
+		if err != nil {
+			t.Fatal(err)
 		}
-		t.Run(name, func(t *testing.T) {
-			h := newDispatchHarness(t)
-			candidate := h.message("candidate", "queued")
-			candidateSession := h.session.ID
-			_, pool := testStore(t)
-			cfg := pool.Config()
-			mutated := make(chan error, 1)
-			cfg.ConnConfig.Tracer = &beforeInputRead{run: func() {
-				if deleted {
-					// Public deletion now rejects the queued candidate; an
-					// earlier release's marker must still fence its execution.
-					mutated <- h.s.commitLegacyDeletion(t.Context(), h.tenant, candidateSession)
-					return
-				}
-				_, err := submitInputs(t.Context(), h.s, h.tenant, candidateSession, "cancel", []sessions.Input{{Kind: "cancel", Payload: json.RawMessage(`{}`)}})
-				mutated <- err
-			}}
-			instrumented, err := pgxpool.NewWithConfig(t.Context(), cfg)
-			if err != nil {
-				t.Fatal(err)
-			}
-			defer instrumented.Close()
-			ctx, cancel := context.WithCancel(t.Context())
-			defer cancel()
-			worker := startWorker(t, ctx, New(t, instrumented), h.d)
-			done := make(chan error, 1)
-			go func() { done <- worker.Run(ctx) }()
-			defer func() {
-				cancel()
-				select {
-				case <-done:
-				case <-time.After(10 * time.Second):
-					t.Error("worker did not stop")
-				}
-			}()
-			select {
-			case err := <-mutated:
-				if err != nil {
-					t.Fatal(err)
-				}
-			case <-time.After(10 * time.Second):
-				t.Fatal("input-read interleaving was not reached")
-			}
-			turn, err := sessionAdapter(h.s).GetTurn(ctx, h.tenant, candidateSession, candidate.TurnID)
-			if err != nil || turn.Status != sessions.TurnCancelled {
-				t.Fatal("candidate was not cancelled", err)
-			}
-			// A later Session must still execute through this same Worker.
-			h.session, err = h.s.CreateSession(ctx, h.tenant, sessions.CreateSession{Creator: FixtureCreator(), Engine: "codex", IdempotencyKey: "healthy", Configuration: h.session.Configuration})
-			if err != nil {
-				t.Fatal(err)
-			}
-			healthy := h.message("healthy", "continue")
-			select {
-			case err := <-done:
-				// Keep teardown able to consume the already completed Worker.
-				done <- err
-				t.Fatal("a stale candidate terminated the global Worker", err)
-			case <-time.After(650 * time.Millisecond):
-			}
-			frame := h.read(testExecutionRequest)
-			if frame.ID != healthy.TurnID {
-				t.Fatal("cancelled candidate reached the Runtime", frame.ID)
-			}
-			h.write(healthy.TurnID, proto.TypeDone, proto.DonePayload{Content: "continued"})
-			waitTurn(t, h, healthy.TurnID, sessions.TurnCompleted)
-		})
+	case <-time.After(10 * time.Second):
+		t.Fatal("input-read interleaving was not reached")
+	}
+	turn, err := sessionAdapter(h.s).GetTurn(ctx, h.tenant, candidateSession, candidate.TurnID)
+	if err != nil || turn.Status != sessions.TurnCancelled {
+		t.Fatal("candidate was not cancelled", err)
+	}
+	// A later Session must still execute through this same Worker.
+	h.session, err = h.s.CreateSession(ctx, h.tenant, sessions.CreateSession{Creator: FixtureCreator(), Engine: "codex", IdempotencyKey: "healthy", Configuration: h.session.Configuration})
+	if err != nil {
+		t.Fatal(err)
+	}
+	healthy := h.message("healthy", "continue")
+	select {
+	case err := <-done:
+		// Keep teardown able to consume the already completed Worker.
+		done <- err
+		t.Fatal("a stale candidate terminated the global Worker", err)
+	case <-time.After(650 * time.Millisecond):
+	}
+	frame := h.read(testExecutionRequest)
+	if frame.ID != healthy.TurnID {
+		t.Fatal("cancelled candidate reached the Runtime", frame.ID)
 	}
+	h.write(healthy.TurnID, proto.TypeDone, proto.DonePayload{Content: "continued"})
+	waitTurn(t, h, healthy.TurnID, sessions.TurnCompleted)
 }
diff --git a/services/core/tests/integration/worker_lease_loss_test.go b/services/core/tests/integration/worker_lease_loss_test.go
index d2b75293f..55b287768 100644
--- a/services/core/tests/integration/worker_lease_loss_test.go
+++ b/services/core/tests/integration/worker_lease_loss_test.go
@@ -14,7 +14,7 @@ import (
 func TestWorkerLeaseLossLeavesUncertainWorkForSuccessor(t *testing.T) {
 	h := newDispatchHarness(t)
 	_, pool := testStore(t)
-	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, WebSearchControl: proto.CapabilitySupported, TextVerbosity: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, Preparation: proto.CapabilitySupported})}}})
+	h.write("", proto.TypeHeartbeat, proto.HeartbeatPayload{SupportedAgentKinds: []proto.SupportedAgentKind{{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Streaming: proto.CapabilitySupported, DurableTurns: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported, ExecutionControls: proto.CapabilitySupported, SubagentControl: proto.CapabilitySupported, ToolObservations: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported, Preparation: proto.CapabilitySupported})}}})
 	h.session = publicSession(t, h, "active")
 	queued := publicSession(t, h, "queued")
 	worker := startWorker(t, t.Context(), h.s, h.d)
diff --git a/services/core/tests/integration/workspace_fixture_test.go b/services/core/tests/integration/workspace_fixture_test.go
new file mode 100644
index 000000000..37c7bc87a
--- /dev/null
+++ b/services/core/tests/integration/workspace_fixture_test.go
@@ -0,0 +1,65 @@
+package integration
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/adminaudit"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/pgunit"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/workspacepg"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/workspacefs"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/workspaces"
+)
+
+// fixtureWorkspaceInstallation seals workspace configurations in the tests; the
+// fixture adapter keeps no credential.
+const fixtureWorkspaceInstallation = "fixture-installation"
+
+// fixtureWorkspaces builds the workspace execution operations on lease as
+// cmd/server does, with the fixture adapter in place of the registered ones so
+// no test needs NFS.
+func fixtureWorkspaces(s *Store, lease *pgunit.Lease) *workspaces.ExecutionOperations {
+	return workspaces.NewExecution(workspacepg.New(s.pooled, s.credentialCipher, fixtureWorkspaceInstallation),
+		workspacepg.NewExecution(lease, s.credentialCipher, fixtureWorkspaceInstallation), fixtureControls{}, lease)
+}
+
+// selectWorkspaceStorage selects the fixture adapter on operations as an operator
+// does before Web setup.
+func selectWorkspaceStorage(t testing.TB, operations *workspaces.ExecutionOperations) {
+	t.Helper()
+	selection := workspaces.SelectionInput{Selection: workspaces.Selection{Configuration: workspacefs.Configuration{ID: uuid.NewString(), Adapter: "fixture", Parameters: json.RawMessage(`{}`)}}}
+	ctx := adminaudit.WithSource(t.Context(), adminaudit.Source{CredentialID: "fixture-admin", RequestID: uuid.NewString(), TraceID: uuid.NewString()})
+	if _, err := operations.Configure(ctx, selection, func(workspacefs.Declaration) error { return nil }); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// fixtureControls constructs the fixture adapter for every configuration.
+type fixtureControls struct{}
+
+func (fixtureControls) Normalize(c workspacefs.Configuration, _ json.RawMessage) (workspacefs.ConfigurationRecord, error) {
+	return workspacefs.ConfigurationRecord{Configuration: c}, nil
+}
+
+func (fixtureControls) Control(c workspacefs.ConfigurationRecord) (workspacefs.Control, error) {
+	return fixtureControl{configuration: c.ID}, nil
+}
+
+// fixtureControl declares what microsandbox requires and issues an attachment
+// for every Reference; Core never resolves paths.
+type fixtureControl struct{ configuration string }
+
+func (fixtureControl) Declaration() workspacefs.Declaration {
+	return workspacefs.Declaration{Attachment: workspacefs.AttachmentHostDirectory, UserXAttr: true}
+}
+func (fixtureControl) Check(context.Context) error { return nil }
+func (c fixtureControl) Create(_ context.Context, r workspacefs.Reference, _ uint32) (workspacefs.Attachment, error) {
+	return c.Observe(context.Background(), r)
+}
+func (c fixtureControl) Observe(_ context.Context, r workspacefs.Reference) (workspacefs.Attachment, error) {
+	return workspacefs.Attachment{Reference: r, ConfigurationID: c.configuration, Kind: workspacefs.AttachmentHostDirectory, Native: json.RawMessage(`{}`)}, nil
+}
+func (fixtureControl) Delete(context.Context, workspacefs.Reference) error { return nil }
diff --git a/services/core/tests/official_agent_reference_retry.py b/services/core/tests/official_agent_reference_retry.py
index 112352452..fedc07591 100644
--- a/services/core/tests/official_agent_reference_retry.py
+++ b/services/core/tests/official_agent_reference_retry.py
@@ -38,7 +38,7 @@ def mutate(**values):
         fresh = sessions.create(**spec)
         assert fresh.agent.model == "changed-model" and fresh.agent.instructions == "changed"
         assert first.agent.model == "original-model" and first.agent.instructions == "frozen"
-        mutate(patch={"service_tier":"priority"})
+        mutate(patch={"tools":[{"type":"tool_search"}]})
         expect(BadRequestError, lambda:sessions.create(**spec))
         assert sessions.create(**spec, extra_headers=headers) == first
         for changed in ({"input":"different"}, {"metadata":{"changed":"yes"}}, {"agent":{"instructions":"frozen"}}, {"agent_id":fresh.id}):
diff --git a/services/core/tests/official_agent_references.py b/services/core/tests/official_agent_references.py
index cdddefff0..ab4fb731f 100644
--- a/services/core/tests/official_agent_references.py
+++ b/services/core/tests/official_agent_references.py
@@ -59,10 +59,6 @@ def verify_agent_references(client, other, expect_error):
     # Configuration storage is broader than execution. Never silently drop an
     # unsupported saved option, but admit a supported whole-field replacement.
     for field, value, replacement in (
-        ("reasoning", {"effort": "high"}, None),
-        ("reasoning", {"summary": "auto"}, {}),
-        ("service_tier", "fast", "auto"),
-        ("text", {"format": {"type": "json_schema", "schema": {"type": "object"}}}, {"verbosity": "medium"}),
         ("tools", [dict(tool, defer_loading=True)], None),
         ("tools", [{"type": "tool_search"}], []),
     ):
@@ -78,6 +74,10 @@ def verify_agent_references(client, other, expect_error):
     for field, value, replacement in (
         ("multi_agent", {"enabled": True}, {"enabled": False}),
         ("tools", [{"type": "programmatic_tool_calling", "enabled": False}], []),
+        ("reasoning", {"effort": "high"}, {"effort": "low"}),
+        ("reasoning", {"summary": "auto"}, {"summary": "concise"}),
+        ("service_tier", "fast", "auto"),
+        ("text", {"format": {"type": "json_schema", "schema": {"type": "object"}}, "verbosity": "medium"}, {"format": {"type": "text"}, "verbosity": "medium"}),
     ):
         supported = agents.create(model="model", **{field: value})
         reference = {"input": "Verify agent references fixture admission.", "agent_id": supported.id, "environment": {"type": "none"}}
diff --git a/services/core/tests/official_agent_update.py b/services/core/tests/official_agent_update.py
index 9b4b8e7fa..bfcb395aa 100644
--- a/services/core/tests/official_agent_update.py
+++ b/services/core/tests/official_agent_update.py
@@ -86,16 +86,13 @@ def main():
                 response = http.post(base + "/v1/agents/" + target, headers=auth, json=body)
                 assert response.status_code == 400 and response.json()["error"] == expected, (body, response.text)
             assert agents.retrieve(original.id) == updated
-        # Saved web_search keeps every pinned mode (TV-05). Session admission still
-        # rejects enabled search, while a same-key retry recovers its earlier Session.
+        # Saved web_search keeps every pinned mode (TV-05). A new Session copies the
+        # live search, while a same-key retry recovers its earlier Session.
         searched = agents.update(original.id, tools=[{"type": "web_search", "context_size": "low"}])
         assert [t.to_dict() for t in searched.tools] == [
             {"type": "web_search", "mode": "live", "context_size": "low", "allowed_domains": None, "location": None}]
         assert agents.retrieve(original.id) == searched
-        response = http.post(base + "/v1/agents/sessions", headers=headers, json=spec)
-        assert response.status_code == 400 and response.json()["error"] == {
-            "type": "invalid_request_error", "code": "unsupported_or_invalid_configuration", "param": None,
-            "message": "Only disabled web_search is qualified for execution."}, response.text
+        assert [t.to_dict() for t in sessions.create(**spec).agent.tools] == [t.to_dict() for t in searched.tools]
         assert sessions.create(**spec, extra_headers=retry) == old
         emptied = agents.update(original.id, tools=[{"type": "web_search", "mode": "live", "allowed_domains": []}])
         assert http.get(endpoint, headers=headers).json()["tools"] == [
diff --git a/services/core/tests/official_client.py b/services/core/tests/official_client.py
index f066072ee..a6523a2e6 100644
--- a/services/core/tests/official_client.py
+++ b/services/core/tests/official_client.py
@@ -188,7 +188,6 @@ def issue_key(project_id, name):
                     expect_error(NotFoundError, lambda: b.beta.agents.sessions.list(after=first.id))
                     expect_error(AuthenticationError, lambda: invalid.beta.agents.sessions.retrieve(first.id))
                     expect_error(BadRequestError, lambda: sessions.retrieve(first.id, extra_headers={"OpenAI-Beta": ""}))
-                    expect_error(BadRequestError, lambda: sessions.create(**{**spec, "input": [{"role": "user", "content": [{"type": "input_image", "image_url": "https://example.com/image.png"}]}]}))
                     # A self-hosted Session carries its own write-only model provider; nothing here calls it.
                     provider = {"protocol": "responses", "base_url": "https://model.fixture.example/v1", "api_key": "fixture-model-key"}
                     self_hosted = sessions.create(agent=spec["agent"], environment={"type": "self_hosted", "workspace_directory": "/workspace"},
diff --git a/services/core/tests/official_environment_activity.py b/services/core/tests/official_environment_activity.py
index 88d5a399d..24b3c1a70 100644
--- a/services/core/tests/official_environment_activity.py
+++ b/services/core/tests/official_environment_activity.py
@@ -153,7 +153,7 @@ def snapshot(name, status):
                 assert raw.get("/agents/sessions/" + session_id + suffix,
                                headers={"Authorization": "Bearer " + foreign}).status_code == 404
             create = raw.post("/agents/sessions", json={"agent": {"model": "MiniMax-M3"}, "input": [{"role": "user", "content": [
-                              {"type": "input_image", "image_url": "https://example.com/image.png"}]}],
+                              {"type": "input_image", "image_url": ""}]}],
                               "environment": {"type": "self_hosted", "workspace_directory": settings["workspace_directory"]}})
             assert create.status_code == 400
             submit = raw.post("/agents/sessions/" + session_id + "/events", json={"events": [{
diff --git a/services/core/tests/official_function_images.py b/services/core/tests/official_function_images.py
index f23133896..8a56dc355 100644
--- a/services/core/tests/official_function_images.py
+++ b/services/core/tests/official_function_images.py
@@ -77,7 +77,7 @@ def run(sid, output=None, expected=None, cancel=False, failed_text=False, valida
                     key = "result-" + action.call_id
                     if validate:
                         before = items(sid)
-                        invalid_urls = ["https://example.test/image.png", "data:image/png;base64,?", "data:image/png;base64,AQID"]
+                        invalid_urls = ["https://example.test/image.png", "data:image/png;base64,?"]
                         # Claude rejects malformed/remote and error images before consuming a call.
                         if proof["kind"] == "claude_sdk":
                             invalid = [{**result, "output": [{"type": "input_image", "image_url": u}]} for u in invalid_urls]
diff --git a/services/core/tests/official_mcp.py b/services/core/tests/official_mcp.py
index b41d95ffb..2e0f553a7 100644
--- a/services/core/tests/official_mcp.py
+++ b/services/core/tests/official_mcp.py
@@ -71,13 +71,12 @@ def verify_mcp_configuration(client, other, expect_error):
                 {**tool, "request_metadata": {"x": "y"}},
                 {**tool, "allowed_tools": [None]}]
     for changes in ({"headers": {"Authorization": "synthetic-private"}},
-                    {"authorization": "synthetic-private"},
-                    {"server_url": "https://mcp.example.invalid/mcp?token=synthetic-private"}):
+                    {"authorization": "synthetic-private"}):
         invalid.append({**tool, "transport": {**transport, **changes}})
-    # A pinned stdio transport stays unsupported with or without an origin; a
+    # A stdio server runs in the Environment, so a service origin is rejected; a
     # malformed one gets the official field error first.
     stdio, malformed = {"type": "stdio", "command": "synthetic-private", "cwd": "/"}, {"type": "stdio", "command": "synthetic-private"}
-    invalid += [{**minimal, "transport": stdio}, {**tool, "transport": stdio}, {**tool, "transport": malformed}]
+    invalid += [{**tool, "transport": stdio}, {**tool, "transport": malformed}]
     for declaration in invalid:
         for prefix, operation in (
             ("", lambda: agents.create(model="requested-model", tools=[declaration])),
@@ -87,7 +86,7 @@ def verify_mcp_configuration(client, other, expect_error):
             error = expect_error(BadRequestError, operation)
             assert "synthetic-private" not in str(error.body)
             if declaration["transport"] is stdio:
-                assert error.body["message"] == "MCP currently supports HTTP transport only."
+                assert error.body["message"] == "MCP stdio servers run in the Environment; connection_origin must be environment."
             if declaration["transport"] is malformed:
                 assert error.body["message"] == f"Missing required parameter: '{prefix}tools[0].transport.cwd'."
     assert {item.id for item in sessions.list()} == before
diff --git a/services/core/tests/official_message_images.py b/services/core/tests/official_message_images.py
index d7aeee37c..528f0984c 100644
--- a/services/core/tests/official_message_images.py
+++ b/services/core/tests/official_message_images.py
@@ -137,7 +137,7 @@ def check_items(sid):
         assert len(sessions.turns.list(session.id).data) == 2
         check_items(session.id)
         before = [t.id for t in sessions.turns.list(session.id).data]
-        invalid = [message_event(messages([text("must not be admitted")])), message_event(messages([{"type": "input_image", "image_url": "https://example.test/image.png"}]))]
+        invalid = [message_event(messages([text("must not be admitted")])), message_event(messages([{"type": "input_image", "image_url": ""}]))]
         response = http.post(base + "/v1/agents/sessions/" + session.id + "/events", headers=headers, json={"events": invalid})
         assert response.status_code == 400
         assert [t.id for t in sessions.turns.list(session.id).data] == before
diff --git a/services/core/tests/official_session_initial_input.py b/services/core/tests/official_session_initial_input.py
index c5cdc1b84..ade5ca5f0 100644
--- a/services/core/tests/official_session_initial_input.py
+++ b/services/core/tests/official_session_initial_input.py
@@ -90,7 +90,7 @@ def user_texts(session_id):
         for fields in [{"input": [{"type": None, "role": "user", "content": [{"type": "input_text", "text": "x"}]}]}, {"input": 0}, {"input": {}}, {"input": []}, {"input": ""},
                        {"input": [{"role": "user", "content": []}]}, {"input": [{"role": "user", "content": [{"type": "input_text", "text": ""}]}]},
                        {"input": [{"role": "assistant", "content": [{"type": "input_text", "text": "x"}]}]},
-                       {"input": [{"role": "user", "content": [{"type": "input_image", "image_url": "https://example.com/x.png"}]}]}]:
+                       {"input": [{"role": "user", "content": [{"type": "input_image", "image_url": ""}]}]}]:
             reply = raw.post(base + "/v1/agents/sessions", headers=headers, json={**spec, **fields})
             assert reply.status_code == 400, (fields, reply.status_code)
         reply = raw.post(unsupported + "/v1/agents/sessions", headers=headers, json={**spec, "input": "x"})
diff --git a/services/core/tests/official_tool_policy.py b/services/core/tests/official_tool_policy.py
index 1da3e06fa..695c166dd 100644
--- a/services/core/tests/official_tool_policy.py
+++ b/services/core/tests/official_tool_policy.py
@@ -8,7 +8,7 @@
 from types import SimpleNamespace
 
 import httpx2
-from openai import BadRequestError, NotFoundError, OpenAI
+from openai import NotFoundError, OpenAI
 
 
 def main():
@@ -77,15 +77,6 @@ def execute(entry, prompt, creation=None):
         entry[stage + "_events"] = events
         save()
 
-    def reject_configuration(payload, message):
-        error = request("POST", "/sessions", status=400, json=payload)["error"]
-        assert error["code"] == "unsupported_or_invalid_configuration" and error["message"] == message, error
-        try:
-            sessions.create(**payload)
-            raise AssertionError("Unsupported enabled tool configuration was admitted")
-        except BadRequestError:
-            pass
-
     try:
         if stage == "initial":
             sdk_agent = client.beta.agents.create(**config)
@@ -126,20 +117,6 @@ def reject_configuration(payload, message):
                     save()
                     check_config(sid)
                     execute(entry, prompt, creation=creation)
-            search_only = "Only disabled web_search is qualified for execution."
-            ptc_only = "Programmatic tool calling is not qualified for execution."
-            for enabled, message in [({"type": "web_search", "mode": "cached"}, search_only),
-                                     ({"type": "web_search", "mode": "live"}, search_only),
-                                     ({"type": "programmatic_tool_calling", "enabled": True}, ptc_only)]:
-                reject_configuration({"agent": {"model": model, "tools": [enabled]}, "environment": {"type": "none"}, "input": "Verify rejected tool policy configuration."}, message)
-                reject_configuration({"agent_id": sdk_agent.id, "agent": {"tools": [enabled]}, "environment": {"type": "none"}, "input": "Verify rejected tool policy configuration."}, message)
-            # Saving PTC intent is independent of Session execution qualification.
-            enabled_agent = client.beta.agents.create(model=model, tools=[{"type": "programmatic_tool_calling", "enabled": True}])
-            reject_configuration({"agent_id": enabled_agent.id, "environment": {"type": "none"}, "input": "Verify rejected tool policy configuration."}, ptc_only)
-            # Saved enabled or omitted-mode search is resource data (TV-05); admission still rejects it.
-            for search in ({"type": "web_search"}, {"type": "web_search", "mode": "cached"}):
-                searched = client.beta.agents.create(model=model, tools=[search])
-                reject_configuration({"agent_id": searched.id, "environment": {"type": "none"}, "input": "Verify rejected tool policy configuration."}, search_only)
             # Omitted-tool default projections are covered by the queued SDK/raw
             # resource fixture; these live cases exercise explicit disabled tools.
             for aid in proof["agents"]:
diff --git a/services/core/tests/official_workspace_images_native.py b/services/core/tests/official_workspace_images_native.py
deleted file mode 100644
index fa9b4bfe4..000000000
--- a/services/core/tests/official_workspace_images_native.py
+++ /dev/null
@@ -1,254 +0,0 @@
-"""Common hosted image acceptance through fixed SDK, HTTP and real native tools."""
-
-import base64
-import importlib.metadata
-import json
-from pathlib import Path
-import secrets
-import time
-
-from image_fixture import picture
-from session_cleanup import delete_session
-
-
-def verify_workspace_images(client, foreign, http, model, kind, restart, evidence):
-    """restart(session_id, environment_id) cold-restarts the owned Core/Runtime."""
-    pin = json.loads((Path(__file__).resolve().parents[3] / "contracts/agents-api/upstream.json").read_text())
-    distribution = importlib.metadata.distribution("openai")
-    assert distribution.version == pin["sdk_version"]
-    assert json.loads(distribution.read_text("direct_url.json"))["vcs_info"]["commit_id"] == pin["commit"]
-    sessions = client.beta.agents.sessions
-    root = str(client.base_url).rstrip("/") + "/agents"
-    headers = {"Authorization": "Bearer " + client.api_key, "OpenAI-Beta": "agents=v1"}
-    foreign_headers = {**headers, "Authorization": "Bearer " + foreign.api_key}
-    proof = {"engine": kind, "checks": [], "runs": [], "calls": []}
-    expected_messages = []
-    sid = None
-
-    def save():
-        Path(evidence).write_text(json.dumps(proof, indent=2))
-
-    def check(name):
-        proof["checks"].append(name)
-        save()
-        print(name, flush=True)
-
-    def text(value):
-        return {"type": "input_text", "text": value}
-
-    def messages(parts):
-        return [{"role": "user", "content": parts}]
-
-    def event(value):
-        return {"type": "agent.session.input.message", "input": value}
-
-    def image_messages(url, path):
-        return messages([text("Inspect this image."), {"type": "input_image", "image_url": url},
-                         text("Remember its four band colors in left-to-right order.")]) + messages([
-            text("Use native workspace tools to write exactly the four lowercase color names, separated by commas and no newline, to " + path +
-                 ". Create the parent directory if necessary. Do not call get_visual. Then reply with the same colors.")])
-
-    def until(predicate, timeout=240):
-        deadline = time.monotonic() + timeout
-        while time.monotonic() < deadline:
-            result = predicate()
-            if result:
-                return result
-            time.sleep(0.2)
-        raise AssertionError("Public workflow did not reach expected state")
-
-    def items():
-        response = http.get(root + "/sessions/" + sid + "/items", headers=headers, params={"order": "asc", "limit": 100})
-        assert response.status_code == 200
-        raw = response.json()["data"]
-        assert not response.json()["has_more"], "Acceptance exceeded its bounded item page"
-        assert raw == [i.to_dict() for i in sessions.items.list(sid, order="asc", limit=100).data]
-        return raw
-
-    def history():
-        stored = items()
-        assert [i["content"] for i in stored if i["type"] == "message" and i.get("role") == "user"] == [m["content"] for m in expected_messages]
-        outputs = {i["call_id"]: i for i in stored if i["type"] == "function_call_output"}
-        for call in proof["calls"]:
-            assert outputs[call["call_id"]]["output"] == call["output"]
-        return stored
-
-    def post(events, key=None, foreign_request=False):
-        hdr = dict(foreign_headers if foreign_request else headers)
-        if key:
-            hdr["Idempotency-Key"] = key
-        return http.post(root + "/sessions/" + sid + "/events", headers=hdr, json={"events": events})
-
-    def verify_file(path, expected, turn):
-        answers = [i for i in items() if i["type"] == "message" and i.get("role") == "assistant"]
-        answer = " ".join(p["text"] for p in answers[-1]["content"] if p["type"] == "output_text").lower()
-        positions = [answer.find(color) for color in expected]
-        assert all(p >= 0 for p in positions) and positions == sorted(positions), answer
-        artifacts = list(sessions.artifacts.list(sid, limit=100))
-        matches = [a for a in artifacts if a.path == path and a.turn_id == turn]
-        assert len(matches) == 1, [a.to_dict() for a in artifacts]
-        artifact = matches[0]
-        with sessions.artifacts.with_streaming_response.content(artifact.id, session_id=sid) as response:
-            assert response.read() == ",".join(expected).encode()
-        assert any(f.path == path for f in client.beta.agents.environments.files.list(eid, path="/workspace/outputs"))
-        for suffix in ("", "/content"):
-            assert http.get(root + "/sessions/" + sid + "/artifacts/" + artifact.id + suffix, headers=foreign_headers).status_code == 404
-
-    def run(value, handler=None):
-        observed = []
-        handled = False
-        with sessions.events.stream(sid, timeout=300) as stream:
-            sessions.events.create(sid, events=[event(value)])
-            expected_messages.extend(value)
-            for received in stream:
-                observed.append(received.to_dict())
-                if received.type == "agent.session.requires_action":
-                    assert handler is not None and not handled
-                    assert len(received.session.required_actions) == 1
-                    action = received.session.required_actions[0]
-                    assert action.name == "get_visual"
-                    handled = True
-                    handler(action)
-                assert received.type not in {"agent.session.failed", "agent.session.turn.failed"}, received.to_dict()
-                if received.type == "agent.session.idle" and any(e["type"] == "agent.session.turn.created" for e in observed):
-                    break
-            else:
-                raise AssertionError("SSE ended without idle")
-        proof["runs"].append(observed)
-        save()
-        types = [e["type"] for e in observed]
-        terminal = [t for t in types if t in {"agent.session.turn.completed", "agent.session.turn.cancelled"}]
-        assert len(terminal) == 1
-        assert types[-1] == "agent.session.idle"
-        assert types.index("agent.session.turn.created") < types.index(terminal[0]) < len(types) - 1
-        assert len({e["event_id"] for e in observed}) == len(observed)
-        assert handled == (handler is not None)
-        turn = sessions.turns.list(sid, order="desc").data[0]
-        assert terminal[0] == "agent.session.turn." + turn.status
-        history()
-        return turn
-
-    def submit(action, output, validate=False):
-        result = {"type": "agent.session.input.tool_result", "turn_id": action.turn_id,
-                  "call_id": action.call_id, "success": True, "output": output}
-        key = "result-" + action.call_id
-        before = items()
-        if validate:
-            if kind == "claude_sdk":
-                invalid = [{**result, "success": False}, {**result, "output": [{"type": "input_image", "image_url": "https://example.test/image.png"}]}]
-                for bad in invalid:
-                    assert post([bad], key).status_code == 400
-                    assert items() == before
-                    assert sessions.retrieve(sid).required_actions[0].call_id == action.call_id
-            assert post([result], foreign_request=True).status_code == 404
-            assert post([{**result, "call_id": "unknown-call"}]).status_code in {400, 404, 409}
-            assert items() == before
-        sessions.events.create(sid, events=[result], idempotency_key=key)
-        assert post([result], key).status_code == 202
-        assert post([{**result, "output": "conflict"}], key).status_code == 409
-        proof["calls"].append(result)
-
-    colors = ["red", "green", "blue", "yellow"]
-    secrets.SystemRandom().shuffle(colors)
-    initial = image_messages(picture(colors), "/workspace/outputs/initial.txt")
-    try:
-        session = sessions.create(agent={"model": model, "tools": [{"type": "function", "name": "get_visual",
-            "description": "Wait for a visual supplied by the caller.", "parameters": {"type": "object", "properties": {}, "additionalProperties": False}}]},
-            environment={"type": "openai_hosted"}, input=initial)
-        sid, eid = session.id, session.environment.id
-        proof.update(session=sid, environment=eid, initial_colors=colors)
-        expected_messages.extend(initial)
-        save()
-
-        def initial_done():
-            turns = sessions.turns.list(sid, order="asc", limit=100).data
-            if not turns or turns[-1].status not in {"completed", "failed", "cancelled"}:
-                return False
-            assert len(turns) == 1 and turns[0].status == "completed", [t.to_dict() for t in turns]
-            return turns[0]
-
-        first = until(initial_done)
-        verify_file("/workspace/outputs/initial.txt", colors, first.id)
-        history()
-        check("initial_png_native_workspace_files_artifact")
-
-        jpeg = "data:image/jpeg;base64," + base64.b64encode((Path(__file__).parent / "testdata/function-bands.jpg").read_bytes()).decode()
-        idle = messages([{"type": "input_image", "image_url": jpeg}]) + messages([text(
-            "Write this image's four lowercase band colors from left to right, comma-separated with no newline, to /workspace/outputs/idle.txt using native tools. Reply with those colors. Do not call get_visual.")])
-        turn = run(idle)
-        verify_file("/workspace/outputs/idle.txt", ["yellow", "blue", "red", "green"], turn.id)
-        check("prepared_image_only_jpeg_and_message_boundary")
-
-        active_colors = colors[1:] + colors[:1]
-        def active(action):
-            incoming = image_messages(picture(active_colors), "/workspace/outputs/active.txt")
-            batch = [event(incoming)]
-            sessions.events.create(sid, events=batch, idempotency_key="active-image")
-            expected_messages.extend(incoming)
-            assert post(batch, "active-image").status_code == 202
-            assert post([event(messages([text("conflict")]))], "active-image").status_code == 409
-            submit(action, "The user supplied an image. Follow its instructions, then stop.")
-        turn = run(messages([text("Call get_visual once and wait. Then follow the incoming image instructions.")]), active)
-        verify_file("/workspace/outputs/active.txt", active_colors, turn.id)
-        check("active_image_input_retry_and_native_tools")
-
-        result_colors = colors[2:] + colors[:2]
-        output = [text("Inspect this visual."), {"type": "input_image", "image_url": picture(result_colors, 15)}, text("Remember these band colors.")]
-        turn = run(messages([text("Call get_visual exactly once. Read its returned image and use native tools to write its four lowercase band colors in left-to-right order, comma-separated with no newline, to /workspace/outputs/result.txt. Reply with the colors. Do not call get_visual again.")]),
-                   lambda action: submit(action, output, validate=True))
-        verify_file("/workspace/outputs/result.txt", result_colors, turn.id)
-        check("large_function_image_result_receipt_retry_isolation_and_artifact")
-
-        before = history()
-        invalid = [event(messages([text("must not persist")])), event(messages([{"type": "input_image", "image_url": "https://example.test/image.png"}]))]
-        assert post(invalid).status_code == 400
-        assert history() == before
-        for suffix in ("", "/items", "/turns", "/artifacts"):
-            assert http.get(root + "/sessions/" + sid + suffix, headers=foreign_headers).status_code == 404
-        assert post([event(initial)], foreign_request=True).status_code == 404
-        assert http.get(root + "/environments/" + eid + "/files", headers=foreign_headers).status_code == 404
-        check("unsupported_message_batch_is_atomic_and_foreign_resources_hidden")
-
-        other = sessions.create(agent={"model": model}, environment={"type": "openai_hosted"})
-        try:
-            source_artifact = list(sessions.artifacts.list(sid, limit=100))[0]
-            for suffix in ("", "/content"):
-                assert http.get(root + "/sessions/" + other.id + "/artifacts/" + source_artifact.id + suffix, headers=headers).status_code == 404
-            response = http.post(root + "/sessions/" + other.id + "/events", headers=headers, json={"events": [proof["calls"][-1]]})
-            assert response.status_code in {400, 404, 409}
-            assert sessions.items.list(other.id).data == []
-            until(lambda: client.beta.agents.environments.retrieve(other.environment.id).status == "connected")
-            response = http.get(root + "/environments/" + other.environment.id + "/files", headers=headers, params={"path": "/workspace/outputs"})
-            assert response.status_code in {200, 404}
-            if response.status_code == 200:
-                assert response.json()["data"] == []
-            assert history() == before
-            check("same_tenant_session_result_artifact_and_workspace_isolation")
-        finally:
-            delete_session(sessions, other.id)
-
-        restart(sid, eid)
-        assert history() == before
-        turn = run(messages([text("Recall the most recent image returned by get_visual from conversation history, without reading any file or calling get_visual. Write its four lowercase band colors in order, comma-separated with no newline, to /workspace/outputs/resumed.txt using native tools, then reply with them.")]))
-        verify_file("/workspace/outputs/resumed.txt", result_colors, turn.id)
-        assert len(sessions.turns.list(sid, limit=100).data) == 5
-        check("cold_core_runtime_history_continuation_without_replay")
-
-        pending = []
-        def cancel(action):
-            pending.append(action.call_id)
-            for _ in range(2):
-                sessions.events.create(sid, events=[{"type": "agent.session.input.cancel"}], idempotency_key="cancel-image-pending")
-        turn = run(messages([text("Call get_visual exactly once and wait for its result.")]), cancel)
-        assert turn.status == "cancelled" and not sessions.retrieve(sid).required_actions
-        assert not any(i["type"] == "function_call_output" and i["call_id"] == pending[0] for i in items())
-        run(messages([text("Reply only PLAIN_OK. Do not call any tools.")]))
-        assert len(sessions.turns.list(sid, limit=100).data) == 7
-        assert any(i["type"] == "message" and i.get("role") == "assistant" and any("PLAIN_OK" in p.get("text", "") for p in i["content"]) for i in items())
-        check("pending_cancel_retry_and_text_continuation")
-        proof["passed"] = True
-        return proof["checks"]
-    finally:
-        save()
-        if sid:
-            delete_session(sessions, sid)
diff --git a/services/core/tools/e2b-provider/README.md b/services/core/tools/e2b-provider/README.md
index 60494acc8..bee9d23c2 100644
--- a/services/core/tools/e2b-provider/README.md
+++ b/services/core/tools/e2b-provider/README.md
@@ -1,6 +1,6 @@
 # E2B Sandbox Provider helper
 
-Core's E2B Sandbox Provider ([`sandbox/e2b`](../../internal/sandbox/e2b)) is a pure-Go adapter that runs this one-shot Python helper for each lifecycle and read operation. The helper uses the official E2B Python SDK 2.51.0 ([`requirements.lock`](requirements.lock)); it implements no provider HTTP, envd RPC, scheduler or network service. E2B uses direct placement: there is no node, and each sandbox's daemon connects to Core over the public URL. Runtime execution and Files use that daemon connection. [Add a Sandbox Provider](../../../../docs/sandbox-provider.md) owns the provider contract this adapter implements.
+Core's E2B Sandbox Provider ([`sandbox/e2b`](../../internal/sandbox/e2b)) is a pure-Go adapter that runs this one-shot Python helper for each lifecycle and read operation. The helper uses the official E2B Python SDK 2.51.0 ([`requirements.lock`](requirements.lock)); it implements no provider HTTP, envd RPC, scheduler or network service. E2B uses direct placement: there is no node, and each sandbox's daemon connects to Core over the public URL. Runtime execution and Files use that daemon connection. [Sandbox Provider protocol](../../../../docs/sandbox-provider.md) owns the provider contract this adapter implements.
 
 ## Deployment
 
@@ -26,7 +26,7 @@ Compatible endpoints must return the SDK 2.51.0 template-list and template-build
 
 ## Private JSON boundary
 
-[`helper_contract.go`](../../internal/sandbox/e2b/helper_contract.go) owns the adapter-private wire types, version, operation and error vocabulary, and bounds. Its generator projects Python declarations into the helper and template sources, deriving managed-bootstrap fields from the Sandbox Provider types, network access values from `agentnetwork.Policy.Validate`, and the SDK version from the hashed dependency lock. The command-input limit comes from its shared Go contract. The generated modules have no SDK or repository dependency and ship with the frozen helper and protected template startup scripts.
+[`helper_contract.go`](../../internal/sandbox/e2b/helper_contract.go) owns the adapter-private wire types, version, operation and error vocabulary, and bounds. Its generator projects Python declarations into the helper and template sources, deriving managed-bootstrap fields from the Sandbox Provider types and the SDK version from the hashed dependency lock. The command-input limit comes from its shared Go contract. The generated modules have no SDK or repository dependency and ship with the frozen helper and protected template startup scripts.
 
 Run `go generate ./services/core/internal/sandbox/e2b` from the repository root after changing these declarations. `make check-e2b-provider` and the Go adapter tests reject stale projections; both languages consume generated valid and invalid exchanges covering wire types, extra fields, operation/reference bounds and managed-bootstrap fields. The helper build copies those fixtures with its source before running the pinned-SDK suite.
 
@@ -34,7 +34,7 @@ The boundary has version 4. Managed bootstrap and Resume accept an omitted or nu
 
 ## Receipts and state directory
 
-`OAC_E2B_STATE_DIR` ([configuration](../../../../docs/configuration.md#appendix-core-environment-without-the-installer)) must already exist, be owned by the helper's user and grant no group or other access. Keep it on durable private storage across Core upgrades and restarts. Its receipts hold SDK connection material, ownership identities and one-shot creation claims; they are not Core execution state. Losing the directory cannot authorize recreation or successful cleanup; never delete receipts after an uncertain call.
+`OAC_E2B_STATE_DIR` ([configuration](../../../../docs/configuration.md#appendix-core-environment-without-the-installer)) must already exist, be owned by the helper's user and grant no group or other access. Keep it on durable private storage across Core restarts. Its receipts hold SDK connection material, ownership identities and one-shot creation claims; they are not Core execution state. Losing the directory cannot authorize recreation or successful cleanup; never delete receipts after an uncertain call.
 
 A helper holds its allocation's lock until the SDK operation returns, even after Core's caller times out. Core tracks the helper's actual exit, and a credential change waits for running helpers without killing them. Helper exit never proves that a remote Create settled. Core serializes lifecycle requests per allocation and never replays Create.
 
@@ -44,7 +44,7 @@ A helper holds its allocation's lock until the SDK operation returns, even after
 2. Record the sandbox ID and connection material, check the sandbox domain, then read the sandbox by ID and check its ownership metadata, template and resources before writing any credential. A mismatch records a settled rejection and returns `CreateSettled` with the error.
 3. Check that `/opt/oac-e2b/managed_init.py` has regular-file type through SDK file information, then open it through the SDK streaming file API as root and close the response without downloading its contents. This verifies readability without a remote probe process. Then write the managed bootstrap input to `/root/.oac/e2b/managed-bootstrap.json` and run `managed_init.py` as root.
 
-`managed_init.py` prepares the image as the [application-managed startup](../../deploy/e2b/README.md#startup-and-security-boundary) does, writes the [Runtime bootstrap](../../../../docs/runtime-bootstrap.md) file to `/home/runtime/runtime-bootstrap.json` (mode 0600, owned by UID 1000), sets the Environment, Session and network variables and starts `oac-daemon connect --profile default --bootstrap-file /home/runtime/runtime-bootstrap.json` as UID/GID 1000. It records process handoff in `/root/.oac/e2b/managed-ready.json` and refuses to run again once any launch record exists. `BootstrapComplete` becomes true when Core validates that record with the expected identity. The initialization command returns the bounded durable receipt on its existing output stream, avoiding a separate file read on successful Create; Core still rereads cloud ownership and configuration before returning. If the command response is lost or its receipt is unreadable, inspection can recover the record without replaying startup; it does not prove enrollment or native readiness.
+`managed_init.py` prepares the image as the [application-managed startup](../../deploy/e2b/README.md#startup-and-security-boundary) does, writes the [Runtime bootstrap](../../../../docs/runtime-bootstrap.md) file to `/home/runtime/runtime-bootstrap.json` (mode 0600, owned by UID 1000), sets the Environment and Session variables and starts `oac-daemon connect --profile default --bootstrap-file /home/runtime/runtime-bootstrap.json` as UID/GID 1000. It records process handoff in `/root/.oac/e2b/managed-ready.json` and refuses to run again once any launch record exists. `BootstrapComplete` becomes true when Core validates that record with the expected identity. The initialization command returns the bounded durable receipt on its existing output stream, avoiding a separate file read on successful Create; Core still rereads cloud ownership and configuration before returning. If the command response is lost or its receipt is unreadable, inspection can recover the record without replaying startup; it does not prove enrollment or native readiness.
 
 An unknown Create is never repeated. A Create whose connection material was lost can be discovered and destroyed but cannot resume bootstrap, and an unconfirmed startup requires reclaiming the whole allocation.
 
diff --git a/services/core/tools/e2b-provider/helper_contract_generated.py b/services/core/tools/e2b-provider/helper_contract_generated.py
index d454cdd8c..3144cb41c 100644
--- a/services/core/tools/e2b-provider/helper_contract_generated.py
+++ b/services/core/tools/e2b-provider/helper_contract_generated.py
@@ -2,15 +2,14 @@
 """Adapter-private wire declarations. No SDK or repository dependency."""
 COMPUTE_FIELDS = ["Generation","Name","ID","RestoredFrom"]
 ERROR_CODES = ["","invalid","ownership","exists","not_found","command_unconfirmed","unconfirmed","template_invalid","team_mismatch","unauthorized"]
-MANAGED_BOOTSTRAP_FIELDS = ["Workspace","TenantID","EnvironmentID","AllocationID","SessionID","DeviceID","NetworkAccess","AllowedDomains","InstallationID","RuntimeBootstrap"]
-MANAGED_BOOTSTRAP_REQUIRED_FIELDS = ["TenantID","EnvironmentID","AllocationID","SessionID","DeviceID","NetworkAccess","AllowedDomains","InstallationID","RuntimeBootstrap"]
+MANAGED_BOOTSTRAP_FIELDS = ["Workspace","TenantID","EnvironmentID","AllocationID","SessionID","DeviceID","InstallationID","RuntimeBootstrap"]
+MANAGED_BOOTSTRAP_REQUIRED_FIELDS = ["TenantID","EnvironmentID","AllocationID","SessionID","DeviceID","InstallationID","RuntimeBootstrap"]
 MANAGED_IDENTITY_FIELDS = ["TenantID","EnvironmentID","AllocationID","SessionID","DeviceID","InstallationID"]
 MAX_COMMAND_INPUT = 52428832
 MAX_CREDENTIAL_REFERENCES = 32
 MAX_OUTPUT = 1048576
 MAX_REQUEST = 75497472
 MAX_RESPONSE = 16777216
-NETWORK_ACCESS = ["enabled","disabled","restricted"]
 OPERATIONS = ["create","inspect","renew","kill","command","validate_deployment","observe","list_templates","list_builds","verify_credential","compute_info","compute_renew","suspend","resume","compute_kill","delete_retained","compute_command","resume_compute"]
 PROTOCOL_VERSION = 4
 REFERENCE_FIELDS = ["TenantID","EnvironmentID","AllocationID"]
diff --git a/services/core/tools/e2b-provider/provider_test.py b/services/core/tools/e2b-provider/provider_test.py
index 8263abe5c..85941d734 100644
--- a/services/core/tools/e2b-provider/provider_test.py
+++ b/services/core/tools/e2b-provider/provider_test.py
@@ -111,7 +111,7 @@ def setUp(self):
                         'Reference': self.reference, 'Deadline': (datetime.now(timezone.utc) + timedelta(seconds=30)).isoformat(),
                         'Bootstrap': dict(self.reference, SessionID=str(uuid4()), DeviceID=str(uuid4()),
                                           CoreURL='https://core.example/api/v1', Credential='private-runtime-secret',
-                                          Harness='codex', NetworkAccess='enabled', AllowedDomains=[])}
+                                          Harness='codex')}
         self.request['RuntimeBootstrap'] = {
             'version': 2, 'harness': 'codex', 'core_url': self.request['Bootstrap']['CoreURL'],
             'device_id': self.request['Bootstrap']['DeviceID'],
diff --git a/services/core/tools/e2b-provider/state.py b/services/core/tools/e2b-provider/state.py
index 86eeba3c3..d44fffb39 100644
--- a/services/core/tools/e2b-provider/state.py
+++ b/services/core/tools/e2b-provider/state.py
@@ -55,8 +55,7 @@ def load_receipt(path, identity, config):
         data = json.load(source)
     if data.get('identity') != identity or data.get('version') != 1:
         raise Failure('ownership')
-    # Receipts from releases before custom endpoints belong to official E2B.
-    if data.get('endpoint', endpoint_identity({})) != endpoint_identity(config):
+    if data.get('endpoint') != endpoint_identity(config):
         raise Failure('ownership')
     return data
 
diff --git a/services/core/tools/e2b-provider/state_test.py b/services/core/tools/e2b-provider/state_test.py
index 7de903990..14cb27b1e 100644
--- a/services/core/tools/e2b-provider/state_test.py
+++ b/services/core/tools/e2b-provider/state_test.py
@@ -56,7 +56,7 @@ def test_receipt_symlink_is_never_followed(self):
                 pass
         self.assertEqual(witness.read_text(), 'unchanged')
 
-    def test_receipt_is_bound_to_endpoint_and_legacy_is_official(self):
+    def test_receipt_is_bound_to_endpoint(self):
         with Receipt(self.request, lambda: 1) as receipt:
             receipt.save(status='create_pending')
             path = receipt.path
@@ -66,14 +66,6 @@ def test_receipt_is_bound_to_endpoint_and_legacy_is_official(self):
         with self.assertRaises(Failure):
             with Receipt(custom, lambda: 1):
                 pass
-        data = json.loads(path.read_text())
-        del data['endpoint']
-        path.write_text(json.dumps(data))
-        with Receipt(self.request, lambda: 1) as receipt:
-            self.assertEqual(receipt.data['status'], 'create_pending')
-        with self.assertRaises(Failure):
-            with Receipt(custom, lambda: 1):
-                pass
 
     def test_foreign_identity_and_world_readable_receipt_rejected(self):
         with Receipt(self.request, lambda: 1) as receipt:
diff --git a/services/core/tools/e2b-provider/testdata/contract.json b/services/core/tools/e2b-provider/testdata/contract.json
index bd22db5b3..d87431079 100644
--- a/services/core/tools/e2b-provider/testdata/contract.json
+++ b/services/core/tools/e2b-provider/testdata/contract.json
@@ -1,64 +1,55 @@
 [
-{"kind":"managed","name":"disabled","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"disabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":true},
-{"kind":"managed","name":"enabled","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":true},
-{"kind":"managed","name":"invalid-AllowedDomains","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":"example.com","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"invalid-AllowedDomains","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":[1],"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"invalid-DeviceID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":null,"EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"invalid-DeviceID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"invalid","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"invalid-Extra","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Extra":true,"InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"invalid-NetworkAccess","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":null,"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"invalid-NetworkAccess","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"unknown","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"invalid-NetworkAccess","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":true,"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"missing-AllocationID","payload":{"AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"missing-AllowedDomains","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"missing-DeviceID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"missing-EnvironmentID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"missing-InstallationID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"missing-NetworkAccess","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"missing-RuntimeBootstrap","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"missing-SessionID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
-{"kind":"managed","name":"missing-TenantID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444"},"valid":false},
-{"kind":"managed","name":"restricted","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":["example.com"],"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"restricted","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":true},
-{"kind":"managed","name":"workspace-\u003cnil\u003e","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111","Workspace":null},"valid":true},
-{"kind":"managed","name":"workspace-map[]","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","NetworkAccess":"enabled","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111","Workspace":{}},"valid":false},
-{"kind":"request","name":"command","payload":{"Version":4,"Operation":"command","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"compute_command","payload":{"Version":4,"Operation":"compute_command","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Command":{"Args":["true"],"Directory":"","Stdin":null},"Compute":{"Generation":0,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":null},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"compute_info","payload":{"Version":4,"Operation":"compute_info","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Compute":{"Generation":0,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":null},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"compute_kill","payload":{"Version":4,"Operation":"compute_kill","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Compute":{"Generation":0,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":null},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"compute_renew","payload":{"Version":4,"Operation":"compute_renew","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Compute":{"Generation":0,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":null},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"config-null","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":null,"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
-{"kind":"request","name":"create","payload":{"Version":4,"Operation":"create","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"delete_retained","payload":{"Version":4,"Operation":"delete_retained","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Retained":{"Reference":"33333333-3333-4333-8333-333333333333","ID":"66666666-6666-4666-8666-666666666666","Data":"opaque","OperationID":"66666666-6666-4666-8666-666666666666","SourceGeneration":0,"SourceName":"33333333-3333-4333-8333-333333333333","SourceID":"native-fixture"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"extra","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Extra":true,"Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
-{"kind":"request","name":"inspect","payload":{"Version":4,"Operation":"inspect","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"kill","payload":{"Version":4,"Operation":"kill","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"list_builds","payload":{"Version":4,"Operation":"list_builds","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"list_templates","payload":{"Version":4,"Operation":"list_templates","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"observe","payload":{"Version":4,"Operation":"observe","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"operation-null","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":null,"Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
-{"kind":"request","name":"operation-unknown","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"unsupported","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
-{"kind":"request","name":"reference-null","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":null,"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
-{"kind":"request","name":"reference-type","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":"invalid","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
-{"kind":"request","name":"renew","payload":{"Version":4,"Operation":"renew","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"resume","payload":{"Version":4,"Operation":"resume","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Resume":{"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"OperationID":"66666666-6666-4666-8666-666666666666","Retained":{"Reference":"33333333-3333-4333-8333-333333333333","ID":"66666666-6666-4666-8666-666666666666","Data":"opaque","OperationID":"66666666-6666-4666-8666-666666666666","SourceGeneration":0,"SourceName":"33333333-3333-4333-8333-333333333333","SourceID":"native-fixture"},"Target":{"Generation":1,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":{"Reference":"33333333-3333-4333-8333-333333333333","ID":"66666666-6666-4666-8666-666666666666","Data":"opaque","OperationID":"66666666-6666-4666-8666-666666666666","SourceGeneration":0,"SourceName":"33333333-3333-4333-8333-333333333333","SourceID":"native-fixture"}},"ReconcileOnly":false},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"resume-workspace-\u003cnil\u003e","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"resume","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"Resume":{"OperationID":"66666666-6666-4666-8666-666666666666","ReconcileOnly":false,"Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"Retained":{"Data":"opaque","ID":"66666666-6666-4666-8666-666666666666","OperationID":"66666666-6666-4666-8666-666666666666","Reference":"33333333-3333-4333-8333-333333333333","SourceGeneration":0,"SourceID":"native-fixture","SourceName":"33333333-3333-4333-8333-333333333333"},"Target":{"Generation":1,"ID":"native-fixture","Name":"33333333-3333-4333-8333-333333333333","RestoredFrom":{"Data":"opaque","ID":"66666666-6666-4666-8666-666666666666","OperationID":"66666666-6666-4666-8666-666666666666","Reference":"33333333-3333-4333-8333-333333333333","SourceGeneration":0,"SourceID":"native-fixture","SourceName":"33333333-3333-4333-8333-333333333333"}},"Workspace":null},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":true},
-{"kind":"request","name":"resume-workspace-map[]","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"resume","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"Resume":{"OperationID":"66666666-6666-4666-8666-666666666666","ReconcileOnly":false,"Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"Retained":{"Data":"opaque","ID":"66666666-6666-4666-8666-666666666666","OperationID":"66666666-6666-4666-8666-666666666666","Reference":"33333333-3333-4333-8333-333333333333","SourceGeneration":0,"SourceID":"native-fixture","SourceName":"33333333-3333-4333-8333-333333333333"},"Target":{"Generation":1,"ID":"native-fixture","Name":"33333333-3333-4333-8333-333333333333","RestoredFrom":{"Data":"opaque","ID":"66666666-6666-4666-8666-666666666666","OperationID":"66666666-6666-4666-8666-666666666666","Reference":"33333333-3333-4333-8333-333333333333","SourceGeneration":0,"SourceID":"native-fixture","SourceName":"33333333-3333-4333-8333-333333333333"}},"Workspace":{}},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
-{"kind":"request","name":"resume_compute","payload":{"Version":4,"Operation":"resume_compute","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Compute":{"Generation":0,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":null},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"suspend","payload":{"Version":4,"Operation":"suspend","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Suspend":{"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"OperationID":"66666666-6666-4666-8666-666666666666","Source":{"Generation":0,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":null},"Retained":null,"ReconcileOnly":false},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"validate_deployment","payload":{"Version":4,"Operation":"validate_deployment","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"verify_credential","payload":{"Version":4,"Operation":"verify_credential","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"References":[{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"}],"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"verify_credential-count-0","payload":{"Version":4,"Operation":"verify_credential","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"verify_credential-count-32","payload":{"Version":4,"Operation":"verify_credential","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"References":[{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000001-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000002-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000003-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000004-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000005-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000006-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000007-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000008-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000009-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000a-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000b-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000c-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000d-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000e-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000f-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000010-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000011-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000012-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000013-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000014-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000015-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000016-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000017-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000018-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000019-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001a-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001b-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001c-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001d-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001e-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001f-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000020-3333-4333-8333-333333333333"}],"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
-{"kind":"request","name":"verify_credential-count-33","payload":{"Version":4,"Operation":"verify_credential","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"References":[{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000001-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000002-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000003-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000004-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000005-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000006-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000007-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000008-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000009-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000a-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000b-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000c-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000d-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000e-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000f-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000010-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000011-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000012-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000013-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000014-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000015-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000016-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000017-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000018-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000019-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001a-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001b-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001c-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001d-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001e-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001f-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000020-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000021-3333-4333-8333-333333333333"}],"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","NetworkAccess":"enabled","AllowedDomains":null},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":false},
-{"kind":"request","name":"verify_credential-references-type","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"verify_credential","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"References":{},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
-{"kind":"request","name":"verify_credential-references-type","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"verify_credential","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"References":"invalid","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
-{"kind":"request","name":"verify_credential-references-type","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"verify_credential","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"References":[null],"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
-{"kind":"request","name":"version-bool","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":true},"valid":false},
-{"kind":"request","name":"version-null","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":null},"valid":false},
-{"kind":"request","name":"version-string","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":"1"},"valid":false},
-{"kind":"request","name":"version-unknown","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":5},"valid":false},
-{"kind":"request","name":"workspace-\u003cnil\u003e","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111","Workspace":null},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":true},
-{"kind":"request","name":"workspace-map[]","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","AllowedDomains":null,"CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","NetworkAccess":"enabled","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111","Workspace":{}},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
+{"kind":"managed","name":"invalid-DeviceID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","DeviceID":null,"EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
+{"kind":"managed","name":"invalid-DeviceID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","DeviceID":"invalid","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
+{"kind":"managed","name":"invalid-Extra","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Extra":true,"InstallationID":"66666666-6666-4666-8666-666666666666","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
+{"kind":"managed","name":"missing-AllocationID","payload":{"DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
+{"kind":"managed","name":"missing-DeviceID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
+{"kind":"managed","name":"missing-EnvironmentID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","DeviceID":"55555555-5555-4555-8555-555555555555","InstallationID":"66666666-6666-4666-8666-666666666666","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
+{"kind":"managed","name":"missing-InstallationID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
+{"kind":"managed","name":"missing-RuntimeBootstrap","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
+{"kind":"managed","name":"missing-SessionID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"TenantID":"11111111-1111-4111-8111-111111111111"},"valid":false},
+{"kind":"managed","name":"missing-TenantID","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444"},"valid":false},
+{"kind":"managed","name":"valid","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"valid":true},
+{"kind":"managed","name":"workspace-\u003cnil\u003e","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111","Workspace":null},"valid":true},
+{"kind":"managed","name":"workspace-map[]","payload":{"AllocationID":"33333333-3333-4333-8333-333333333333","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","InstallationID":"66666666-6666-4666-8666-666666666666","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111","Workspace":{}},"valid":false},
+{"kind":"request","name":"command","payload":{"Version":4,"Operation":"command","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"compute_command","payload":{"Version":4,"Operation":"compute_command","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Command":{"Args":["true"],"Directory":"","Stdin":null},"Compute":{"Generation":0,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":null},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"compute_info","payload":{"Version":4,"Operation":"compute_info","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Compute":{"Generation":0,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":null},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"compute_kill","payload":{"Version":4,"Operation":"compute_kill","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Compute":{"Generation":0,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":null},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"compute_renew","payload":{"Version":4,"Operation":"compute_renew","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Compute":{"Generation":0,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":null},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"config-null","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":null,"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
+{"kind":"request","name":"create","payload":{"Version":4,"Operation":"create","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"delete_retained","payload":{"Version":4,"Operation":"delete_retained","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Retained":{"Reference":"33333333-3333-4333-8333-333333333333","ID":"66666666-6666-4666-8666-666666666666","Data":"opaque","OperationID":"66666666-6666-4666-8666-666666666666","SourceGeneration":0,"SourceName":"33333333-3333-4333-8333-333333333333","SourceID":"native-fixture"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"extra","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Extra":true,"Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
+{"kind":"request","name":"inspect","payload":{"Version":4,"Operation":"inspect","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"kill","payload":{"Version":4,"Operation":"kill","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"list_builds","payload":{"Version":4,"Operation":"list_builds","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"list_templates","payload":{"Version":4,"Operation":"list_templates","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"observe","payload":{"Version":4,"Operation":"observe","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"operation-null","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":null,"Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
+{"kind":"request","name":"operation-unknown","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"unsupported","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
+{"kind":"request","name":"reference-null","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":null,"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
+{"kind":"request","name":"reference-type","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":"invalid","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
+{"kind":"request","name":"renew","payload":{"Version":4,"Operation":"renew","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"resume","payload":{"Version":4,"Operation":"resume","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Resume":{"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"OperationID":"66666666-6666-4666-8666-666666666666","Retained":{"Reference":"33333333-3333-4333-8333-333333333333","ID":"66666666-6666-4666-8666-666666666666","Data":"opaque","OperationID":"66666666-6666-4666-8666-666666666666","SourceGeneration":0,"SourceName":"33333333-3333-4333-8333-333333333333","SourceID":"native-fixture"},"Target":{"Generation":1,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":{"Reference":"33333333-3333-4333-8333-333333333333","ID":"66666666-6666-4666-8666-666666666666","Data":"opaque","OperationID":"66666666-6666-4666-8666-666666666666","SourceGeneration":0,"SourceName":"33333333-3333-4333-8333-333333333333","SourceID":"native-fixture"}},"ReconcileOnly":false},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"resume-workspace-\u003cnil\u003e","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"resume","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"Resume":{"OperationID":"66666666-6666-4666-8666-666666666666","ReconcileOnly":false,"Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"Retained":{"Data":"opaque","ID":"66666666-6666-4666-8666-666666666666","OperationID":"66666666-6666-4666-8666-666666666666","Reference":"33333333-3333-4333-8333-333333333333","SourceGeneration":0,"SourceID":"native-fixture","SourceName":"33333333-3333-4333-8333-333333333333"},"Target":{"Generation":1,"ID":"native-fixture","Name":"33333333-3333-4333-8333-333333333333","RestoredFrom":{"Data":"opaque","ID":"66666666-6666-4666-8666-666666666666","OperationID":"66666666-6666-4666-8666-666666666666","Reference":"33333333-3333-4333-8333-333333333333","SourceGeneration":0,"SourceID":"native-fixture","SourceName":"33333333-3333-4333-8333-333333333333"}},"Workspace":null},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":true},
+{"kind":"request","name":"resume-workspace-map[]","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"resume","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"Resume":{"OperationID":"66666666-6666-4666-8666-666666666666","ReconcileOnly":false,"Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"Retained":{"Data":"opaque","ID":"66666666-6666-4666-8666-666666666666","OperationID":"66666666-6666-4666-8666-666666666666","Reference":"33333333-3333-4333-8333-333333333333","SourceGeneration":0,"SourceID":"native-fixture","SourceName":"33333333-3333-4333-8333-333333333333"},"Target":{"Generation":1,"ID":"native-fixture","Name":"33333333-3333-4333-8333-333333333333","RestoredFrom":{"Data":"opaque","ID":"66666666-6666-4666-8666-666666666666","OperationID":"66666666-6666-4666-8666-666666666666","Reference":"33333333-3333-4333-8333-333333333333","SourceGeneration":0,"SourceID":"native-fixture","SourceName":"33333333-3333-4333-8333-333333333333"}},"Workspace":{}},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
+{"kind":"request","name":"resume_compute","payload":{"Version":4,"Operation":"resume_compute","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Compute":{"Generation":0,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":null},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"suspend","payload":{"Version":4,"Operation":"suspend","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Suspend":{"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"OperationID":"66666666-6666-4666-8666-666666666666","Source":{"Generation":0,"Name":"33333333-3333-4333-8333-333333333333","ID":"native-fixture","RestoredFrom":null},"Retained":null,"ReconcileOnly":false},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"validate_deployment","payload":{"Version":4,"Operation":"validate_deployment","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"verify_credential","payload":{"Version":4,"Operation":"verify_credential","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"References":[{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"}],"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"verify_credential-count-0","payload":{"Version":4,"Operation":"verify_credential","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"verify_credential-count-32","payload":{"Version":4,"Operation":"verify_credential","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"References":[{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000001-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000002-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000003-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000004-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000005-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000006-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000007-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000008-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000009-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000a-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000b-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000c-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000d-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000e-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000f-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000010-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000011-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000012-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000013-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000014-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000015-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000016-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000017-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000018-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000019-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001a-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001b-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001c-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001d-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001e-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001f-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000020-3333-4333-8333-333333333333"}],"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":true},
+{"kind":"request","name":"verify_credential-count-33","payload":{"Version":4,"Operation":"verify_credential","Config":{"Binary":"","StateDir":"","InstallationID":"66666666-6666-4666-8666-666666666666","APIKey":"","Template":"","APIURL":"","Domain":"","TimeoutSeconds":0,"Resources":null},"Reference":{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333"},"References":[{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000001-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000002-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000003-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000004-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000005-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000006-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000007-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000008-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000009-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000a-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000b-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000c-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000d-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000e-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000000f-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000010-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000011-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000012-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000013-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000014-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000015-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000016-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000017-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000018-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000019-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001a-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001b-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001c-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001d-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001e-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"0000001f-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000020-3333-4333-8333-333333333333"},{"TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"00000021-3333-4333-8333-333333333333"}],"Bootstrap":{"Harness":"codex","TenantID":"11111111-1111-4111-8111-111111111111","EnvironmentID":"22222222-2222-4222-8222-222222222222","AllocationID":"33333333-3333-4333-8333-333333333333","SessionID":"44444444-4444-4444-8444-444444444444","DeviceID":"55555555-5555-4555-8555-555555555555","CoreURL":"https://core.example/api/v1","Credential":"fixture-only"},"RuntimeBootstrap":{"version":2,"core_url":"https://core.example/api/v1","device_id":"55555555-5555-4555-8555-555555555555","credential":"fixture-only","harness":"codex"},"Deadline":"2099-01-01T00:00:00Z"},"valid":false},
+{"kind":"request","name":"verify_credential-references-type","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"verify_credential","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"References":{},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
+{"kind":"request","name":"verify_credential-references-type","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"verify_credential","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"References":"invalid","RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
+{"kind":"request","name":"verify_credential-references-type","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"verify_credential","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"References":[null],"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
+{"kind":"request","name":"version-bool","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":true},"valid":false},
+{"kind":"request","name":"version-null","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":null},"valid":false},
+{"kind":"request","name":"version-string","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":"1"},"valid":false},
+{"kind":"request","name":"version-unknown","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111"},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":5},"valid":false},
+{"kind":"request","name":"workspace-\u003cnil\u003e","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111","Workspace":null},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":true},
+{"kind":"request","name":"workspace-map[]","payload":{"Bootstrap":{"AllocationID":"33333333-3333-4333-8333-333333333333","CoreURL":"https://core.example/api/v1","Credential":"fixture-only","DeviceID":"55555555-5555-4555-8555-555555555555","EnvironmentID":"22222222-2222-4222-8222-222222222222","Harness":"codex","SessionID":"44444444-4444-4444-8444-444444444444","TenantID":"11111111-1111-4111-8111-111111111111","Workspace":{}},"Config":{"APIKey":"","APIURL":"","Binary":"","Domain":"","InstallationID":"66666666-6666-4666-8666-666666666666","Resources":null,"StateDir":"","Template":"","TimeoutSeconds":0},"Deadline":"2099-01-01T00:00:00Z","Operation":"create","Reference":{"AllocationID":"33333333-3333-4333-8333-333333333333","EnvironmentID":"22222222-2222-4222-8222-222222222222","TenantID":"11111111-1111-4111-8111-111111111111"},"RuntimeBootstrap":{"core_url":"https://core.example/api/v1","credential":"fixture-only","device_id":"55555555-5555-4555-8555-555555555555","harness":"codex","version":2},"Version":4},"valid":false},
 {"kind":"response","name":"error-","payload":{"Version":4,"ErrorCode":""},"valid":true},
 {"kind":"response","name":"error-command_unconfirmed","payload":{"Version":4,"ErrorCode":"command_unconfirmed"},"valid":true},
 {"kind":"response","name":"error-exists","payload":{"Version":4,"ErrorCode":"exists"},"valid":true},
diff --git a/services/core/tools/microsandbox-provider/README.md b/services/core/tools/microsandbox-provider/README.md
index 475249881..33cd932f4 100644
--- a/services/core/tools/microsandbox-provider/README.md
+++ b/services/core/tools/microsandbox-provider/README.md
@@ -1,8 +1,8 @@
 # microsandbox Sandbox Provider helper
 
-microsandbox runs each hosted Session in its own microVM on a Linux amd64 node with KVM, and it is the Sandbox Provider that supports idle suspension. Core forwards provider operations to the node over the [node protocol](../../../../contracts/agents-api/node-generation-protocol.md); the node's adapter ([`sandbox/microsandbox`](../../internal/sandbox/microsandbox)) runs this helper once per operation. The private helper wire version is 5; mismatches are rejected. The helper links the microsandbox Go SDK v0.7.8 with its FFI library, so Core and the node program stay CGO-free Go binaries. It implements the suspension operations of the provider-neutral `sandbox.SandboxProvider` with full snapshots. It has no daemon, lifecycle database, scheduler or network control plane.
+microsandbox runs each hosted Session in its own microVM on a Linux amd64 node with KVM, and supports idle suspension. Core forwards provider operations to the node over the [node protocol](../../../../contracts/agents-api/node-generation-protocol.md); the node's adapter ([`sandbox/microsandbox`](../../internal/sandbox/microsandbox)) runs this helper once per operation. The private helper wire version is 7; mismatches are rejected. The helper links the microsandbox Go SDK v0.7.8 with its FFI library, so Core and the node program stay CGO-free Go binaries. It implements the checkpoint operations of the provider-neutral `sandbox.SandboxProvider` with full snapshots. It has no daemon, lifecycle database, scheduler or network control plane.
 
-[Add a Sandbox Provider](../../../../docs/sandbox-provider.md) owns the provider contract. [Sandbox deployment](../../../../contracts/agents-api/sandbox-deployment.md) owns the resources, Runtime release and suspension policy; the [nodes guide](../../../../docs/getting-started/nodes.md) owns node installation, host requirements, the node's directories and its network policy.
+[Sandbox Provider protocol](../../../../docs/sandbox-provider.md) owns the provider contract. [Sandbox deployment](../../../../contracts/agents-api/sandbox-deployment.md) owns the resources and suspension policy; the [nodes guide](../../../../docs/getting-started/nodes.md) owns node installation, host requirements, the node's directories and its network policy.
 
 ## Installation checks
 
@@ -12,15 +12,15 @@ Before every operation the helper checks that it was built with the exact offici
 
 The runtime home must be private (mode 0700), short, on local persistent storage and used by no other installation, profile or manual lifecycle tool. microsandbox uses Unix sockets there, so the node installer refuses a home whose path would exceed their limit. The home holds confidential VM disks, memory snapshots and SDK state; preserve it with the node identity and Core's database when recovering a host. Every managed lifecycle change goes through the provider.
 
-The Runtime image is an immutable `repository@sha256:<64 lowercase hex>` reference that matches the saved Runtime release; bare image IDs and mutable tags are rejected. The node installer imports the distribution's image under that reference. To load an image by hand, `msb image load --tag repository@sha256:<digest>` must register the digest reference explicitly, with the manifest digest from `image inspect`, not the Docker image config ID. The image carries the daemon, Python 3, the native Harnesses and the shared Runtime helpers. The provider installs no registry credentials. Creation uses the SDK's `never` pull policy.
+The Runtime image is an immutable `repository@sha256:<64 lowercase hex>` reference that the node's `provider.json` records as `native.image`; bare image IDs and mutable tags are rejected. The node installer imports the distribution's image under that reference. To load an image by hand, `msb image load --tag repository@sha256:<digest>` must register the digest reference explicitly, with the manifest digest from `image inspect`, not the Docker image config ID. The image carries the daemon, Python 3, the native Harnesses and the shared Runtime helpers. The provider installs no registry credentials. Creation uses the SDK's `never` pull policy.
 
-The checkpoint root is a separate adapter-owned directory, mode 0700, with a private `.oac-checkpoint-store` UUID marker. It is never derived from a workspace binding and must not be reachable through any guest mount. Archives contain confidential RAM and root-disk state. The marker and installation identity define the artifact domain; native release and binary hashes, Runtime image, kernel, CPU features and guest geometry define the conservative execution class. Filesystem paths, hostnames and local SDK homes do not define compatibility. Nodes can share this private root at different mount paths; the backing store must preserve durable writes, atomic rename and cross-host file locks. The installer's local default only advertises its own domain.
+The checkpoint root is a separate adapter-owned directory, mode 0700, with a private `.oac-checkpoint-store` UUID marker. It is never derived from a workspace binding and must not be reachable through any guest mount. Snapshots contain confidential RAM and root-disk state. The marker and installation identity define the artifact domain; native release and binary hashes, Runtime image, kernel, CPU features and guest geometry define the conservative execution class. Filesystem paths, hostnames and local SDK homes do not define compatibility. Nodes can share this private root at different mount paths; the backing store must preserve durable writes, atomic rename and cross-host file locks. The installer's local default only advertises its own domain.
 
 ## Create and bootstrap
 
-Create names the VM from a hash of the installation and allocation reference plus the compute generation; a name never serves another incarnation. It creates the VM with the saved CPUs and memory as both initial and maximum, a managed root disk of `root_disk_mib`, an owned ext4 disk of `environment_disk_mib` or the explicitly resolved external directory mounted at `/environment`, user 1000:1000, working directory `/` and the node's network policy ([`bootstrap.go`](bootstrap.go)). The resource checks run before bootstrap. Creation and restore retain the SDK's strict hostname policy enforcement; the adapter does not disable it.
+Create names the VM from a hash of the installation and allocation reference plus the compute generation; a name never serves another incarnation. It creates the VM with the saved CPUs and memory as both initial and maximum, a managed root disk of `root_disk_mib`, the explicitly resolved workspace directory mounted at `/environment`, user 1000:1000, working directory `/` and the node's network policy ([`bootstrap.go`](bootstrap.go)). The resource checks run before bootstrap. Creation and restore retain the SDK's strict hostname policy enforcement; the adapter does not disable it.
 
-Workspace, staging and outputs share the `/environment` filesystem, which keeps the Runtime's cross-device and link checks intact; the layered root filesystem can report different device IDs for a directory and its upper-layer files, so it holds no workspace data. In owned mode, full snapshots and sandbox removal capture, restore and reclaim this disk. In external mode, the filesystem provider owns the directory; sandbox removal never deletes it. The binding and resource rules belong to [Independent workspace attachment](../../../../docs/sandbox-provider.md#independent-workspace-attachment). The [Runtime bootstrap](../../../../docs/runtime-bootstrap.md) owns the Runtime directory layout.
+Workspace, staging and outputs share the `/environment` filesystem, which keeps the Runtime's cross-device and link checks intact; the layered root filesystem can report different device IDs for a directory and its upper-layer files, so it holds no workspace data. The filesystem provider owns the directory; sandbox removal never deletes it. The binding and resource rules belong to [Workspace filesystem protocol](../../../../docs/workspace-provider.md#attachment). The [Runtime bootstrap](../../../../docs/runtime-bootstrap.md) owns the Runtime directory layout.
 
 VM creation does not run the image's entry point. The bootstrap runs as root through confidential standard input, with a two-minute limit. It creates the Runtime directories and the private control directory `/run/oac` (mode 0700, owned by UID 1000), writes the [Runtime bootstrap](../../../../docs/runtime-bootstrap.md) file to `/home/runtime/runtime-bootstrap.json`, bind-mounts `/environment/workspace` at `/workspace` and starts `oac-daemon connect --bootstrap-file` in the background as UID/GID 1000. `OAC_RUNTIME_DAEMON_SUSPEND_PID_FILE=/run/oac/daemon-suspend.json` enables the daemon's park and wake control. The `io.oac.bootstrap` label then changes from `pending` to `complete` through the SDK's next-start modification policy, because v0.7.8 cannot update the labels of a running VM. That label confirms only these writes and the launch, not authentication or native readiness.
 
@@ -30,17 +30,17 @@ A helper response carries `CreateSettled` with a configuration rejection only af
 
 Core persists operation IDs, source and target generations, exact identities and snapshot evidence before it depends on them. `Initial` and `NewCompute` only construct references and allocate nothing.
 
-- **Suspend** pauses the exact VM, captures and verifies the full checkpoint closure, then exports an SDK archive without the Runtime image into the private checkpoint root; the execution class pins that image, which every compatible node holds. The adapter hashes the archive once as it publishes it and synchronizes the archive and its digest, size and ownership receipt before force-stopping the exact paused source, removing its writable disks and deleting its local SDK snapshot. Only after that cleanup is synchronized does `SourceStopped` authorize transfer. A matching artifact is completed instead of captured again; a running source is never killed to finish an old capture.
+- **Suspend** pauses the exact VM and has the SDK capture the full checkpoint closure directly into its own group directory `s-<operation>` in the private checkpoint root (`SnapshotCreateOptions.DestDir`). The SDK makes the snapshot durable (the closure is hard-linked on the same filesystem, otherwise copied and fsynced, then its directories, descriptor and group head are synced). The adapter verifies the snapshot once, writes the ownership receipt next to it, force-stops the exact paused source and removes its writable disks. Only after that cleanup is synchronized does `SourceStopped` authorize transfer. The snapshot excludes the Runtime image; the execution class pins that image, which every compatible node holds. A matching snapshot is completed instead of captured again; a running source is never killed to finish an old capture.
 - **KillCompute** fences future admission for the exact target and checks its incarnation before stopping and removing it. Under that dispatch fence the SDK serializes against native launch, waits for the runtime lifecycle lock on Kill, and rechecks the terminal incarnation under that lock on Remove. A final typed absence permits a durable cleanup receipt, including for an admitted restore whose launcher died. This proves the writer is gone, never that it did not execute.
-- **Restore** requires the source-settled archive receipt, matching artifact domain and execution class, and the complete archive hash before importing through the SDK, then the imported snapshot's full verification. Before native restore, the snapshot's captured image digest must equal the pinned Runtime image digest and that image must be in the local image store; otherwise restore fails as invalid without starting the target. This metadata check does not prove that every cached image object is present. The pinned SDK's restore has no pull-policy option and uses `if-missing`; missing cache objects can trigger a registry request pinned to the captured manifest digest. A failed resolution leaves the restore unresolved for exact observation and cleanup; it never substitutes another image or cold-boots the Session. Restore then creates the precommitted target name. An existing target is adopted only when its immutable ID, if known, and its persisted `snapshot_parent` agree. Upstream restore defaults to public networking, so restore passes the same explicit host policy as creation, and no undeclared host resource or mount is inherited.
-- Native restore leaves the managed root size unset because the target inherits the verified full snapshot. The helper accepts that only with a matching snapshot resource proof and the exact source and target identities, and it checks the target's CPU, memory and Environment disk before keeping the inherited proof. A missing root size never counts as unlimited capacity, and retained state is never resized.
+- **Restore** requires the source-settled receipt, matching artifact domain and execution class, and the snapshot's full verification, then restores directly from the snapshot directory; another node that mounts the same checkpoint root does the same. Before native restore, the snapshot's captured image digest must equal the pinned Runtime image digest and that image must be in the local image store; otherwise restore fails as invalid without starting the target. This metadata check does not prove that every cached image object is present. The pinned SDK's restore has no pull-policy option and uses `if-missing`; missing cache objects can trigger a registry request pinned to the captured manifest digest. A failed resolution leaves the restore unresolved for exact observation and cleanup; it never substitutes another image or cold-boots the Session. Restore then creates the precommitted target name. An existing target is adopted only when its immutable ID, if known, and its persisted `snapshot_parent` agree. Upstream restore defaults to public networking, so restore passes the same explicit host policy as creation, and no undeclared host resource or mount is inherited.
+- Native restore leaves the managed root size unset because the target inherits the verified full snapshot. The helper accepts that only with a matching snapshot resource proof and the exact source and target identities, and it checks the target's CPU and memory before keeping the inherited proof. A missing root size never counts as unlimited capacity, and retained state is never resized.
 - Fresh restore and retry share one completion: verify the original artifact and resource proof, inspect the running target's resources and ancestry, persist its missing derived resource-proof label, then strictly reread the same native ID ([`restore_completion.go`](restore_completion.go)). A conflicting proof is an error. Native restore does not copy the source's ownership labels; ancestry supplies that evidence. There is no ordinary Start, replacement, disk-only restore or cold boot.
 - **ResumeCompute** thaws the same resident source after an aborted suspension. The pinned SDK handle method is name-based; the allocation lock and ID checks before and after the call fence every managed replacement. Manual lifecycle changes in the managed namespace are unsupported.
-- **DeleteRetained** accepts only the derived operation selector and matching artifact identity. It compares the SDK descriptor digest, which covers the checkpoint root, instead of re-hashing payloads, so damaged content never blocks owned cleanup. It fences delayed publication and restoration with a durable deletion receipt before deleting the local SDK snapshot and portable archive. An unsettled admitted restore blocks deletion. The small ownership tombstone remains; Core owns retention and cleanup order.
+- **DeleteRetained** (the private snapshot-delete operation) accepts only the derived operation selector and matching artifact identity. It fences delayed publication and restoration with a durable deletion receipt, then removes everything else in the operation directory without opening the snapshot, so damaged content or a staging directory left by an interrupted capture never blocks owned cleanup. An unsettled admitted restore blocks deletion. The small ownership tombstone remains; Core owns retention and cleanup order.
 
-After a lost response Core uses `ObserveOnly`. It never starts a capture or restore. For an existing verified capture it may complete archive publication and exact paused-source cleanup, but never captures again or kills a running source. Source termination is recorded before local removal so a lost cleanup response can be settled from the archive receipt. A valid ownership receipt remains discoverable when archive bytes are missing or corrupt: observation returns its snapshot identity with unknown source state and `SourceStopped=false`, so ordinary explicit cleanup can proceed. Restore still requires complete archive verification. An interrupted restore may finish the derived proof on the exact running target, but never restarts a stopped target or restores again.
+After a lost response Core uses `ObserveOnly`. It never starts a capture or restore. For an existing verified capture it may complete the receipt and exact paused-source cleanup, but never captures again or kills a running source. Source termination is recorded before local removal so a lost cleanup response can be settled from the receipt. A valid ownership receipt remains discoverable when the snapshot is missing or corrupt: observation returns its snapshot identity with unknown source state and `SourceStopped=false`, so ordinary explicit cleanup can proceed. Restore still requires full snapshot verification. An interrupted restore may finish the derived proof on the exact running target, but never restarts a stopped target or restores again.
 
-Before native import or restore, the helper synchronizes an admission record bound to the request operation, snapshot and target. Observation of a never-admitted operation writes a permanent closed record and returns that exact `RestoreAttemptClosed`; late dispatch is rejected. A fresh dispatch checks its existing request deadline after admission and immediately before calling native Restore. If the deadline has elapsed, it durably closes its exact attempt while still holding the allocation lock and returns without invoking Restore. Native FFI waits remain uncancelled. Import or qualification errors keep the admission open, avoiding repeated attempts against an invalid archive. This proof is never inferred from a previous admission or a native Restore error. After admission, helper death or native absence alone never establishes no effect. Observation checks an admitted target before reading the archive; typed absence or a non-running target remains unconfirmed without hashing or importing the archive. A running target still requires complete archive verification. Successful resume requires an observable exact running target. A failed or uncertain admitted restore retains its artifact and owner until explicit deletion or the original retention deadline; the normal cleanup operation uses the native lifecycle fence and records completion. It never shortens retention or substitutes a cold restart.
+Before native restore, the helper synchronizes an admission record bound to the request operation, snapshot and target. Observation of a never-admitted operation writes a permanent closed record and returns that exact `RestoreAttemptClosed`; late dispatch is rejected. A fresh dispatch checks its existing request deadline after admission and immediately before calling native Restore. If the deadline has elapsed, it durably closes its exact attempt while still holding the allocation lock and returns without invoking Restore. Native FFI waits remain uncancelled. Any other failure of that fresh dispatch before native Restore also closes its attempt. A missing snapshot, a failed receipt, identity or integrity check, or a failed resource, workspace or runtime-image qualification also marks the record unusable: every later request for the operation returns `checkpoint_unusable`, and Core [ends the checkpoint's retention](../../../../docs/sandbox-provider.md#cold-replacement-after-checkpoint-retention). This proof is never inferred from a previous admission or a native Restore error. After admission, helper death or native absence alone never establishes no effect. Observation checks an admitted target before reading the snapshot; typed absence or a non-running target remains unconfirmed without verifying it. A running target still requires full snapshot verification. Successful resume requires an observable exact running target. An uncertain admitted restore retains its artifact and owner until explicit deletion or the original retention deadline; the normal cleanup operation uses the native lifecycle fence and records completion. The helper itself never shortens retention or substitutes a cold restart.
 
 GetCompute, commands, cleanup and the next suspension verify restored provenance from the persisted VM configuration after the consumed artifact is deleted.
 
diff --git a/services/core/tools/microsandbox-provider/backend.go b/services/core/tools/microsandbox-provider/backend.go
index cc27005c6..3da947ba6 100644
--- a/services/core/tools/microsandbox-provider/backend.go
+++ b/services/core/tools/microsandbox-provider/backend.go
@@ -45,6 +45,11 @@ func (b backend) run(ctx context.Context) (wire.Response, error) {
 		defer cancel()
 		result, e := runCommand(commandCtx, live, *b.q.Command, "1000:1000")
 		return wire.Response{Command: &result}, e
+	case "restore_preparation":
+		restored, e := b.restorePreparation(ctx)
+		return wire.Response{Restored: restored}, e
+	case "save_preparation":
+		return wire.Response{}, b.savePreparation(ctx)
 	case "suspend":
 		s, e := b.suspend(ctx, *b.q.Suspend)
 		return wire.Response{State: &s}, e
@@ -52,7 +57,7 @@ func (b backend) run(ctx context.Context) (wire.Response, error) {
 		s, e := b.resume(ctx, *b.q.Resume)
 		return wire.Response{State: &s}, e
 	case "delete_snapshot":
-		return wire.Response{}, b.deleteArchive(ctx, *b.q.Snapshot)
+		return wire.Response{}, b.deleteCheckpoint(ctx, *b.q.Snapshot)
 	}
 	return wire.Response{}, sandbox.ErrInvalid
 }
diff --git a/services/core/tools/microsandbox-provider/bootstrap.go b/services/core/tools/microsandbox-provider/bootstrap.go
index eb411cf6c..1be01cb37 100644
--- a/services/core/tools/microsandbox-provider/bootstrap.go
+++ b/services/core/tools/microsandbox-provider/bootstrap.go
@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"time"
 
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentnetwork"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimebootstrap"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	wire "github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/microsandbox"
@@ -47,17 +46,11 @@ func (b backend) create(ctx context.Context) (wire.Response, error) {
 		return wire.Response{}, e
 	}
 	bootstrap := *b.q.Bootstrap
-	policy := agentnetwork.Policy{Access: bootstrap.NetworkAccess, AllowedDomains: bootstrap.AllowedDomains}
-	domains, _ := json.Marshal(policy.Hosts())
 	labels := wire.Labels(b.q.Config, b.q.Reference)
 	labels[bootstrapLabel] = "pending"
 	for key, value := range workspaceLabels(b.q.Workspace) {
 		labels[key] = value
 	}
-	mount := sdk.Mount.Owned(sdk.OwnedVolumeOptions{Kind: sdk.VolumeKindDisk, SizeMiB: b.q.Config.EnvironmentDiskMiB})
-	if b.q.Workspace != nil {
-		mount = sdk.Mount.Bind(b.q.Workspace.Path, sdk.MountOptions{})
-	}
 	live, e := sdk.CreateSandbox(ctx, c.Name,
 		// Every compatible node holds the pinned image; nothing is ever pulled.
 		sdk.WithImage(b.q.Config.Image), sdk.WithPullPolicy(sdk.PullPolicyNever), sdk.WithMemory(b.q.Config.MemoryMiB), sdk.WithCPUs(b.q.Config.CPUs),
@@ -66,13 +59,12 @@ func (b backend) create(ctx context.Context) (wire.Response, error) {
 		// The selected Environment mount keeps workspace and staging on one filesystem.
 		// Bootstrap creates their directories before starting the daemon.
 		sdk.WithWorkdir("/"), sdk.WithMounts(map[string]sdk.MountConfig{
-			"/environment": mount,
+			"/environment": sdk.Mount.Bind(b.q.Workspace.Path, sdk.MountOptions{}),
 		}),
 		sdk.WithLabels(labels), sdk.WithDetached(), sdk.WithQuietLogs(), sdk.WithNetwork(b.network()),
 		sdk.WithEnv(map[string]string{
 			"HOME": "/home/runtime", "OAC_RUNTIME_HOME": "/home/runtime/.oac",
 			"OAC_RUNTIME_ENVIRONMENT_ID": bootstrap.EnvironmentID, "OAC_RUNTIME_SESSION_ID": bootstrap.SessionID,
-			"OAC_RUNTIME_NETWORK_ACCESS": policy.Access, "OAC_RUNTIME_ALLOWED_DOMAINS": string(domains),
 			"OAC_RUNTIME_DAEMON_SUSPEND_PID_FILE": runtimebootstrap.SuspendControlFile,
 		}))
 	if e != nil {
@@ -91,7 +83,7 @@ func (b backend) create(ctx context.Context) (wire.Response, error) {
 	var actual struct {
 		Labels map[string]string `json:"labels"`
 	}
-	if json.Unmarshal([]byte(h.ConfigJSON()), &actual) != nil || qualifyWorkspace(actual.Labels, b.q.Workspace) != nil || (b.q.Workspace != nil && actual.Labels[workspacePathLabel] != b.q.Workspace.Path) {
+	if json.Unmarshal([]byte(h.ConfigJSON()), &actual) != nil || qualifyWorkspace(actual.Labels, b.q.Workspace) != nil || actual.Labels[workspacePathLabel] != b.q.Workspace.Path {
 		qualified.CreateSettled = true
 		return qualified, sandbox.ErrInvalid
 	}
diff --git a/services/core/tools/microsandbox-provider/archive.go b/services/core/tools/microsandbox-provider/checkpoint.go
similarity index 69%
rename from services/core/tools/microsandbox-provider/archive.go
rename to services/core/tools/microsandbox-provider/checkpoint.go
index 17e3ee49e..a3e910421 100644
--- a/services/core/tools/microsandbox-provider/archive.go
+++ b/services/core/tools/microsandbox-provider/checkpoint.go
@@ -4,8 +4,6 @@ package main
 
 import (
 	"context"
-	"crypto/sha256"
-	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"io"
@@ -21,11 +19,11 @@ import (
 )
 
 // This adapter-private namespace is never a guest mount. The allocation lock
-// serializes archive publication, admission and deletion across all its nodes.
-type archiveReceipt struct {
+// serializes checkpoint publication, admission and deletion across all its nodes.
+// The native snapshot is the checkpoint: it lives in the group directory of its
+// operation, next to the receipt that proves ownership.
+type checkpointReceipt struct {
 	Snapshot         wire.SnapshotIdentity `json:"snapshot"`
-	SHA256           string                `json:"sha256"`
-	Size             int64                 `json:"size"`
 	SourceTerminated bool                  `json:"source_terminated"`
 	SourceStopped    bool                  `json:"source_stopped"`
 	Deleted          bool                  `json:"deleted"`
@@ -34,7 +32,7 @@ type archiveReceipt struct {
 func (b backend) storeDirectory() string {
 	return filepath.Join(b.q.Config.CheckpointRoot, wire.Name(b.q.Config, b.q.Reference, 0))
 }
-func (b backend) archiveDirectory(operation string) string {
+func (b backend) checkpointDirectory(operation string) string {
 	return filepath.Join(b.storeDirectory(), "s-"+operation)
 }
 func privateDirectory(path string) error {
@@ -114,91 +112,17 @@ func readPrivateJSON(path string, value any) error {
 	}
 	return nil
 }
-func (b backend) receipt(operation string) (archiveReceipt, error) {
-	var r archiveReceipt
-	e := readPrivateJSON(filepath.Join(b.archiveDirectory(operation), "receipt.json"), &r)
-	if e == nil && (r.Snapshot.OperationID != operation || wire.ValidateSnapshot(b.q.Config, b.q.Reference, r.Snapshot) != nil) {
+func (b backend) receipt(operation string) (checkpointReceipt, error) {
+	var r checkpointReceipt
+	e := readPrivateJSON(filepath.Join(b.checkpointDirectory(operation), "receipt.json"), &r)
+	if e == nil && (r.Snapshot.OperationID != operation || wire.ValidateSnapshot(b.q.Config, b.q.Reference, r.Snapshot) != nil || (r.SourceStopped && !r.SourceTerminated)) {
 		e = sandbox.ErrOwnership
 	}
-	if e == nil && !r.Deleted {
-		decoded, err := hex.DecodeString(r.SHA256)
-		if err != nil || len(decoded) != 32 || r.Size <= 0 || (r.SourceStopped && !r.SourceTerminated) {
-			e = sandbox.ErrOwnership
-		}
-	}
 	return r, e
 }
-func archiveDigest(path string) (string, int64, error) {
-	real, e := filepath.EvalSymlinks(path)
-	if e != nil {
-		return "", 0, e
-	}
-	if real != path {
-		return "", 0, sandbox.ErrOwnership
-	}
-	st, e := os.Lstat(path)
-	if e != nil {
-		return "", 0, e
-	}
-	if !st.Mode().IsRegular() || st.Mode().Perm() != 0600 {
-		return "", 0, sandbox.ErrOwnership
-	}
-	f, e := os.Open(path)
-	if e != nil {
-		return "", 0, e
-	}
-	defer f.Close()
-	h := sha256.New()
-	n, e := io.Copy(h, f)
-	return hex.EncodeToString(h.Sum(nil)), n, e
-}
-func (b backend) publishArchive(ctx context.Context, a *sdk.SnapshotArtifact, s wire.SnapshotIdentity) (archiveReceipt, bool, error) {
-	prior, e := b.receipt(s.OperationID)
-	if e == nil {
-		if prior.Snapshot != s || prior.Deleted {
-			return prior, false, sandbox.ErrOwnership
-		}
-		return prior, false, nil
-	}
-	if !errors.Is(e, os.ErrNotExist) {
-		return prior, false, e
-	}
-	dir := b.archiveDirectory(s.OperationID)
-	if e = privateDirectory(dir); e != nil {
-		return prior, false, e
-	}
-	if e = syncDirectory(b.storeDirectory()); e != nil {
-		return prior, false, e
-	}
-	archive := filepath.Join(dir, "archive.msb")
-	// A publication interrupted before its receipt can be rebuilt from the exact
-	// verified native artifact. The shared allocation lock excludes consumers.
-	if e = os.Remove(archive); e != nil && !errors.Is(e, os.ErrNotExist) {
-		return prior, false, e
-	}
-	if e = a.SaveTo(ctx, archive, sdk.SnapshotSaveOptions{}); e != nil {
-		return prior, false, e
-	}
-	if e = os.Chmod(archive, 0600); e != nil {
-		return prior, false, e
-	}
-	f, e := os.Open(archive)
-	if e != nil {
-		return prior, false, e
-	}
-	e = f.Sync()
-	f.Close()
-	if e != nil {
-		return prior, false, e
-	}
-	digest, size, e := archiveDigest(archive)
-	if e != nil {
-		return prior, false, e
-	}
-	r := archiveReceipt{Snapshot: s, SHA256: digest, Size: size}
-	return r, true, durableJSON(filepath.Join(dir, "receipt.json"), r)
-}
-func (b backend) importArchive(ctx context.Context, want wire.SnapshotIdentity) (*sdk.SnapshotArtifact, error) {
+
+// restoreSource returns the verified checkpoint of a source-settled receipt.
+func (b backend) restoreSource(ctx context.Context, want wire.SnapshotIdentity) (*sdk.SnapshotArtifact, error) {
 	r, e := b.receipt(want.OperationID)
 	if e != nil {
 		return nil, e
@@ -213,45 +137,17 @@ func (b backend) importArchive(ctx context.Context, want wire.SnapshotIdentity)
 	if class != want.Compatibility {
 		return nil, sandbox.ErrInvalid
 	}
-	path := filepath.Join(b.archiveDirectory(want.OperationID), "archive.msb")
-	hash, size, e := archiveDigest(path)
-	if e != nil {
-		return nil, e
-	}
-	if hash != r.SHA256 || size != r.Size {
-		return nil, sandbox.ErrOwnership
-	}
-	artifact, e := b.verifiedSnapshot(ctx, want)
-	if sdk.IsKind(e, sdk.ErrSnapshotNotFound) {
-		if _, e = sdk.Snapshot.LoadWithOptions(ctx, path, sdk.SnapshotLoadOptions{Group: wire.Name(b.q.Config, b.q.Reference, 0)}); e != nil {
-			return nil, e
-		}
-		return b.verifiedSnapshot(ctx, want)
-	}
-	return artifact, e
-}
-func (b backend) deleteArchive(ctx context.Context, want wire.SnapshotIdentity) error {
-	return b.deleteArchiveWithNative(want, func() error {
-		_, err := b.ownedSnapshot(ctx, want)
-		if err == nil {
-			err = sdk.Snapshot.Remove(ctx, want.Reference, false)
-		}
-		if sdk.IsKind(err, sdk.ErrSnapshotNotFound) {
-			return nil
-		}
-		return err
-	})
+	return b.verifiedSnapshot(ctx, want)
 }
-
-// Native artifact removal must settle before the private archive is unlinked.
-func (b backend) deleteArchiveWithNative(want wire.SnapshotIdentity, removeNative func() error) error {
+func (b backend) deleteCheckpoint(ctx context.Context, want wire.SnapshotIdentity) error {
 	if e := b.requireSettledRestores(nil, &want); e != nil {
 		return e
 	}
+	dir := b.checkpointDirectory(want.OperationID)
 	r, e := b.receipt(want.OperationID)
 	if errors.Is(e, os.ErrNotExist) {
-		r = archiveReceipt{Snapshot: want}
-		if e = privateDirectory(b.archiveDirectory(want.OperationID)); e != nil {
+		r = checkpointReceipt{Snapshot: want}
+		if e = privateDirectory(dir); e != nil {
 			return e
 		}
 		if e = syncDirectory(b.storeDirectory()); e != nil {
@@ -263,19 +159,31 @@ func (b backend) deleteArchiveWithNative(want wire.SnapshotIdentity, removeNativ
 	if r.Snapshot != want {
 		return sandbox.ErrOwnership
 	}
-	// Fence consumers before removing either local or portable artifact. Keep the
-	// small tombstone, including its ownership identity, against delayed helpers.
+	// Fence consumers before removing the checkpoint. Keep the small tombstone,
+	// including its ownership identity, against delayed helpers.
 	r.Deleted = true
-	if e = durableJSON(filepath.Join(b.archiveDirectory(want.OperationID), "receipt.json"), r); e != nil {
+	if e = durableJSON(filepath.Join(dir, "receipt.json"), r); e != nil {
 		return e
 	}
-	if e = removeNative(); e != nil {
+	entries, e := os.ReadDir(dir)
+	if e != nil {
 		return e
 	}
-	if e = os.Remove(filepath.Join(b.archiveDirectory(want.OperationID), "archive.msb")); e != nil && !errors.Is(e, os.ErrNotExist) {
-		return e
+	for _, entry := range entries {
+		if entry.Name() == "receipt.json" {
+			continue
+		}
+		// The SDK removal also drops its index row; a damaged snapshot or a
+		// staging directory left by an interrupted capture is removed directly.
+		path := filepath.Join(dir, entry.Name())
+		if strings.HasPrefix(entry.Name(), "snap_") && sdk.Snapshot.Remove(ctx, path, false) == nil {
+			continue
+		}
+		if e = os.RemoveAll(path); e != nil {
+			return e
+		}
 	}
-	return syncDirectory(b.archiveDirectory(want.OperationID))
+	return syncDirectory(dir)
 }
 
 type restoreAdmission struct {
@@ -283,6 +191,8 @@ type restoreAdmission struct {
 	Snapshot    wire.SnapshotIdentity
 	Target      wire.Compute
 	Closed      bool
+	// Unusable marks a closed attempt whose snapshot cannot be restored.
+	Unusable    bool
 	CompletedID string
 	Cleaned     bool
 }
@@ -299,14 +209,17 @@ func (b backend) admitRestore(q wire.ResumeRequest) (bool, error) {
 	var prior restoreAdmission
 	e := readPrivateJSON(path, &prior)
 	if e == nil {
-		closed := prior.Closed
-		prior.Closed = false
+		closed, unusable := prior.Closed, prior.Unusable
+		prior.Closed, prior.Unusable = false, false
 		prior.CompletedID = ""
 		cleaned := prior.Cleaned
 		prior.Cleaned = false
 		if !reflect.DeepEqual(prior, want) {
 			return false, sandbox.ErrOwnership
 		}
+		if unusable {
+			return false, sandbox.ErrCheckpointUnusable
+		}
 		if closed {
 			return true, nil
 		}
@@ -338,6 +251,37 @@ func (b backend) closeExpiredRestore(q wire.ResumeRequest) error {
 	if time.Now().Before(b.q.Deadline) {
 		return nil
 	}
+	if err := b.closeRestore(q, false); err != nil {
+		return err
+	}
+	return context.DeadlineExceeded
+}
+
+// closeUndispatchedRestore closes the attempt this fresh dispatch just admitted
+// after a failure before RestoreSandbox. A snapshot defect is recorded so that
+// every later call for the operation reports ErrCheckpointUnusable; any other
+// failure is returned as it is and Core replaces the closed attempt.
+func (b backend) closeUndispatchedRestore(q wire.ResumeRequest, cause error) error {
+	unusable := snapshotDefect(cause)
+	if err := b.closeRestore(q, unusable); err != nil {
+		return err
+	}
+	if unusable {
+		return sandbox.ErrCheckpointUnusable
+	}
+	return cause
+}
+
+// snapshotDefect reports a failure that proves this snapshot cannot be restored:
+// it is missing, fails identity or integrity verification, or fails this
+// generation's qualification. I/O and context errors prove nothing.
+func snapshotDefect(e error) bool {
+	return errors.Is(e, sandbox.ErrOwnership) || errors.Is(e, sandbox.ErrInvalid) || errors.Is(e, os.ErrNotExist) ||
+		sdk.IsKind(e, sdk.ErrSnapshotNotFound) || sdk.IsKind(e, sdk.ErrSnapshotIntegrity) ||
+		sdk.IsKind(e, sdk.ErrSnapshotImageMissing) || sdk.IsKind(e, sdk.ErrSnapshotMigration)
+}
+
+func (b backend) closeRestore(q wire.ResumeRequest, unusable bool) error {
 	if q.ObserveOnly || q.Target.ID != "" {
 		return sandbox.ErrOwnership
 	}
@@ -350,11 +294,8 @@ func (b backend) closeExpiredRestore(q wire.ResumeRequest) error {
 	if !reflect.DeepEqual(prior, want) {
 		return sandbox.ErrOwnership
 	}
-	want.Closed = true
-	if err := durableJSON(path, want); err != nil {
-		return err
-	}
-	return context.DeadlineExceeded
+	want.Closed, want.Unusable = true, unusable
+	return durableJSON(path, want)
 }
 
 // Completion records the incarnation whose native restore has become observable
@@ -417,17 +358,6 @@ func (b backend) requireSettledRestores(target *wire.Compute, snapshot *wire.Sna
 	return nil
 }
 
-func (b backend) verifyArchive(r archiveReceipt) error {
-	hash, size, e := archiveDigest(filepath.Join(b.archiveDirectory(r.Snapshot.OperationID), "archive.msb"))
-	if e != nil {
-		return e
-	}
-	if hash != r.SHA256 || size != r.Size {
-		return sandbox.ErrOwnership
-	}
-	return nil
-}
-
 // The native transition/lifecycle locks fence an admitted launcher and its
 // detached child. This receipt means cleanup completed, never "did not run".
 func (b backend) recordRestoreCleanup(target wire.Compute) error {
diff --git a/services/core/tools/microsandbox-provider/creation_settlement_test.go b/services/core/tools/microsandbox-provider/creation_settlement_test.go
index 6242bbab6..484438497 100644
--- a/services/core/tools/microsandbox-provider/creation_settlement_test.go
+++ b/services/core/tools/microsandbox-provider/creation_settlement_test.go
@@ -5,6 +5,7 @@ package main
 import (
 	"encoding/json"
 	"errors"
+	"maps"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
@@ -18,7 +19,7 @@ func TestCreatedConfigurationRejectionRequiresExactOwnedCompute(t *testing.T) {
 			ref := sandbox.Reference{TenantID: "tenant", EnvironmentID: "environment", AllocationID: "allocation"}
 			created := wire.Compute{Name: wire.Name(config, ref, 0), ID: "local:created"}
 			labels := wire.Labels(config, ref)
-			labels[workspaceModeLabel] = "owned"
+			maps.Copy(labels, workspaceLabels(fixtureWorkspace))
 			labels[bootstrapLabel] = "pending"
 			actual["labels"] = labels
 			actualID, status := created.ID, "running"
diff --git a/services/core/tools/microsandbox-provider/deployment.go b/services/core/tools/microsandbox-provider/deployment.go
index 9e2683ef1..01870c4bb 100644
--- a/services/core/tools/microsandbox-provider/deployment.go
+++ b/services/core/tools/microsandbox-provider/deployment.go
@@ -16,7 +16,6 @@ import (
 	sdk "github.com/superradcompany/microsandbox/sdk/go"
 )
 
-const workspaceModeLabel = "io.oac.workspace-mode"
 const workspaceObjectLabel = "io.oac.workspace-object"
 const workspacePathLabel = "io.oac.workspace-path"
 
@@ -24,17 +23,15 @@ const resourceProofLabel = "io.oac.resource-proof"
 
 func resourceProof(config wire.Config) string {
 	raw, _ := json.Marshal(struct {
-		ExternalWorkspace bool
-		Image             string
-		Resources         sandbox.Resources
-	}{config.ExternalWorkspace, config.Image, sandbox.Resources{CPUs: uint32(config.CPUs), MemoryMiB: config.MemoryMiB,
-		RootDiskMiB: config.RootDiskMiB, EnvironmentDiskMiB: config.EnvironmentDiskMiB}})
+		Image     string
+		Resources sandbox.Resources
+	}{config.Image, sandbox.Resources{CPUs: uint32(config.CPUs), MemoryMiB: config.MemoryMiB, RootDiskMiB: config.RootDiskMiB}})
 	digest := sha256.Sum256(raw)
 	return hex.EncodeToString(digest[:])
 }
 
 // The SDK decodes native CPU/memory/rootfs configuration. Its v0.7.8 projection
-// omits mounts, so the explicitly owned or external inventory is projected here.
+// omits mounts, so the external directory inventory is projected here.
 // Restored roots have no configured size: a verified full snapshot supplies that
 // proof, retained as a label only after inspecting the restored target.
 func qualifyConfiguration(config wire.Config, compute wire.Compute, raw string, inheritedRoot bool) error {
@@ -53,38 +50,18 @@ func qualifyConfiguration(config wire.Config, compute wire.Compute, raw string,
 	}
 	var inventory struct {
 		Mounts []struct {
-			Type    string `json:"type"`
-			Host    string `json:"host"`
-			Guest   string `json:"guest"`
-			Storage struct {
-				Kind        string `json:"kind"`
-				CapacityMiB uint32 `json:"capacity_mib"`
-			} `json:"storage"`
+			Type  string `json:"type"`
+			Host  string `json:"host"`
+			Guest string `json:"guest"`
 		} `json:"mounts"`
 	}
 	if json.Unmarshal([]byte(raw), &inventory) != nil || len(inventory.Mounts) != 1 {
 		return sandbox.ErrInvalid
 	}
 	mount := inventory.Mounts[0]
-	if config.ExternalWorkspace != (actual.Labels[workspaceModeLabel] == "external") {
-		return sandbox.ErrInvalid
-	}
-	switch actual.Labels[workspaceModeLabel] {
-	case "external":
-		id, err := uuid.Parse(actual.Labels[workspaceObjectLabel])
-		path := actual.Labels[workspacePathLabel]
-		if err != nil || id == uuid.Nil || id.String() != actual.Labels[workspaceObjectLabel] || !filepath.IsAbs(path) || filepath.Clean(path) != path || mount.Type != "Bind" || mount.Guest != "/environment" || mount.Host != path {
-			return sandbox.ErrInvalid
-		}
-		return nil
-	case "owned":
-		if actual.Labels[workspaceObjectLabel] != "" || actual.Labels[workspacePathLabel] != "" || config.EnvironmentDiskMiB == 0 {
-			return sandbox.ErrInvalid
-		}
-	default:
-		return sandbox.ErrInvalid
-	}
-	if mount.Type != "Owned" || mount.Guest != "/environment" || mount.Storage.Kind != "disk" || mount.Storage.CapacityMiB != config.EnvironmentDiskMiB {
+	id, err := uuid.Parse(actual.Labels[workspaceObjectLabel])
+	path := actual.Labels[workspacePathLabel]
+	if err != nil || id == uuid.Nil || id.String() != actual.Labels[workspaceObjectLabel] || !filepath.IsAbs(path) || filepath.Clean(path) != path || mount.Type != "Bind" || mount.Guest != "/environment" || mount.Host != path {
 		return sandbox.ErrInvalid
 	}
 	return nil
@@ -97,7 +74,7 @@ func qualifySnapshotResources(config wire.Config, labels map[string]string) erro
 	return nil
 }
 
-// Archives exclude the image. The restored root must resolve from this node's
+// Checkpoints exclude the image. The restored root must resolve from this node's
 // installed image by the captured digest; a missing image record fails before
 // Restore. This metadata check cannot verify the SDK's physical image cache.
 func qualifyRuntimeImage(ctx context.Context, config wire.Config, captured string) error {
@@ -119,16 +96,11 @@ func qualifyRuntimeImage(ctx context.Context, config wire.Config, captured strin
 }
 
 func workspaceLabels(workspace *wire.WorkspaceDirectory) map[string]string {
-	if workspace == nil {
-		return map[string]string{workspaceModeLabel: "owned"}
-	}
-	return map[string]string{workspaceModeLabel: "external", workspaceObjectLabel: workspace.ObjectID, workspacePathLabel: workspace.Path}
+	return map[string]string{workspaceObjectLabel: workspace.ObjectID, workspacePathLabel: workspace.Path}
 }
 func qualifyWorkspace(labels map[string]string, workspace *wire.WorkspaceDirectory) error {
-	for _, key := range []string{workspaceModeLabel, workspaceObjectLabel} {
-		if labels[key] != workspaceLabels(workspace)[key] {
-			return sandbox.ErrOwnership
-		}
+	if labels[workspaceObjectLabel] != workspace.ObjectID {
+		return sandbox.ErrOwnership
 	}
 	return nil
 }
diff --git a/services/core/tools/microsandbox-provider/deployment_test.go b/services/core/tools/microsandbox-provider/deployment_test.go
index efdde16d1..441aa7edc 100644
--- a/services/core/tools/microsandbox-provider/deployment_test.go
+++ b/services/core/tools/microsandbox-provider/deployment_test.go
@@ -12,19 +12,30 @@ import (
 	wire "github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/microsandbox"
 )
 
+var fixtureWorkspace = &wire.WorkspaceDirectory{Path: "/resolved/environment", ObjectID: "88888888-8888-4888-8888-888888888888"}
+
+// fixtureLabels are the workspace labels of a created compute plus any extras.
+func fixtureLabels(extra map[string]string) map[string]string {
+	labels := workspaceLabels(fixtureWorkspace)
+	for key, value := range extra {
+		labels[key] = value
+	}
+	return labels
+}
+
 func deploymentFixture() (wire.Config, map[string]any) {
-	config := wire.Config{Image: "runtime@sha256:" + strings.Repeat("a", 64), CPUs: 2, MemoryMiB: 2048, RootDiskMiB: 8192, EnvironmentDiskMiB: 4096}
+	config := wire.Config{Image: "runtime@sha256:" + strings.Repeat("a", 64), CPUs: 2, MemoryMiB: 2048, RootDiskMiB: 8192}
 	actual := map[string]any{
-		"labels":    map[string]string{workspaceModeLabel: "owned"},
+		"labels":    fixtureLabels(nil),
 		"image":     map[string]any{"Oci": map[string]any{"reference": config.Image, "root_disk": map[string]any{"kind": "managed", "size_mib": 8192}}},
 		"resources": map[string]any{"cpus": 2, "max_cpus": 2, "memory_mib": 2048, "max_memory_mib": 2048},
-		"mounts":    []any{map[string]any{"type": "Owned", "guest": "/environment", "storage": map[string]any{"kind": "disk", "capacity_mib": 4096}}},
+		"mounts":    []any{map[string]any{"type": "Bind", "host": fixtureWorkspace.Path, "guest": "/environment"}},
 	}
 	return config, actual
 }
 
 func TestNativeDeploymentConfigurationRejectsDrift(t *testing.T) {
-	for _, field := range []string{"match", "cpus", "max_cpus", "memory_mib", "max_memory_mib", "image", "root", "environment", "extra_mount", "missing_mount"} {
+	for _, field := range []string{"match", "cpus", "max_cpus", "memory_mib", "max_memory_mib", "image", "root", "mount", "extra_mount", "missing_mount"} {
 		t.Run(field, func(t *testing.T) {
 			config, actual := deploymentFixture()
 			switch field {
@@ -34,8 +45,8 @@ func TestNativeDeploymentConfigurationRejectsDrift(t *testing.T) {
 				actual["image"] = "runtime:latest"
 			case "root":
 				actual["image"].(map[string]any)["Oci"].(map[string]any)["root_disk"].(map[string]any)["size_mib"] = 16384
-			case "environment":
-				actual["mounts"].([]any)[0].(map[string]any)["storage"].(map[string]any)["capacity_mib"] = 8192
+			case "mount":
+				actual["mounts"].([]any)[0].(map[string]any)["host"] = "/foreign"
 			case "extra_mount":
 				actual["mounts"] = append(actual["mounts"].([]any), map[string]any{"type": "Bind", "guest": "/other"})
 			case "missing_mount":
@@ -55,7 +66,7 @@ func TestRestoredRootRequiresVerifiedInheritedProof(t *testing.T) {
 	actual["image"].(map[string]any)["Oci"].(map[string]any)["root_disk"].(map[string]any)["size_mib"] = nil
 	compute := wire.Compute{RestoredFrom: &wire.SnapshotIdentity{ID: "verified-parent"}}
 	for _, proof := range []string{"", "foreign", resourceProof(config)} {
-		actual["labels"] = map[string]string{workspaceModeLabel: "owned", resourceProofLabel: proof}
+		actual["labels"] = fixtureLabels(map[string]string{resourceProofLabel: proof})
 		raw, _ := json.Marshal(actual)
 		err := qualifyConfiguration(config, compute, string(raw), false)
 		if (proof == resourceProof(config)) != (err == nil) {
@@ -74,7 +85,6 @@ func TestSnapshotProofBindsResourcesWithoutChangingCleanupOwnership(t *testing.T
 	config, actual := deploymentFixture()
 	ref := sandbox.Reference{TenantID: "tenant", EnvironmentID: "environment", AllocationID: "allocation"}
 	labels := wire.Labels(config, ref)
-	labels[workspaceModeLabel] = "owned"
 	labels[resourceProofLabel] = resourceProof(config)
 	if err := qualifySnapshotResources(config, labels); err != nil {
 		t.Fatal(err)
@@ -85,7 +95,7 @@ func TestSnapshotProofBindsResourcesWithoutChangingCleanupOwnership(t *testing.T
 	}
 	actual["labels"] = labels
 	raw, _ := json.Marshal(actual)
-	if _, err := qualifyCompute(config, ref, wire.Compute{ID: "owned"}, "owned", "running", string(raw)); err != nil {
+	if _, err := qualifyCompute(config, ref, wire.Compute{ID: "local:1"}, "local:1", "running", string(raw)); err != nil {
 		t.Fatal("resource drift changed cleanup ownership", err)
 	}
 	if err := qualifySnapshotResources(config, nil); !errors.Is(err, sandbox.ErrInvalid) {
@@ -93,7 +103,7 @@ func TestSnapshotProofBindsResourcesWithoutChangingCleanupOwnership(t *testing.T
 	}
 }
 
-// Archives exclude the image, so Restore must find the pinned image locally.
+// Checkpoints exclude the image, so Restore must find the pinned image locally.
 // The real SDK's empty local registry proves absence fails typed, without a pull.
 func TestRestoreRequiresPinnedLocalImage(t *testing.T) {
 	if !isolatedSDKTest(t) {
diff --git a/services/core/tools/microsandbox-provider/main.go b/services/core/tools/microsandbox-provider/main.go
index f6220baae..e023f322f 100644
--- a/services/core/tools/microsandbox-provider/main.go
+++ b/services/core/tools/microsandbox-provider/main.go
@@ -102,6 +102,8 @@ func code(err error) string {
 		return "not_found"
 	case errors.Is(err, sandbox.ErrCommandUnconfirmed):
 		return "command_unconfirmed"
+	case errors.Is(err, sandbox.ErrCheckpointUnusable):
+		return "checkpoint_unusable"
 	case errors.Is(err, runtimeobs.ErrUnavailable), sdk.IsKind(err, sdk.ErrMetricsDisabled), sdk.IsKind(err, sdk.ErrMetricsUnavailable):
 		return "metrics_unavailable"
 	default:
diff --git a/services/core/tools/microsandbox-provider/observed_test.go b/services/core/tools/microsandbox-provider/observed_test.go
index 3acbb2baa..1a23c205f 100644
--- a/services/core/tools/microsandbox-provider/observed_test.go
+++ b/services/core/tools/microsandbox-provider/observed_test.go
@@ -41,7 +41,6 @@ func TestInitialIdentityNeedsAllLabelsAndBootstrapReceipt(t *testing.T) {
 	config := wire.Config{InstallationID: "installation"}
 	ref := sandbox.Reference{TenantID: "tenant", EnvironmentID: "environment", AllocationID: "allocation"}
 	labels := wire.Labels(config, ref)
-	labels[workspaceModeLabel] = "owned"
 	labels[bootstrapLabel] = "pending"
 	raw, _ := json.Marshal(map[string]any{"labels": labels})
 	state, e := qualifyCompute(config, ref, wire.Compute{ID: "local:4"}, "local:4", "running", string(raw))
diff --git a/services/core/tools/microsandbox-provider/preparation.go b/services/core/tools/microsandbox-provider/preparation.go
new file mode 100644
index 000000000..9cac07d97
--- /dev/null
+++ b/services/core/tools/microsandbox-provider/preparation.go
@@ -0,0 +1,194 @@
+//go:build linux
+
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+	"github.com/google/uuid"
+	sdk "github.com/superradcompany/microsandbox/sdk/go"
+)
+
+// The preparation cache keeps one archive of the prepared /environment
+// directories per Core-supplied key and image digest in a private
+// directory under the Runtime home. The guest never sees it. An entry is valid
+// for preparationTTL after its save.
+const preparationTTL = 24 * time.Hour
+
+// preparedDirectories are what preparation writes, as created by the bootstrap.
+// runtime-state belongs to the running daemon and is never copied.
+var preparedDirectories = []string{"initialization", "packages", "workspace"}
+
+// The store holds at most this many bytes. A measured Environment archive is
+// tens of MiB, so this keeps over a hundred of them and bounds the node's disk
+// use; the TTL alone does not, because a busy node can save many keys in a day.
+const maxPreparationBytes = 8 << 30
+
+func (b backend) preparationStore() string {
+	return filepath.Join(b.q.Config.RuntimeHome, "preparation")
+}
+
+// preparationEntry names the archive for this key, scoped by the Runtime image digest.
+func (b backend) preparationEntry() string {
+	_, digest, _ := strings.Cut(b.q.Config.Image, "@")
+	sum := sha256.Sum256([]byte(fmt.Sprintf("%s|%s", digest, b.q.Key)))
+	return filepath.Join(b.preparationStore(), hex.EncodeToString(sum[:])+".tar")
+}
+
+func validPreparation(path string, now time.Time) bool {
+	st, err := os.Lstat(path)
+	return err == nil && st.Mode().IsRegular() && now.Sub(st.ModTime()) < preparationTTL
+}
+
+// preparationSandbox connects to the running compute and returns the host
+// directory behind /environment.
+func (b backend) preparationSandbox(ctx context.Context) (*sdk.Sandbox, string, error) {
+	h, _, err := b.inspect(ctx, b.q.Compute)
+	if err != nil {
+		return nil, "", err
+	}
+	live, err := h.Connect(ctx)
+	if err != nil {
+		return nil, "", err
+	}
+	var config sdk.SandboxConfig
+	if json.Unmarshal([]byte(h.ConfigJSON()), &config) != nil || config.Labels[workspacePathLabel] == "" {
+		live.Detach(context.Background())
+		return nil, "", sandbox.ErrInvalid
+	}
+	return live, config.Labels[workspacePathLabel], nil
+}
+
+func guestRun(ctx context.Context, live *sdk.Sandbox, script string) error {
+	result, err := runCommand(ctx, live, sandbox.Command{Args: []string{"/bin/sh", "-c", script}, Directory: "/"}, "0:0")
+	if err == nil && result.ExitCode != 0 {
+		err = errors.New("preparation command failed")
+	}
+	return err
+}
+
+// hostTar copies the SDK's ownership xattrs of an external directory verbatim,
+// so the helper never interprets them.
+func hostTar(ctx context.Context, stdin *os.File, args ...string) error {
+	cmd := exec.CommandContext(ctx, "tar", append([]string{"--xattrs", "--xattrs-include=*"}, args...)...)
+	if stdin != nil {
+		cmd.Stdin = stdin
+	}
+	return cmd.Run()
+}
+
+func (b backend) restorePreparation(ctx context.Context) (bool, error) {
+	entry := b.preparationEntry()
+	if !validPreparation(entry, time.Now()) {
+		return false, nil
+	}
+	ctx, cancel := context.WithDeadline(ctx, b.q.Deadline)
+	defer cancel()
+	live, external, err := b.preparationSandbox(ctx)
+	if err != nil {
+		return false, err
+	}
+	defer live.Detach(context.Background())
+	// The running guest sees the extracted files at once.
+	f, err := os.Open(entry)
+	if err != nil {
+		return false, nil
+	}
+	defer f.Close()
+	if err = hostTar(ctx, f, "-C", external, "-xf", "-"); err != nil {
+		// A failed extraction fails this Session; later Sessions prepare in full.
+		_ = os.Remove(entry)
+	}
+	return err == nil, err
+}
+
+func (b backend) savePreparation(ctx context.Context) error {
+	ctx, cancel := context.WithDeadline(ctx, b.q.Deadline)
+	defer cancel()
+	live, external, err := b.preparationSandbox(ctx)
+	if err != nil {
+		return err
+	}
+	defer live.Detach(context.Background())
+	store := b.preparationStore()
+	if err = privateDirectory(store); err != nil {
+		return err
+	}
+	temporary := filepath.Join(store, ".tmp-"+uuid.NewString())
+	defer os.Remove(temporary)
+	if err = guestRun(ctx, live, "sync"); err == nil {
+		err = hostTar(ctx, nil, append([]string{"-C", external, "-cf", temporary}, preparedDirectories...)...)
+	}
+	if err != nil {
+		return err
+	}
+	f, err := os.OpenFile(temporary, os.O_RDWR, 0)
+	if err != nil {
+		return err
+	}
+	err = f.Sync()
+	if closeErr := f.Close(); err == nil {
+		err = closeErr
+	}
+	if err == nil {
+		err = os.Chmod(temporary, 0600)
+	}
+	if err == nil {
+		err = os.Rename(temporary, b.preparationEntry())
+	}
+	if err != nil {
+		return err
+	}
+	_ = prunePreparations(store, time.Now())
+	return syncDirectory(store)
+}
+
+// prunePreparations deletes expired entries, then the oldest while the store is
+// over its bound.
+func prunePreparations(store string, now time.Time) error {
+	entries, err := os.ReadDir(store)
+	if err != nil {
+		return err
+	}
+	type kept struct {
+		path     string
+		size     int64
+		modified time.Time
+	}
+	var live []kept
+	var total int64
+	for _, entry := range entries {
+		info, err := entry.Info()
+		if err != nil {
+			continue
+		}
+		path := filepath.Join(store, entry.Name())
+		if now.Sub(info.ModTime()) >= preparationTTL {
+			_ = os.Remove(path)
+			continue
+		}
+		live = append(live, kept{path, info.Size(), info.ModTime()})
+		total += info.Size()
+	}
+	sort.Slice(live, func(i, j int) bool { return live[i].modified.Before(live[j].modified) })
+	for _, entry := range live {
+		if total <= maxPreparationBytes {
+			break
+		}
+		_ = os.Remove(entry.path)
+		total -= entry.size
+	}
+	return nil
+}
diff --git a/services/core/tools/microsandbox-provider/preparation_test.go b/services/core/tools/microsandbox-provider/preparation_test.go
new file mode 100644
index 000000000..096ccde3e
--- /dev/null
+++ b/services/core/tools/microsandbox-provider/preparation_test.go
@@ -0,0 +1,35 @@
+//go:build linux
+
+package main
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	wire "github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/microsandbox"
+)
+
+func TestExpiredPreparationIsNotRestored(t *testing.T) {
+	b := backend{q: wire.Request{Config: wire.Config{RuntimeHome: t.TempDir(), Image: "image@sha256:" + strings.Repeat("a", 64)}, Key: strings.Repeat("b", 64), Deadline: time.Now().Add(time.Minute)}}
+	if err := privateDirectory(b.preparationStore()); err != nil {
+		t.Fatal(err)
+	}
+	entry := b.preparationEntry()
+	if err := os.WriteFile(entry, []byte("archive"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if !validPreparation(entry, time.Now()) {
+		t.Fatal("fresh entry rejected")
+	}
+	old := time.Now().Add(-preparationTTL - time.Minute)
+	if err := os.Chtimes(entry, old, old); err != nil {
+		t.Fatal(err)
+	}
+	// An expired entry returns before the helper touches any compute.
+	if restored, err := b.restorePreparation(context.Background()); restored || err != nil {
+		t.Fatal(restored, err)
+	}
+}
diff --git a/services/core/tools/microsandbox-provider/restore_completion_test.go b/services/core/tools/microsandbox-provider/restore_completion_test.go
index 5f0b13a14..95d95d3e8 100644
--- a/services/core/tools/microsandbox-provider/restore_completion_test.go
+++ b/services/core/tools/microsandbox-provider/restore_completion_test.go
@@ -17,7 +17,7 @@ func TestRestoreCompletionRecoversOnlyDerivedProof(t *testing.T) {
 			config, actual := deploymentFixture()
 			actual["image"].(map[string]any)["Oci"].(map[string]any)["root_disk"].(map[string]any)["size_mib"] = nil
 			actual["snapshot_parent"] = "verified-snapshot"
-			labels := map[string]string{workspaceModeLabel: "owned"}
+			labels := fixtureLabels(nil)
 			actual["labels"] = labels
 			target := wire.Compute{Name: "restored-target", Generation: 1, RestoredFrom: &wire.SnapshotIdentity{ID: "verified-snapshot"}}
 			reads, writes := 0, 0
@@ -61,12 +61,12 @@ func TestRestoreCompletionRecoversOnlyDerivedProof(t *testing.T) {
 }
 
 func TestRestoreCompletionRejectsUnverifiedTargets(t *testing.T) {
-	for _, fault := range []string{"cpu", "memory", "environment", "image", "root", "foreign parent", "foreign ID", "foreign proof", "stopped", "starting", "paused", "crashed", "unfinished", "replacement after write", "proof not persisted"} {
+	for _, fault := range []string{"cpu", "memory", "mount", "image", "root", "foreign parent", "foreign ID", "foreign proof", "stopped", "starting", "paused", "crashed", "unfinished", "replacement after write", "proof not persisted"} {
 		t.Run(fault, func(t *testing.T) {
 			config, actual := deploymentFixture()
 			actual["image"].(map[string]any)["Oci"].(map[string]any)["root_disk"].(map[string]any)["size_mib"] = nil
 			actual["snapshot_parent"] = "verified-snapshot"
-			labels := map[string]string{workspaceModeLabel: "owned"}
+			labels := fixtureLabels(nil)
 			actual["labels"] = labels
 			target := wire.Compute{Name: "restored-target", ID: "local:restored", Generation: 1, RestoredFrom: &wire.SnapshotIdentity{ID: "verified-snapshot"}}
 			actualID, status := target.ID, "running"
@@ -75,8 +75,8 @@ func TestRestoreCompletionRejectsUnverifiedTargets(t *testing.T) {
 				actual["resources"].(map[string]any)["cpus"] = 1
 			case "memory":
 				actual["resources"].(map[string]any)["memory_mib"] = 1024
-			case "environment":
-				actual["mounts"].([]any)[0].(map[string]any)["storage"].(map[string]any)["capacity_mib"] = 1024
+			case "mount":
+				actual["mounts"].([]any)[0].(map[string]any)["host"] = "/foreign"
 			case "image":
 				actual["image"] = "runtime:foreign"
 			case "root":
@@ -126,7 +126,7 @@ func TestRestoreCompletionPreservesInspectionErrors(t *testing.T) {
 	for _, failedRead := range []int{1, 2} {
 		config, actual := deploymentFixture()
 		actual["snapshot_parent"] = "verified-snapshot"
-		actual["labels"] = map[string]string{workspaceModeLabel: "owned", resourceProofLabel: resourceProof(config)}
+		actual["labels"] = fixtureLabels(map[string]string{resourceProofLabel: resourceProof(config)})
 		target := wire.Compute{Name: "restored-target", ID: "local:restored", Generation: 1, RestoredFrom: &wire.SnapshotIdentity{ID: "verified-snapshot"}}
 		unavailable := errors.New("native inspection unavailable")
 		reads := 0
diff --git a/services/core/tools/microsandbox-provider/snapshot.go b/services/core/tools/microsandbox-provider/snapshot.go
index a41ea4797..2256434fa 100644
--- a/services/core/tools/microsandbox-provider/snapshot.go
+++ b/services/core/tools/microsandbox-provider/snapshot.go
@@ -10,6 +10,7 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	wire "github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/microsandbox"
@@ -25,15 +26,44 @@ func (b backend) snapshotLabels(operation string, source wire.Compute) map[strin
 	return labels
 }
 
-// openSnapshot opens only an allocation/operation-derived selector and returns
+// snapshotPath finds the one native snapshot the SDK published in the
+// operation's group directory.
+func (b backend) snapshotPath(operation string) (string, error) {
+	dir := b.checkpointDirectory(operation)
+	entries, e := os.ReadDir(dir)
+	if errors.Is(e, os.ErrNotExist) {
+		return "", &sdk.Error{Kind: sdk.ErrSnapshotNotFound, Message: dir}
+	} else if e != nil {
+		return "", e
+	}
+	var found string
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), "snap_") {
+			continue
+		}
+		if found != "" || !entry.IsDir() {
+			return "", sandbox.ErrOwnership
+		}
+		found = entry.Name()
+	}
+	if found == "" {
+		return "", &sdk.Error{Kind: sdk.ErrSnapshotNotFound, Message: dir}
+	}
+	return filepath.Join(dir, found), nil
+}
+
+// openSnapshot opens only an allocation/operation-derived directory and returns
 // its ownership identity without the checkpoint root, which needs Verify.
 func (b backend) openSnapshot(ctx context.Context, operation string, source wire.Compute) (*sdk.SnapshotArtifact, wire.SnapshotIdentity, error) {
-	selector := wire.SnapshotReference(b.q.Config, b.q.Reference, operation)
-	artifact, e := sdk.Snapshot.Open(ctx, selector)
+	path, e := b.snapshotPath(operation)
+	if e != nil {
+		return nil, wire.SnapshotIdentity{}, e
+	}
+	artifact, e := sdk.Snapshot.Open(ctx, path)
 	if e != nil {
 		return nil, wire.SnapshotIdentity{}, e
 	}
-	if artifact.Scope() != sdk.SnapshotScopeFull || artifact.SourceSandbox() == nil || *artifact.SourceSandbox() != source.Name {
+	if artifact.ID() != filepath.Base(path) || artifact.Scope() != sdk.SnapshotScopeFull || artifact.SourceSandbox() == nil || *artifact.SourceSandbox() != source.Name {
 		return nil, wire.SnapshotIdentity{}, sandbox.ErrOwnership
 	}
 	for key, value := range b.snapshotLabels(operation, source) {
@@ -50,7 +80,7 @@ func (b backend) openSnapshot(ctx context.Context, operation string, source wire
 		return nil, wire.SnapshotIdentity{}, sandbox.ErrOwnership
 	}
 	compatibility := sandbox.CheckpointCompatibility{ArtifactDomain: artifact.Labels()["io.oac.artifact_domain"], ExecutionClass: artifact.Labels()["io.oac.execution_class"]}
-	return artifact, wire.SnapshotIdentity{Compatibility: compatibility, Reference: selector, ID: artifact.ID(), Digest: artifact.Digest(), CheckpointID: state.Checkpoint.CheckpointID, OperationID: operation, SourceName: source.Name, SourceID: source.ID, SourceGeneration: source.Generation}, nil
+	return artifact, wire.SnapshotIdentity{Compatibility: compatibility, Reference: wire.SnapshotReference(b.q.Config, b.q.Reference, operation), ID: artifact.ID(), Digest: artifact.Digest(), CheckpointID: state.Checkpoint.CheckpointID, OperationID: operation, SourceName: source.Name, SourceID: source.ID, SourceGeneration: source.Generation}, nil
 }
 
 // inspectSnapshot verifies a fresh capture before its identity is published.
@@ -85,23 +115,6 @@ func (b backend) verifiedSnapshot(ctx context.Context, want wire.SnapshotIdentit
 	return a, nil
 }
 
-// ownedSnapshot matches a published identity for cleanup, where payload
-// integrity is irrelevant. The SDK descriptor digest covers the checkpoint
-// root, so an equal digest binds the published root without re-hashing.
-func (b backend) ownedSnapshot(ctx context.Context, want wire.SnapshotIdentity) (*sdk.SnapshotArtifact, error) {
-	a, got, e := b.openSnapshot(ctx, want.OperationID, wire.Compute{Name: want.SourceName, ID: want.SourceID, Generation: want.SourceGeneration})
-	if e != nil {
-		return nil, e
-	}
-	if got.Digest != want.Digest {
-		return nil, sandbox.ErrOwnership
-	}
-	got.CheckpointRoot = want.CheckpointRoot
-	if got != want || wire.ValidateSnapshot(b.q.Config, b.q.Reference, got) != nil {
-		return nil, sandbox.ErrOwnership
-	}
-	return a, nil
-}
 func (b backend) suspend(ctx context.Context, q wire.SuspendRequest) (wire.State, error) {
 	receipt, receiptErr := b.receipt(q.OperationID)
 	if receiptErr == nil {
@@ -114,7 +127,7 @@ func (b backend) suspend(ctx context.Context, q wire.SuspendRequest) (wire.State
 	}
 
 	// The host allocation flock spans pause, capture, verification and source kill.
-	// A surviving completed artifact is observed, never overwritten or recaptured.
+	// A surviving completed snapshot is observed, never overwritten or recaptured.
 	artifact, snap, e := b.inspectSnapshot(ctx, q.OperationID, q.Source)
 	if sdk.IsKind(e, sdk.ErrSnapshotNotFound) {
 		// Native absence cannot settle an admitted capture. Only a durable
@@ -176,11 +189,11 @@ func (b backend) suspend(ctx context.Context, q wire.SuspendRequest) (wire.State
 		if json.Unmarshal([]byte(source.ConfigJSON()), &captured) != nil {
 			return wire.State{}, sandbox.ErrOwnership
 		}
-		for _, key := range []string{workspaceModeLabel, workspaceObjectLabel, workspacePathLabel} {
+		for _, key := range []string{workspaceObjectLabel, workspacePathLabel} {
 			labels[key] = captured.Labels[key]
 		}
 		_, err = sdk.Snapshot.Create(ctx, sdk.SnapshotCreateOptions{
-			Name: "s-" + q.OperationID, Group: wire.Name(b.q.Config, b.q.Reference, 0), FromSandbox: q.Source.Name,
+			Name: "s-" + q.OperationID, Group: "s-" + q.OperationID, DestDir: b.storeDirectory(), FromSandbox: q.Source.Name,
 			Full: true, RecordIntegrity: true, GuestFlush: sdk.GuestFlushSkip, Labels: labels})
 		if err != nil {
 			return wire.State{}, err
@@ -196,20 +209,22 @@ func (b backend) suspend(ctx context.Context, q wire.SuspendRequest) (wire.State
 	if e = qualifySnapshotResources(b.q.Config, artifact.Labels()); e != nil {
 		return wire.State{}, e
 	}
-	receipt, hashed, e := b.publishArchive(ctx, artifact, snap)
-	if e != nil {
+	// The SDK has published the snapshot durably and inspectSnapshot has just
+	// verified it, so the receipt only records ownership.
+	receipt = checkpointReceipt{Snapshot: snap}
+	if e = durableJSON(filepath.Join(b.checkpointDirectory(q.OperationID), "receipt.json"), receipt); e != nil {
 		return wire.State{}, e
 	}
-	return b.settleSource(ctx, q, receipt, hashed)
+	return b.settleSource(ctx, q, receipt, true)
 }
 
-// hashed means this process has just written and hashed the archive under the
-// allocation lock; an existing receipt is always checked against its bytes.
-func (b backend) settleSource(ctx context.Context, q wire.SuspendRequest, r archiveReceipt, hashed bool) (wire.State, error) {
-	if !hashed {
-		if e := b.verifyArchive(r); e != nil {
+// verified means this process has just verified the snapshot under the
+// allocation lock; an existing receipt is always checked against its snapshot.
+func (b backend) settleSource(ctx context.Context, q wire.SuspendRequest, r checkpointReceipt, verified bool) (wire.State, error) {
+	if !verified {
+		if _, e := b.verifiedSnapshot(ctx, r.Snapshot); e != nil {
 			if q.ObserveOnly {
-				// Ownership comes from the durable receipt, independently of archive
+				// Ownership comes from the durable receipt, independently of snapshot
 				// usability. Expose cleanup identity without authorizing source transfer,
 				// claiming its current state, or weakening the restore integrity check.
 				return wire.State{Compute: q.Source, Status: "unknown", Snapshot: &r.Snapshot}, nil
@@ -243,7 +258,7 @@ func (b backend) settleSource(ctx context.Context, q wire.SuspendRequest, r arch
 	}
 	if !r.SourceTerminated {
 		r.SourceTerminated = true
-		if e = durableJSON(filepath.Join(b.archiveDirectory(q.OperationID), "receipt.json"), r); e != nil {
+		if e = durableJSON(filepath.Join(b.checkpointDirectory(q.OperationID), "receipt.json"), r); e != nil {
 			return wire.State{}, e
 		}
 	}
@@ -255,11 +270,8 @@ func (b backend) settleSource(ctx context.Context, q wire.SuspendRequest, r arch
 	if _, e = sdk.GetSandbox(ctx, q.Source.Name); !sdk.IsKind(e, sdk.ErrSandboxNotFound) {
 		return wire.State{}, wire.ErrUnconfirmed
 	}
-	if e = sdk.Snapshot.Remove(ctx, r.Snapshot.Reference, false); e != nil && !sdk.IsKind(e, sdk.ErrSnapshotNotFound) {
-		return wire.State{}, e
-	}
 	r.SourceStopped = true
-	if e = durableJSON(filepath.Join(b.archiveDirectory(q.OperationID), "receipt.json"), r); e != nil {
+	if e = durableJSON(filepath.Join(b.checkpointDirectory(q.OperationID), "receipt.json"), r); e != nil {
 		return wire.State{}, e
 	}
 	return wire.State{Compute: q.Source, Status: "suspended", BootstrapComplete: true, Snapshot: &r.Snapshot, SourceStopped: true}, nil
@@ -315,33 +327,42 @@ func (b backend) resume(ctx context.Context, q wire.ResumeRequest) (wire.State,
 	}
 	// Admission is durable before any native import/restore operation. A prior
 	// admitted operation with no visible target remains unknown, never replayed.
-	artifact, e := b.importArchive(ctx, q.Snapshot)
-	if e != nil {
-		return wire.State{}, e
+	// The fresh dispatch that created the admission closes it on any failure
+	// before RestoreSandbox, since no guest execution can have occurred.
+	artifact, e := b.restoreSource(ctx, q.Snapshot)
+	if e == nil {
+		e = qualifySnapshotResources(b.q.Config, artifact.Labels())
 	}
-	if e = qualifySnapshotResources(b.q.Config, artifact.Labels()); e != nil {
-		return wire.State{}, e
+	if e == nil {
+		e = qualifyWorkspace(artifact.Labels(), b.q.Workspace)
 	}
-	if err := qualifyWorkspace(artifact.Labels(), b.q.Workspace); err != nil {
-		return wire.State{}, err
+	if e == nil {
+		e = qualifyRuntimeImage(ctx, b.q.Config, artifact.ImageManifestDigest())
 	}
-	if err := qualifyRuntimeImage(ctx, b.q.Config, artifact.ImageManifestDigest()); err != nil {
-		return wire.State{}, err
+	if e != nil {
+		if q.ObserveOnly {
+			return wire.State{}, e
+		}
+		return wire.State{}, b.closeUndispatchedRestore(q, e)
 	}
 	_, _, e = b.inspectOwned(ctx, q.Target)
 	if e == nil {
 		return b.completeRestore(ctx, q, q.Target)
 	}
 	if !sdk.IsKind(e, sdk.ErrSandboxNotFound) {
+		// A failed target lookup proves nothing about the snapshot: close only.
+		if !q.ObserveOnly {
+			if err := b.closeRestore(q, false); err != nil {
+				return wire.State{}, err
+			}
+		}
 		return wire.State{}, e
 	}
 	if q.ObserveOnly || q.Target.ID != "" {
 		return wire.State{}, wire.ErrUnconfirmed
 	}
-	restore := sdk.RestoreConfig{NetworkPolicy: b.network(), ExternalMountPolicy: sdk.ExternalMountStrict}
-	if b.q.Workspace != nil {
-		restore.Volumes = map[string]sdk.MountConfig{"/environment": sdk.Mount.Bind(b.q.Workspace.Path, sdk.MountOptions{})}
-	}
+	restore := sdk.RestoreConfig{NetworkPolicy: b.network(), ExternalMountPolicy: sdk.ExternalMountStrict,
+		Volumes: map[string]sdk.MountConfig{"/environment": sdk.Mount.Bind(b.q.Workspace.Path, sdk.MountOptions{})}}
 	if err := b.closeExpiredRestore(q); err != nil {
 		return wire.State{}, err
 	}
diff --git a/services/core/tools/microsandbox-provider/snapshot_observation_test.go b/services/core/tools/microsandbox-provider/snapshot_observation_test.go
index 7ebd62a6d..ffd6dcca3 100644
--- a/services/core/tools/microsandbox-provider/snapshot_observation_test.go
+++ b/services/core/tools/microsandbox-provider/snapshot_observation_test.go
@@ -83,31 +83,6 @@ func TestRestoreJournalRejectsPartialAndSymlinkRecords(t *testing.T) {
 		})
 	}
 }
-func TestArchiveDigestRejectsGuestReadableAndSymlinkArtifacts(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "archive")
-	if err := os.WriteFile(path, []byte("private RAM"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	hash, size, err := archiveDigest(path)
-	if err != nil || len(hash) != 64 || size != 11 {
-		t.Fatal(hash, size, err)
-	}
-	if err = os.Chmod(path, 0644); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err = archiveDigest(path); !errors.Is(err, sandbox.ErrOwnership) {
-		t.Fatal(err)
-	}
-	link := filepath.Join(dir, "link")
-	if err = os.Symlink(path, link); err != nil {
-		t.Fatal(err)
-	}
-	if _, _, err = archiveDigest(link); !errors.Is(err, sandbox.ErrOwnership) {
-		t.Fatal(err)
-	}
-}
-
 func TestAdmittedRestoreBlocksCleanupUntilExactCompletion(t *testing.T) {
 	request := initialInfoRequest(t)
 	guard, err := allocationLock(request)
@@ -184,7 +159,11 @@ func TestTargetCleanupFenceSurvivesReopenBeforeAndAfterAdmission(t *testing.T) {
 	}
 }
 
-func TestLostCaptureResponseStillExposesOwnedIdentityWhenArchiveIsDamaged(t *testing.T) {
+func TestLostCaptureResponseStillExposesOwnedIdentityWhenCheckpointIsDamaged(t *testing.T) {
+	if !isolatedSDKTest(t) {
+		return
+	}
+	t.Setenv("MSB_HOME", t.TempDir())
 	for _, settled := range []bool{false, true} {
 		for _, damage := range []string{"corrupt", "missing"} {
 			t.Run(fmt.Sprintf("settled=%t/%s", settled, damage), func(t *testing.T) {
@@ -203,29 +182,21 @@ func TestLostCaptureResponseStillExposesOwnedIdentityWhenArchiveIsDamaged(t *tes
 					t.Fatal(err)
 				}
 				snapshot := wire.SnapshotIdentity{Compatibility: compatibility, Reference: wire.SnapshotReference(request.Config, request.Reference, operation), ID: "exact-snapshot", Digest: "digest", CheckpointID: "checkpoint", CheckpointRoot: "root", OperationID: operation, SourceName: source.Name, SourceID: source.ID}
-				dir := b.archiveDirectory(operation)
+				dir := b.checkpointDirectory(operation)
 				if err = privateDirectory(dir); err != nil {
 					t.Fatal(err)
 				}
-				archive := filepath.Join(dir, "archive.msb")
-				if err = os.WriteFile(archive, []byte("verified full archive"), 0600); err != nil {
-					t.Fatal(err)
-				}
-				hash, size, err := archiveDigest(archive)
-				if err != nil {
-					t.Fatal(err)
-				}
-				receipt := archiveReceipt{Snapshot: snapshot, SHA256: hash, Size: size, SourceTerminated: settled, SourceStopped: settled}
+				receipt := checkpointReceipt{Snapshot: snapshot, SourceTerminated: settled, SourceStopped: settled}
 				if err = durableJSON(filepath.Join(dir, "receipt.json"), receipt); err != nil {
 					t.Fatal(err)
 				}
 				if damage == "corrupt" {
-					err = os.WriteFile(archive, []byte("damaged"), 0600)
-				} else {
-					err = os.Remove(archive)
-				}
-				if err != nil {
-					t.Fatal(err)
+					if err = os.Mkdir(filepath.Join(dir, "snap_damaged"), 0700); err == nil {
+						err = os.WriteFile(filepath.Join(dir, "snap_damaged", "snapshot.json"), []byte("damaged"), 0600)
+					}
+					if err != nil {
+						t.Fatal(err)
+					}
 				}
 				// Core lost the capture response and therefore has no Snapshot yet. It
 				// needs this ownership identity to reach ordinary Kill/DeleteSnapshot.
@@ -233,11 +204,11 @@ func TestLostCaptureResponseStillExposesOwnedIdentityWhenArchiveIsDamaged(t *tes
 				if err != nil || state.Snapshot == nil || *state.Snapshot != snapshot || state.Compute != source || state.SourceStopped || state.Status != "unknown" || state.BootstrapComplete {
 					t.Fatalf("cleanup identity hidden or execution authorized: %+v %v", state, err)
 				}
-				if artifact, err := b.importArchive(t.Context(), snapshot); err == nil || artifact != nil {
-					t.Fatal("damaged archive was usable for restore", err)
+				if artifact, err := b.restoreSource(t.Context(), snapshot); err == nil || artifact != nil {
+					t.Fatal("damaged checkpoint was usable for restore", err)
 				}
 				if _, err = b.suspend(t.Context(), wire.SuspendRequest{Reference: request.Reference, OperationID: operation, Source: source}); err == nil {
-					t.Fatal("non-observation accepted unusable archive")
+					t.Fatal("non-observation accepted unusable checkpoint")
 				}
 				foreign := source
 				foreign.ID = "local:foreign"
@@ -245,15 +216,11 @@ func TestLostCaptureResponseStillExposesOwnedIdentityWhenArchiveIsDamaged(t *tes
 				if !errors.Is(err, sandbox.ErrOwnership) || denied.Snapshot != nil {
 					t.Fatal("foreign request recovered owned identity", denied, err)
 				}
-				nativeRemoved := false
-				if err = b.deleteArchiveWithNative(*state.Snapshot, func() error { nativeRemoved = true; return nil }); err != nil {
-					t.Fatal("owned damaged archive could not be deleted", err)
+				if err = b.deleteCheckpoint(t.Context(), *state.Snapshot); err != nil {
+					t.Fatal("owned damaged checkpoint could not be deleted", err)
 				}
-				if !nativeRemoved {
-					t.Fatal("native cleanup was skipped")
-				}
-				if _, err = os.Lstat(archive); !errors.Is(err, os.ErrNotExist) {
-					t.Fatal("archive remains", err)
+				if _, err = os.Stat(filepath.Join(dir, "snap_damaged")); !errors.Is(err, os.ErrNotExist) {
+					t.Fatal("damaged checkpoint content was kept", err)
 				}
 				deleted, err := b.receipt(operation)
 				if err != nil || !deleted.Deleted || deleted.Snapshot != snapshot {
@@ -265,7 +232,7 @@ func TestLostCaptureResponseStillExposesOwnedIdentityWhenArchiveIsDamaged(t *tes
 }
 
 // These requests use the real SDK's empty local registry, without starting a VM.
-func TestPermanentRestoreImportFailureKeepsOneAdmission(t *testing.T) {
+func TestUnusableCheckpointClosesAdmissionDurably(t *testing.T) {
 	if !isolatedSDKTest(t) {
 		return
 	}
@@ -288,32 +255,24 @@ func TestPermanentRestoreImportFailureKeepsOneAdmission(t *testing.T) {
 					t.Fatal(err)
 				}
 				q.Snapshot = wire.SnapshotIdentity{Compatibility: compatibility, Reference: wire.SnapshotReference(request.Config, request.Reference, q.OperationID), ID: "id", Digest: "digest", CheckpointID: "checkpoint", CheckpointRoot: "root", OperationID: q.OperationID, SourceName: wire.Name(request.Config, request.Reference, 0), SourceID: "local:source"}
-				dir := b.archiveDirectory(q.OperationID)
+				dir := b.checkpointDirectory(q.OperationID)
 				if err = privateDirectory(dir); err != nil {
 					t.Fatal(err)
 				}
-				archive := filepath.Join(dir, "archive.msb")
-				if err = os.WriteFile(archive, []byte("original"), 0600); err != nil {
-					t.Fatal(err)
-				}
-				hash, size, err := archiveDigest(archive)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if err = durableJSON(filepath.Join(dir, "receipt.json"), archiveReceipt{Snapshot: q.Snapshot, SHA256: hash, Size: size, SourceStopped: true, SourceTerminated: true}); err != nil {
+				if err = durableJSON(filepath.Join(dir, "receipt.json"), checkpointReceipt{Snapshot: q.Snapshot, SourceStopped: true, SourceTerminated: true}); err != nil {
 					t.Fatal(err)
 				}
-				if err = os.WriteFile(archive, []byte("corrupt!"), 0600); err != nil {
+				if err = os.MkdirAll(filepath.Join(dir, "snap_damaged"), 0700); err != nil {
 					t.Fatal(err)
 				}
 			}
-			if _, err = b.resume(t.Context(), q); err == nil {
-				t.Fatal("missing archive accepted")
+			if _, err = b.resume(t.Context(), q); !errors.Is(err, sandbox.ErrCheckpointUnusable) {
+				t.Fatal("unusable checkpoint not reported", err)
 			}
 			path := filepath.Join(b.storeDirectory(), "r-"+q.OperationID+".json")
 			var record restoreAdmission
-			if err = readPrivateJSON(path, &record); err != nil || record.Closed {
-				t.Fatal("permanent failure closed", record, err)
+			if err = readPrivateJSON(path, &record); err != nil || !record.Closed || !record.Unusable {
+				t.Fatal("unusable checkpoint left admission open", record, err)
 			}
 			before, err := os.ReadFile(path)
 			if err != nil {
@@ -323,10 +282,11 @@ func TestPermanentRestoreImportFailureKeepsOneAdmission(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			q.ObserveOnly = true
-			for i := 0; i < 3; i++ {
+			// Observation and late fresh requests report the same durable outcome.
+			for _, observe := range []bool{true, false, true} {
+				q.ObserveOnly = observe
 				state, err := b.resume(t.Context(), q)
-				if !errors.Is(err, wire.ErrUnconfirmed) || state.RestoreAttemptClosed != "" {
+				if !errors.Is(err, sandbox.ErrCheckpointUnusable) || state.RestoreAttemptClosed != "" {
 					t.Fatal(state, err)
 				}
 			}
@@ -342,6 +302,28 @@ func TestPermanentRestoreImportFailureKeepsOneAdmission(t *testing.T) {
 	}
 }
 
+func TestUnclassifiedPreDispatchFailureClosesAttemptForReplacement(t *testing.T) {
+	request := initialInfoRequest(t)
+	guard, err := allocationLock(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer guard.Close()
+	b := backend{q: request}
+	q := wire.ResumeRequest{OperationID: "66666666-6666-4666-8666-666666666666", Target: wire.Compute{Name: "target", Generation: 1}}
+	if _, err = b.admitRestore(q); err != nil {
+		t.Fatal(err)
+	}
+	if err = b.closeUndispatchedRestore(q, context.Canceled); !errors.Is(err, context.Canceled) {
+		t.Fatal("unclassified failure changed", err)
+	}
+	q.ObserveOnly = true
+	state, err := b.resume(t.Context(), q)
+	if err != nil || state.RestoreAttemptClosed != q.OperationID {
+		t.Fatal("closed attempt not reported", state, err)
+	}
+}
+
 func TestFreshRestoreRequestDeadlineClosesBeforeNativeExecution(t *testing.T) {
 	if !isolatedSDKTest(t) {
 		return
@@ -390,7 +372,7 @@ func isolatedSDKTest(t *testing.T) bool {
 	return false
 }
 
-func TestAdmittedAbsentObservationSkipsArchiveAndStaysUnknown(t *testing.T) {
+func TestAdmittedAbsentObservationSkipsCheckpointAndStaysUnknown(t *testing.T) {
 	if !isolatedSDKTest(t) {
 		return
 	}
@@ -406,7 +388,7 @@ func TestAdmittedAbsentObservationSkipsArchiveAndStaysUnknown(t *testing.T) {
 	if _, err = b.admitRestore(q); err != nil {
 		t.Fatal(err)
 	}
-	// Even a missing archive must not be consulted: its ENOENT would differ from
+	// Even a missing checkpoint must not be consulted: its ENOENT would differ from
 	// the typed unknown result returned for this existing admitted target.
 	path := filepath.Join(b.storeDirectory(), "r-"+q.OperationID+".json")
 	before, err := os.ReadFile(path)
diff --git a/services/core/tools/microsandbox-provider/workspace_test.go b/services/core/tools/microsandbox-provider/workspace_test.go
index ea726d3f1..220ef4adb 100644
--- a/services/core/tools/microsandbox-provider/workspace_test.go
+++ b/services/core/tools/microsandbox-provider/workspace_test.go
@@ -8,20 +8,14 @@ import (
 	"testing"
 )
 
-func TestExternalEnvironmentQualificationRequiresExplicitOwnership(t *testing.T) {
-	for _, fault := range []string{"match", "missing mode", "foreign path", "owned mount", "wrong guest", "missing object"} {
+func TestEnvironmentQualificationRequiresExplicitOwnership(t *testing.T) {
+	for _, fault := range []string{"match", "foreign path", "owned mount", "wrong guest", "missing object"} {
 		t.Run(fault, func(t *testing.T) {
 			config, actual := deploymentFixture()
-			config.EnvironmentDiskMiB = 0
-			config.ExternalWorkspace = true
-			workspace := &wire.WorkspaceDirectory{Path: "/resolved/environment", ObjectID: "88888888-8888-4888-8888-888888888888"}
-			labels := workspaceLabels(workspace)
+			labels := workspaceLabels(fixtureWorkspace)
 			actual["labels"] = labels
-			mount := map[string]any{"type": "Bind", "host": workspace.Path, "guest": "/environment"}
-			actual["mounts"] = []any{mount}
+			mount := actual["mounts"].([]any)[0].(map[string]any)
 			switch fault {
-			case "missing mode":
-				delete(labels, workspaceModeLabel)
 			case "foreign path":
 				mount["host"] = "/foreign"
 			case "owned mount":
@@ -46,9 +40,6 @@ func TestSnapshotWorkspaceIdentityAllowsReresolvedDirectory(t *testing.T) {
 	if err := qualifyWorkspace(labels, workspace); err != nil {
 		t.Fatal(err)
 	}
-	if err := qualifyWorkspace(labels, nil); err == nil {
-		t.Fatal("external checkpoint accepted owned mode")
-	}
 	workspace.ObjectID = "99999999-9999-4999-8999-999999999999"
 	if err := qualifyWorkspace(labels, workspace); err == nil {
 		t.Fatal("foreign object accepted")
diff --git a/services/web/distribution_test.go b/services/web/distribution_test.go
index 51e0608df..3a540af8a 100644
--- a/services/web/distribution_test.go
+++ b/services/web/distribution_test.go
@@ -12,38 +12,29 @@ import (
 	"testing"
 )
 
-// activeRelease publishes an empty node payload release under root the way
-// `oac init` does and returns the release directory.
-func activeRelease(t *testing.T, root string, manifest map[string]any) string {
+// publishedPayload writes an empty node payload manifest under root the way
+// `oac init` does and returns root.
+func publishedPayload(t *testing.T, root string, manifest map[string]any) string {
 	t.Helper()
-	revision := strings.Repeat("a", 40)
-	release := filepath.Join(root, "releases", revision)
-	if err := os.MkdirAll(release, 0700); err != nil {
-		t.Fatal(err)
-	}
-	manifest["source_commit"] = revision
+	manifest["source_commit"] = strings.Repeat("a", 40)
 	raw, _ := json.Marshal(manifest)
-	if os.WriteFile(filepath.Join(release, "manifest.json"), raw, 0600) != nil ||
-		os.WriteFile(filepath.Join(root, "active.json"), []byte(`{"source_commit":"`+revision+`"}`), 0600) != nil {
+	if os.WriteFile(filepath.Join(root, "manifest.json"), raw, 0600) != nil {
 		t.Fatal("cannot publish the node payload")
 	}
-	return release
+	return root
 }
 
 func TestConsoleRequiresPublishedNodePayload(t *testing.T) {
-	payload := t.TempDir()
-	if err := os.WriteFile(filepath.Join(payload, "node-install.pyz"), []byte("bootstrap"), 0600); err != nil {
-		t.Fatal(err)
-	}
+	payload := publishedPayload(t, t.TempDir(), map[string]any{})
 	upstream, _ := url.Parse("http://127.0.0.1:1")
 	if _, err := newConsole(config{origin: testOrigin, upstream: upstream, dist: t.TempDir(), coreKey: testCoreKey, nodePayloadDir: payload}); err == nil {
-		t.Fatal("console started from a node payload without active.json")
+		t.Fatal("console started from a node payload without node-install.pyz")
 	}
 }
 
 func TestOfflineArtifactsAreManifestAllowlisted(t *testing.T) {
 	dist, payload := t.TempDir(), t.TempDir()
-	release := activeRelease(t, payload, map[string]any{"artifacts": map[string]any{"native/bin/oac-node": map[string]string{"filename": "matched-node"}, "private/key": map[string]string{"filename": "private-key"}, "native/bin/oac-selfhost": map[string]string{"filename": "retired-launcher"}}})
+	release := publishedPayload(t, payload, map[string]any{"artifacts": map[string]any{"native/bin/oac-node": map[string]string{"filename": "matched-node"}, "private/key": map[string]string{"filename": "private-key"}, "native/bin/oac-selfhost": map[string]string{"filename": "retired-launcher"}}})
 	for _, item := range []struct{ root, name, body string }{{dist, "index.html", "console"}, {release, "node-install.pyz", "bootstrap"}} {
 		if err := os.WriteFile(filepath.Join(item.root, item.name), []byte(item.body), 0600); err != nil {
 			t.Fatal(err)
@@ -96,7 +87,7 @@ func TestConsoleReportsServableNodeProviders(t *testing.T) {
 	for _, logical := range []string{"native/bin/oac-node", "images/runtime.tar.gz", "native/microsandbox/msb", "runtime/seccomp.json"} {
 		artifacts[logical] = map[string]any{"filename": strings.ReplaceAll(logical, "/", "-"), "size": len("runtime-bytes")}
 	}
-	release := activeRelease(t, payload, map[string]any{"artifacts": artifacts})
+	release := publishedPayload(t, payload, map[string]any{"artifacts": artifacts})
 	write(filepath.Join(dist, "index.html"), "console")
 	write(filepath.Join(release, "node-install.pyz"), "bootstrap")
 	for logical := range artifacts {
@@ -135,7 +126,7 @@ func TestConsoleReportsServableNodeProviders(t *testing.T) {
 	}
 }
 
-func TestRetainedPayloadsRemainHTTPReachableAfterPublication(t *testing.T) {
+func TestNodePayloadServesOnlyPublishedFiles(t *testing.T) {
 	root := t.TempDir()
 	write := func(name, body string) {
 		t.Helper()
@@ -147,14 +138,11 @@ func TestRetainedPayloadsRemainHTTPReachableAfterPublication(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
-	a, b := strings.Repeat("a", 40), strings.Repeat("b", 40)
-	for _, revision := range []string{a, b} {
-		prefix := "releases/" + revision + "/"
-		write(prefix+"manifest.json", `{"source_commit":"`+revision+`","artifacts":{"native/bin/oac-node":{"filename":"node"},"private/key":{"filename":"key"}}}`)
-		write(prefix+"node-install.pyz", "installer-"+revision)
-		write(prefix+"artifacts/node", "binary-"+revision)
-		write(prefix+"artifacts/key", "secret-must-not-be-served")
-	}
+	write("manifest.json", `{"source_commit":"`+strings.Repeat("a", 40)+`","artifacts":{"native/bin/oac-node":{"filename":"node"},"private/key":{"filename":"key"}}}`)
+	write("node-install.pyz", "installer")
+	write("artifacts/node", "binary")
+	write("artifacts/key", "secret-must-not-be-served")
+	write("secrets/core.key", "secret-must-not-be-served")
 	payload, err := os.OpenRoot(root)
 	if err != nil {
 		t.Fatal(err)
@@ -167,33 +155,22 @@ func TestRetainedPayloadsRemainHTTPReachableAfterPublication(t *testing.T) {
 		h.serveNodePayload(w, httptest.NewRequest("GET", "/node-install/"+path, nil))
 		return w.Code, w.Body.String()
 	}
-	for _, revision := range []string{a, b} {
-		write("active.json", `{"source_commit":"`+revision+`"}`)
-		if code, body := request("node-install.pyz"); code != 200 || body != "installer-"+revision {
-			t.Fatal("active release not served", code, body)
-		}
-		// Add node commands verify the active release's installer without a Web restart.
-		config := httptest.NewRecorder()
-		h.serveConsoleConfiguration(config, httptest.NewRequest("GET", "/console/config", nil))
-		digest := sha256.Sum256([]byte("installer-" + revision))
-		if !strings.Contains(config.Body.String(), `"node_installer_sha256":"`+hex.EncodeToString(digest[:])+`"`) {
-			t.Fatal("installer digest does not follow the active release", config.Body.String())
-		}
-		if code, body := request("releases/" + a + "/artifacts/node"); code != 200 || body != "binary-"+a {
-			t.Fatal("retained release unreachable", code, body)
-		}
-		for _, name := range []string{"active.json", "releases/" + a + "/artifacts/key", "releases/" + a + "/secrets/core.key", "releases/../../node-install.pyz"} {
-			if code, _ := request(name); code != 404 {
-				t.Fatal("non-public file exposed", name, code)
-			}
-		}
+	if code, body := request("node-install.pyz"); code != 200 || body != "installer" {
+		t.Fatal("installer not served", code, body)
+	}
+	// Add node commands verify the installer by this digest.
+	config := httptest.NewRecorder()
+	h.serveConsoleConfiguration(config, httptest.NewRequest("GET", "/console/config", nil))
+	digest := sha256.Sum256([]byte("installer"))
+	if !strings.Contains(config.Body.String(), `"node_installer_sha256":"`+hex.EncodeToString(digest[:])+`"`) {
+		t.Fatal("installer digest does not follow the payload", config.Body.String())
 	}
-	write("releases/"+a+"/manifest.json", `{"source_commit":"`+b+`"}`)
-	if code, _ := request("releases/" + a + "/node-install.pyz"); code != 404 {
-		t.Fatal("mismatched release identity was served")
+	if code, body := request("artifacts/node"); code != 200 || body != "binary" {
+		t.Fatal("declared artifact unreachable", code, body)
 	}
-	write("active.json", `{"source_commit":"../../"}`)
-	if code, _ := request("node-install.pyz"); code != 404 {
-		t.Fatal("invalid pointer did not fail closed")
+	for _, name := range []string{"artifacts/key", "secrets/core.key", "releases/" + strings.Repeat("a", 40) + "/node-install.pyz", "../node-install.pyz"} {
+		if code, _ := request(name); code != 404 {
+			t.Fatal("non-public file exposed", name, code)
+		}
 	}
 }
diff --git a/services/web/node_artifacts.go b/services/web/node_artifacts.go
index c17869b87..2e96ecc00 100644
--- a/services/web/node_artifacts.go
+++ b/services/web/node_artifacts.go
@@ -22,9 +22,9 @@ type nodeManifest struct {
 	Artifacts       map[string]nodeArtifact `json:"artifacts"`
 }
 
-func (h *console) readNodeManifest(prefix string) (nodeManifest, error) {
+func (h *console) readNodeManifest() (nodeManifest, error) {
 	var manifest nodeManifest
-	f, err := h.nodePayload.Open(prefix + "manifest.json")
+	f, err := h.nodePayload.Open("manifest.json")
 	if err != nil {
 		return manifest, err
 	}
@@ -33,12 +33,10 @@ func (h *console) readNodeManifest(prefix string) (nodeManifest, error) {
 	if err != nil || len(raw) > 1024*1024 || json.Unmarshal(raw, &manifest) != nil {
 		return manifest, errors.New("invalid node manifest")
 	}
-	if prefix != "releases/"+manifest.SourceCommit+"/" {
-		return manifest, errors.New("node manifest release mismatch")
-	}
 	return manifest, nil
 }
 
+var payloadRevision = regexp.MustCompile(`^[0-9a-f]{40}$`)
 var nodeArtifactName = regexp.MustCompile(`^[A-Za-z0-9._-]+$`)
 var nodeArtifactDigest = regexp.MustCompile(`^[0-9a-f]{64}$`)
 
diff --git a/services/web/node_artifacts_test.go b/services/web/node_artifacts_test.go
index 8dc245484..6fdc01150 100644
--- a/services/web/node_artifacts_test.go
+++ b/services/web/node_artifacts_test.go
@@ -14,7 +14,6 @@ import (
 func TestOnlineNodeArtifactsRedirectWithoutLocalPayload(t *testing.T) {
 	root := t.TempDir()
 	revision := strings.Repeat("a", 40)
-	prefix := "releases/" + revision + "/"
 	write := func(name string, data []byte) {
 		t.Helper()
 		full := filepath.Join(root, name)
@@ -31,8 +30,7 @@ func TestOnlineNodeArtifactsRedirectWithoutLocalPayload(t *testing.T) {
 		manifest.Artifacts[logical] = nodeArtifact{Filename: "oac-" + revision + "-" + strings.ReplaceAll(logical, "/", "-"), Size: 9, SHA256: hex.EncodeToString(sum[:])}
 	}
 	raw, _ := json.Marshal(manifest)
-	write(prefix+"manifest.json", raw)
-	write("active.json", []byte(`{"source_commit":"`+revision+`"}`))
+	write("manifest.json", raw)
 	payload, err := os.OpenRoot(root)
 	if err != nil {
 		t.Fatal(err)
@@ -45,31 +43,31 @@ func TestOnlineNodeArtifactsRedirectWithoutLocalPayload(t *testing.T) {
 	name := manifest.Artifacts["images/runtime.tar.gz"].Filename
 	for _, method := range []string{"GET", "HEAD"} {
 		w := httptest.NewRecorder()
-		h.serveNodePayload(w, httptest.NewRequest(method, "/node-install/"+prefix+"artifacts/"+name, nil))
+		h.serveNodePayload(w, httptest.NewRequest(method, "/node-install/artifacts/"+name, nil))
 		if w.Code != 307 || w.Header().Get("Location") != manifest.ArtifactBaseURL+"/"+name {
 			t.Fatal(w.Code, w.Header())
 		}
 	}
-	if _, err := os.Stat(filepath.Join(root, prefix, "artifacts")); !os.IsNotExist(err) {
+	if _, err := os.Stat(filepath.Join(root, "artifacts")); !os.IsNotExist(err) {
 		t.Fatal("Web cached execution artifacts", err)
 	}
 	for _, name := range []string{"unknown", "../manifest.json", "private-key"} {
 		w := httptest.NewRecorder()
-		h.serveNodePayload(w, httptest.NewRequest("GET", "/node-install/"+prefix+"artifacts/"+name, nil))
+		h.serveNodePayload(w, httptest.NewRequest("GET", "/node-install/artifacts/"+name, nil))
 		if w.Code != 404 {
 			t.Fatal(w.Code, name)
 		}
 	}
-	write(prefix+"artifacts/"+name, []byte("node-data"))
+	write("artifacts/"+name, []byte("node-data"))
 	w := httptest.NewRecorder()
-	request := httptest.NewRequest("GET", "/node-install/"+prefix+"artifacts/"+name, nil)
+	request := httptest.NewRequest("GET", "/node-install/artifacts/"+name, nil)
 	request.Header.Set("Range", "bytes=5-")
 	h.serveNodePayload(w, request)
 	if w.Code != 206 || w.Body.String() != "data" {
 		t.Fatal("offline artifact did not take precedence", w.Code, w.Body.String())
 	}
 	// A damaged local file must not be hidden by a remote availability fallback.
-	write(prefix+"artifacts/"+name, []byte("bad"))
+	write("artifacts/"+name, []byte("bad"))
 	if len(h.nodeArtifacts()) != 0 {
 		t.Fatal("damaged local Runtime was advertised")
 	}
diff --git a/services/web/node_installation.go b/services/web/node_installation.go
index 4825af720..65dd5135b 100644
--- a/services/web/node_installation.go
+++ b/services/web/node_installation.go
@@ -8,7 +8,6 @@ import (
 	"io"
 	"net/http"
 	"os"
-	"regexp"
 	"sort"
 	"strings"
 
@@ -33,64 +32,29 @@ var optionalPayloadFiles = func() map[string]bool {
 	return files
 }()
 
-var payloadRevision = regexp.MustCompile(`^[0-9a-f]{40}$`)
-
-// activePayloadPrefix reads the installer's atomic release pointer once per request.
-func activePayloadPrefix(root *os.Root) (string, error) {
-	raw, err := root.ReadFile("active.json")
-	if err != nil || len(raw) > 256 {
-		return "", errors.New("invalid active node payload")
-	}
-	var pointer struct {
-		SourceCommit string `json:"source_commit"`
-	}
-	if json.Unmarshal(raw, &pointer) != nil || !payloadRevision.MatchString(pointer.SourceCommit) {
-		return "", errors.New("invalid active node payload")
-	}
-	return "releases/" + pointer.SourceCommit + "/", nil
-}
-
-func (h *console) resolveNodePayload(name string) (string, bool) {
-	var prefix string
-	if strings.HasPrefix(name, "releases/") {
-		parts := strings.SplitN(name, "/", 3)
-		if len(parts) != 3 || !payloadRevision.MatchString(parts[1]) {
-			return "", false
-		}
-		prefix, name = "releases/"+parts[1]+"/", parts[2]
-	} else {
-		var err error
-		prefix, err = activePayloadPrefix(h.nodePayload)
-		if err != nil {
-			return "", false
-		}
-	}
+func (h *console) resolveNodePayload(name string) bool {
 	if !nodePayloadFiles[name] && (!strings.HasPrefix(name, "artifacts/") || strings.Contains(strings.TrimPrefix(name, "artifacts/"), "/")) {
-		return "", false
+		return false
 	}
-	manifest, err := h.readNodeManifest(prefix)
+	manifest, err := h.readNodeManifest()
 	if err != nil {
-		return "", false
+		return false
 	}
 	if nodePayloadFiles[name] {
-		return prefix + name, true
+		return true
 	}
 	for logical, entry := range manifest.Artifacts {
 		if optionalPayloadFiles[logical] && entry.Filename != "" && "artifacts/"+entry.Filename == name {
-			return prefix + name, true
+			return true
 		}
 	}
-	return "", false
+	return false
 }
 
 // installerDigest returns the SHA-256 that Web's install commands verify
 // before running the named installer from the payload.
 func installerDigest(root *os.Root, name string) (string, error) {
-	prefix, err := activePayloadPrefix(root)
-	if err != nil {
-		return "", err
-	}
-	f, err := root.Open(prefix + name)
+	f, err := root.Open(name)
 	if err != nil {
 		return "", errors.New("installer " + name + " is missing from the node installation payload")
 	}
@@ -113,16 +77,15 @@ func (h *console) serveNodePayload(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	name := strings.TrimPrefix(r.URL.Path, "/node-install/")
-	resolved, allowed := h.resolveNodePayload(name)
-	if !allowed {
+	if !h.resolveNodePayload(name) {
 		http.NotFound(w, r)
 		return
 	}
-	f, err := h.nodePayload.Open(resolved)
+	f, err := h.nodePayload.Open(name)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			if prefix, filename, ok := strings.Cut(resolved, "artifacts/"); ok {
-				if manifest, readErr := h.readNodeManifest(prefix); readErr == nil {
+			if filename, ok := strings.CutPrefix(name, "artifacts/"); ok {
+				if manifest, readErr := h.readNodeManifest(); readErr == nil {
 					if target := manifest.artifactURL(filename); target != "" {
 						http.Redirect(w, r, target, http.StatusTemporaryRedirect)
 						return
@@ -145,18 +108,13 @@ func (h *console) serveNodePayload(w http.ResponseWriter, r *http.Request) {
 
 // nodeArtifacts reports the providers whose node artifacts this console can serve:
 // each is present locally or has a pinned release download. Nodes verify every
-// checksum themselves. It is read per
-// request, so artifacts added by rerunning the installer show without a restart.
+// checksum themselves. It is read per request.
 func (h *console) nodeArtifacts() []string {
 	available := []string{}
 	if h.nodePayload == nil {
 		return available
 	}
-	prefix, err := activePayloadPrefix(h.nodePayload)
-	if err != nil {
-		return available
-	}
-	manifest, err := h.readNodeManifest(prefix)
+	manifest, err := h.readNodeManifest()
 	if err != nil {
 		return available
 	}
@@ -165,7 +123,7 @@ func (h *console) nodeArtifacts() []string {
 		for _, artifact := range artifacts {
 			logical := artifact.Path
 			entry, ok := manifest.Artifacts[logical]
-			info, err := h.nodePayload.Stat(prefix + "artifacts/" + entry.Filename)
+			info, err := h.nodePayload.Stat("artifacts/" + entry.Filename)
 			local := err == nil && info.Mode().IsRegular() && info.Size() == entry.Size
 			remote := errors.Is(err, os.ErrNotExist) && manifest.artifactURL(entry.Filename) != ""
 			if !ok || entry.Filename == "" || strings.Contains(entry.Filename, "/") || (!local && !remote) {
@@ -181,8 +139,8 @@ func (h *console) nodeArtifacts() []string {
 	return available
 }
 
-// serveConsoleConfiguration reads the active release on every request, so an
-// upgrade that moves the pointer needs no Web restart.
+// serveConsoleConfiguration reads the payload on every request, so artifacts
+// added by rerunning the installer show without a Web restart.
 func (h *console) serveConsoleConfiguration(w http.ResponseWriter, _ *http.Request) {
 	digest := ""
 	if h.nodePayload != nil {
diff --git a/services/web/node_installation_test.go b/services/web/node_installation_test.go
index 6ee331c8f..277b36504 100644
--- a/services/web/node_installation_test.go
+++ b/services/web/node_installation_test.go
@@ -35,7 +35,7 @@ func TestPairedConsoleProxiesOnlyAdministration(t *testing.T) {
 	defer upstream.Close()
 	u, _ := url.Parse(upstream.URL)
 	dist, payload := t.TempDir(), t.TempDir()
-	release := activeRelease(t, payload, map[string]any{})
+	release := publishedPayload(t, payload, map[string]any{})
 	for _, file := range []struct{ path, value string }{{filepath.Join(dist, "index.html"), "console"}, {filepath.Join(release, "node-install.pyz"), "print('installer')"}, {filepath.Join(release, "self-hosted-install.pyz"), "print('self-hosted')"}, {filepath.Join(release, "caller.key"), "must-not-be-served"}} {
 		if err := os.WriteFile(file.path, []byte(file.value), 0600); err != nil {
 			t.Fatal(err)
diff --git a/website/.vitepress/config.mts b/website/.vitepress/config.mts
index 55d80382d..a2c8bb1b6 100644
--- a/website/.vitepress/config.mts
+++ b/website/.vitepress/config.mts
@@ -6,14 +6,14 @@ import { defineConfig, type SiteConfig } from 'vitepress'
 import { mermaidFences } from './mermaid.mts'
 import { repositoryLinks } from './repository-links.mts'
 import { siteBase } from './site-base.mts'
-import { docsSidebar, legacyRedirects, pageTitle, readDocsJson, repoRoot } from './docs-nav.mts'
+import { docsNav, docsSidebar, pageTitle, readDocsJson, repoRoot, summary } from './docs-nav.mts'
 
 // Pages outside this package resolve Vue from here, not from the repository root.
 const require = createRequire(import.meta.url)
 const vueDir = dirname(require.resolve('vue/package.json'))
 
 const repo = 'https://github.com/MiniMax-AI/OpenAgentCore'
-const description = 'An open-source, self-hosted implementation of the OpenAI Agents API with multiple native Harnesses.'
+const description = 'The OpenAI Agents API, open source and self-hosted. Run Codex, Claude Code or MiniMax Code on your own machines with your own models, through the official OpenAI SDK.'
 
 const base = siteBase(process.env.WEBSITE_URL)
 
@@ -21,18 +21,11 @@ const base = siteBase(process.env.WEBSITE_URL)
 const logoSvg = readFileSync(resolve(repoRoot, 'docs/assets/openagentcore-logo.svg'), 'utf8')
 const favicon = `data:image/svg+xml,${encodeURIComponent(logoSvg.replace('currentColor', '#4ADE80'))}`
 
-const docsNav = [
-  { text: 'Docs', link: '/docs/getting-started/', activeMatch: '^/docs/(getting-started|examples|configuration|web)' },
-  { text: 'API', link: '/docs/api/public-agent-api', activeMatch: '^/(docs/api|contracts)/' },
-  { text: 'Architecture', link: '/docs/architecture', activeMatch: '^/docs/(architecture|concepts|runtime|sandbox|development)' },
-]
-
 export default defineConfig({
   title: 'OpenAgentCore',
   description,
   base,
   cleanUrls: true,
-  lastUpdated: true,
   appearance: 'dark',
 
   // The existing documentation is published in place: the repository root is
@@ -65,31 +58,26 @@ export default defineConfig({
     ['meta', { name: 'theme-color', content: '#0a0d0c' }],
     ['meta', { property: 'og:title', content: 'OpenAgentCore — One core. Many agents.' }],
     ['meta', { property: 'og:description', content: description }],
-    ['meta', { property: 'og:image', content: 'https://raw.githubusercontent.com/MiniMax-AI/OpenAgentCore/main/docs/assets/openagentcore-banner.jpeg' }],
+    ['meta', { property: 'og:image', content: 'https://raw.githubusercontent.com/MiniMax-AI/OpenAgentCore/main/docs/assets/og-image.png' }],
     ['meta', { name: 'twitter:card', content: 'summary_large_image' }],
+    ['meta', { name: 'twitter:image', content: 'https://raw.githubusercontent.com/MiniMax-AI/OpenAgentCore/main/docs/assets/og-image.png' }],
   ],
 
   locales: {
     root: {
       label: 'English',
       lang: 'en',
-      themeConfig: { nav: docsNav },
+      themeConfig: { nav: docsNav() },
     },
     zh: {
       label: '简体中文',
       lang: 'zh-CN',
       link: '/zh/',
-      description: '开源、可自部署的 OpenAI Agents API 实现，支持多种原生 Harness。',
+      description: '开源、可自部署的 OpenAI Agents API。用官方 OpenAI SDK，在你自己的机器上用你自己的模型运行 Codex、Claude Code 或 MiniMax Code。',
       themeConfig: {
-        nav: docsNav.map((item, index) => ({
-          ...item,
-          text: ['文档', 'API', '架构'][index],
-          link: `/zh${item.link}`,
-          activeMatch: item.activeMatch.replace('^/', '^/zh/'),
-        })),
+        nav: docsNav('zh'),
         langMenuLabel: '切换语言',
-        lastUpdatedText: '最后更新',
-        footer: { message: '基于 MIT 许可证发布。', copyright: 'One core. Many agents.' },
+        footer: { message: '基于 MIT 许可证发布。© 2026 MiniMax-AI' },
         returnToTopLabel: '返回顶部',
         sidebarMenuLabel: '目录',
         darkModeSwitchLabel: '主题',
@@ -107,22 +95,14 @@ export default defineConfig({
     logo: { src: favicon, alt: '' },
     siteTitle: 'OpenAgentCore',
     socialLinks: [{ icon: 'github', link: repo }],
-    sidebar: {
-      '/docs/': docsSidebar(),
-      '/contracts/': docsSidebar(),
-      '/zh/docs/': docsSidebar('zh'),
-      '/zh/contracts/': docsSidebar('zh'),
-    },
+    sidebar: { ...docsSidebar(), ...docsSidebar('zh') },
     outline: { level: [2, 3] },
     search: { provider: 'local', options: { locales: { zh: { translations: { button: { buttonText: '搜索文档', buttonAriaLabel: '搜索文档' }, modal: { noResultsText: '没有找到相关内容', resetButtonTitle: '清除搜索', displayDetails: '显示详细内容', footer: { selectText: '选择', navigateText: '切换', closeText: '关闭' } } } } } } },
     editLink: {
       pattern: `${repo}/edit/main/:path`,
       text: 'Edit this page on GitHub',
     },
-    footer: {
-      message: 'Released under the MIT License.',
-      copyright: 'One core. Many agents.',
-    },
+    footer: { message: 'Released under the MIT License. © 2026 MiniMax-AI' },
   },
 
   markdown: {
@@ -149,7 +129,6 @@ export default defineConfig({
 
   buildEnd: (site) => {
     writeMarkdownCopies(site)
-    writeLegacyRedirects(site)
     copyFileSync(resolve(repoRoot, 'website/install.sh'), resolve(site.outDir, 'install.sh'))
   },
 })
@@ -169,23 +148,12 @@ function writeMarkdownCopies(site: SiteConfig) {
 
   const origin = site.site.base
   const lines = ['# OpenAgentCore', '', `> ${description}`, '']
-  for (const group of readDocsJson().navigation.groups) {
-    lines.push(`## ${group.group}`, '')
-    for (const page of group.pages) lines.push(`- [${pageTitle(page)}](${origin}${page}.md)`)
-    lines.push('')
+  for (const tab of readDocsJson().navigation.tabs) {
+    for (const group of tab.groups) {
+      lines.push(`## ${tab.tab} › ${group.group}`, '')
+      for (const page of group.pages) lines.push(`- [${pageTitle(page)}](${origin}${page}.md): ${summary(page)}`)
+      lines.push('')
+    }
   }
   writeFileSync(resolve(site.outDir, 'llms.txt'), lines.join('\n'))
 }
-
-/** Writes static redirects for the non-Markdown legacy paths declared in docs.json. */
-function writeLegacyRedirects(site: SiteConfig) {
-  for (const { from, to } of legacyRedirects()) {
-    const target = resolve(site.outDir, `${from}.html`)
-    const url = `${site.site.base}${to.replace(/^\//, '')}`
-    mkdirSync(dirname(target), { recursive: true })
-    writeFileSync(
-      target,
-      `<!doctype html><meta charset="utf-8"><title>Redirecting…</title><link rel="canonical" href="${url}"><meta http-equiv="refresh" content="0; url=${url}"><a href="${url}">${url}</a>\n`,
-    )
-  }
-}
diff --git a/website/.vitepress/docs-nav.mts b/website/.vitepress/docs-nav.mts
index 1c7228cc1..da6fe58fe 100644
--- a/website/.vitepress/docs-nav.mts
+++ b/website/.vitepress/docs-nav.mts
@@ -1,7 +1,7 @@
 // Builds website navigation from the repository's existing documentation.
 // docs.json owns the page list and order; each page's frontmatter title owns
 // its label. Nothing here copies or rewrites the Markdown sources.
-import { translatedSource, groupLabel } from './locales.mts'
+import { translatedSource, navLabel } from './locales.mts'
 import { existsSync, readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -9,9 +9,13 @@ import type { DefaultTheme } from 'vitepress'
 
 export const repoRoot = fileURLToPath(new URL('../../', import.meta.url))
 
+interface DocsTab {
+  tab: string
+  groups: { group: string; pages: string[] }[]
+}
+
 interface DocsJson {
-  navigation: { groups: { group: string; pages: string[] }[] }
-  redirects?: { source: string; destination: string }[]
+  navigation: { tabs: DocsTab[] }
 }
 
 export function readDocsJson(): DocsJson {
@@ -43,20 +47,61 @@ export function pageLink(page: string): string {
   return `/${page.replace(/(^|\/)index$/, '$1')}`
 }
 
-export function docsSidebar(lang: 'en' | 'zh' = 'en'): DefaultTheme.SidebarItem[] {
-  return readDocsJson().navigation.groups.map((group) => ({
-    text: groupLabel(group.group, lang),
-    collapsed: false,
-    items: group.pages.map((page) => ({ text: pageTitle(lang === 'zh' ? translatedSource(page) : page), link: pageLink(lang === 'zh' ? `zh/${page}` : page) })),
-  }))
+type Lang = 'en' | 'zh'
+
+function localized(page: string, lang: Lang): string {
+  return lang === 'zh' ? translatedSource(page) : page
+}
+
+function route(page: string, lang: Lang): string {
+  return pageLink(lang === 'zh' ? `zh/${page}` : page)
+}
+
+/** Every page listed in docs.json, in tab, group and page order. */
+export function listedPages(): string[] {
+  return readDocsJson().navigation.tabs.flatMap((tab) => tab.groups.flatMap((group) => group.pages))
+}
+
+/** One top-nav item per tab: it opens the tab's first page and stays active on every page of the tab. */
+export function docsNav(lang: Lang = 'en'): DefaultTheme.NavItem[] {
+  return readDocsJson().navigation.tabs.map((tab) => {
+    const links = tab.groups.flatMap((group) => group.pages).map((page) => route(page, lang))
+    const paths = links.map((link) => link.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/\/$/, '(/|/index)?'))
+    return { text: navLabel(tab.tab, lang), link: links[0], activeMatch: `^(${paths.join('|')})(\\.html)?$` }
+  })
 }
 
 /**
- * Redirects in docs.json that point a legacy path (such as `README`) at a page.
- * `.md` sources are served by the raw Markdown copies, so they are skipped.
+ * A multi-sidebar keyed by each page's source path, so a page shows only its own tab's groups.
+ * VitePress picks the key that the page's source path starts with, and `.md` keeps `install.md` apart from `install-options.md`.
  */
-export function legacyRedirects(): { from: string; to: string }[] {
-  return (readDocsJson().redirects ?? [])
-    .filter((r) => !r.source.endsWith('.md'))
-    .map((r) => ({ from: r.source.replace(/^\//, ''), to: pageLink(r.destination.replace(/^\//, '')) }))
+export function docsSidebar(lang: Lang = 'en'): DefaultTheme.SidebarMulti {
+  const sidebar: DefaultTheme.SidebarMulti = {}
+  for (const tab of readDocsJson().navigation.tabs) {
+    const items = tab.groups.map((group) => ({
+      text: navLabel(group.group, lang),
+      collapsed: false,
+      items: group.pages.map((page) => ({ text: pageTitle(localized(page, lang)), link: route(page, lang) })),
+    }))
+    for (const page of tab.groups.flatMap((group) => group.pages)) sidebar[`/${lang === 'zh' ? 'zh/' : ''}${page}.md`] = items
+  }
+  return sidebar
+}
+
+/** The first sentence of a page's opening paragraph, with Markdown links and code marks removed. */
+export function summary(page: string): string {
+  const source = readFileSync(resolve(repoRoot, `${page}.md`), 'utf8')
+  const body = source.replace(/^---[\s\S]*?\n---\s*/, '')
+  const paragraph = body
+    .split(/\n\s*\n/)
+    .map((block) => block.trim())
+    .find((block) => block && !/^(#|\||```|!\[|<|\[\/\/\]|>|-|\d+\.)/.test(block))
+  if (!paragraph) return ''
+  const text = paragraph
+    .replace(/!\[[^\]]*\]\([^)]*\)/g, '')
+    .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
+    .replace(/[`*_]/g, '')
+    .replace(/\s+/g, ' ')
+  const sentence = /^(.+?(?:[。！？]|[.!?](?=\s|$)))/.exec(text)?.[1] ?? text
+  return sentence.length > 180 ? `${sentence.slice(0, 177).trimEnd()}…` : sentence
 }
diff --git a/website/.vitepress/locales.mts b/website/.vitepress/locales.mts
index 7c9de0d4b..1bef2f66e 100644
--- a/website/.vitepress/locales.mts
+++ b/website/.vitepress/locales.mts
@@ -28,7 +28,21 @@ export function translationRewrites(): Record<string, string> {
   return Object.fromEntries(authoredPages().map((page) => [translatedSource(page), `zh/${page}`]))
 }
 
-export function groupLabel(group: string, lang: 'en' | 'zh'): string {
-  const labels: Record<string, string> = { 'Get started': '开始使用', 'Operate': '部署与运维', 'API guides': 'API 指南', 'Architecture and extensions': '架构与扩展' }
-  return lang === 'zh' ? labels[group] ?? group : group
+const zhLabels: Record<string, string> = {
+  Docs: '文档',
+  API: 'API',
+  Extend: '扩展',
+  'Get started': '开始使用',
+  Operate: '部署与运维',
+  Concepts: '概念',
+  'Build on the API': '基于 API 开发',
+  'Agents API reference': 'Agents API 参考',
+  'Core API reference': 'Core API 参考',
+  Protocols: '协议',
+  Contribute: '参与贡献',
+}
+
+/** The Chinese label of a tab or group; English labels are the docs.json names. */
+export function navLabel(name: string, lang: 'en' | 'zh'): string {
+  return lang === 'zh' ? zhLabels[name] ?? name : name
 }
diff --git a/website/.vitepress/theme/components/AsciiCanvas.vue b/website/.vitepress/theme/components/AsciiCanvas.vue
deleted file mode 100644
index 2a2f36000..000000000
--- a/website/.vitepress/theme/components/AsciiCanvas.vue
+++ /dev/null
@@ -1,300 +0,0 @@
-<script setup lang="ts">
-// Renders a shape as animated ASCII on a canvas: the OpenAgentCore mark (from
-// the canonical SVG path) or a line of text. Characters decode in, a scan line
-// sweeps through, and the pointer stirs the field around it. Motion stops when
-// the canvas is off screen or the user prefers reduced motion.
-import { onBeforeUnmount, onMounted, ref, watch } from 'vue'
-import logoSvg from '../../../../docs/assets/openagentcore-logo.svg?raw'
-
-const props = withDefaults(
-  defineProps<{
-    kind?: 'logo' | 'text'
-    text?: string
-    /** Character cell height in CSS pixels. */
-    cell?: number
-    /** Density ramp from empty to full. */
-    ramp?: string
-    /** Probability of a background character in empty cells. */
-    noise?: number
-    /** Fraction of the canvas the shape may fill. */
-    fill?: number
-    /** Vertical offset of the shape's centre, as a fraction of the height. */
-    shiftY?: number
-    label?: string
-  }>(),
-  { kind: 'logo', text: '', cell: 14, ramp: ' .:-=+*#%@', noise: 0.035, fill: 0.86, shiftY: 0, label: '' },
-)
-
-const canvas = ref<HTMLCanvasElement>()
-const GLYPHS = '01{}[]<>/\\|=+*#%$&@?!~^;:'
-const logoPath = /\sd="([^"]+)"/.exec(logoSvg)?.[1] ?? ''
-
-interface Cell { target: string; level: number; reveal: number; glyph: string; seed: number }
-
-let ctx: CanvasRenderingContext2D | null = null
-let cells: Cell[] = []
-let cols = 0
-let rows = 0
-let cw = 8
-let ch = 14
-let frame = 0
-let start = 0
-let visible = false
-let reduced = false
-let pointer = { x: -1e4, y: -1e4, t: 0 }
-let colors = { dim: '#1f3a2b', mid: '#2f7a4c', hot: '#4ade80', white: '#e9fff1' }
-let resizeObserver: ResizeObserver | undefined
-let intersection: IntersectionObserver | undefined
-let themeObserver: MutationObserver | undefined
-
-function readColors() {
-  const style = getComputedStyle(canvas.value!)
-  const v = (name: string, fallback: string) => style.getPropertyValue(name).trim() || fallback
-  colors = { dim: v('--ascii-dim', colors.dim), mid: v('--ascii-mid', colors.mid), hot: v('--ascii-hot', colors.hot), white: v('--ascii-white', colors.white) }
-}
-
-function randomGlyph() {
-  return GLYPHS[(Math.random() * GLYPHS.length) | 0]
-}
-
-/** Rasterises the shape at 3x3 samples per cell and maps coverage onto the ramp. */
-function layout() {
-  const el = canvas.value
-  if (!el || !ctx) return
-  const rect = el.getBoundingClientRect()
-  if (!rect.width || !rect.height) return
-  const dpr = Math.min(window.devicePixelRatio || 1, 2)
-  el.width = Math.round(rect.width * dpr)
-  el.height = Math.round(rect.height * dpr)
-  ctx.setTransform(dpr, 0, 0, dpr, 0, 0)
-
-  ch = props.cell
-  ctx.font = `${Math.round(ch * 0.78)}px "Geist Mono Variable", ui-monospace, SFMono-Regular, Menlo, monospace`
-  cw = Math.max(5, ctx.measureText('M').width * 1.04)
-  ctx.textBaseline = 'middle'
-  ctx.textAlign = 'center'
-  cols = Math.max(1, Math.floor(rect.width / cw))
-  rows = Math.max(1, Math.floor(rect.height / ch))
-
-  const ss = 3
-  const mask = document.createElement('canvas')
-  mask.width = cols * ss
-  mask.height = rows * ss
-  const m = mask.getContext('2d', { willReadFrequently: true })!
-  m.fillStyle = '#fff'
-  // One mask pixel is cw/ss by ch/ss screen pixels; scale so the shape keeps its
-  // on-screen proportions.
-  const sx = ss / cw
-  const sy = ss / ch
-  if (props.kind === 'logo') {
-    // The mark occupies x 214–988 and y 245–1026 of its 1254-unit viewBox.
-    const bounds = { x: 214, y: 245, size: 781 }
-    const size = Math.min(rect.width, rect.height) * props.fill
-    const scale = size / bounds.size
-    const ox = (rect.width - size) / 2 - bounds.x * scale
-    const oy = (rect.height - size) / 2 + rect.height * props.shiftY - bounds.y * scale
-    m.setTransform(scale * sx, 0, 0, scale * sy, ox * sx, oy * sy)
-    m.fill(new Path2D(logoPath), 'evenodd')
-  } else {
-    const lines = props.text.split('\n')
-    let fontSize = rect.height * props.fill / lines.length / 1.05
-    m.font = `800 ${fontSize}px "Inter Variable", Inter, system-ui, sans-serif`
-    const widest = Math.max(...lines.map((line) => m.measureText(line).width))
-    if (widest > rect.width * 0.96) fontSize *= (rect.width * 0.96) / widest
-    m.setTransform(sx, 0, 0, sy, 0, 0)
-    m.font = `800 ${fontSize}px "Inter Variable", Inter, system-ui, sans-serif`
-    m.textAlign = 'center'
-    m.textBaseline = 'middle'
-    const lineHeight = fontSize * 1.05
-    const top = rect.height / 2 - (lineHeight * (lines.length - 1)) / 2
-    lines.forEach((line, i) => m.fillText(line, rect.width / 2, top + i * lineHeight))
-  }
-  const data = m.getImageData(0, 0, mask.width, mask.height).data
-
-  const ramp = props.ramp
-  const cx = cols / 2
-  const cy = rows / 2
-  const maxDist = Math.hypot(cx, cy)
-  cells = new Array(cols * rows)
-  for (let r = 0; r < rows; r++) {
-    for (let c = 0; c < cols; c++) {
-      let sum = 0
-      for (let y = 0; y < ss; y++) for (let x = 0; x < ss; x++) sum += data[((r * ss + y) * mask.width + (c * ss + x)) * 4 + 3]
-      const level = sum / (ss * ss * 255)
-      const index = level < 0.04 ? 0 : Math.min(ramp.length - 1, 1 + Math.floor(level * (ramp.length - 1)))
-      const dist = Math.hypot(c - cx, (r - cy) * (ch / cw)) / maxDist
-      cells[r * cols + c] = {
-        target: ramp[index],
-        level,
-        reveal: 250 + dist * 900 + Math.random() * 650,
-        glyph: randomGlyph(),
-        seed: Math.random(),
-      }
-    }
-  }
-}
-
-function draw(now: number) {
-  if (!ctx || !canvas.value) return
-  const t = reduced ? 1e6 : now - start
-  const w = canvas.value.width
-  const h = canvas.value.height
-  ctx.clearRect(0, 0, w, h)
-
-  // A diagonal scan line crosses the shape every few seconds.
-  const period = 5200
-  const phase = ((t % period) / period) * (cols + rows) * 1.6 - rows * 0.3
-  const pointerAge = now - pointer.t
-  const pointerStrength = reduced ? 0 : Math.max(0, 1 - pointerAge / 2200)
-  const pc = pointer.x / cw
-  const pr = pointer.y / ch
-  const radius = 9
-
-  const buckets: Record<string, number[]> = { dim: [], mid: [], hot: [], white: [] }
-  const chars: string[] = new Array(cells.length)
-
-  for (let i = 0; i < cells.length; i++) {
-    const cell = cells[i]
-    const c = i % cols
-    const r = (i / cols) | 0
-    const inside = cell.target !== ' '
-    let ch2 = ' '
-    let tone: keyof typeof buckets = 'dim'
-
-    const scan = Math.abs(c + r * 1.4 - phase)
-    const dx = c - pc
-    const dy = (r - pr) * (ch / cw)
-    const near = pointerStrength > 0 ? Math.max(0, 1 - Math.hypot(dx, dy) / radius) * pointerStrength : 0
-
-    if (inside) {
-      if (t < cell.reveal) {
-        if (t > cell.reveal - 700) {
-          ch2 = (frame + i) % 3 === 0 ? randomGlyph() : cell.glyph
-          tone = 'mid'
-        }
-      } else {
-        ch2 = cell.target
-        tone = cell.level > 0.7 ? 'hot' : 'mid'
-        if (t < cell.reveal + 160) tone = 'white'
-        if (!reduced && scan < 1.6) {
-          ch2 = scan < 0.8 ? randomGlyph() : cell.target
-          tone = 'white'
-        } else if (!reduced && cell.seed < 0.012 && (frame + i) % 40 < 3) {
-          ch2 = randomGlyph()
-          tone = 'white'
-        }
-        if (near > 0.25) {
-          ch2 = near > 0.6 ? randomGlyph() : ch2
-          tone = 'white'
-        }
-      }
-    } else {
-      // Background field: sparse, slowly drifting characters that the pointer stirs up.
-      const drift = reduced ? 0 : Math.floor(t / 1400 + cell.seed * 40)
-      const on = ((cell.seed * 997 + drift * 0.61803) % 1) < props.noise
-      if (near > 0.15 && cell.seed < near * 0.9) {
-        ch2 = randomGlyph()
-        tone = near > 0.55 ? 'hot' : 'mid'
-      } else if (on && t > cell.reveal * 0.6) {
-        ch2 = cell.glyph
-        tone = 'dim'
-      }
-    }
-    if (ch2 !== ' ') {
-      chars[i] = ch2
-      buckets[tone].push(i)
-    }
-  }
-
-  for (const tone of ['dim', 'mid', 'hot', 'white'] as const) {
-    ctx.fillStyle = colors[tone]
-    for (const i of buckets[tone]) ctx.fillText(chars[i], (i % cols) * cw + cw / 2, ((i / cols) | 0) * ch + ch / 2)
-  }
-}
-
-let raf = 0
-let last = 0
-function loop(now: number) {
-  raf = 0
-  if (!visible || document.hidden) return
-  // About 30 frames per second is enough for character animation.
-  if (now - last > 32) {
-    last = now
-    frame++
-    draw(now)
-  }
-  raf = requestAnimationFrame(loop)
-}
-
-function play() {
-  if (reduced) return draw(performance.now())
-  if (!raf) raf = requestAnimationFrame(loop)
-}
-
-function onPointer(event: PointerEvent) {
-  const rect = canvas.value!.getBoundingClientRect()
-  pointer = { x: event.clientX - rect.left, y: event.clientY - rect.top, t: performance.now() }
-}
-
-function onVisibility() {
-  if (!document.hidden && visible) play()
-}
-
-onMounted(() => {
-  const el = canvas.value!
-  ctx = el.getContext('2d')
-  reduced = window.matchMedia('(prefers-reduced-motion: reduce)').matches
-  readColors()
-  start = performance.now()
-  const relayout = () => {
-    layout()
-    if (reduced || !raf) draw(performance.now())
-  }
-  // Wait for the web fonts so cell widths match the rendered glyphs.
-  document.fonts?.ready.then(relayout)
-  relayout()
-  resizeObserver = new ResizeObserver(relayout)
-  resizeObserver.observe(el)
-  intersection = new IntersectionObserver(([entry]) => {
-    visible = entry.isIntersecting
-    if (visible) play()
-  })
-  intersection.observe(el)
-  themeObserver = new MutationObserver(() => {
-    readColors()
-    draw(performance.now())
-  })
-  themeObserver.observe(document.documentElement, { attributes: true, attributeFilter: ['class'] })
-  document.addEventListener('visibilitychange', onVisibility)
-})
-
-onBeforeUnmount(() => {
-  cancelAnimationFrame(raf)
-  resizeObserver?.disconnect()
-  intersection?.disconnect()
-  themeObserver?.disconnect()
-  document.removeEventListener('visibilitychange', onVisibility)
-})
-
-watch(() => props.text, () => layout())
-</script>
-
-<template>
-  <canvas
-    ref="canvas"
-    class="ascii-canvas"
-    role="img"
-    :aria-label="label"
-    @pointermove="onPointer"
-    @pointerdown="onPointer"
-  />
-</template>
-
-<style scoped>
-.ascii-canvas {
-  display: block;
-  width: 100%;
-  height: 100%;
-  touch-action: pan-y;
-}
-</style>
diff --git a/website/.vitepress/theme/components/ComposeLab.vue b/website/.vitepress/theme/components/ComposeLab.vue
index 8c41fdd43..a266247a8 100644
--- a/website/.vitepress/theme/components/ComposeLab.vue
+++ b/website/.vitepress/theme/components/ComposeLab.vue
@@ -56,10 +56,6 @@ const lines = computed<Tok[][]>(() => {
     [{ t: '        ' }, s('x_agents_core'), { t: ': {' }, s('model_provider'), { t: ': {' }],
     [{ t: '            ' }, s('protocol'), { t: ': ' }, pair(protocol.value), { t: ',' }],
     [{ t: '            ' }, s('base_url'), { t: ': BASE_URL, ' }, s('api_key'), { t: ': API_KEY,' }],
-    // MiniMax Code requires positive token limits (contracts/agents-api/model-execution.md).
-    ...(harness.value === 'mcode'
-      ? [[{ t: '            ' }, s('context_window'), { t: ': ' }, { t: '200000' }, { t: ', ' }, s('max_output_tokens'), { t: ': ' }, { t: '8000' }, { t: ',' }]]
-      : []),
     [{ t: '        }},' }],
     [{ t: '    },' }],
     [{ t: ')' }],
@@ -75,7 +71,7 @@ const lines = computed<Tok[][]>(() => {
   <div class="lab">
     <div class="lab-controls">
       <fieldset>
-        <legend><span class="dollar">$</span> {{ t.harness }}</legend>
+        <legend>{{ t.harness }}</legend>
         <button
           v-for="h in harnesses"
           :key="h.id"
@@ -87,12 +83,11 @@ const lines = computed<Tok[][]>(() => {
         >
           <span class="box">{{ harness === h.id ? '■' : '□' }}</span>
           <span class="name">{{ h.label }}</span>
-          <code>{{ h.id }}</code>
         </button>
       </fieldset>
 
       <fieldset>
-        <legend><span class="dollar">$</span> {{ t.protocol }}</legend>
+        <legend>{{ t.protocol }}</legend>
         <button
           v-for="p in protocols"
           :key="p"
@@ -104,14 +99,13 @@ const lines = computed<Tok[][]>(() => {
         >
           <span class="box">{{ protocol === p ? '■' : '□' }}</span>
           <span class="name">{{ p }}</span>
-          <code>{{ (selected.protocols as readonly string[]).includes(p) ? 'native' : '—' }}</code>
         </button>
       </fieldset>
 
       <fieldset>
-        <legend><span class="dollar">$</span> {{ t.environment }}</legend>
+        <legend>{{ t.environment }}</legend>
         <button
-          v-for="(e, id) in t.envs"
+          v-for="(label, id) in t.envs"
           :key="id"
           type="button"
           class="opt"
@@ -120,8 +114,7 @@ const lines = computed<Tok[][]>(() => {
           @click="env = id as Env"
         >
           <span class="box">{{ env === id ? '■' : '□' }}</span>
-          <span class="name">{{ e.label }}</span>
-          <code>{{ e.note }}</code>
+          <span class="name">{{ label }}</span>
         </button>
       </fieldset>
     </div>
@@ -150,39 +143,37 @@ const lines = computed<Tok[][]>(() => {
 .lab {
   display: grid;
   grid-template-columns: minmax(0, 0.9fr) minmax(0, 1.4fr);
-  gap: 20px;
+  gap: 24px;
 }
 .lab-controls {
   display: grid;
-  gap: 14px;
+  gap: 16px;
   align-content: start;
 }
 fieldset {
+  position: relative;
   border: 1px solid var(--l-line);
   border-radius: 10px;
-  padding: 10px 10px 8px;
+  padding: 8px;
   margin: 0;
   background: var(--l-panel);
 }
 legend {
-  padding: 0 6px;
-  font: 500 12px/1 var(--l-mono);
-  text-transform: uppercase;
-  letter-spacing: 0.08em;
-  color: var(--l-muted);
-}
-.dollar {
-  color: var(--l-accent);
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  overflow: hidden;
+  clip: rect(0 0 0 0);
 }
 .opt {
   display: grid;
-  grid-template-columns: 18px 1fr auto;
+  grid-template-columns: 18px 1fr;
   align-items: center;
   gap: 8px;
   width: 100%;
-  padding: 7px 8px;
+  padding: 9px 10px;
   border-radius: 6px;
-  font: 14px/1.3 var(--l-mono);
+  font: 15px/1.3 var(--l-mono);
   color: var(--l-text-2);
   text-align: left;
   transition: background 0.15s, color 0.15s;
@@ -206,13 +197,8 @@ legend {
 .opt.unsupported.on .name {
   color: var(--l-danger);
 }
-.opt code {
-  font-size: 11px;
-  color: var(--l-muted);
-  white-space: nowrap;
-}
 .box {
-  font-size: 12px;
+  font-size: 14px;
 }
 .lab-code {
   display: flex;
@@ -229,7 +215,7 @@ legend {
   gap: 12px;
   padding: 10px 14px;
   border-bottom: 1px solid rgba(232, 241, 235, 0.08);
-  font: 12px var(--l-mono);
+  font: 14px var(--l-mono);
   color: #7f8f85;
 }
 .dots {
@@ -249,7 +235,7 @@ legend {
   margin: 0;
   padding: 16px 18px;
   overflow-x: auto;
-  font: 13px/1.7 var(--l-mono);
+  font: 14px/1.7 var(--l-mono);
   color: var(--l-code-text);
   animation: settle 0.35s ease-out;
 }
@@ -286,7 +272,7 @@ legend {
   align-items: baseline;
   padding: 12px 18px;
   border-top: 1px solid rgba(232, 241, 235, 0.08);
-  font: 13px/1.5 var(--l-mono);
+  font: 14px/1.5 var(--l-mono);
 }
 .verdict.pass {
   color: #4ade80;
@@ -307,13 +293,15 @@ legend {
 }
 .lab-foot {
   grid-column: 1 / -1;
-  margin: 0;
-  font-size: 14px;
-  color: var(--l-muted);
+  margin: 12px 0 0;
+  font-size: 16px;
+  line-height: 1.6;
+  color: var(--l-text-2);
 }
 .lab-foot a {
   color: var(--l-accent);
   font-family: var(--l-mono);
+  white-space: nowrap;
   text-decoration: none;
 }
 @keyframes settle {
diff --git a/website/.vitepress/theme/components/Landing.vue b/website/.vitepress/theme/components/Landing.vue
index 498ad7cc3..d1c754e4a 100644
--- a/website/.vitepress/theme/components/Landing.vue
+++ b/website/.vitepress/theme/components/Landing.vue
@@ -1,14 +1,15 @@
 <script setup lang="ts">
 import { computed, onBeforeUnmount, onMounted, ref } from 'vue'
 import { withBase } from 'vitepress'
-import AsciiCanvas from './AsciiCanvas.vue'
+import '@fontsource-variable/space-grotesk'
 import ComposeLab from './ComposeLab.vue'
 import LogoWall from './LogoWall.vue'
 import LaunchVideo from './LaunchVideo.vue'
 import SessionFlow from './SessionFlow.vue'
 import TitleAccent from './TitleAccent.vue'
-import { copy, installCommand, repoUrl, type Lang } from '../landing-content'
-import architectureImg from '../../../../docs/assets/architecture.svg'
+import { copy, installCommands, repoUrl, type Lang } from '../landing-content'
+import architectureLight from '../../../../docs/assets/architecture.svg'
+import architectureDark from '../../../../docs/assets/architecture-dark.svg'
 import overviewEn from '../../../../docs/assets/console-overview-en.webp'
 import overviewZh from '../../../../docs/assets/console-overview-zh.webp'
 import metricsEn from '../../../../docs/assets/console-agent-metrics-en.webp'
@@ -22,14 +23,14 @@ const consoleImages = computed(() =>
 )
 const consoleTab = ref<'overview' | 'metrics'>('overview')
 const consoleAlt = computed(() => t.value.observe.tabs.find((tab) => tab.id === consoleTab.value)!.alt)
-
 function localLink(path: string) { return withBase(props.lang === 'zh' ? `/zh${path}` : path) }
 
-
+const installOs = ref<'unix' | 'windows'>('unix')
+const installCommand = computed(() => installCommands[installOs.value])
 const copied = ref(false)
 async function copyInstall() {
   try {
-    await navigator.clipboard.writeText(installCommand)
+    await navigator.clipboard.writeText(installCommand.value)
     copied.value = true
     setTimeout(() => (copied.value = false), 1600)
   } catch {
@@ -98,127 +99,85 @@ onBeforeUnmount(() => {
 
     <!-- Hero -->
     <section class="hero">
-      <div class="wrap hero-grid">
-        <div class="hero-copy">
-          <p class="eyebrow"><span class="led" aria-hidden="true" />{{ t.hero.eyebrow }}</p>
-          <h1 class="hero-title" :aria-label="t.hero.title.join(' ')">
-            <span aria-hidden="true">{{ titleLines[0] }}</span>
-            <span aria-hidden="true" class="accent">{{ titleLines[1] }}<span class="cursor">_</span></span>
-          </h1>
-          <p class="lede">{{ t.hero.lede }}</p>
-          <div class="ctas">
-            <a class="btn primary" :href="localLink('/docs/getting-started/quickstart')">{{ t.hero.primary }} <span aria-hidden="true">→</span></a>
-            <a class="btn ghost" :href="localLink('/docs/getting-started/')">{{ t.hero.secondary }}</a>
-            <a class="btn ghost icon" :href="repoUrl" target="_blank" rel="noreferrer" aria-label="GitHub">
+      <div class="wrap">
+        <div class="hero-grid">
+          <div class="hero-head">
+            <h1 class="hero-title" :aria-label="t.hero.title.join(' ')">
+              <span aria-hidden="true">{{ titleLines[0] }}</span>
+              <span aria-hidden="true" class="accent">{{ titleLines[1] }}<span class="cursor">_</span></span>
+            </h1>
+            <LaunchVideo :lang="lang" />
+          </div>
+          <div class="hero-copy">
+            <p class="lede">{{ t.hero.lede }}</p>
+            <div class="ctas">
+              <a class="btn primary" :href="localLink('/docs/getting-started/install')">{{ t.hero.primary }} <span aria-hidden="true">→</span></a>
+              <a class="btn ghost" :href="localLink('/docs/getting-started/')">{{ t.hero.secondary }}</a>
+              <a class="btn ghost icon" :href="repoUrl" target="_blank" rel="noreferrer" aria-label="GitHub">
               <svg viewBox="0 0 24 24" width="18" height="18" aria-hidden="true"><path fill="currentColor" d="M12 .5a11.5 11.5 0 0 0-3.64 22.41c.58.1.79-.25.79-.56v-2c-3.2.7-3.88-1.37-3.88-1.37-.53-1.33-1.28-1.69-1.28-1.69-1.05-.71.08-.7.08-.7 1.16.08 1.77 1.19 1.77 1.19 1.03 1.77 2.71 1.26 3.37.96.1-.75.4-1.26.73-1.55-2.55-.29-5.24-1.28-5.24-5.68 0-1.25.45-2.28 1.19-3.08-.12-.29-.52-1.46.11-3.05 0 0 .97-.31 3.17 1.18a11 11 0 0 1 5.77 0c2.2-1.49 3.17-1.18 3.17-1.18.63 1.59.23 2.76.11 3.05.74.8 1.19 1.83 1.19 3.08 0 4.41-2.69 5.38-5.25 5.67.41.36.78 1.06.78 2.14v3.17c0 .31.21.67.8.56A11.5 11.5 0 0 0 12 .5Z" /></svg>
               GitHub
             </a>
-          </div>
-          <div class="hero-install">
-          <div class="install">
-            <code><span class="prompt">$</span> {{ installCommand }}</code>
-            <button type="button" class="copy" @click="copyInstall">{{ copied ? t.hero.copied : t.hero.copy }}</button>
-          </div>
-          <p class="install-note">{{ t.hero.installLabel }}</p>
-          </div>
-        </div>
-
-        <div class="hero-media">
-          <div class="hero-brand">
-            <div class="hero-art">
-              <div class="corner tl" aria-hidden="true" /><div class="corner tr" aria-hidden="true" /><div class="corner bl" aria-hidden="true" /><div class="corner br" aria-hidden="true" />
-              <AsciiCanvas kind="logo" :cell="8" :fill="0.78" label="OpenAgentCore" />
             </div>
-            <dl class="hud">
-              <div v-for="[k, v] in t.hero.hud" :key="k"><dt>{{ k }}</dt><dd>{{ v }}</dd></div>
-            </dl>
+            <div class="install-tabs" role="group">
+              <button v-for="(label, i) in t.hero.installTabs" :key="label" type="button" :aria-pressed="installOs === (i ? 'windows' : 'unix')" :class="{ on: installOs === (i ? 'windows' : 'unix') }" @click="installOs = i ? 'windows' : 'unix'">{{ label }}</button>
+            </div>
+            <div class="install">
+              <code><span class="prompt">{{ installOs === 'unix' ? '$' : '>' }}</span> {{ installCommand }}</code>
+              <button type="button" class="copy" @click="copyInstall">{{ copied ? t.hero.copied : t.hero.copy }}</button>
+            </div>
           </div>
-          <LaunchVideo :lang="lang" />
-        </div>
-      </div>
-
-      <div class="ticker" aria-hidden="true">
-        <div class="ticker-track">
-          <span v-for="n in 2" :key="n" class="ticker-run">
-            <span v-for="item in t.ticker" :key="item + n">{{ item }}<b>/</b></span>
-          </span>
         </div>
+        <div class="hero-lab" data-reveal><ComposeLab :t="t.compose" :lang="lang" /></div>
       </div>
     </section>
 
-    <!-- 01 Compose -->
+    <!-- Architecture -->
     <section class="sec">
       <div class="wrap">
-        <header class="sec-head" data-reveal><span class="idx">// {{ t.compose.index }}</span><span class="kicker">{{ t.compose.kicker }}</span></header>
-        <h2 data-reveal><TitleAccent :title="t.compose.title" :accent="t.compose.titleAccent" /></h2>
-        <p class="sec-lede" data-reveal>{{ t.compose.lede }}</p>
-        <div data-reveal><ComposeLab :t="t.compose" :lang="lang" /></div>
-
-      </div>
-    </section>
-
-    <!-- 02 Architecture -->
-    <section class="sec">
-      <div class="wrap">
-        <header class="sec-head" data-reveal><span class="idx">// {{ t.architecture.index }}</span><span class="kicker">{{ t.architecture.kicker }}</span></header>
         <h2 data-reveal><TitleAccent :title="t.architecture.title" :accent="t.architecture.titleAccent" /></h2>
-        <p class="sec-lede" data-reveal>{{ t.architecture.lede }}</p>
-        <a class="architecture-visual" :href="architectureImg" target="_blank" rel="noreferrer" data-reveal>
-          <img :src="architectureImg" :alt="t.architecture.tabs[0].alt" loading="lazy" decoding="async" />
-        </a>
+        <div class="architecture-visual" data-reveal>
+          <a class="light-only" :href="architectureLight" target="_blank" rel="noreferrer"><img :src="architectureLight" :alt="t.architecture.alt" loading="lazy" decoding="async" /></a>
+          <a class="dark-only" :href="architectureDark" target="_blank" rel="noreferrer"><img :src="architectureDark" :alt="t.architecture.alt" loading="lazy" decoding="async" /></a>
+        </div>
         <a class="more" :href="localLink('/docs/architecture')">{{ t.architecture.more }} →</a>
       </div>
     </section>
 
-    <!-- 03 Session lifecycle -->
+    <!-- Session -->
     <section class="sec">
       <div class="wrap">
-        <header class="sec-head" data-reveal><span class="idx">// {{ t.session.index }}</span><span class="kicker">{{ t.session.kicker }}</span></header>
         <h2 data-reveal><TitleAccent :title="t.session.title" :accent="t.session.titleAccent" /></h2>
-        <p class="sec-lede" data-reveal>{{ t.session.lede }}</p>
         <SessionFlow :lang="lang" />
-        <a class="more" :href="localLink('/docs/api/public-agent-api')">{{ t.session.more }} →</a>
+        <a class="more" :href="localLink('/docs/architecture#a-session-end-to-end')">{{ t.session.more }} →</a>
       </div>
     </section>
 
-    <!-- 04 Observe -->
+    <!-- Console -->
     <section class="sec">
       <div class="wrap">
-        <header class="sec-head" data-reveal><span class="idx">// {{ t.observe.index }}</span><span class="kicker">{{ t.observe.kicker }}</span></header>
         <div class="observe-heading" data-reveal>
-          <div><h2><TitleAccent :title="t.observe.title" :accent="t.observe.titleAccent" /></h2><p class="sec-lede">{{ t.observe.lede }}</p></div>
+          <h2><TitleAccent :title="t.observe.title" :accent="t.observe.titleAccent" /></h2>
           <div class="tabs" :aria-label="t.observe.title">
             <button v-for="tab in t.observe.tabs" :key="tab.id" type="button" :aria-pressed="consoleTab === tab.id" :class="{ on: consoleTab === tab.id }" @click="consoleTab = tab.id">{{ tab.label }}</button>
           </div>
         </div>
-        <div class="window console-wide" data-reveal>
-          <div class="win-bar"><span class="dots"><i /><i /><i /></span><span>web · {{ consoleTab }}</span></div>
+        <div class="window" data-reveal>
           <img :key="consoleTab + lang" :src="consoleImages[consoleTab]" :alt="consoleAlt" loading="lazy" decoding="async" />
         </div>
-        <p class="caption">{{ t.observe.caption }}</p>
       </div>
     </section>
 
     <nav class="wrap doc-shortcuts" :aria-label="t.docs.title">
-      <a v-for="(link, i) in t.docs.links" :key="link.path" :href="localLink(link.path)">
-        <span class="shortcut-index">0{{ i + 1 }}</span><span>{{ link.label }}</span><span aria-hidden="true">↗</span>
-      </a>
+      <a v-for="link in t.docs.links" :key="link.path" :href="localLink(link.path)"><span>{{ link.label }}</span><span aria-hidden="true">↗</span></a>
     </nav>
 
     <LogoWall :lang="lang" />
 
-    <!-- 05 Get started -->
+    <!-- Next steps -->
     <section class="outro">
-      <div class="wrap start-compact">
-        <header class="sec-head"><span class="idx">// {{ t.start.index }}</span><span class="kicker">{{ t.start.kicker }}</span></header>
+      <div class="wrap">
         <h2><TitleAccent :title="t.start.title" :accent="t.start.titleAccent" /></h2>
-        <p class="install-note">{{ t.hero.installLabel }}</p>
-        <div class="install"><code><span class="prompt">$</span> {{ installCommand }}</code><button type="button" class="copy" @click="copyInstall">{{ copied ? t.hero.copied : t.hero.copy }}</button></div>
-        <ol class="start-path"><li v-for="(step, i) in t.start.steps" :key="step.title"><span>0{{ i + 1 }}</span>{{ step.title }}</li></ol>
-        <div class="ctas"><a class="btn primary" :href="localLink('/docs/getting-started/install')">{{ t.start.cta }} →</a><a class="btn ghost" :href="localLink('/docs/getting-started/quickstart')">{{ t.start.trial }}</a></div>
-      </div>
-      <div class="outro-art">
-        <AsciiCanvas kind="text" text="ONE CORE.&#10;MANY AGENTS." :cell="11" ramp=" .:░▒▓█" :noise="0.02" :fill="0.82" label="One core. Many agents." />
+        <ol class="start-path"><li v-for="(step, i) in t.start.steps" :key="step.path"><span>0{{ i + 1 }}</span><a :href="localLink(step.path)">{{ step.label }} →</a></li></ol>
       </div>
     </section>
   </div>
@@ -242,10 +201,6 @@ onBeforeUnmount(() => {
   --l-danger-soft: rgba(220, 38, 38, 0.08);
   --l-glow: rgba(21, 128, 61, 0.35);
   --l-grid: rgba(11, 21, 16, 0.05);
-  --ascii-dim: #c4d1c7;
-  --ascii-mid: #3f8a5c;
-  --ascii-hot: #15803d;
-  --ascii-white: #04210f;
   /* Code and terminals stay dark in both themes. */
   --l-code-bg: #0b100e;
   --l-code-text: #d7e5dc;
@@ -278,13 +233,12 @@ onBeforeUnmount(() => {
   --l-danger-soft: rgba(251, 113, 133, 0.08);
   --l-glow: rgba(74, 222, 128, 0.35);
   --l-grid: rgba(232, 241, 235, 0.035);
-  --ascii-dim: #1d3326;
-  --ascii-mid: #2f8a52;
-  --ascii-hot: #4ade80;
-  --ascii-white: #eafff1;
 }
+:where(.landing) button { font-size: 14px; }
+.landing :is(.install, .code) code { font-size: 14px; }
 </style>
 
+
 <style scoped>
 .landing :deep(a) {
   text-decoration: none;
@@ -312,20 +266,12 @@ onBeforeUnmount(() => {
 .accent {
   color: var(--l-accent);
 }
-.sr-only {
-  position: absolute;
-  width: 1px;
-  height: 1px;
-  overflow: hidden;
-  clip: rect(0 0 0 0);
-}
 
 /* ---------- reveal ---------- */
 .animate [data-reveal] {
   opacity: 0;
   transform: translateY(14px);
   transition: opacity 0.7s ease, transform 0.7s cubic-bezier(0.2, 0.7, 0.2, 1);
-  transition-delay: calc(var(--i, 0) * 70ms);
 }
 .animate [data-reveal].in {
   opacity: 1;
@@ -337,19 +283,16 @@ onBeforeUnmount(() => {
   display: flex;
   flex-wrap: wrap;
   gap: 10px;
-  margin-top: 28px;
-}
-.ctas.center {
-  justify-content: center;
+  margin-top: 32px;
 }
 .btn {
   display: inline-flex;
   align-items: center;
   gap: 8px;
-  height: 42px;
-  padding: 0 18px;
+  height: 44px;
+  padding: 0 20px;
   border-radius: 2px;
-  font: 500 14px/1 var(--l-mono);
+  font: 500 15px/1 var(--l-mono);
   border: 1px solid var(--l-line-strong);
   color: var(--l-text);
   transition: transform 0.15s, background 0.15s, border-color 0.15s, box-shadow 0.15s;
@@ -362,49 +305,38 @@ onBeforeUnmount(() => {
   background: var(--l-accent);
   border-color: var(--l-accent);
   color: var(--l-bg);
-  box-shadow: 0 0 0 0 var(--l-glow);
+  box-shadow: 3px 3px 0 var(--l-text);
 }
 .btn.primary:hover {
-  box-shadow: 0 8px 30px -8px var(--l-glow);
+  box-shadow: 5px 5px 0 var(--l-text);
 }
 .btn.ghost {
   background: var(--l-panel);
   backdrop-filter: blur(6px);
 }
+.btn:focus-visible,
+.copy:focus-visible,
+.install-tabs button:focus-visible,
+.tabs button:focus-visible {
+  outline: 2px solid var(--l-accent);
+  outline-offset: 4px;
+}
 
 /* ---------- hero ---------- */
 .hero {
   position: relative;
-  padding: 56px 0 0;
+  padding: 88px 0 0;
 }
 .hero-grid {
   display: grid;
   grid-template-columns: minmax(0, 1fr) minmax(0, 1fr);
-  gap: 32px;
-  align-items: center;
-  min-height: min(72vh, 660px);
-}
-.eyebrow {
-  display: inline-flex;
+  gap: 56px;
   align-items: center;
-  gap: 10px;
-  margin: 0 0 22px;
-  padding: 6px 12px;
-  border: 1px solid var(--l-line);
-  border-radius: 999px;
-  background: var(--l-panel);
-  font: 12px/1 var(--l-mono);
-  letter-spacing: 0.06em;
-  text-transform: uppercase;
-  color: var(--l-text-2);
 }
-.led {
-  width: 7px;
-  height: 7px;
-  border-radius: 50%;
-  background: var(--l-accent);
-  box-shadow: 0 0 10px var(--l-accent);
-  animation: pulse 2s ease-in-out infinite;
+.hero-head {
+  display: grid;
+  gap: 40px;
+  justify-items: start;
 }
 .hero-title {
   display: flex;
@@ -413,24 +345,52 @@ onBeforeUnmount(() => {
   font: 700 clamp(44px, 6vw, 78px) / 0.98 var(--l-display);
   letter-spacing: -0.045em;
   white-space: nowrap;
+  border: 0;
+  padding: 0;
+}
+.hero-title .accent {
+  font-style: italic;
+}
+.landing[lang='zh-CN'] .hero-title .accent,
+.landing[lang='zh-CN'] :deep(em) {
+  font-style: normal;
 }
 .cursor {
   color: var(--l-accent);
+  font-style: normal;
   animation: blink 1.1s steps(1) infinite;
 }
 .lede {
   max-width: 34em;
-  margin: 26px 0 0;
+  margin: 0;
   font-size: 18px;
   line-height: 1.6;
   color: var(--l-text-2);
 }
+.install-tabs {
+  display: flex;
+  gap: 4px;
+  margin-top: 32px;
+}
+.install-tabs button {
+  padding: 6px 12px;
+  border-radius: 4px;
+  font: 14px var(--l-mono);
+  color: var(--l-muted);
+}
+.install-tabs button.on {
+  color: var(--l-accent);
+  background: var(--l-accent-soft);
+}
+.install-tabs button:hover {
+  color: var(--l-text);
+}
 .install {
   display: flex;
   align-items: center;
   gap: 8px;
   max-width: 100%;
-  margin-top: 26px;
+  margin-top: 8px;
   padding: 6px 6px 6px 14px;
   border: 1px solid var(--l-line);
   border-radius: 3px;
@@ -442,7 +402,7 @@ onBeforeUnmount(() => {
   overflow-x: auto;
   white-space: nowrap;
   scrollbar-width: none;
-  font: 13px/2.2 var(--l-mono);
+  font: 14px/2.2 var(--l-mono);
   color: var(--l-code-text);
   background: none;
   padding: 0;
@@ -452,319 +412,94 @@ onBeforeUnmount(() => {
 }
 .copy {
   flex: none;
-  padding: 6px 12px;
+  padding: 7px 14px;
   border-radius: 6px;
   border: 1px solid rgba(232, 241, 235, 0.16);
-  font: 12px var(--l-mono);
+  font: 14px var(--l-mono);
   color: #b7c5bc;
 }
 .copy:hover {
   color: #4ade80;
   border-color: #4ade80;
 }
-.install-note {
-  margin: 10px 0 0;
-  font: 12px var(--l-mono);
-  color: var(--l-muted);
-}
-.hero-media { min-width: 0; }
-.hero-brand { display: flex; align-items: center; gap: 20px; margin-bottom: 24px; }
-.hero-art {
-  position: relative;
-  aspect-ratio: 1 / 1;
-  width: clamp(220px, 22vw, 280px);
-  flex-shrink: 0;
-}
-.corner {
-  position: absolute;
-  width: 18px;
-  height: 18px;
-  border-color: var(--l-accent);
-  border-style: solid;
-  opacity: 0.7;
-}
-.corner.tl { top: 0; left: 0; border-width: 1px 0 0 1px; }
-.corner.tr { top: 0; right: 0; border-width: 1px 1px 0 0; }
-.corner.bl { bottom: 0; left: 0; border-width: 0 0 1px 1px; }
-.corner.br { bottom: 0; right: 0; border-width: 0 1px 1px 0; }
-.hud {
-  min-width: 0;
-  margin: 0;
-  font: 10px/1.8 var(--l-mono);
-  color: var(--l-muted);
-  pointer-events: none;
-}
-.hud div {
-  display: flex;
-  gap: 8px;
-}
-.hud dt {
-  min-width: 6.5em;
-  flex-shrink: 0;
-  color: var(--l-accent);
-}
-.hud dt::after {
-  content: ':';
-}
-.hud dd {
-  overflow-wrap: anywhere;
-  margin: 0;
-}
-
-/* ticker */
-.ticker {
-  margin-top: 48px;
-  border-block: 1px solid var(--l-line);
-  overflow: hidden;
-  background: var(--l-panel);
-  mask-image: linear-gradient(90deg, transparent, #000 10%, #000 90%, transparent);
-}
-.ticker-track {
-  display: flex;
-  width: max-content;
-  animation: marquee 48s linear infinite;
-}
-.ticker-run span {
-  display: inline-block;
-  padding: 14px 0 14px 22px;
-  font: 13px var(--l-mono);
-  color: var(--l-text-2);
-  text-transform: lowercase;
-}
-.ticker-run b {
-  margin-left: 22px;
-  font-weight: 400;
-  color: var(--l-accent);
+.hero-lab {
+  margin-top: 88px;
 }
 
 /* ---------- sections ---------- */
 .sec {
   position: relative;
-  padding: 64px 0 0;
-}
-.sec-head {
-  display: flex;
-  align-items: center;
-  gap: 14px;
-  margin-bottom: 20px;
-  font: 12px/1 var(--l-mono);
-  text-transform: uppercase;
-  letter-spacing: 0.12em;
-}
-.sec-head::after {
-  content: '';
-  flex: 1;
-  height: 1px;
-  background: linear-gradient(90deg, var(--l-line-strong), transparent);
-}
-.idx {
-  color: var(--l-accent);
-}
-.kicker {
-  color: var(--l-muted);
+  margin-top: 96px;
+  padding-top: 72px;
+  border-top: 1px solid var(--l-line-strong);
 }
 h2 {
   max-width: 22em;
-  margin: 0;
-  font: 700 clamp(28px, 3.6vw, 44px) / 1.12 var(--l-sans);
-  letter-spacing: -0.03em;
+  margin: 0 0 48px;
+  font: 700 clamp(28px, 3.6vw, 44px) / 1.12 var(--l-display);
+  letter-spacing: -0.045em;
   border: 0;
   padding: 0;
 }
 .landing[lang='zh-CN'] h2 {
   letter-spacing: -0.01em;
 }
-h3 {
-  margin: 0;
-  font: 600 17px/1.35 var(--l-sans);
-  letter-spacing: -0.01em;
+.more {
+  display: inline-block;
+  margin-top: 24px;
+  font: 16px var(--l-mono);
+  color: var(--l-accent);
 }
-.sec-lede {
-  max-width: 44em;
-  margin: 18px 0 36px;
-  font-size: 17px;
-  line-height: 1.65;
-  color: var(--l-text-2);
+.architecture-visual {
+  display: block;
+  max-width: 980px;
+  margin: 0 auto;
 }
-.split {
-  display: grid;
-  grid-template-columns: minmax(0, 1fr) minmax(0, 1.1fr);
-  gap: 56px;
-  align-items: start;
+.architecture-visual a {
+  display: block;
 }
-.split.narrow-right {
-  grid-template-columns: minmax(0, 0.8fr) minmax(0, 1.5fr);
+.architecture-visual .dark-only,
+.dark .architecture-visual .light-only {
+  display: none;
 }
-.mono-label {
-  margin: 0 0 12px;
-  font: 12px var(--l-mono);
-  text-transform: uppercase;
-  letter-spacing: 0.1em;
-  color: var(--l-muted);
+.dark .architecture-visual .dark-only {
+  display: block;
 }
-.sigil {
-  display: inline-block;
-  width: 1.6em;
-  font-family: var(--l-mono);
-  color: var(--l-accent);
+.architecture-visual img {
+  display: block;
+  width: 100%;
+  height: auto;
 }
 
-/* 03 */
-.figure {
-  border: 1px solid var(--l-line);
-  border-radius: 3px;
-  background: var(--l-panel);
-  overflow: hidden;
+/* console */
+.observe-heading {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 24px;
 }
 .tabs {
   display: flex;
+  flex-shrink: 0;
   gap: 4px;
-  padding: 8px;
-  border-bottom: 1px solid var(--l-line);
-  overflow-x: auto;
+  padding: 6px;
+  border: 1px solid var(--l-line);
 }
 .tabs button {
-  padding: 7px 14px;
+  padding: 8px 16px;
   border-radius: 7px;
-  font: 13px var(--l-mono);
+  font: 14px var(--l-mono);
   color: var(--l-muted);
   white-space: nowrap;
   transition: color 0.15s, background 0.15s;
 }
-.tabs button::before {
-  content: '> ';
-  opacity: 0;
-}
 .tabs button.on {
   color: var(--l-accent);
   background: var(--l-accent-soft);
 }
-.tabs button.on::before {
-  opacity: 1;
-}
 .tabs button:hover {
   color: var(--l-text);
 }
-.tabs.vertical {
-  flex-direction: column;
-  align-items: flex-start;
-  padding: 0;
-  border: 0;
-}
-.plate {
-  display: block;
-  padding: 18px;
-  background: #fff;
-  cursor: zoom-in;
-}
-.plate img {
-  display: block;
-  width: 100%;
-  height: auto;
-  animation: fade 0.4s ease;
-}
-.boundaries {
-  display: grid;
-  gap: 0;
-  margin-top: 28px;
-}
-.boundary {
-  display: grid;
-  grid-template-columns: 9em minmax(40px, 1fr) 9em minmax(0, 1.3fr);
-  align-items: center;
-  gap: 14px;
-  padding: 12px 6px;
-  border-bottom: 1px solid var(--l-line);
-  font: 14px var(--l-mono);
-  color: var(--l-text);
-  transition: background 0.15s;
-}
-.boundary:hover {
-  background: var(--l-hover);
-}
-.b-to {
-  text-align: left;
-}
-.b-wire {
-  position: relative;
-  height: 1px;
-  background: var(--l-line-strong);
-}
-.b-wire::after {
-  content: '▶';
-  position: absolute;
-  right: -2px;
-  top: 50%;
-  transform: translateY(-52%);
-  font-size: 9px;
-  color: var(--l-line-strong);
-}
-.b-wire i {
-  position: absolute;
-  top: -1px;
-  left: 0;
-  width: 26px;
-  height: 3px;
-  border-radius: 2px;
-  background: var(--l-accent);
-  box-shadow: 0 0 10px var(--l-accent);
-  animation: packet 2.6s linear infinite;
-  animation-delay: calc(var(--i) * -0.43s);
-}
-.b-doc {
-  justify-self: end;
-  color: var(--l-muted);
-  font-size: 13px;
-}
-.boundary:hover .b-doc {
-  color: var(--l-accent);
-}
-.more {
-  justify-self: start;
-  margin-top: 18px;
-  font: 14px var(--l-mono);
-  color: var(--l-accent);
-}
-
-/* 04 */
-.rules {
-  display: grid;
-  grid-template-columns: repeat(2, minmax(0, 1fr));
-  gap: 14px;
-  margin: 0;
-  padding: 0;
-  list-style: none;
-}
-.rules li {
-  padding: 20px;
-  border: 1px solid var(--l-line);
-  border-radius: 3px;
-  background: var(--l-panel);
-}
-.art {
-  margin: 0 0 18px;
-  padding: 14px 16px;
-  border-radius: 2px;
-  background: var(--l-code-bg);
-  color: #4ade80;
-  font: 12.5px/1.7 var(--l-mono);
-  overflow-x: auto;
-  white-space: pre;
-}
-.note {
-  display: flex;
-  margin: 26px 0 0;
-  font: 14px/1.6 var(--l-mono);
-  color: var(--l-text-2);
-}
-
-/* 05 */
-.caption {
-  margin: 22px 0 0;
-  font-size: 13px;
-  line-height: 1.6;
-  color: var(--l-muted);
-}
 .window {
   border: 1px solid var(--l-line);
   border-radius: 3px;
@@ -778,174 +513,92 @@ h3 {
   height: auto;
   animation: fade 0.4s ease;
 }
-.win-bar {
+
+/* documentation shortcuts */
+.doc-shortcuts {
+  display: grid;
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  gap: 16px;
+  margin-top: 96px;
+}
+.doc-shortcuts a {
   display: flex;
   align-items: center;
-  gap: 12px;
-  padding: 10px 14px;
-  border-bottom: 1px solid var(--l-line);
-  font: 12px var(--l-mono);
-  color: var(--l-muted);
+  gap: 16px;
+  padding: 28px 20px;
+  border: 1px solid var(--l-line-strong);
+  font: 500 15px/1.4 var(--l-mono);
+  color: var(--l-text);
 }
-.dots {
-  display: flex;
-  gap: 6px;
+.doc-shortcuts a:hover {
+  border-color: var(--l-accent);
+  color: var(--l-accent);
 }
-.dots i {
-  width: 10px;
-  height: 10px;
-  border-radius: 50%;
+.doc-shortcuts a > :last-child {
+  margin-left: auto;
 }
-.dots i:nth-child(1) { background: #ff5f57; }
-.dots i:nth-child(2) { background: #febc2e; }
-.dots i:nth-child(3) { background: #28c840; }
 
 /* outro */
 .outro {
   position: relative;
-  margin-top: 24px;
-  padding-bottom: 96px;
+  margin-top: 56px;
+  padding: 72px 0 120px;
   border-top: 1px solid var(--l-line);
 }
-.outro-art {
-  height: clamp(200px, 30vw, 380px);
-  max-width: 1280px;
-  margin: 0 auto;
+.start-path {
+  display: flex;
+  gap: 48px;
+  margin: 0;
+  padding: 0;
+  list-style: none;
+  font: 16px var(--l-mono);
 }
-.outro-copy {
-  text-align: center;
+.start-path li {
+  display: flex;
+  gap: 14px;
+  align-items: baseline;
 }
-.outro-copy p {
-  margin: 8px auto 0;
-  max-width: 36em;
-  font-size: 18px;
-  line-height: 1.6;
-  color: var(--l-text-2);
+.start-path span {
+  color: var(--l-accent);
+}
+.start-path a {
+  color: var(--l-text);
+}
+.start-path a:hover {
+  color: var(--l-accent);
 }
 
 /* ---------- motion ---------- */
 @keyframes blink {
   50% { opacity: 0; }
 }
-@keyframes pulse {
-  50% { opacity: 0.35; }
-}
-@keyframes marquee {
-  to { transform: translateX(-50%); }
-}
-@keyframes packet {
-  from { left: 0; opacity: 0; }
-  10% { opacity: 1; }
-  90% { opacity: 1; }
-  to { left: calc(100% - 26px); opacity: 0; }
-}
 @keyframes fade {
   from { opacity: 0; }
 }
 @media (prefers-reduced-motion: reduce) {
-  .ticker-track, .b-wire i, .led, .cursor { animation: none; }
+  .cursor { animation: none; }
 }
 
 /* ---------- responsive ---------- */
-@media (max-width: 1080px) {
-  .pillars, .roadmap, .docs-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); }
-}
-@media (max-width: 900px) {
-  .hero { padding-top: 24px; }
-  .hero-grid { grid-template-columns: minmax(0, 1fr); gap: 8px; min-height: 0; }
-  .hero-copy { display: contents; }
-  .hero-media { order: 1; width: 100%; max-width: 600px; justify-self: center; margin-top: 24px; }
-  .hero-install { order: 2; }
-  .hero-brand { justify-content: center; }
-  .hero-art { width: min(60vw, 280px); }
-  .hud { display: none; }
-  .split, .split.narrow-right { grid-template-columns: minmax(0, 1fr); gap: 32px; }
-  .tradeoffs { grid-template-columns: minmax(0, 1fr); }
-  .rules { grid-template-columns: minmax(0, 1fr); }
-  .boundary { grid-template-columns: 7.5em minmax(24px, 1fr) 7.5em; }
-  .b-doc { grid-column: 1 / -1; justify-self: start; }
-  .sec { padding-top: 84px; }
-}
-@media (max-width: 560px) {
-  .wrap { padding: 0 18px; }
-  .pillars, .roadmap, .docs-grid { grid-template-columns: minmax(0, 1fr); }
-  .eyebrow { flex-wrap: wrap; border-radius: 3px; line-height: 1.5; }
-  .hero-title { font-size: clamp(38px, 12vw, 56px); }
-  .lede { font-size: 16px; }
-  .compare tbody th { white-space: normal; }
-}
-
-/* Editorial typography and ruled sections retain the terminal demonstrations. */
-.hero-title .accent { font-style: italic; }
-.cursor { font-style: normal; }
-.eyebrow { border-radius: 0; background: transparent; border: 0; border-left: 3px solid var(--l-accent); padding-left: 12px; }
-.sec { border-top: 1px solid var(--l-line-strong); padding-bottom: 56px; }
-
-.sec-head { align-items: center; }
-.idx { background: var(--l-accent); color: var(--l-bg); padding: 7px 10px; }
-h2, .motto { font-family: var(--l-display); letter-spacing: -0.045em; }
-h3 { font-family: var(--l-display); }
-.hero-art { background: transparent; }
-.ticker { background: var(--l-text); color: var(--l-bg); border-top: 3px solid var(--l-accent); }
-.ticker-run span { color: inherit; }
-.btn.primary { box-shadow: 3px 3px 0 var(--l-text); }
-.btn.primary:hover { box-shadow: 5px 5px 0 var(--l-text); }
-.btn:focus-visible, .copy:focus-visible { outline: 2px solid var(--l-accent); outline-offset: 5px; }
-@media (max-width: 640px) {
-  .hero-art { transform: none; }
-  .hero-title { letter-spacing: -0.05em; }
-}
-</style>
-
-<style scoped>
-.architecture-visual { display: block; max-width: 980px; margin: 0 auto 20px; }
-.architecture-visual img { display: block; width: 100%; height: auto; }
-.more { display: inline-block; }
-.session-flow { display: flex; align-items: center; justify-content: center; gap: 28px; padding: 32px 24px; margin: 24px 0; border: 1px solid var(--l-line-strong); background: var(--l-panel); }
-.flow-node { display: flex; align-items: center; gap: 12px; padding: 18px 24px; border: 1px solid var(--l-line-strong); font: 500 17px var(--l-mono); }
-.flow-dot { width: 8px; height: 8px; border-radius: 50%; background: var(--l-muted); }
-.flow-node.active { border-color: var(--l-accent); color: var(--l-accent); }
-.active .flow-dot { background: var(--l-accent); box-shadow: 0 0 16px var(--l-glow); }
-.flow-arrow { color: var(--l-accent); font-size: 24px; }
-.flow-outcomes { display: grid; gap: 10px; }
-.compact-rules { grid-template-columns: repeat(4, minmax(0, 1fr)); }
-.compact-rules li { padding: 16px; }
-.rule-icon { width: 36px; height: 36px; margin-bottom: 18px; color: var(--l-accent); }
-.compact-rules h3 { font-size: 16px; }
-.compact-rules p { font-size: 13px; }
-.observe-heading { display: flex; align-items: center; justify-content: space-between; gap: 24px; }
-.observe-heading .tabs { flex-shrink: 0; border: 1px solid var(--l-line); }
-.console-wide { width: 100%; }
-.console-wide img { width: 100%; display: block; }
-.doc-shortcuts { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 12px; padding-top: 28px; padding-bottom: 28px; }
-.doc-shortcuts a { display: flex; align-items: center; gap: 16px; padding: 22px 16px; border: 1px solid var(--l-line-strong); font: 500 14px var(--l-mono); }
-.doc-shortcuts a:hover { border-color: var(--l-accent); color: var(--l-accent); }
-.doc-shortcuts a > :last-child { margin-left: auto; }
-.shortcut-index { color: var(--l-accent); font-size: 11px; }
-.start-compact { padding-top: 40px; }
-.start-compact .install { max-width: 100%; }
-.start-path { display: flex; gap: 32px; list-style: none; padding: 0; margin: 24px 0; font: 14px var(--l-mono); }
-.start-path li { display: flex; gap: 12px; align-items: center; }
-.start-path span { color: var(--l-accent); }
-.outro { padding-bottom: 0; }
-.outro-art { margin-top: 32px; }
 @media (max-width: 900px) {
-  .compact-rules, .doc-shortcuts { grid-template-columns: repeat(2, minmax(0, 1fr)); }
-  .session-flow { gap: 14px; padding: 24px 12px; }
-  .flow-node { padding: 12px; font-size: 14px; }
+  .hero { padding-top: 48px; }
+  .hero-grid { grid-template-columns: minmax(0, 1fr); gap: 40px; }
+  .hero-lab { margin-top: 64px; }
+  .sec { margin-top: 72px; padding-top: 56px; }
+  .doc-shortcuts { grid-template-columns: repeat(2, minmax(0, 1fr)); margin-top: 72px; }
 }
 @media (max-width: 640px) {
+  .wrap { padding: 0 18px; }
+  .hero-title { font-size: clamp(38px, 12vw, 56px); letter-spacing: -0.05em; }
+  .lede { font-size: 16px; }
   .observe-heading { display: block; }
-  .observe-heading .tabs { margin-bottom: 20px; width: fit-content; }
-  .session-flow { flex-wrap: wrap; gap: 10px; }
-  .flow-node { font-size: 11px; padding: 10px; gap: 6px; }
-  .flow-arrow { font-size: 18px; }
-  .flow-dot { width: 5px; height: 5px; }
-  .start-path { flex-direction: column; gap: 16px; }
-  .doc-shortcuts a { font-size: 12px; gap: 8px; padding: 16px 10px; }
+  .observe-heading .tabs { margin-bottom: 28px; width: fit-content; }
+  .doc-shortcuts { grid-template-columns: minmax(0, 1fr); }
+  .start-path { flex-direction: column; gap: 20px; }
+  /* Keep the figure and the console at a readable size and let them scroll sideways. */
+  .architecture-visual, .window { overflow-x: auto; }
+  .architecture-visual img { min-width: 960px; }
+  .window img { min-width: 900px; }
+  .outro { padding-bottom: 80px; }
 }
 </style>
-
-<style scoped>
-@font-face { font-family: 'OAC Hand'; src: url('../assets/fonts/Virgil.woff2') format('woff2'); font-weight: 400; font-display: swap; }
-</style>
diff --git a/website/.vitepress/theme/components/LaunchVideo.vue b/website/.vitepress/theme/components/LaunchVideo.vue
index 2672f86b1..a38ce8261 100644
--- a/website/.vitepress/theme/components/LaunchVideo.vue
+++ b/website/.vitepress/theme/components/LaunchVideo.vue
@@ -1,37 +1,25 @@
 <script setup lang="ts">
-import { computed, onBeforeUnmount, onMounted, ref } from 'vue'
+import { computed, nextTick, onBeforeUnmount, ref } from 'vue'
 import { copy, type Lang } from '../landing-content'
 
 const props = defineProps<{ lang: Lang }>()
 const t = computed(() => copy[props.lang].video)
 const source = 'https://file.cdn.minimax.io/public/OpenAgentCore-launch.mp4'
-const preview = ref<HTMLVideoElement>()
 const player = ref<HTMLVideoElement>()
 const dialog = ref<HTMLDialogElement>()
-const paused = ref(true)
-let resumePreview = false
+// The video loads only after the first click.
+const opened = ref(false)
 
-function play(video?: HTMLVideoElement) {
-  void video?.play().catch(() => {})
-}
-function expand() {
-  if (!preview.value || !player.value || !dialog.value) return
-  resumePreview = !preview.value.paused
-  preview.value.pause()
-  dialog.value.showModal()
-  player.value.currentTime = preview.value.currentTime
-  play(player.value)
+async function open() {
+  opened.value = true
+  dialog.value?.showModal()
+  await nextTick()
+  void player.value?.play().catch(() => {})
 }
 function close() {
   player.value?.pause()
-  if (preview.value && player.value) preview.value.currentTime = player.value.currentTime
-  if (resumePreview) play(preview.value)
 }
-onMounted(() => {
-  if (!window.matchMedia('(prefers-reduced-motion: reduce)').matches) play(preview.value)
-})
 onBeforeUnmount(() => {
-  preview.value?.pause()
   player.value?.pause()
   dialog.value?.close()
 })
@@ -39,41 +27,25 @@ onBeforeUnmount(() => {
 
 <template>
   <div class="launch-video">
-    <div class="preview-frame">
-      <button class="preview-open" type="button" :aria-label="t.expand" aria-haspopup="dialog" @click="expand">
-        <video ref="preview" :src="source" muted loop playsinline preload="metadata" aria-hidden="true" @play="paused = false" @pause="paused = true" />
-        <span class="expand-icon" aria-hidden="true">↗</span>
-      </button>
-      <span class="video-corner top-left" aria-hidden="true" /><span class="video-corner top-right" aria-hidden="true" /><span class="video-corner bottom-left" aria-hidden="true" /><span class="video-corner bottom-right" aria-hidden="true" />
-      <button class="preview-pause" type="button" :aria-label="paused ? t.play : t.pause" @click="paused ? play(preview) : preview?.pause()">{{ paused ? '▶' : 'Ⅱ' }}</button>
-    </div>
-    <button class="video-caption" type="button" @click="expand">{{ t.title }} <span aria-hidden="true">↗</span></button>
+    <button class="watch" type="button" aria-haspopup="dialog" @click="open">
+      <span class="play" aria-hidden="true">▶</span>{{ t.expand }}
+    </button>
     <dialog ref="dialog" class="video-dialog" :aria-label="t.title" @close="close" @click="($event.target === dialog) && dialog?.close()">
       <div class="player-heading"><span>{{ t.title }}</span><button type="button" :aria-label="t.close" autofocus @click="dialog?.close()">✕</button></div>
-      <video ref="player" :src="source" controls playsinline preload="none" :aria-label="t.title" />
+      <video ref="player" :src="opened ? source : undefined" controls playsinline preload="none" :aria-label="t.title" />
     </dialog>
   </div>
 </template>
 
 <style scoped>
-.launch-video { width: 100%; }
-.preview-frame { position: relative; padding: 6px; background: transparent; }
-.video-corner { position: absolute; width: 18px; height: 18px; border-style: solid; border-color: var(--l-accent); opacity: 0.65; pointer-events: none; }
-.top-left { top: 0; left: 0; border-width: 1px 0 0 1px; }
-.top-right { top: 0; right: 0; border-width: 1px 1px 0 0; }
-.bottom-left { bottom: 0; left: 0; border-width: 0 0 1px 1px; }
-.bottom-right { bottom: 0; right: 0; border-width: 0 1px 1px 0; }
-.preview-open { display: block; width: 100%; cursor: pointer; }
-.preview-open video { display: block; width: 100%; aspect-ratio: 16 / 9; object-fit: contain; }
-.expand-icon, .preview-pause { position: absolute; bottom: 10px; display: grid; place-items: center; width: 30px; height: 30px; border: 1px solid #ffffff50; border-radius: 3px; color: #fff; background: #0b100ecc; }
-.expand-icon { right: 10px; }
-.preview-pause { left: 10px; cursor: pointer; }
-.video-caption { display: flex; align-items: center; justify-content: space-between; width: 100%; padding: 12px 6px; border-bottom: 1px solid var(--l-line); color: var(--l-text-2); font: 12px var(--l-mono); cursor: pointer; }
-button:focus-visible { outline: 2px solid var(--l-accent); outline-offset: -3px; }
-.preview-frame:hover .video-corner { opacity: 1; }
+.watch { display: inline-flex; align-items: center; gap: 14px; padding: 6px 0; color: var(--l-text); font: 500 16px/1.4 var(--l-mono); cursor: pointer; }
+.watch:hover { color: var(--l-accent); }
+.play { display: grid; place-items: center; width: 40px; height: 40px; border: 1px solid var(--l-line-strong); border-radius: 50%; color: var(--l-accent); font-size: 14px; padding-left: 2px; }
+.watch:hover .play { border-color: var(--l-accent); }
+button:focus-visible { outline: 2px solid var(--l-accent); outline-offset: 4px; }
 .video-dialog { position: fixed; inset: 0; width: min(1040px, calc(100vw - 32px)); max-width: none; max-height: calc(100dvh - 32px); margin: auto; padding: 0; border: 1px solid var(--l-line-strong); border-radius: 6px; background: var(--l-code-bg); color: var(--l-code-text); box-shadow: 0 24px 100px #0008; }
 .video-dialog::backdrop { background: #050907d9; backdrop-filter: blur(8px); }
-.player-heading { display: flex; align-items: center; justify-content: space-between; gap: 16px; padding: 10px 16px; border-bottom: 1px solid #ffffff20; font: 13px var(--l-mono); }
+.player-heading { display: flex; align-items: center; justify-content: space-between; gap: 16px; padding: 10px 16px; border-bottom: 1px solid #ffffff20; font: 14px var(--l-mono); }
 .player-heading button { width: 32px; height: 32px; cursor: pointer; }
 .video-dialog video { display: block; width: 100%; max-height: calc(100dvh - 90px); background: #000; }
 </style>
diff --git a/website/.vitepress/theme/components/LogoWall.vue b/website/.vitepress/theme/components/LogoWall.vue
index 70063329c..1a7d693af 100644
--- a/website/.vitepress/theme/components/LogoWall.vue
+++ b/website/.vitepress/theme/components/LogoWall.vue
@@ -8,8 +8,8 @@ const props = defineProps<{ lang: Lang }>()
 const t = computed(() => copy[props.lang].ecosystem)
 const paused = ref(false)
 const rows = computed(() => [
-  { label: t.value.agents, logos: agentLogos },
-  { label: t.value.compute, logos: computeLogos },
+  { label: 'Harnesses and models', logos: agentLogos },
+  { label: 'Cloud and compute', logos: computeLogos },
 ])
 </script>
 
@@ -23,7 +23,6 @@ const rows = computed(() => [
       </button>
     </header>
     <div v-for="(row, index) in rows" :key="index" class="logo-row" :class="{ reverse: index === 1 }">
-      <p class="logo-row-label">{{ row.label }}</p>
       <div class="logo-viewport" tabindex="0" role="region" :aria-label="row.label">
         <div class="logo-track">
           <ul v-for="run in 2" :key="run" class="logo-run" :aria-hidden="run === 2 ? true : undefined">
@@ -41,9 +40,9 @@ const rows = computed(() => [
 <style scoped>
 .logo-wall {
   position: relative;
-  padding: 20px 0;
+  padding: 56px 0 24px;
   background: transparent;
-  color: #fff;
+  color: var(--l-text);
 }
 .logo-wall-heading {
   max-width: 1200px;
@@ -58,32 +57,24 @@ const rows = computed(() => [
   margin: 0;
   font: 500 clamp(20px, 2.5vw, 28px) / 1.3 var(--l-display);
   letter-spacing: -0.035em;
-  color: #fff;
+  color: var(--l-text);
 }
 .logo-wall-heading button {
   flex-shrink: 0;
   display: flex;
   align-items: center;
   gap: 8px;
-  padding: 8px 10px;
-  border: 1px solid rgba(255, 255, 255, 0.28);
+  padding: 10px 14px;
+  border: 1px solid var(--l-line-strong);
   border-radius: 3px;
-  color: #fff;
-  font: 11px var(--l-mono);
+  color: var(--l-text);
+  font: 14px var(--l-mono);
   cursor: pointer;
 }
-.logo-wall-heading button:hover { background: rgba(255, 255, 255, 0.08); }
+.logo-wall-heading button:hover { background: var(--l-hover); }
 .logo-wall-heading button:focus-visible,
-.logo-viewport:focus-visible { outline: 2px solid #4ade80; outline-offset: -2px; }
+.logo-viewport:focus-visible { outline: 2px solid var(--l-accent); outline-offset: -2px; }
 .logo-row + .logo-row { margin-top: 18px; }
-.logo-row-label {
-  margin: 0 0 6px;
-  text-align: center;
-  color: #9aaba0;
-  font: 10px / 1.5 var(--l-mono);
-  letter-spacing: 0.15em;
-  text-transform: uppercase;
-}
 .logo-viewport {
   overflow-x: auto;
   scrollbar-width: none;
@@ -121,8 +112,9 @@ const rows = computed(() => [
   width: 36px;
   height: 36px;
   object-fit: contain;
-  filter: brightness(0) invert(1);
+  filter: brightness(0);
 }
+.dark .logo-item img { filter: brightness(0) invert(1); }
 .logo-wall.paused .logo-track,
 .logo-wall:hover .logo-track,
 .logo-viewport:focus-within .logo-track { animation-play-state: paused; }
diff --git a/website/.vitepress/theme/components/Mermaid.vue b/website/.vitepress/theme/components/Mermaid.vue
index 886a01381..ee745c76d 100644
--- a/website/.vitepress/theme/components/Mermaid.vue
+++ b/website/.vitepress/theme/components/Mermaid.vue
@@ -8,6 +8,9 @@ const props = defineProps<{ code: string }>()
 
 const source = computed(() => decodeURIComponent(props.code))
 const svg = ref('')
+// Mermaid caps each diagram at its natural width; on a narrow screen the
+// diagram keeps up to 640px of it and the container scrolls, so text stays readable.
+const minWidth = ref('')
 const failed = ref(false)
 let themeObserver: MutationObserver | undefined
 let renderCount = 0
@@ -28,7 +31,10 @@ async function render() {
   })
   const id = `oac-mermaid-${Math.random().toString(36).slice(2)}-${renderCount++}`
   try {
-    svg.value = (await mermaid.render(id, source.value)).svg
+    const rendered = (await mermaid.render(id, source.value)).svg
+    const natural = Number(/max-width:\s*([\d.]+)px/.exec(rendered)?.[1])
+    minWidth.value = natural > 0 ? `${Math.min(natural, 640)}px` : ''
+    svg.value = rendered
     failed.value = false
   } catch (error) {
     console.error('Mermaid diagram failed to render', error)
@@ -48,7 +54,7 @@ onBeforeUnmount(() => themeObserver?.disconnect())
 
 <template>
   <div class="oac-mermaid" :class="{ failed }">
-    <div v-if="svg && !failed" class="oac-mermaid-diagram" v-html="svg" />
+    <div v-if="svg && !failed" class="oac-mermaid-diagram" :style="{ '--oac-mermaid-min-width': minWidth }" v-html="svg" />
     <pre v-else class="oac-mermaid-source"><code>{{ source }}</code></pre>
   </div>
 </template>
@@ -65,6 +71,7 @@ onBeforeUnmount(() => themeObserver?.disconnect())
 .oac-mermaid-diagram :deep(svg) {
   display: block;
   max-width: 100%;
+  min-width: var(--oac-mermaid-min-width, 0);
   height: auto;
   margin: 0 auto;
 }
diff --git a/website/.vitepress/theme/components/SessionFlow.vue b/website/.vitepress/theme/components/SessionFlow.vue
index 7ac648b8c..184f7c73c 100644
--- a/website/.vitepress/theme/components/SessionFlow.vue
+++ b/website/.vitepress/theme/components/SessionFlow.vue
@@ -1,24 +1,20 @@
 <script setup lang="ts">
 import { computed, onBeforeUnmount, onMounted, ref } from 'vue'
-import type { Lang } from '../landing-content'
+import { copy as landing, type Lang } from '../landing-content'
 import codex from '../assets/logos/codex.svg'
 import claude from '../assets/logos/claudecode.svg'
 import minimax from '../assets/logos/minimax.svg'
 
 const props = defineProps<{ lang: Lang }>()
-const copy = computed(() => props.lang === 'zh' ? {
-  stages: ['原生 Agent', '统一执行', '自由组合'],
-  captions: ['Runtime 准备环境，原生 Harness 运行模型与工具循环。', '应用通过 Agents API 创建 Session，Core 管理执行与持久状态。', '不同 Session 使用不同 Harness 与模型；此示例中的托管 Session 共用 microsandbox 部署，独立工作区可跨计算生命周期保留。'],
-  app: '你的应用', api: 'OpenAI SDK · Agents API', state: 'Session 与 Turn', orchestration: '调度 · 取消 · 交互', events: '事件 · 结果 · 持久状态', workspace: '挂载工作区 · Shell · 工具', loop: '原生 Agent 循环', runtime: '环境准备 · 执行管理', model: '模型提供商', provider: '沙箱提供商', compute: '创建与回收计算资源', next: '下一步', back: '上一步', play: '播放', pause: '暂停', label: 'Session 架构演示', step: '演示阶段',
-} : {
-  stages: ['Native agent', 'Managed execution', 'Many combinations'],
-  captions: ['Runtime prepares the environment. The native harness owns the model and tool loop.', 'Your app creates a Session through the Agents API. Core manages execution and durable state.', 'Sessions use different Harnesses and models. Managed Sessions here share one microsandbox deployment; independent workspaces outlive compute.'],
-  app: 'Your application', api: 'OpenAI SDK · Agents API', state: 'Sessions & Turns', orchestration: 'Schedule · cancel · interact', events: 'Events · results · durable state', workspace: 'Mounted workspace · shell · tools', loop: 'Native agent loop', runtime: 'Prepare · execute · report', model: 'Model provider', provider: 'Sandbox Provider', compute: 'Provision & reclaim compute', next: 'Next', back: 'Back', play: 'Play', pause: 'Pause', label: 'Inside a Session', step: 'Architecture stage',
-})
+const copy = computed(() => landing[props.lang].session.flow)
 const step = ref(0)
 const playing = ref(true)
 const visible = ref(false)
 const root = ref<HTMLElement>()
+const fit = ref<HTMLElement>()
+// The 1100 px board scales down to the column width instead of scrolling.
+const scale = ref(1)
+let resize: ResizeObserver | undefined
 let timer: ReturnType<typeof setInterval> | undefined
 let observer: IntersectionObserver | undefined
 let media: MediaQueryList | undefined
@@ -36,15 +32,16 @@ onMounted(() => {
   observer = new IntersectionObserver(([entry]) => { visible.value = entry.isIntersecting; syncTimer() }, { threshold: .2 })
   observer.observe(root.value!)
   document.addEventListener('visibilitychange', syncTimer)
+  resize = new ResizeObserver(([entry]) => { scale.value = Math.min(1, entry.contentRect.width / 1100) })
+  resize.observe(fit.value!)
 })
-onBeforeUnmount(() => { clearInterval(timer); observer?.disconnect(); media?.removeEventListener('change', onMotion); document.removeEventListener('visibilitychange', syncTimer) })
+onBeforeUnmount(() => { clearInterval(timer); observer?.disconnect(); resize?.disconnect(); media?.removeEventListener('change', onMotion); document.removeEventListener('visibilitychange', syncTimer) })
 </script>
 
 <template>
   <figure ref="root" class="session-sketch" :data-stage="step" :class="{ paused: !playing || !visible }" :aria-label="copy.label">
-    <div class="sketch-top"><strong>{{ copy.label }}</strong><span>0{{ step + 1 }} · {{ copy.stages[step] }}</span></div>
-    <div class="sketch-scroll" tabindex="0" :aria-label="copy.label">
-      <div class="sketch-board">
+    <div ref="fit" class="sketch-fit" :style="{ height: 530 * scale + 'px' }">
+      <div class="sketch-board" :style="{ transform: `scale(${scale})` }">
         <svg class="wires" viewBox="0 0 1100 530" aria-hidden="true">
           <defs><marker id="session-arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path d="M1 1 8 5 1 9" /></marker></defs>
           <g class="core-wires"><path d="M205 228 Q238 222 266 228" marker-end="url(#session-arrow)" /><path d="M266 265 Q238 271 205 265" marker-end="url(#session-arrow)" /><text x="219" y="210">/v1</text>
@@ -91,11 +88,9 @@ onBeforeUnmount(() => { clearInterval(timer); observer?.disconnect(); media?.rem
 </template>
 
 <style scoped>
-.session-sketch { margin: 28px 0 24px; color: var(--l-text); font-family: 'OAC Hand', 'Kaiti SC', KaiTi, cursive; line-height: 1.35; }
-.sketch-top { display: flex; justify-content: space-between; gap: 20px; padding: 0 20px 12px; font-size: 20px; }
-.sketch-top > span { color: var(--l-muted); font-size: 16px; }
-.sketch-scroll { overflow-x: auto; }
-.sketch-board { position: relative; width: 1100px; height: 530px; margin: auto; background-image: linear-gradient(var(--l-grid) 1px,transparent 1px),linear-gradient(90deg,var(--l-grid) 1px,transparent 1px); background-size: 32px 32px; }
+.session-sketch { margin: 40px 0 24px; color: var(--l-text); font-family: 'OAC Hand', 'Kaiti SC', KaiTi, cursive; line-height: 1.35; }
+.sketch-fit { width: 100%; max-width: 1100px; margin: 0 auto; }
+.sketch-board { position: relative; width: 1100px; height: 530px; transform-origin: top left; background-image: linear-gradient(var(--l-grid) 1px,transparent 1px),linear-gradient(90deg,var(--l-grid) 1px,transparent 1px); background-size: 32px 32px; }
 .hand-box { position: relative; border: 1.3px solid var(--l-text-2); border-radius: 2px 5px 3px 7px; background: var(--l-bg); }
 .hand-box::after { content: ''; pointer-events: none; position: absolute; inset: 2px -3px -3px 2px; border: .7px solid var(--l-muted); opacity: .4; border-radius: 5px 2px 6px 3px; transform: rotate(-.35deg); }
 .sketch-board > article { position: absolute; box-sizing: border-box; transition: left .85s cubic-bezier(.22,1,.36,1), top .85s cubic-bezier(.22,1,.36,1), width .85s, height .85s, opacity .5s, transform .85s; }
@@ -122,7 +117,8 @@ strong, b { font-weight: 400; }
 .runtime small { font-size: 11px; }
 .harness { padding: 12px; margin-top: 14px; }
 .harness > strong { display: flex; align-items: center; gap: 9px; font-size: 19px; }
-.harness img { width: 22px; height: 22px; filter: brightness(0) invert(1); }
+.harness img { width: 22px; height: 22px; filter: brightness(0); }
+.dark .harness img { filter: brightness(0) invert(1); }
 .agent-loop { text-align: center; margin-top: 8px; }
 .cycle { position: relative; height: 90px; width: 200px; margin: auto; font-size: 14px; }
 .cycle span { position: absolute; z-index: 1; background: var(--l-bg); padding: 0 3px; }
@@ -164,10 +160,14 @@ figcaption { min-height: 2.8em; max-width: 900px; margin: 8px auto 14px; padding
 .sketch-controls { display: flex; gap: 22px; align-items: center; justify-content: center; padding: 8px 12px; }
 .sketch-controls button { border: 1px solid var(--l-line-strong); padding: 7px 14px; font: 16px 'OAC Hand', 'Kaiti SC', cursive; cursor: pointer; }.sketch-controls button:disabled { opacity: .3; cursor: default; }
 .sketch-controls button:hover:enabled { border-color: var(--l-accent); color: var(--l-accent); }
-.sketch-controls :focus-visible,.sketch-scroll:focus-visible { outline: 2px solid var(--l-accent); outline-offset: 3px; }
-.stage-picker { width: 330px; }.stage-picker input { width: 100%; accent-color: var(--l-accent); }.stage-picker > div { display: flex; justify-content: space-between; font-size: 13px; color: var(--l-muted); }
+.sketch-controls :focus-visible { outline: 2px solid var(--l-accent); outline-offset: 3px; }
+.stage-picker { width: 520px; max-width: 100%; }.stage-picker input { width: 100%; accent-color: var(--l-accent); }.stage-picker > div { display: flex; justify-content: space-between; font-size: 14px; color: var(--l-muted); }
 @keyframes ink-flow { to { stroke-dashoffset: -54; } }
 .paused .cycle svg,.paused .request { animation-play-state: paused; }
-@media (max-width: 640px) { .sketch-top { padding: 0 4px 12px; font-size: 16px; }.sketch-top > span { font-size: 13px; }.sketch-controls { gap: 8px; flex-wrap: wrap; }.stage-picker { width: 100%; order: -1; }figcaption { font-size: 16px; } }
+@media (max-width: 640px) { .sketch-controls { gap: 8px; flex-wrap: wrap; }.stage-picker { width: 100%; order: -1; }figcaption { font-size: 16px; } }
 @media (prefers-reduced-motion: reduce) { article,.core-wires,.fleet-wires { transition: none; }.cycle svg,.wires .request { animation: none; } }
 </style>
+
+<style scoped>
+@font-face { font-family: 'OAC Hand'; src: url('../assets/fonts/Virgil.woff2') format('woff2'); font-weight: 400; font-display: swap; }
+</style>
diff --git a/website/.vitepress/theme/components/TypeTerminal.vue b/website/.vitepress/theme/components/TypeTerminal.vue
deleted file mode 100644
index b5ee7a58e..000000000
--- a/website/.vitepress/theme/components/TypeTerminal.vue
+++ /dev/null
@@ -1,136 +0,0 @@
-<script setup lang="ts">
-// A terminal that types its lines once it scrolls into view.
-import { onBeforeUnmount, onMounted, ref } from 'vue'
-
-export interface TermLine {
-  kind: 'cmd' | 'comment' | 'out'
-  text: string
-}
-
-const props = defineProps<{ lines: TermLine[]; title: string }>()
-
-const root = ref<HTMLElement>()
-const shown = ref<string[]>(props.lines.map(() => ''))
-const active = ref(-1)
-let timer: ReturnType<typeof setTimeout> | undefined
-let observer: IntersectionObserver | undefined
-
-function finish() {
-  shown.value = props.lines.map((line) => line.text)
-  active.value = props.lines.length - 1
-}
-
-function run() {
-  let line = 0
-  let char = 0
-  const step = () => {
-    if (line >= props.lines.length) return
-    active.value = line
-    const target = props.lines[line]
-    if (target.kind !== 'cmd') {
-      shown.value[line] = target.text
-      line++
-      timer = setTimeout(step, 140)
-      return
-    }
-    char = Math.min(target.text.length, char + 2)
-    shown.value[line] = target.text.slice(0, char)
-    if (char >= target.text.length) {
-      line++
-      char = 0
-      timer = setTimeout(step, 420)
-    } else {
-      timer = setTimeout(step, 18 + Math.random() * 30)
-    }
-  }
-  step()
-}
-
-onMounted(() => {
-  if (window.matchMedia('(prefers-reduced-motion: reduce)').matches) return finish()
-  observer = new IntersectionObserver(
-    ([entry]) => {
-      if (!entry.isIntersecting) return
-      observer?.disconnect()
-      run()
-    },
-    { threshold: 0.4 },
-  )
-  observer.observe(root.value!)
-})
-
-onBeforeUnmount(() => {
-  clearTimeout(timer)
-  observer?.disconnect()
-})
-</script>
-
-<template>
-  <div ref="root" class="term">
-    <div class="term-bar">
-      <span class="dots"><i /><i /><i /></span>
-      <span>{{ title }}</span>
-    </div>
-    <pre class="term-body" :aria-label="lines.map((l) => l.text).join('\n')"><template v-for="(line, i) in lines" :key="i"><span v-if="shown[i] || active === i" :class="line.kind"><span v-if="line.kind === 'cmd'" class="prompt">❯ </span>{{ shown[i] }}<span v-if="active === i" class="caret" aria-hidden="true">█</span>
-</span></template></pre>
-  </div>
-</template>
-
-<style scoped>
-.term {
-  border: 1px solid var(--l-line);
-  border-radius: 12px;
-  overflow: hidden;
-  background: var(--l-code-bg);
-  box-shadow: 0 30px 80px -40px var(--l-glow);
-}
-.term-bar {
-  display: flex;
-  align-items: center;
-  gap: 12px;
-  padding: 10px 14px;
-  border-bottom: 1px solid rgba(232, 241, 235, 0.08);
-  font: 12px var(--l-mono);
-  color: #7f8f85;
-}
-.dots {
-  display: flex;
-  gap: 6px;
-}
-.dots i {
-  width: 10px;
-  height: 10px;
-  border-radius: 50%;
-}
-.dots i:nth-child(1) { background: #ff5f57; }
-.dots i:nth-child(2) { background: #febc2e; }
-.dots i:nth-child(3) { background: #28c840; }
-.term-body {
-  margin: 0;
-  min-height: 15.5em;
-  padding: 16px 18px;
-  overflow-x: auto;
-  font: 13px/1.75 var(--l-mono);
-  color: var(--l-code-text);
-  white-space: pre-wrap;
-  word-break: break-all;
-}
-.prompt {
-  color: #4ade80;
-}
-.comment {
-  color: #5f7166;
-}
-.out {
-  color: #b7c5bc;
-}
-.caret {
-  color: #4ade80;
-  animation: blink 1s steps(1) infinite;
-}
-@keyframes blink {
-  50% {
-    opacity: 0;
-  }
-}
-</style>
diff --git a/website/.vitepress/theme/docs.data.mts b/website/.vitepress/theme/docs.data.mts
deleted file mode 100644
index 836a61b2d..000000000
--- a/website/.vitepress/theme/docs.data.mts
+++ /dev/null
@@ -1,53 +0,0 @@
-// Build-time data for the landing page's documentation index. The page list
-// and order come from docs.json; titles and summaries come from each page, so
-// new documentation appears on the landing page without editing the website.
-import { translatedSource, groupLabel } from '../locales.mts'
-import { readFileSync } from 'node:fs'
-import { resolve } from 'node:path'
-import { defineLoader } from 'vitepress'
-import { pageLink, pageTitle, readDocsJson, repoRoot } from '../docs-nav.mts'
-
-export interface DocsPage {
-  title: string
-  link: string
-  summary: string
-  zh: { title: string; link: string; summary: string }
-}
-
-export interface DocsGroup {
-  group: string
-  zhGroup: string
-  pages: DocsPage[]
-}
-
-declare const data: DocsGroup[]
-export { data }
-
-/** The first sentence of the page body, with Markdown links and code marks removed. */
-function summary(page: string): string {
-  const source = readFileSync(resolve(repoRoot, `${page}.md`), 'utf8')
-  const body = source.replace(/^---[\s\S]*?\n---\s*/, '')
-  const paragraph = body
-    .split(/\n\s*\n/)
-    .map((block) => block.trim())
-    .find((block) => block && !/^(#|\||```|!\[|<|\[\/\/\]|>|-|\d+\.)/.test(block))
-  if (!paragraph) return ''
-  const text = paragraph
-    .replace(/!\[[^\]]*\]\([^)]*\)/g, '')
-    .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
-    .replace(/[`*_]/g, '')
-    .replace(/\s+/g, ' ')
-  const sentence = /^(.+?(?:[。！？]|[.!?](?=\s|$)))/.exec(text)?.[1] ?? text
-  return sentence.length > 180 ? `${sentence.slice(0, 177).trimEnd()}…` : sentence
-}
-
-export default defineLoader({
-  watch: [resolve(repoRoot, 'docs.json'), resolve(repoRoot, 'docs/**/*.md'), resolve(repoRoot, 'contracts/**/*.md')],
-  load(): DocsGroup[] {
-    return readDocsJson().navigation.groups.map((group) => ({
-      group: group.group,
-      zhGroup: groupLabel(group.group, 'zh'),
-      pages: group.pages.map((page) => ({ title: pageTitle(page), link: pageLink(page), summary: summary(page), zh: { title: pageTitle(translatedSource(page)), link: pageLink(`zh/${page}`), summary: summary(translatedSource(page)) } })),
-    }))
-  },
-})
diff --git a/website/.vitepress/theme/index.ts b/website/.vitepress/theme/index.ts
index c05406789..1bc256aff 100644
--- a/website/.vitepress/theme/index.ts
+++ b/website/.vitepress/theme/index.ts
@@ -1,7 +1,6 @@
 import DefaultTheme from 'vitepress/theme'
 import type { Theme } from 'vitepress'
 import '@fontsource-variable/inter'
-import '@fontsource-variable/space-grotesk'
 import '@fontsource-variable/geist-mono'
 import Layout from './Layout.vue'
 import Landing from './components/Landing.vue'
diff --git a/website/.vitepress/theme/landing-content.ts b/website/.vitepress/theme/landing-content.ts
index e5879da97..d150fcc0c 100644
--- a/website/.vitepress/theme/landing-content.ts
+++ b/website/.vitepress/theme/landing-content.ts
@@ -1,284 +1,170 @@
 // Landing page copy. Every product claim here is backed by a page in docs/ or
-// contracts/; each section links to the page that owns the detail.
+// contracts/; link labels equal the target page titles.
 
 export type Lang = 'en' | 'zh'
 
+export interface FlowCopy {
+  label: string
+  stages: string[]
+  captions: string[]
+  app: string
+  api: string
+  state: string
+  orchestration: string
+  events: string
+  workspace: string
+  loop: string
+  runtime: string
+  model: string
+  provider: string
+  compute: string
+  next: string
+  back: string
+  play: string
+  pause: string
+  step: string
+}
+
 export interface LandingCopy {
-  hero: {
-    eyebrow: string
-    title: [string, string]
-    lede: string
-    primary: string
-    secondary: string
-    installLabel: string
-    copied: string
-    copy: string
-    hud: [string, string][]
-  }
-  video: { title: string; expand: string; close: string; pause: string; play: string }
-  ticker: string[]
+  hero: { title: [string, string]; lede: string; primary: string; secondary: string; copied: string; copy: string; installTabs: [string, string] }
+  video: { title: string; expand: string; close: string }
   compose: {
-    index: string
-    kicker: string
-    title: string
-    titleAccent: string
-    lede: string
     harness: string
     protocol: string
     environment: string
     accepted: string
     rejected: (harness: string, protocols: string) => string
-    envs: Record<'openai_hosted' | 'self_hosted', { label: string; note: string }>
+    envs: Record<'openai_hosted' | 'self_hosted', string>
     input: string
     footnote: string
     footnoteLink: string
   }
-  architecture: {
-    index: string
-    kicker: string
-    title: string
-    titleAccent: string
-    lede: string
-    tabs: { id: string; label: string; alt: string }[]
-    more: string
-  }
-  session: {
-    index: string
-    kicker: string
-    title: string
-    titleAccent: string
-    lede: string
-    rules: { title: string; body: string; art: string }[]
-    animation: { label: string; steps: string[]; messages: string[]; states: string[]; pause: string; play: string; replay: string; next: string; note: string }
-    more: string
-  }
-  observe: {
-    index: string
-    kicker: string
-    title: string
-    titleAccent: string
-    lede: string
-    tabs: { id: 'overview' | 'metrics'; label: string; alt: string }[]
-    caption: string
-  }
-  start: {
-    index: string
-    kicker: string
-    title: string
-    titleAccent: string
-    lede: string
-    steps: { title: string; body: string }[]
-    cta: string
-    trial: string
-  }
+  architecture: { title: string; titleAccent: string; alt: string; more: string }
+  session: { title: string; titleAccent: string; more: string; flow: FlowCopy }
+  observe: { title: string; titleAccent: string; tabs: { id: 'overview' | 'metrics'; label: string; alt: string }[] }
   docs: { title: string; links: { label: string; path: string }[] }
-  ecosystem: { title: string; titleAccent: string; agents: string; compute: string; pause: string; resume: string }
+  ecosystem: { title: string; titleAccent: string; pause: string; resume: string }
+  start: { title: string; titleAccent: string; steps: { label: string; path: string }[] }
 }
 
 const en: LandingCopy = {
   hero: {
-    eyebrow: 'open source · self-hosted · OpenAI Agents API',
     title: ['One core.', 'Many agents.'],
-    lede: 'An open-source, self-hosted implementation of the OpenAI Agents API. Run Codex, Claude Code or MiniMax Code with your own models, on your own machines, through the official OpenAI SDK.',
-    primary: 'Run your first Session',
+    lede: 'The OpenAI Agents API, open source and self-hosted. Run Codex, Claude Code or MiniMax Code on your own machines with your own models, through the official OpenAI SDK.',
+    primary: 'Get started',
     secondary: 'Read the docs',
-    installLabel: 'Linux amd64 · Docker · Python 3.9+',
     copied: 'copied',
     copy: 'copy',
-    hud: [
-      ['api', '/v1 · OpenAI Agents API'],
-      ['harness', 'codex | claude_sdk | mcode'],
-      ['protocol', 'responses | anthropic | chat_completions'],
-      ['sandbox', 'microsandbox | e2b | docker'],
-      ['workspace', 'independent filesystem adapter'],
-      ['machine', 'linux | macos | windows'],
-    ],
+    installTabs: ['macOS / Linux', 'Windows'],
   },
-  video: { title: 'Meet OpenAgentCore', expand: 'Watch the launch film', close: 'Close video', pause: 'Pause preview', play: 'Play preview' },
-  ticker: ['Codex', 'Claude Code', 'MiniMax Code', 'Responses API', 'Anthropic Messages', 'Chat Completions', 'microsandbox', 'E2B', 'Docker', 'Linux', 'macOS', 'Windows', 'PostgreSQL', 'OpenAI SDK'],
+  video: { title: 'Meet OpenAgentCore', expand: 'Watch the launch film', close: 'Close video' },
   compose: {
-    index: '01',
-    kicker: 'pick each part',
-    title: 'Your agent. Your model. Your machine.', titleAccent: 'Your machine.',
-    lede: 'Choose a combination. See the API call.',
-    harness: 'harness',
-    protocol: 'model protocol',
-    environment: 'environment',
+    harness: 'Harness',
+    protocol: 'Model protocol',
+    environment: 'Environment',
     accepted: 'accepted · Session created',
     rejected: (harness, protocols) => `rejected before the Session is created · ${harness} speaks only ${protocols}`,
-    envs: {
-      openai_hosted: { label: 'managed sandbox', note: 'microsandbox + persistent FS · E2B' },
-      self_hosted: { label: 'your machine', note: 'Linux · macOS · Windows' },
-    },
+    envs: { openai_hosted: 'managed sandbox', self_hosted: 'your machine' },
     input: 'Fix the failing test and explain the change.',
-    footnote: 'The supported combinations are declared by each harness, not guessed.',
+    footnote: 'Each Harness declares the protocols it speaks; Core rejects other combinations before it creates the Session.',
     footnoteLink: 'Harness capabilities',
   },
   architecture: {
-    index: '02',
-    kicker: 'protocols at every boundary',
     title: 'One API. Replaceable parts.', titleAccent: 'Replaceable parts.',
-    lede: 'Core orchestrates. Native harnesses run inside sandboxes. Compute and persistent workspace storage have separate adapters.',
-    tabs: [
-      { id: 'ecosystem', label: 'ecosystem', alt: 'Applications call Core through the Agents API; native Harnesses run inside sandboxes and call models directly. Separate adapters manage compute and persistent workspace storage.' },
-      { id: 'protocols', label: 'components', alt: 'Agents API and Core API on top of Core; Sandbox Provider, Runtime, Harness and Model Provider connected by protocols.' },
-      { id: 'surfaces', label: 'api namespaces', alt: 'Three namespaces with three credentials: Agents API for applications, Core API for operators, Machine API for nodes.' },
-    ],
-    more: 'Read the architecture',
+    alt: 'Applications call Core through the Agents API; native Harnesses run inside sandboxes and call models directly. Separate adapters manage compute and persistent workspace storage.',
+    more: 'Architecture',
   },
   session: {
-    index: '03',
-    kicker: 'execution you can manage',
-    title: 'Session is all you need.', titleAccent: 'Session',
-    lede: 'Submit work, follow its progress, and pick up the conversation.',
-    rules: [
-      { title: 'Connection ≠ work', body: 'Submitted work continues after the stream closes.', art: 'client ──────╳  disconnect\nturn   ━━━━━━━━━━━━━━▶ completed' },
-      { title: 'Retries have identity', body: 'Stable keys prevent duplicates on supported submission paths.', art: 'POST  Idempotency-Key: a1f ──▶ turn_01\nPOST  Idempotency-Key: a1f ──▶ turn_01' },
-      { title: 'Cancel has a receipt', body: 'Core confirms the target Turn\'s execution and cleanup.', art: 'cancel ──▶ turn  in_progress\n       ──▶ turn  cancelled  ✓ confirmed' },
-      { title: 'Compute can sleep', body: 'microsandbox suspends idle compute. Independent workspace files survive snapshot expiry; new work resumes or cold-starts execution.', art: 'compute    ━━━┫ sleep ┣━━━\nworkspace  ━━━━━━━━━━━━━━━' },
-    ],
-    animation: {
-      label: 'Execution demo', steps: ['Submit', 'Run', 'Input needed', 'Resume', 'Complete'],
-      messages: ['Your application submits a task.', 'The native harness runs the task.', 'The turn waits for input from your application.', 'Your application responds. Execution continues.', 'The result is ready for your application.'],
-      states: ['Submitted', 'Running', 'Waiting', 'Running', 'Completed'],
-      pause: 'Pause', play: 'Play', replay: 'Replay', next: 'Next', note: 'Illustrative workflow · Each harness declares its supported interactions.',
+    title: 'One Session, from request to result.', titleAccent: 'from request to result.',
+    more: 'A Session, end to end',
+    flow: {
+      label: 'Inside a Session', stages: ['Native agent', 'Managed execution', 'Many combinations'],
+      captions: ['Runtime prepares the environment. The native Harness owns the model and tool loop.', 'Your app creates a Session through the Agents API. Core manages execution and durable state.', 'Sessions use different Harnesses and models. Managed Sessions here share one microsandbox deployment; independent workspaces outlive compute.'],
+      app: 'Your application', api: 'OpenAI SDK · Agents API', state: 'Sessions & Turns', orchestration: 'Schedule · cancel · interact', events: 'Events · results · durable state', workspace: 'Mounted workspace · shell · tools', loop: 'Native agent loop', runtime: 'Prepare · execute · report', model: 'Model provider', provider: 'Sandbox Provider', compute: 'Provision & reclaim compute', next: 'Next', back: 'Back', play: 'Play', pause: 'Pause', step: 'Architecture stage',
     },
-    more: 'Session lifecycle',
   },
   observe: {
-    index: '04',
-    kicker: 'see it run',
-    title: 'Operations you can actually see.', titleAccent: 'actually see.',
-    lede: 'Sessions · Compute capacity · Usage',
+    title: 'Run it from one console.', titleAccent: 'one console.',
     tabs: [
-      { id: 'overview', label: 'overview', alt: 'Web console overview: service status, running Sessions, sandbox capacity, fleet and Projects.' },
-      { id: 'metrics', label: 'agent metrics', alt: 'Web console agent metrics: requests, errors, latency, tokens and tool calls.' },
+      { id: 'overview', label: 'Overview', alt: 'Web console overview: service status, running Sessions, sandbox capacity, fleet and Projects.' },
+      { id: 'metrics', label: 'Agent metrics', alt: 'Web console agent metrics: requests, errors, latency, tokens and tool calls.' },
     ],
-    caption: 'Screenshot values are illustrative. Usage visibility depends on what each native harness reports.',
   },
+  docs: { title: 'Documentation', links: [
+    { label: 'Run your first Session', path: '/docs/getting-started/quickstart' },
+    { label: 'Agents API guide', path: '/docs/api/public-agent-api' },
+    { label: 'Install Core and Web', path: '/docs/getting-started/install' },
+    { label: 'Develop OpenAgentCore', path: '/docs/development' },
+  ] },
+  ecosystem: { title: 'An open ecosystem.', titleAccent: 'open ecosystem.', pause: 'Pause', resume: 'Resume' },
   start: {
-    index: '05',
-    kicker: 'get started',
     title: 'From install to first Session.', titleAccent: 'first Session.',
-    lede: 'On a Linux amd64 host with Docker and Python 3.9+:',
     steps: [
-      { title: 'Install & sign in', body: '' },
-      { title: 'Configure model & compute', body: '' },
-      { title: 'Run your first Session', body: '' },
+      { label: 'Install Core and Web', path: '/docs/getting-started/install' },
+      { label: 'Add and manage nodes', path: '/docs/getting-started/nodes' },
+      { label: 'Run your first Session', path: '/docs/getting-started/quickstart' },
     ],
-    cta: 'Installation guide',
-    trial: 'Quickstart',
   },
-  docs: { title: 'Explore the docs', links: [
-    { label: 'Quickstart', path: '/docs/getting-started/quickstart' },
-    { label: 'API reference', path: '/docs/api/public-agent-api' },
-    { label: 'Deployment', path: '/docs/getting-started/install' },
-    { label: 'Build an adapter', path: '/docs/development' },
-  ] },
-  ecosystem: { title: 'One core. An open ecosystem.', titleAccent: 'An open ecosystem.', agents: 'Harnesses & models', compute: 'Cloud & compute', pause: 'Pause', resume: 'Resume' },
 }
 
 const zh: LandingCopy = {
   hero: {
-    eyebrow: '开源 · 可自部署 · OpenAI Agents API',
     title: ['One core.', 'Many agents.'],
-    lede: 'OpenAI Agents API 的开源实现。用官方 OpenAI SDK，在你自己的模型和机器上运行 Codex、Claude Code 或 MiniMax Code。',
-    primary: '运行第一个 Session',
+    lede: '开源、可自部署的 OpenAI Agents API。用官方 OpenAI SDK，在你自己的机器上用你自己的模型运行 Codex、Claude Code 或 MiniMax Code。',
+    primary: '开始使用',
     secondary: '阅读文档',
-    installLabel: 'Linux amd64 · Docker · Python 3.9+',
     copied: '已复制',
     copy: '复制',
-    hud: [
-      ['api', '/v1 · OpenAI Agents API'],
-      ['harness', 'codex | claude_sdk | mcode'],
-      ['protocol', 'responses | anthropic | chat_completions'],
-      ['sandbox', 'microsandbox | e2b | docker'],
-      ['workspace', '独立文件系统 adapter'],
-      ['machine', 'linux | macos | windows'],
-    ],
+    installTabs: ['macOS / Linux', 'Windows'],
   },
-  video: { title: '认识 OpenAgentCore', expand: '观看发布视频', close: '关闭视频', pause: '暂停预览', play: '播放预览' },
-  ticker: en.ticker,
+  video: { title: '认识 OpenAgentCore', expand: '观看发布视频', close: '关闭视频' },
   compose: {
-    index: '01',
-    kicker: '自由组合',
-    title: 'Agent、模型、机器，自由组合。', titleAccent: '自由组合。',
-    lede: '选一个组合，看看对应的 API 调用。',
-    harness: 'harness',
+    harness: 'Harness',
     protocol: '模型协议',
     environment: '执行环境',
     accepted: '通过校验 · Session 已创建',
     rejected: (harness, protocols) => `创建前即被拒绝 · ${harness} 只支持 ${protocols}`,
-    envs: {
-      openai_hosted: { label: '托管沙箱', note: 'microsandbox + 持久 FS · E2B' },
-      self_hosted: { label: '你自己的机器', note: 'Linux · macOS · Windows' },
-    },
+    envs: { openai_hosted: '托管沙箱', self_hosted: '你自己的机器' },
     input: '修复失败的测试，并说明改动。',
-    footnote: '支持哪些组合，由每个 Harness 明确声明，而不是猜测。',
-    footnoteLink: 'Harness 能力表',
+    footnote: '每个 Harness 声明自己支持的协议；其他组合在创建 Session 前即被拒绝。',
+    footnoteLink: 'Harness 能力',
   },
   architecture: {
-    index: '02',
-    kicker: '每条边界都是协议',
     title: '一个 API，部件自由替换。', titleAccent: '部件自由替换。',
-    lede: 'Core 编排，原生 Harness 在沙箱内执行；计算与持久工作区存储由独立 adapter 管理。',
-    tabs: [
-      { id: 'ecosystem', label: '生态', alt: '应用通过 Agents API 接入 Core；原生 Harness 在沙箱内运行并调用模型，计算与持久工作区存储由独立 adapter 管理。' },
-      { id: 'protocols', label: '组件', alt: 'Core 之上是 Agents API 与 Core API；沙箱提供商、Runtime、Harness、模型提供商通过协议连接。' },
-      { id: 'surfaces', label: 'API 命名空间', alt: '三个命名空间、三种凭据：应用用 Agents API，管理员用 Core API，节点用 Machine API。' },
-    ],
-    more: '阅读架构文档',
+    alt: '应用通过 Agents API 接入 Core；原生 Harness 在沙箱内运行并调用模型，计算与持久工作区存储由独立 adapter 管理。',
+    more: '架构',
   },
   session: {
-    index: '03',
-    kicker: '可管理的执行',
-    title: 'Session is all you need.', titleAccent: 'Session',
-    lede: '提交任务，追踪进度，继续对话。',
-    rules: [
-      { title: '连接 ≠ 任务', body: '关闭输出流，已提交的任务仍继续执行。', art: en.session.rules[0].art },
-      { title: '重试有身份', body: '支持的提交路径用稳定标识避免重复任务。', art: en.session.rules[1].art },
-      { title: '取消要有回执', body: 'Core 确认任务停止与资源清理。', art: en.session.rules[2].art },
-      { title: '计算可以休眠', body: 'microsandbox 自动挂起空闲计算；独立工作区文件在快照过期后保留，新任务到来时恢复或冷启动。', art: en.session.rules[3].art },
-    ],
-    animation: {
-      label: '执行流程演示', steps: ['提交', '执行', '等待输入', '继续执行', '完成'],
-      messages: ['应用提交一项任务。', '原生 Harness 开始执行。', 'Turn 等待应用提供输入。', '应用回应，任务继续执行。', '结果已就绪，应用可以读取。'],
-      states: ['已提交', '执行中', '等待中', '执行中', '已完成'],
-      pause: '暂停', play: '播放', replay: '重播', next: '下一步', note: '流程示意 · 交互支持范围由各 Harness 声明。',
+    title: '一个 Session，从请求到结果。', titleAccent: '从请求到结果。',
+    more: '一个 Session 的完整流程',
+    flow: {
+      label: 'Session 内部', stages: ['原生 Agent', '统一执行', '自由组合'],
+      captions: ['Runtime 准备环境，原生 Harness 运行模型与工具循环。', '应用通过 Agents API 创建 Session，Core 管理执行与持久状态。', '不同 Session 使用不同 Harness 与模型；此示例中的托管 Session 共用 microsandbox 部署，独立工作区可跨计算生命周期保留。'],
+      app: '你的应用', api: 'OpenAI SDK · Agents API', state: 'Session 与 Turn', orchestration: '调度 · 取消 · 交互', events: '事件 · 结果 · 持久状态', workspace: '挂载工作区 · Shell · 工具', loop: '原生 Agent 循环', runtime: '环境准备 · 执行管理', model: '模型提供商', provider: '沙箱提供商', compute: '创建与回收计算资源', next: '下一步', back: '上一步', play: '播放', pause: '暂停', step: '演示阶段',
     },
-    more: 'Session 生命周期',
   },
   observe: {
-    index: '04',
-    kicker: '看见运行',
-    title: '运行情况，看得见。', titleAccent: '看得见。',
-    lede: 'Session 状态 · 计算资源 · 用量',
+    title: '一个控制台管理全部运行。', titleAccent: '一个控制台',
     tabs: [
-      { id: 'overview', label: '部署概览', alt: 'Web 控制台概览：服务状态、运行中的 Session、沙箱容量、节点与项目。' },
+      { id: 'overview', label: '概览', alt: 'Web 控制台概览：服务状态、运行中的 Session、沙箱容量、节点与项目。' },
       { id: 'metrics', label: 'Agent 监控', alt: 'Web 控制台 Agent 监控：请求、错误、耗时、Token 与工具调用。' },
     ],
-    caption: '截图数值仅用于展示界面。用量可见性取决于原生 Harness 提供的数据。',
   },
+  docs: { title: '文档', links: [
+    { label: '运行第一个 Session', path: '/docs/getting-started/quickstart' },
+    { label: 'Agents API 指南', path: '/docs/api/public-agent-api' },
+    { label: '安装 Core 和 Web', path: '/docs/getting-started/install' },
+    { label: '开发 OpenAgentCore', path: '/docs/development' },
+  ] },
+  ecosystem: { title: '开放的生态。', titleAccent: '开放的生态。', pause: '暂停', resume: '继续' },
   start: {
-    index: '05',
-    kicker: '开始使用',
     title: '从安装到第一个 Session。', titleAccent: '第一个 Session。',
-    lede: '在装有 Docker 和 Python 3.9+ 的 Linux amd64 主机上：',
     steps: [
-      { title: '安装并登录', body: '' },
-      { title: '配置模型与计算资源', body: '' },
-      { title: '运行第一个 Session', body: '' },
+      { label: '安装 Core 和 Web', path: '/docs/getting-started/install' },
+      { label: '添加和管理节点', path: '/docs/getting-started/nodes' },
+      { label: '运行第一个 Session', path: '/docs/getting-started/quickstart' },
     ],
-    cta: '安装指南',
-    trial: '快速开始',
   },
-  docs: { title: '文档入口', links: [
-    { label: '快速开始', path: '/docs/getting-started/quickstart' },
-    { label: 'API 参考', path: '/docs/api/public-agent-api' },
-    { label: '部署指南', path: '/docs/getting-started/install' },
-    { label: '扩展适配器', path: '/docs/development' },
-  ] },
-  ecosystem: { title: '一个内核，开放的生态。', titleAccent: '开放的生态。', agents: 'Harness 与模型', compute: '云计算与沙箱', pause: '暂停', resume: '继续' },
 }
 
 export const copy: Record<Lang, LandingCopy> = { en, zh }
@@ -292,6 +178,9 @@ export const harnesses = [
 
 export const protocols = ['responses', 'anthropic', 'chat_completions'] as const
 
-export const installCommand = 'curl -fsSL https://openagentcore.dev/install.sh | bash'
+export const installCommands = {
+  unix: 'curl -fsSL https://openagentcore.dev/install.sh | bash',
+  windows: 'irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1 | iex',
+} as const
 
 export const repoUrl = 'https://github.com/MiniMax-AI/OpenAgentCore'
diff --git a/website/.vitepress/theme/style.css b/website/.vitepress/theme/style.css
index fbef0e2dc..996e33548 100644
--- a/website/.vitepress/theme/style.css
+++ b/website/.vitepress/theme/style.css
@@ -40,12 +40,12 @@
   --vp-button-brand-active-bg: #22c55e;
 }
 
-/* Headings in the documentation use the monospace face, as on the Web console. */
+/* Documentation headings use the body face; monospace is for code only. */
 .vp-doc h1,
 .vp-doc h2,
 .vp-doc h3,
 .oac-doc-title {
-  font-family: var(--vp-font-family-mono);
+  font-weight: 600;
   letter-spacing: -0.02em;
 }
 
@@ -53,7 +53,7 @@
   margin: 0 0 24px;
   font-size: 32px;
   line-height: 1.25;
-  font-weight: 650;
+  font-weight: 600;
   color: var(--vp-c-text-1);
 }
 
@@ -61,13 +61,106 @@
   border-radius: 8px;
 }
 
-.dark .vp-doc img[src*='architecture'],
-.dark .vp-doc img[src*='development-architecture'] {
-  background: #fff;
+/* Alerts: a soft fill with an icon. */
+.vp-doc .custom-block {
+  --alert: var(--vp-c-text-2);
+  margin: 24px 0;
+  padding: 18px 22px;
+  border: 0;
+  border-radius: 10px;
+  background: color-mix(in srgb, var(--alert) 11%, var(--vp-c-bg));
+  color: var(--vp-c-text-1);
+  font-size: 16px;
+  line-height: 1.7;
+}
+.vp-doc .custom-block.note { --alert: #3b6d8c; }
+.vp-doc .custom-block.tip { --alert: var(--vp-c-brand-1); }
+.vp-doc .custom-block.important { --alert: #7c5cbf; }
+.vp-doc .custom-block.warning { --alert: #b45309; }
+.vp-doc .custom-block.caution { --alert: #c2410c; }
+.dark .vp-doc .custom-block.note { --alert: #7cb4d6; }
+.dark .vp-doc .custom-block.important { --alert: #b49cf0; }
+.dark .vp-doc .custom-block.warning { --alert: #fbbf24; }
+.dark .vp-doc .custom-block.caution { --alert: #f87171; }
+.vp-doc .custom-block p {
+  margin: 8px 0 0;
+  line-height: inherit;
+}
+.vp-doc .custom-block .custom-block-title {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin: 0;
+  color: var(--alert);
+  font-size: 15px;
+  font-weight: 600;
+  letter-spacing: 0.02em;
+  text-transform: uppercase;
+}
+.vp-doc .custom-block .custom-block-title::before {
+  content: '';
+  width: 18px;
+  height: 18px;
+  flex: none;
+  background: currentColor;
+  -webkit-mask: var(--alert-icon) center / contain no-repeat;
+  mask: var(--alert-icon) center / contain no-repeat;
+}
+.vp-doc .custom-block a { color: var(--alert); }
+.vp-doc .custom-block code {
+  background: color-mix(in srgb, var(--alert) 12%, transparent);
+  color: var(--vp-c-text-1);
+}
+.vp-doc .custom-block.note { --alert-icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'/%3E%3Cpath d='M12 16v-4M12 8h.01'/%3E%3C/svg%3E"); }
+.vp-doc .custom-block.tip { --alert-icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M15 14c.2-1 .7-1.7 1.5-2.5 1-.9 1.5-2.2 1.5-3.5A6 6 0 0 0 6 8c0 1 .2 2.2 1.5 3.5.7.7 1.3 1.5 1.5 2.5M9 18h6M10 22h4'/%3E%3C/svg%3E"); }
+.vp-doc .custom-block.important { --alert-icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2zM12 7v4M12 14h.01'/%3E%3C/svg%3E"); }
+.vp-doc .custom-block.warning { --alert-icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='m21.7 18-8-14a2 2 0 0 0-3.4 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.7-3M12 9v4M12 17h.01'/%3E%3C/svg%3E"); }
+.vp-doc .custom-block.caution { --alert-icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='black' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M7.9 2h8.2L22 7.9v8.2L16.1 22H7.9L2 16.1V7.9zM12 8v4M12 16h.01'/%3E%3C/svg%3E"); }
+
+/* Code groups: tabs as pills on a soft fill. */
+.vp-doc .vp-code-group {
+  margin: 24px 0;
+  border-radius: 10px;
+  background: var(--vp-c-bg-soft);
+  overflow: hidden;
+}
+.vp-doc .vp-code-group .tabs {
+  display: flex;
+  gap: 4px;
+  padding: 10px 10px 0;
+  margin: 0;
+  background: transparent;
+  box-shadow: none;
+}
+.vp-doc .vp-code-group .tabs label {
+  padding: 6px 14px;
+  border-radius: 8px;
+  color: var(--vp-c-text-2);
+  font-size: 15px;
+  font-weight: 500;
+  line-height: 1.5;
+}
+.vp-doc .vp-code-group .tabs label::after { display: none; }
+.vp-doc .vp-code-group input:checked + label {
+  background: var(--vp-c-brand-soft);
+  color: var(--vp-c-brand-1);
 }
+.vp-doc .vp-code-group div[class*='language-'] {
+  margin: 0;
+  background: transparent;
+  border-radius: 0;
+}
+.vp-doc .vp-code-group div[class*='language-'] pre {
+  padding: 8px 0;
+}
+.vp-doc .vp-code-group div[class*='language-'] code {
+  padding: 8px 24px;
+  font-size: 15px;
+  line-height: 1.7;
+}
+.vp-doc .vp-code-group .lang { display: none; }
 
 .VPNavBarTitle .title {
-  font-family: var(--vp-font-family-mono);
   font-weight: 600;
   letter-spacing: -0.02em;
 }
@@ -95,3 +188,8 @@ html:has(.landing) .VPPage {
 html:has(.landing) .VPFooter {
   border-top: 1px solid var(--vp-c-divider);
 }
+
+/* The landing page has no headings, so its outline bar would be empty. */
+html:has(.landing) .VPLocalNav {
+  display: none;
+}
diff --git a/website/README.md b/website/README.md
index c7d040ab6..0b6a74f88 100644
--- a/website/README.md
+++ b/website/README.md
@@ -15,29 +15,29 @@ pnpm --dir website preview   # serve the build at http://127.0.0.1:4181
 ## How documentation reaches the site
 
 - The content root is the repository root. `docs/**` and `contracts/**` keep their paths as URLs, so `docs/architecture.md` is `/docs/architecture`. `website/index.md` and `website/zh/index.md` are mapped onto `/` and `/zh/`. Chinese sources in `docs/zh/` and `contracts/agents-api/zh/` map to `/zh/docs/` and `/zh/contracts/agents-api/`; the language switch opens the matching page.
-- `docs.json` owns the page list and order. The sidebar and `/llms.txt` are generated from it at build time; each page's frontmatter `title` is its label. Every Markdown page under `docs/` and `contracts/` is built; listing it in `docs.json` adds it to the sidebar and `llms.txt`.
+- `docs.json` owns the page list and order: three tabs (Docs, API, Extend), each with groups of pages. The top nav shows one item per tab, and each page's sidebar shows only its own tab. `/llms.txt` lists every page under `## <tab> › <group>` with a one-sentence summary taken from the page's first paragraph. Each page's frontmatter `title` is its label. Every Markdown page under `docs/` and `contracts/` is built, and a test fails when one is missing from `docs.json`.
 - Each page's source Markdown is published next to its HTML (`/docs/architecture.md`), and the `README` paths declared in `docs.json` redirect to their section index.
 - Relative links from a page to a file that is not a published page, such as `CONTRIBUTING.md` or `openapi.yaml`, are rewritten to GitHub at build time, so the Markdown works unchanged on GitHub and on the site.
 
-The visual system combines warm paper surfaces, green accents, ruled sections and ASCII artwork. Landing headings use self-hosted Space Grotesk; body text uses Inter and code uses Geist Mono. Chinese text uses the system Chinese sans-serif stack. Both light and dark themes share the same hierarchy.
+The visual system combines warm paper surfaces, green accents and ruled sections. Landing headings use self-hosted Space Grotesk (loaded by the landing only); body text uses Inter and code uses Geist Mono. Chinese text uses the system Chinese sans-serif stack. Both light and dark themes share the same hierarchy.
 
 Site appearance and metadata are configured in `.vitepress/config.mts` and `.vitepress/theme/`.
 
-The landing page lives in `.vitepress/theme/`. `landing-content.ts` holds its English and Chinese copy; every claim there must be backed by a page in `docs/` or `contracts/`, and its harness protocols follow [Model execution](../contracts/agents-api/model-execution.md).
+The landing page lives in `.vitepress/theme/`. `landing-content.ts` holds its English and Chinese copy; every claim there must be backed by a page in `docs/` or `contracts/`, link labels equal the target page titles, and its Harness protocols follow [Model execution](../contracts/agents-api/model-execution.md). The hero lede and the `description` in `config.mts` are the same sentence.
 
-The landing page has five numbered sections: the interactive combination example, an architecture image, execution lifecycle, console screenshots and installation. Four documentation shortcuts link to the detailed guides. `components/SessionFlow.vue` illustrates native execution, Core orchestration and multiple Session environments through a three-stage hand-drawn animation. It autoplays while visible and offers previous/next buttons, a stage slider and pause/play. Reduced-motion preferences disable autoplay. The diagram uses the locally bundled [Virgil font](https://github.com/excalidraw/virgil); its OFL license is stored beside the font in `.vitepress/theme/assets/fonts/`. Section headings share the hero’s display font with white text and green italic accents.
+The hero holds the title, the lede, the install command and the interactive example (`components/ComposeLab.vue`). Below it are four sections: an architecture image, the Session diagram, console screenshots and next steps, with four documentation shortcuts and the logo wall between the last two. `components/SessionFlow.vue` illustrates native execution, Core orchestration and multiple Session environments through a three-stage hand-drawn animation that scales to the column width. It autoplays while visible and offers previous/next buttons, a stage slider and pause/play. Reduced-motion preferences disable autoplay. The diagram uses the locally bundled [Virgil font](https://github.com/excalidraw/virgil); its OFL license is stored beside the font in `.vitepress/theme/assets/fonts/`.
 
 ### Launch video
 
-`components/LaunchVideo.vue` embeds the CDN-hosted launch film in the hero’s right column, below an interactive ASCII brand panel, in both languages. Green corner marks frame the preview. On narrow screens, the video fills the content width between the hero actions and installation command. The compact preview loops silently and has a pause control; reduced-motion preferences leave it paused. Opening the preview pauses it and continues from the same position in a modal player with native playback and audio controls. The close button, Escape and backdrop dismiss the player and return focus to the preview.
+`components/LaunchVideo.vue` renders the "Watch the launch film" link in the hero. The CDN-hosted video loads only when the link opens the modal player; nothing autoplays. The close button, Escape and backdrop dismiss the player.
 
 ### Ecosystem logo wall
 
-`components/LogoWall.vue` places two full-width white logo rows between the documentation shortcuts and the closing installation section. The wall is transparent and borderless, allowing the landing page's background and grid to continue through it. Harness and model brands occupy the first row; cloud and compute brands occupy the second. They scroll in opposite directions, pause on hover or row keyboard focus, and have an explicit pause control. Reduced-motion preferences disable animation and leave both rows manually scrollable. Labels and controls use the landing page's English and Chinese copy.
+`components/LogoWall.vue` places two full-width logo rows between the documentation shortcuts and the closing section. The wall is transparent and borderless, allowing the landing page's background and grid to continue through it. Harness and model brands occupy the first row; cloud and compute brands occupy the second. They scroll in opposite directions, pause on hover or row keyboard focus, and have an explicit pause control. Reduced-motion preferences disable animation and leave both rows manually scrollable.
 
-`.vitepress/theme/ecosystem-logos.ts` owns the brand list. These are ecosystem illustrations; supported Harness combinations remain defined by [Model execution](../contracts/agents-api/model-execution.md), and host requirements by [Installation](../docs/getting-started/install.md). Brand artwork does not establish deployment qualification or a partnership.
+`.vitepress/theme/ecosystem-logos.ts` owns the brand list. These are ecosystem illustrations; supported Harness combinations remain defined by [Model execution](../contracts/agents-api/model-execution.md), and host requirements by [Install Core and Web](../docs/getting-started/install.md). Brand artwork does not establish deployment qualification or a partnership.
 
-SVG files are bundled under `.vitepress/theme/assets/logos/` and rendered in white with CSS, preserving their proportions. Their sources are:
+SVG files are bundled under `.vitepress/theme/assets/logos/` and tinted with CSS (dark in the light theme, white in the dark theme), preserving their proportions. Their sources are:
 
 - AI brands, AWS, Azure, Google Cloud, Alibaba Cloud, Tencent Cloud, Huawei Cloud, Volcengine, Baidu AI Cloud and DigitalOcean: [Lobe Icons](https://github.com/lobehub/lobe-icons), from `@lobehub/icons-static-svg` version `1.95.1`, using the matching filename in its `icons/` directory. MIT license: `LICENSE-lobe-icons.txt` beside the assets.
 - Docker: [SVGL's Docker SVG](https://github.com/pheralb/svgl/blob/main/static/library/docker.svg). MIT license: `LICENSE-svgl.txt` beside the assets.
@@ -60,4 +60,4 @@ Pull request checks build under the published `/OpenAgentCore/` path. Output tes
 
 English documentation owns technical facts. Translate each authored page in `docs/` and `contracts/agents-api/` into its mirrored `zh/` path in the same change. Keep code blocks, API identifiers and exact Web action names unchanged; translate explanatory prose and preserve the English heading ID with an explicit `{#id}` anchor. Resolve relative links from the Chinese file to the corresponding Chinese document or shared original asset. The Harness catalog generator produces both language editions. Extend other generators before translating their output; preserve generated regions in otherwise authored pages byte for byte, with a Chinese explanation before the region.
 
-Each Chinese frontmatter records `source` as the repository-relative English path and `source_hash` as its SHA-256 digest. Update that digest only after reconciling the complete translation with the source. `pnpm --dir website check-translations` checks coverage and freshness before the build. `docs.json` remains the single navigation order; titles and summaries are read from the selected language's source.
+Each Chinese frontmatter records `source` as the repository-relative English path and `source_hash` as its SHA-256 digest. Update that digest only after reconciling the complete translation with the source. `pnpm --dir website check-translations` checks coverage and freshness before the build. `docs.json` remains the single navigation order; titles are read from the selected language's source.
diff --git a/website/index.md b/website/index.md
index 92771439e..bab529dc7 100644
--- a/website/index.md
+++ b/website/index.md
@@ -2,7 +2,6 @@
 layout: page
 title: OpenAgentCore — One core. Many agents.
 titleTemplate: false
-description: An open-source, self-hosted implementation of the OpenAI Agents API with multiple native Harnesses.
 ---
 
 <Landing lang="en" />
diff --git a/website/tests/dist.test.mjs b/website/tests/dist.test.mjs
index dde3ed4ca..43ec8dda6 100644
--- a/website/tests/dist.test.mjs
+++ b/website/tests/dist.test.mjs
@@ -1,15 +1,15 @@
 // Checks a finished build: run `pnpm build` first. Every docs.json page has
-// an HTML page and a raw Markdown copy, legacy paths redirect, both landing
-// pages exist and llms.txt lists every page.
+// an HTML page and a raw Markdown copy, both landing pages exist and llms.txt
+// lists every page.
 import assert from 'node:assert/strict'
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
 import { resolve } from 'node:path'
 import test from 'node:test'
 import { fileURLToPath } from 'node:url'
-import { legacyRedirects, readDocsJson } from '../.vitepress/docs-nav.mts'
+import { listedPages } from '../.vitepress/docs-nav.mts'
 
 const dist = fileURLToPath(new URL('../.vitepress/dist/', import.meta.url))
-const pages = readDocsJson().navigation.groups.flatMap((g) => g.pages)
+const pages = listedPages()
 const basePath = new URL(process.env.WEBSITE_URL ?? 'http://localhost/').pathname
 const base = basePath.endsWith('/') ? basePath : `${basePath}/`
 
@@ -51,19 +51,25 @@ test('generated navigation and assets stay under the site base and resolve to fi
   assert.ok(checked > 0, 'generated pages must contain local navigation and assets')
 })
 
-test('legacy paths redirect', () => {
-  for (const { from, to } of legacyRedirects()) {
-    const source = readFileSync(resolve(dist, `${from}.html`), 'utf8')
-    const target = `${base}${to.replace(/^\//, '')}`
-    assert.ok(source.includes(`content="0; url=${target}"`), `${from} → ${target}`)
-  }
-})
-
 test('llms.txt lists every page', () => {
   const llms = readFileSync(resolve(dist, 'llms.txt'), 'utf8')
   for (const page of pages) assert.ok(llms.includes(`](${base}${page}.md)`), `${page} in llms.txt uses ${base}`)
 })
 
+test('llms.txt describes each page and groups pages by tab', () => {
+  const llms = readFileSync(resolve(dist, 'llms.txt'), 'utf8')
+  assert.match(llms, /^## Docs › Get started$/m)
+  assert.match(llms, /^## Extend › Protocols$/m)
+  for (const line of llms.split('\n').filter((l) => l.startsWith('- ['))) assert.match(line, /\.md\): \S/, `${line} has a summary`)
+})
+
+test('each tab shows its own sidebar', () => {
+  const sidebar = (file) => [...readFileSync(html(file), 'utf8').matchAll(/class="VPSidebarItem level-0[^"]*"/g)].length
+  assert.equal(sidebar('docs/getting-started/install'), 3)
+  assert.equal(sidebar('contracts/agents-api/environments'), 3)
+  assert.equal(sidebar('docs/sandbox-provider'), 2)
+})
+
 test('Mermaid fences become diagrams, not code blocks', () => {
   const source = readFileSync(html('docs/architecture'), 'utf8')
   assert.match(source, /class="oac-mermaid/)
diff --git a/website/tests/docs-nav.test.mjs b/website/tests/docs-nav.test.mjs
index 1de1705b3..3f98db157 100644
--- a/website/tests/docs-nav.test.mjs
+++ b/website/tests/docs-nav.test.mjs
@@ -3,7 +3,8 @@ import assert from 'node:assert/strict'
 import { existsSync } from 'node:fs'
 import { resolve } from 'node:path'
 import test from 'node:test'
-import { docsSidebar, legacyRedirects, pageLink, pageTitle, readDocsJson, repoRoot, unquote } from '../.vitepress/docs-nav.mts'
+import { translatedSource } from '../.vitepress/locales.mts'
+import { docsNav, docsSidebar, listedPages, pageLink, pageTitle, readDocsJson, repoRoot, summary, unquote } from '../.vitepress/docs-nav.mts'
 
 test('page ids map to clean routes', () => {
   assert.equal(pageLink('docs/getting-started/index'), '/docs/getting-started/')
@@ -17,27 +18,52 @@ test('YAML titles are unquoted with their escapes', () => {
   assert.equal(unquote('Plain title'), 'Plain title')
 })
 
-test('every docs.json page exists and has a title', () => {
-  for (const group of readDocsJson().navigation.groups) {
-    for (const page of group.pages) {
-      assert.ok(existsSync(resolve(repoRoot, `${page}.md`)), `${page}.md exists`)
-      assert.ok(pageTitle(page).length > 0, `${page} has a title`)
-    }
+test('every docs.json page exists, has a title and a Chinese mirror', () => {
+  for (const page of listedPages()) {
+    assert.ok(existsSync(resolve(repoRoot, `${page}.md`)), `${page}.md exists`)
+    assert.ok(pageTitle(page).length > 0, `${page} has a title`)
+    assert.ok(pageTitle(translatedSource(page)).length > 0, `${page} has a Chinese title`)
   }
+  assert.equal(new Set(listedPages()).size, listedPages().length, 'no page is listed twice')
+})
+
+test('the top nav has one item per tab and opens its first page', () => {
+  const tabs = readDocsJson().navigation.tabs
+  assert.deepEqual(tabs.map((t) => t.tab), ['Docs', 'API', 'Extend'])
+  assert.deepEqual(docsNav().map((n) => n.text), ['Docs', 'API', 'Extend'])
+  assert.deepEqual(docsNav('zh').map((n) => n.text), ['文档', 'API', '扩展'])
+  docsNav().forEach((item, i) => assert.equal(item.link, pageLink(tabs[i].groups[0].pages[0])))
+  assert.equal(docsNav('zh')[0].link, '/zh/docs/getting-started/')
 })
 
-test('the sidebar follows docs.json order', () => {
-  const groups = readDocsJson().navigation.groups
-  const sidebar = docsSidebar()
-  assert.deepEqual(sidebar.map((g) => g.text), groups.map((g) => g.group))
-  assert.deepEqual(sidebar[0].items.map((i) => i.link), groups[0].pages.map(pageLink))
+test('a tab is active exactly on its own pages', () => {
+  const tabs = readDocsJson().navigation.tabs
+  const nav = docsNav()
+  tabs.forEach((tab, i) => {
+    for (const other of tabs.keys()) {
+      for (const page of tabs[other].groups.flatMap((g) => g.pages)) {
+        const route = pageLink(page)
+        assert.equal(new RegExp(nav[i].activeMatch).test(route), other === i, `${route} against ${tab.tab}`)
+      }
+    }
+  })
 })
 
-test('legacy README paths redirect to section indexes', () => {
-  const redirects = legacyRedirects()
-  assert.ok(redirects.length > 0)
-  for (const { from, to } of redirects) {
-    assert.ok(!from.endsWith('.md'), `${from} is not a Markdown copy`)
-    assert.ok(to.startsWith('/'), `${to} is a site route`)
+test('each page shows only its own tab in the sidebar, labelled by page titles', () => {
+  const tabs = readDocsJson().navigation.tabs
+  for (const lang of ['en', 'zh']) {
+    const sidebar = docsSidebar(lang)
+    for (const tab of tabs) {
+      const expected = tab.groups.map((g) => g.pages.map((p) => pageTitle(lang === 'zh' ? translatedSource(p) : p)))
+      for (const page of tab.groups.flatMap((g) => g.pages)) {
+        const items = sidebar[`/${lang === 'zh' ? 'zh/' : ''}${page}.md`]
+        assert.deepEqual(items.map((g) => g.items.map((i) => i.text)), expected, `${lang} ${page}`)
+      }
+    }
   }
 })
+
+test('summaries are one sentence taken from the page opening', () => {
+  assert.ok(summary('docs/architecture').length > 0)
+  for (const page of listedPages()) assert.ok(summary(page).length > 0, `${page} has a summary`)
+})
diff --git a/website/tests/harnesses.test.mjs b/website/tests/harnesses.test.mjs
index 4c882a7d8..41cca7a25 100644
--- a/website/tests/harnesses.test.mjs
+++ b/website/tests/harnesses.test.mjs
@@ -1,5 +1,5 @@
 // The landing page's harness table must match the repository's declarations:
-// ids and labels from the built-in catalog, protocols from Model execution.
+// ids and labels from the generated client catalog, protocols from Model execution.
 import assert from 'node:assert/strict'
 import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
@@ -7,9 +7,9 @@ import test from 'node:test'
 import { repoRoot } from '../.vitepress/docs-nav.mts'
 import { harnesses } from '../.vitepress/theme/landing-content.ts'
 
-test('harness ids and labels match the built-in catalog', () => {
-  const catalog = JSON.parse(readFileSync(resolve(repoRoot, 'internal/harnessconfig/builtin/catalog.json'), 'utf8'))
-  const expected = Object.fromEntries(catalog.map((h) => [h.kind, h.label]))
+test('harness ids and labels match the generated client catalog', () => {
+  const source = readFileSync(resolve(repoRoot, 'packages/agents-client/src/harness-catalog.ts'), 'utf8')
+  const expected = Object.fromEntries([...source.matchAll(/^  "([a-z_]+)": "([^"]+)",$/gm)].map((m) => [m[1], m[2]]))
   assert.deepEqual(Object.fromEntries(harnesses.map((h) => [h.id, h.label])), expected)
 })
 
@@ -17,11 +17,9 @@ test('harness protocols match Model execution, default first', () => {
   const doc = readFileSync(resolve(repoRoot, 'contracts/agents-api/model-execution.md'), 'utf8')
   const table = doc.split('| Harness | Supported protocols, default first |')[1].split('\n\n')[0]
   const rows = Object.fromEntries(
-    [...table.matchAll(/^\| ([^|]+) \| (.+) \|$/gm)]
+    [...table.matchAll(/^\| ([^|]+) \| ([^|]+) \|/gm)]
       .filter(([, name]) => !name.startsWith('---'))
       .map(([, name, protocols]) => [name.trim(), [...protocols.matchAll(/`([a-z_]+)`/g)].map((m) => m[1])]),
   )
-  // The table names Claude Code by its SDK.
-  const docName = { codex: 'Codex', claude_sdk: 'Claude SDK', mcode: 'MiniMax Code' }
-  for (const h of harnesses) assert.deepEqual([...h.protocols], rows[docName[h.id]], h.id)
+  for (const h of harnesses) assert.deepEqual([...h.protocols], rows[h.label], h.id)
 })
diff --git a/website/tests/install.test.mjs b/website/tests/install.test.mjs
index 5c1452ab7..8a8444284 100644
--- a/website/tests/install.test.mjs
+++ b/website/tests/install.test.mjs
@@ -27,7 +27,7 @@ exit "$DOWNLOAD_STATUS"
     writeFileSync(join(root, 'sleep'), '#!/bin/sh\n')
     chmodSync(join(root, 'sleep'), 0o700)
     chmodSync(join(root, 'curl'), 0o700)
-    const args = ['--upgrade', '--install-dir', '/path with spaces/core', '--version', 'v0.0.10']
+    const args = ['--install-dir', '/path with spaces/core', '--version', 'v0.0.10']
     for (const downloadStatus of [0, 22]) {
       const result = spawnSync('/bin/bash', ['-s', '--', ...args], {
         input: readFileSync(script), encoding: 'utf8',
diff --git a/website/tests/orphans.test.mjs b/website/tests/orphans.test.mjs
new file mode 100644
index 000000000..14bf20f87
--- /dev/null
+++ b/website/tests/orphans.test.mjs
@@ -0,0 +1,17 @@
+// Every authored page under docs/ and contracts/agents-api/, English or Chinese, belongs to a docs.json tab.
+import assert from 'node:assert/strict'
+import { readdirSync } from 'node:fs'
+import { resolve } from 'node:path'
+import test from 'node:test'
+import { listedPages, repoRoot } from '../.vitepress/docs-nav.mts'
+
+test('no authored page is missing from docs.json', () => {
+  const listed = new Set(listedPages())
+  const pages = ['docs', 'contracts/agents-api'].flatMap((dir) =>
+    readdirSync(resolve(repoRoot, dir), { recursive: true })
+      .filter((file) => file.endsWith('.md') && !file.startsWith('assets/'))
+      .map((file) => `${dir}/${file.replace(/\.md$/, '')}`),
+  )
+  const english = pages.map((page) => (/\/zh\//.test(page) ? page.replace(/\/zh\//, '/') : page))
+  assert.deepEqual([...new Set(english)].filter((page) => !listed.has(page)).sort(), [])
+})
diff --git a/website/zh/index.md b/website/zh/index.md
index 05facbf58..775163080 100644
--- a/website/zh/index.md
+++ b/website/zh/index.md
@@ -2,7 +2,6 @@
 layout: page
 title: OpenAgentCore — One core. Many agents.
 titleTemplate: false
-description: OpenAI Agents API 的开源实现，支持多种原生 Harness，可自部署。
 ---
 
 <Landing lang="zh" />